@sema-agent/server 7.117.0 → 7.118.0

package/dist/approval.js

@@ -4,7 +4,6 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 import { handsOnWorkerFilePlane } from "./execution-lane-caps.js";
 import { heldRuleName } from "./tool-rule-names.js";
-import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
 export function hasApprovalListIntent(config) {
     return (config.approvalRequire.length > 0 ||
         config.approvalDeny.length > 0 ||
@@ -93,33 +92,12 @@ export function createDurableAskPolicy(opts) {
             if (neverAutoHit !== undefined)
                 return operatorAlwaysHumanAsk(`APPROVAL_NEVER_AUTO(${neverAutoHit})`, `human approval required to run "${req.toolName}"`);
             const requireHit = heldRuleName(req, require);
-            if (requireHit !== undefined) {
-                const remEarly = req.budget?.resourceRemainingMicroUsd;
-                if (remEarly !== undefined && remEarly <= 0) {
-                    return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
-                }
-                if (opts.exempt && heldRuleName(req, isQuestionTool) === undefined && !answerGrantsBeyondCall(req)) {
-                    return (async () => {
-                        let exempted = false;
-                        try {
-                            exempted = (await opts.exempt(req.toolName)) === true;
-                        }
-                        catch {
-                            exempted = false;
-                        }
-                        if (exempted) {
-                            opts.onExempted?.(req.toolName, req.toolName);
-                            return grantedByRule();
-                        }
-                        return decideRequired(req, requireHit);
-                    })();
-                }
-                return decideRequired(req, requireHit);
-            }
+            if (requireHit !== undefined)
+                return decideRequired(req, operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`));
             return { action: "allow" };
         },
     };
-    function decideRequired(req, requireHit) {
+    function decideRequired(req, ask) {
         const rem = req.budget?.resourceRemainingMicroUsd;
         if (rem !== undefined && rem <= 0) {
             return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
@@ -128,7 +106,7 @@ export function createDurableAskPolicy(opts) {
             autoApproved++;
             return grantedByRule();
         }
-        return operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`);
+        return ask;
     }
 }
 //# sourceMappingURL=approval.js.map

package/dist/boot/parked-revive-gate.d.ts

@@ -11,10 +11,6 @@ export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigVi
     /** host 腿裁决 env 的 cwd 占位根(见下方 `hostGateCwd`)。 */
     readonly localDataRoot?: ServiceConfig["localDataRoot"];
 }
-/** 会话豁免探针店的所需切面(canonical toolName 键空间;`StoreBackend.approvalExemption()` 结构满足)。 */
-export interface ApprovalExemptionProbe {
-    has(sessionId: string, toolName: string): Promise<boolean>;
-}
 export interface ParkedReviveGateDeps {
     /** ⚠️ **活引用**:热改字段(autonomy/commandPolicy/守卫集/审批四旋钮)每次赎回现读,见下方「禁 memoize」。 */
     readonly config: ParkedReviveGateConfigView;
@@ -47,7 +43,6 @@ export interface ParkedReviveGateDeps {
      *    headless auto-deny,比「再问人一次」严且哑。交了之后最坏也是 park,方向 fail-safe。
      */
     readonly approverSeat: RunnerDepsOnAsk | undefined;
-    readonly approvalExemptionStore: ApprovalExemptionProbe | undefined;
     /**
      * [ref] —— core `RunnerDeps.runtimeCapsResolver` 的**同一只**(main.ts 的 `runtimeCapsResolver`,
      * 单一属主同 `boot/runtime-caps.ts`)。重建条目的第三位决议链元数据 `autoModeArmed` 的唯一判据是
@@ -69,7 +64,6 @@ export interface ParkedReviveGateDeps {
      *  这一座可改读它 —— 接线不在本次提货单内,见 7.106.0 收车档「未闭环」。 */
     readonly parentAutoModeIntent?: ((row: BackgroundAgentRecord) => boolean) | undefined;
     readonly logger: {
-        info(event: string, fields?: Record<string, unknown>): void;
         warn(event: string, fields?: Record<string, unknown>): void;
     };
     /** host 腿 cwd 占位的落地根(main.ts 的 `localRoot`;`config.localDataRoot` 优先)。 */
@@ -96,7 +90,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  * 赎回腿的父约束链重建([ref] 件二)。
  *
  * 语义:**同/跨副本一致地重建「部署 ⊇ 操作员」两层完整链**——审批基线(durable question 门 + F4 高危写
- * 审批门 + 会话豁免探针)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
+ * 审批门)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
  * (→ core `tightenTaskSpec`)叠上部署治理段(autonomy / commandPolicy / MANUAL_MODE_SHELL_GATE /
  * 守卫集),取其 `toolPolicy` 装进单层 `parentConstraints`。
  *

package/dist/boot/parked-revive-gate.js

@@ -10,7 +10,7 @@ function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
 export function createParkedReviveInheritedGate(deps) {
-    const { config, question, approvalExemptionStore, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
+    const { config, question, logger, localRoot, approverSeat, memoryEngineRoot } = deps;
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
@@ -26,17 +26,7 @@ export function createParkedReviveInheritedGate(deps) {
                 ...homeBase,
             }
             : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
-        const rootSessionId = row.rootSessionId;
-        const baseline = createApprovalBaselinePolicy(config, {
-            kind: "durable",
-            question,
-            ...(approvalExemptionStore && rootSessionId
-                ? {
-                    exempt: (toolName) => approvalExemptionStore.has(rootSessionId, toolName),
-                    onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: rootSessionId, toolName, rawToolName, leg: "parked_revive" }),
-                }
-                : {}),
-        });
+        const baseline = createApprovalBaselinePolicy(config, { kind: "durable", question });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication, { engineDataRoot: memoryEngineRoot }));
         return {
             parentConstraints: [

package/dist/boot/resolve-spec.js

@@ -10,7 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
+import { gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
@@ -27,7 +27,7 @@ import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../rou
 import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
-import { HttpError, encodeCheckpointScope } from "../security.js";
+import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../config-center/facade.js";
@@ -65,6 +65,9 @@ export function createResolveSpec(ctx) {
     if (approvalGrantNotice)
         logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     const resolveSpec = async (body, req, auth, opts) => {
+        const seatRefusal = gateIntentUnserviceableReason(config, checkpointStore !== undefined);
+        if (seatRefusal !== undefined)
+            throw createCodedHttpError(501, "capability.checkpoint_store_required", seatRefusal);
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
             assertRequestMcpContentOrigin(body.mcpServers);
@@ -320,7 +323,7 @@ export function createResolveSpec(ctx) {
             return false;
         if (headerStr(req?.headers["x-detach-on-disconnect"]) === "true")
             return false;
-        const askForm = resolveAskSeamForm({}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
+        const askForm = resolveAskSeamForm(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
@@ -369,6 +372,7 @@ export function createResolveSpec(ctx) {
             ...(() => { const v = toolMaterializeStrategyFromBody(body.toolMaterializeStrategy); return v ? { toolMaterializeStrategy: v } : {}; })(),
             ...(typeof body.interactiveTools === "boolean" ? { interactiveTools: body.interactiveTools } : {}),
             ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
+            ...(body.approvalReach !== undefined ? { approvalReach: body.approvalReach } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
             resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
@@ -456,16 +460,7 @@ export function createResolveSpec(ctx) {
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled
-                ? createApprovalBaselinePolicy(config, {
-                    kind: "durable",
-                    question: liveQuestionFace,
-                    ...(approvalExemptionStore && auth?.sessionId
-                        ? {
-                            exempt: (toolName) => approvalExemptionStore.has(auth.sessionId, toolName),
-                            onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: auth.sessionId, toolName, rawToolName }),
-                        }
-                        : {}),
-                })
+                ? createApprovalBaselinePolicy(config, { kind: "durable", question: liveQuestionFace })
                 : singleUserAutoAcceptBaselineApplies(config)
                     ? createApprovalBaselinePolicy(config, { kind: "absent" })
                     : undefined),

package/dist/boot/runner-deps.js

@@ -16,7 +16,7 @@ import { createInstructionSourceSeat } from "../instruction-source-notice.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../cross-session-settings.js";
 import { createPeerDirectory } from "../peer-directory.js";
-import { targetOutsideStoreInIncident } from "../memory-store-refusal.js";
+import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
 export function createRunnerDepsOnAsk(toolApproval) {
@@ -197,7 +197,7 @@ export function createRunnerDeps(ctx) {
                 if (report.patches)
                     metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
                 if (report.incident) {
-                    const code = targetOutsideStoreInIncident(report.incident);
+                    const code = storeFormRefusalInIncident(report.incident);
                     logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase, ...(code !== undefined ? { code } : {}) });
                 }
                 const byCode = new Map();

package/dist/boot/stage-07-capability-layer.js

@@ -64,7 +64,7 @@ export async function runStage07(ctx) {
                 newId: uuidv7,
             });
             if (converged > 0)
-                logger.warn("user_input_ledger_crash_converged", { converged, note: "steers accepted with 200 \"applied\" by a previous process that ended before its run settled were converged as cause:crashed; each session's next run announces them (task.user_steer_undrained) and GET /v1/sessions/:id lists them under userInputUndrained" });
+                logger.warn("user_input_ledger_crash_converged", { converged, note: "steers accepted with 200 \"applied\" by a previous process that ended before its run settled were converged as cause:crashed; each session's next run announces them (task.user_steer_undrained, or task.user_followup_undrained for steers queued with priority later) and GET /v1/sessions/:id lists them under userInputUndrained" });
             return ledger;
         })()
         : undefined;
@@ -166,7 +166,7 @@ export async function runStage07(ctx) {
     const parkedReviveSurface = checkpointStore && backgroundAgentStore && builtinDefaultScenario ? createParkedReviveSurface(builtinDefaultScenario) : undefined;
     const parkedReviveInheritedGate = parkedReviveSurface && config.durableApproval
         ? createParkedReviveInheritedGate({
-            config, question, approvalExemptionStore, logger, localRoot,
+            config, question, logger, localRoot,
             memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),

package/dist/capabilities/hands-lane.d.ts

@@ -33,6 +33,31 @@ export interface HandsRunnerPair {
 }
 /** 按场景表态取 Runner。**穷举 switch**:`ScenarioHands` 加词而此处不改 = 编译错(无 default 臂)。 */
 export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerPair): Runner;
+/**
+ * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
+ *
+ * 两段来源,都不是拍脑袋:
+ *  · `handBandEffects()`(core 7.8.0 B1 起的导出面;此前是手抄表常量 `HAND_TOOL_EFFECTS`)—— band 的
+ *    effect 表,由**静态工具目录**按 `mountedBy.includes("hands")` 派生。名册单源之后这张表不再是一张
+ *    手抄名表,加/退工具由目录一处说了算。
+ *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
+ *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
+ *    core 加/改 band 成员时红,防漂移)。
+ *
+ * ⚠️ 本全集是**观测口径**(用于防漂移对账),**不是** deny 名单 —— deny 用下面的
+ * {@link HANDS_EXCLUSIVE_TOOL_NAMES},理由见那里。
+ *
+ * 🚨 [ref] P0(2026-08-09):派生时必须过滤 core 的 `RETIRED_TOOL_NAMES` —— core 5.21.0 的
+ * `HAND_TOOL_EFFECTS` 里残留已退役的 `MultiEdit`,而 core `prepare-task` 的策略名审计见退役名
+ * **无条件 throw**(`config.legacy_tool_name`);不过滤,deny 名单一进 `spec.toolPolicy`,
+ * `hands: none` 三场景(scan/code-review/team)在**所有部署**上零 turn 全灭。core 5.21.1 已删
+ * 那条死条目([ref]),这道 filter 是结构性防御:将来 core 再退役任何 band 名都不会重演
+ * (test/scenario-hands-lane.test.ts 格7/格8 双钉:真 Runner 过审计 + 零交集门)。
+ * filter 打在**整表**(effect 表 + 锚定补集)之后 —— caret floor 下装置会解析到更新的 core,
+ * 补集名哪天被退役,只滤前半就是同一次故障换个名字(codex 复审 finding,2026-08-09)。
+ * S-1047(core 7.41.0 #1156):判据换成 core 导出的**那一只** `judgeRuleToolName`(策略名审计、会话规则店、本仓写口与配置表同调)——
+ * 修前这里直读 `RETIRED_TOOL_NAMES` 表,是本仓第三份「这是不是旧名」的手写判据。名册 = 空集(这张 deny 名单不挂在任何一跑的名册上判)。
+ */
 export declare const HANDS_BAND_TOOL_NAMES: readonly string[];
 /**
  * band 里**只有手才可能出现**的那批(= deny 名单)。

package/dist/capabilities/hands-lane.js

@@ -1,4 +1,5 @@
 import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
+import { NO_DECLARED_TOOL_NAMES } from "../namespaced-rule-name.js";
 export function withoutExecutionEnv(deps) {
     const { executionEnvFactory: _handsDropped, ...rest } = deps;
     return rest;
@@ -11,7 +12,6 @@ export function pickHandsRunner(hands, pair) {
             return pair.handsless;
     }
 }
-const NO_DECLARED_TOOL_NAMES = new Set();
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     ...handBandEffects().keys(),
     "SendMessage",

package/dist/capabilities/mcp-probe.d.ts

@@ -79,7 +79,7 @@ export declare const MCP_PROBE_MAX_INFLIGHT = 32;
  *
  * 🔴 **不是新旋钮**:没有 env、不进 config-catalog、部署方改不了它 —— 「不新铸旋钮」这条要求管的是
  * **旋钮**,不是常量。数值与既有 `GET /v1/sessions/:id/mcp` 面板的物化上界同阶(那边 10s),而**名字刻意
- * 独立**:本仓 `sessions.ts` 的四枚同族时限逐字写着理由 ——「两条腿的物化成本不同族,将来任一侧调窗时不该
+ * 独立**:本仓 `sessions.ts` 的同族时限(MCP / A2A / memory-status 各一枚)逐字写着理由 ——「两条腿的物化成本不同族,将来任一侧调窗时不该
  * 被另一侧的名字绑架」。那边界的是**整次物化**,这边界的是**每台的裁决**,连语义都不是一回事。
  *
  * ⚠️ core 的硬条款(d.ts 逐字):`timeoutMs` 界**裁决**不界**拨号** —— 被时钟放弃的那次拨号仍在跑,
@@ -99,7 +99,7 @@ export declare const MCP_PROBE_VERDICT_TIMEOUT_MS = 10000;
  * 与 core 自己成文的走查时长公式**逐字同形**(d.ts:"its own duration is those per-dial times summed over
  * `ceil(n / concurrency)` rounds"),所以在一台**对端会答或会失败**的部署上这口钟结构上摸不到 —— 摸到它
  * 就是真有一台对端在卡发送。读数:1 台 ⇒ 14s;32 台 ⇒ 44s。
- * 兄弟先例:`GET /v1/sessions/:id/mcp` 面板的 `MCP_MATERIALIZE_TIMEOUT_MS`(那边界的也是整次物化,但它是
+ * 兄弟先例:`GET /v1/sessions/:id/mcp` 面板的 `MCP_DIAL_DEADLINE_MS`(`http/mcp-dial-deadline.ts`;那边界的也是整次物化,但它是
  * 一个定值;本面的申报条数由调用方决定,所以定值在这里就是那个「与所问无关的宽限」)。
  * **纯数据** ⇒ `build*`。
  */

package/dist/config.d.ts

@@ -297,10 +297,10 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *   - 退役名(`bash`/`Task`/`KillShell`…)与 pre-prefix 短名(`figma__x`):S-1047(core 7.41.0 #1156)起判据是 core 导出的
  *     **那一只** `judgeRuleToolName`(准备阶段、两只会话规则店、本仓会话规则写口同调),本函数零手写臂;指引 = core 表给的现役指引 /
  *     补全协议前缀。
- *   - 够不着挂载工具的协议名:缺段(`mcp__`、`mcp__srv__`、`mcp____x`)与**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、
- *     超长 / 归一后带连串下划线的服务器段;服务器段带通配的 `mcp__*` 单列判词 `wildcard_peer`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。
- *     判官与句子是 `namespaced-rule-name.ts` 的那**一只**(判据 = core `mintNamespacePrefix` 的自铸对照;会话规则写口两腿与 SQL 店写口同调),
- *     本文件零手写臂。修前(7.116.0 之前)这里只有缺段一臂外加一条只排 `*` 的特例(`coversAServer`),对端段带点号 / 超长的覆盖形在每个面都照收。
+ *   - 够不着挂载工具的协议名:**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、`mcp__*`、超长 / 归一后带连串下划线的服务器段、对端段为空的
+ *     `mcp__` / `mcp____x`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。判官是引擎的 `judgeRuleToolName`(core 7.43.0 #1355 (b)
+ *     的判词 `unmintable_segment`,句子带它的 guidance 与 1:1 现名);本仓 7.116.0–7.117.x 那只自比 `mintNamespacePrefix` 的对照随之退役。
+ *     引擎判官放行、却一只工具都够不着的一形 —— **工具段为空**(`mcp__srv__`)—— 由本仓判(`namespaced-rule-name.ts`,会话规则写口两腿与 SQL 店写口同调)。
  *     ⚠️ 两段覆盖形 `mcp__<server>`(服务器段是自铸形)够得着(S-1047 收掉的分叉,见下)。
  *   - **core 的文法编不出来的串**(名字里带反斜杠、单条 >512 字符、空串):判词取自 core 自己的
  *     `validatePermissionRules`,见 {@link uncompilableRuleGuidance}。[ref]①([ref])补齐 ——
@@ -338,23 +338,19 @@ export interface UnmatchableToolName {
  *  · `"rule-policy"` —— 消费者是 core 的**规则编译器**(`createPermissionRulePolicy`):`settings.permissions.deny` / `.ask`
  *    (S-177 / core 7.9.0 起)。引擎**真的按内容匹配** deny / ask 的内容形(`Bash(rm -r:*)` / `Edit(~/.sema/**)`),所以本仓不许再替它拒 ——
  *    判据整条交回 core 的 `validatePermissionRules`,按这张表自己的 behavior 问。core 7.42.0 起策略只说 deny / ask(allow 表不再是本消费者)。
- *  · `"allow-layer"` —— 消费者是引擎的 **allow 层**(`TaskSpec.allowedTools`):`settings.permissions.allow`(7.117.0 起)。本仓**只判名字**
- *    (退役名 / 无前缀短名 / 协议名够不着挂载工具 —— 与另两张桶同一只判、同一句),**不判内容**:条目的文法、匹配、读成空都归引擎
- *    (读成空的引擎在开跑时通告)。没有 behavior 一问(引擎的 allow 层不经规则编译器)。
- *    翻转条件:引擎的 allow 层对非现行名也出通告(core 7.43.0 起在条目编译拿到工具名册时给「不是工具名 / 近似名」这类原因)—— 提到那一版、
- *    并把名册交给条目编译之后,本消费者的名字判退役(allow 侧整只交引擎)。
+ * (7.117.0 有过第三种 `"allow-layer"` —— 请求的 `settings.permissions.allow` 只判名字。7.118.0 / core 7.43.0 #1358 起引擎的 allow 层自己按名册读条目名并通告
+ *  (`permission.allowed_tool_not_granted`,`reason: "tool_name"` / `near_miss`)⇒ 本仓的名字判退役,allow 侧整只交引擎,只剩引擎读不到的那一形在
+ *  `task-settings.ts` 经 `rule-entry-list.ts` 拒。)
  */
-export type RuleEntryConsumer = "tool-name-table" | "rule-policy" | "allow-layer";
+export type RuleEntryConsumer = "tool-name-table" | "rule-policy";
 /**
  * {@link unmatchableToolNamesRefusal} 的判据入参:这张表喂给谁(名表 / 规则编译器 / allow 层);前两种按哪种态度问 core 的文法、路径基 ——
  * allow 层没有文法一问(见 {@link RuleEntryConsumer}),型上就不带这两位。
  */
 export type UnmatchableToolNameJudgment = {
-    readonly consumer: "tool-name-table" | "rule-policy";
+    readonly consumer: RuleEntryConsumer;
     readonly behavior: PermissionRule["behavior"];
     readonly pathBases?: PathRuleBases;
-} | {
-    readonly consumer: "allow-layer";
 };
 /**
  * 「这张表里有永远不会生效的条目」的**判据与拒因句,同一只函数**(返回 `undefined` = 通过;拒 ⇒ 句子 + 被点名的条目)。
@@ -372,13 +368,13 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
 } | undefined;
 /**
  * 运维 allow 表 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:返回句子 = 拒,`undefined` = 通过)。
- * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据改成**引擎的读法**,与请求的两张
+ * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张
  * allow 表同一份(`rule-entry-list.ts`):
  *  ① 值不是字符串表 ⇒ 拒(env 的 CSV 恒给字符串表;判在这里是为了「值一旦换了来源,第一道判仍在」);
- *  ② 协议名对端段铸不出 / 缺段 / 对端段写通配 ⇒ 拒(与技能清单、请求 allow 桶同一只函数);
- *  ③ 引擎读成空的条目(`compileAllowList(names, "allow").inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字)⇒ 拒,
- *     句子点名条目、引擎给的原因词、该怎么写。请求的 allow 侧对 ③ 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,
- *     而引擎在 Runner 构造期对读成空的部署条目只发一条无会话的通告。
+ *  ② 引擎读不到的那一形(工具段为空的协议名)⇒ 拒(与技能清单、请求 allow 桶同一只函数);
+ *  ③ 引擎读成空的条目(`compileAllowList(names, "allow", 名册 = 空集).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
+ *     core 7.43.0 起条目名过引擎判官读成 `tool_name` 的退役名 / 无前缀短名 / 对端段铸不出)⇒ 拒,句子点名条目、引擎给的原因词(名字层带判词与现名)、
+ *     该怎么写。请求的 allow 侧对 ③ 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,而引擎对读成空的部署条目只在每一跑发一条通告。
  * 文法随引擎:工具名、协议名覆盖形、`Bash(...)` 命令规则、`Read(//dir/**)` 读目录都收(内容形里带逗号的写不进 CSV —— 这张表的分隔符就是逗号)。
  */
 export declare function approvalGrantRefusal(names: unknown): string | undefined;

package/dist/config.js

@@ -18,12 +18,12 @@ import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-post
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeInertRuleEntries, describeRetiredRuleEntry, describeUnreachableRuleEntry, inertRuleEntriesOf, retiredRuleEntryOf, ruleEntryListShapeOk, unreachableRuleEntryOf } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, describeInertRuleEntries, emptyToolSegmentEntryOf, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
@@ -1243,29 +1243,21 @@ function findUnmatchableToolNames(names, opts) {
             }
         }
         const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
-        const verdict = judgeRuleToolName(subject, NO_DECLARED_TOOL_NAMES);
-        if (verdict.kind === "retired") {
-            out.push({ name, guidance: verdict.guidance });
+        const verdict = unmatchableRuleNameOf(subject);
+        if (verdict?.kind === "retired") {
+            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
             continue;
         }
-        if (opts.consumer !== "allow-layer") {
-            const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
-            if (uncompilable !== undefined) {
-                out.push({ name, guidance: uncompilable });
-                continue;
-            }
-        }
-        if (verdict.kind === "unprefixed_namespace") {
-            out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
+        const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
+        if (uncompilable !== undefined) {
+            out.push({ name, guidance: uncompilable });
             continue;
         }
-        const unreachable = unreachableNamespacedRuleNameOf(subject);
-        if (unreachable !== undefined)
-            out.push({ name, guidance: describeUnreachableNamespacedRuleName(unreachable) });
+        if (verdict !== undefined)
+            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
     }
     return out;
 }
-const NO_DECLARED_TOOL_NAMES = new Set();
 export function unmatchableToolNamesRefusal(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)
@@ -1282,12 +1274,9 @@ export function approvalGrantRefusal(names) {
     const over = allowLayerEntryCountIssue(APPROVAL_GRANT_ENV, names);
     if (over !== undefined)
         return `${over.message} — refusing to start rather than running with a truncated list`;
-    const retired = retiredRuleEntryOf(names);
-    if (retired !== undefined)
-        return `${describeRetiredRuleEntry(APPROVAL_GRANT_ENV, retired)} — refusing to start rather than running without it`;
-    const unreachable = unreachableRuleEntryOf(names);
-    if (unreachable !== undefined)
-        return `${describeUnreachableRuleEntry(APPROVAL_GRANT_ENV, unreachable)} — refusing to start rather than running without it`;
+    const empty = emptyToolSegmentEntryOf(names);
+    if (empty !== undefined)
+        return `${describeEmptyToolSegmentEntry(APPROVAL_GRANT_ENV, empty)} — refusing to start rather than running without it`;
     const inert = inertRuleEntriesOf(names, "allow");
     if (inert.length > 0)
         return `${describeInertRuleEntries(APPROVAL_GRANT_ENV, inert)} — the engine would grant nothing for ${inert.length === 1 ? "it" : "them"}; refusing to start rather than running with an allow rule that never takes effect`;

package/dist/deployment-governance.d.ts

@@ -1,5 +1,4 @@
 import { FileError, StubExecutionEnv, type ExecutionEnv, type Result, type ToolPolicy } from "@sema-agent/core";
-import { type DurableAskOptions } from "./approval.js";
 import type { ServiceConfig } from "./config.js";
 import type { applyRuntimeGovernance } from "./runtime-governance.js";
 /** `applyRuntimeGovernance` 的 governance 实参 —— 从折叠属主的签名位**推导**,不复制形状
@@ -92,12 +91,8 @@ export interface DurableApprovalSeat {
     readonly kind: "durable";
     /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
     readonly question: LiveQuestionFace | undefined;
-    /** 每会话「本会话不再询问」探针(canonical toolName 键空间)。 */
-    readonly exempt?: DurableAskOptions["exempt"];
-    /** 豁免短路时的审计钩子。 */
-    readonly onExempted?: DurableAskOptions["onExempted"];
 }
-/** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店)。 */
+/** live 席:Runner 的活 onAsk 当场服 ask(无 park)。 */
 export interface LiveApprovalSeat {
     readonly kind: "live";
 }
@@ -268,7 +263,7 @@ export declare function buildApprovalGrantNotice(config: {
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
  * 三形,按席穷举(S-694,席的定义见 {@link ApprovalSeat}):
- *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/会话豁免全在
+ *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算全在
  *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
  *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
  *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。

package/dist/deployment-governance.js

@@ -126,9 +126,9 @@ export function buildApprovalGrantNotice(config) {
 export function createApprovalBaselinePolicy(config, seat) {
     switch (seat.kind) {
         case "durable":
-            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat));
+            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config));
         case "live":
-            return createApprovalListPolicy(config, {});
+            return createApprovalListPolicy(config);
         case "absent":
             if (hasApprovalListIntent(config)) {
                 throw new Error("approval baseline: this leg has no approval seat (nobody can answer an ask), yet an approval list is in force " +
@@ -142,14 +142,12 @@ export function createApprovalBaselinePolicy(config, seat) {
         }
     }
 }
-function createApprovalListPolicy(config, memory) {
+function createApprovalListPolicy(config) {
     return createDurableAskPolicy({
         requireApproval: config.approvalRequire,
         deny: config.approvalDeny,
         autoBudget: config.approvalAutoBudget,
         neverAuto: config.approvalNeverAuto,
-        ...(memory.exempt ? { exempt: memory.exempt } : {}),
-        ...(memory.onExempted ? { onExempted: memory.onExempted } : {}),
     });
 }
 //# sourceMappingURL=deployment-governance.js.map