@sema-agent/server 7.117.0 → 7.119.0

package/dist/spec-fields.d.ts

@@ -49,26 +49,28 @@ export declare const MAX_TASK_AGENTS = 32;
  *
  * 本谓词只判「字符串数组」(core 7.42.0 起与请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT` **同一只**:`rule-entry-list.ts` 的
  * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
- * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法**归引擎:允侧读不出的条目(`*` / 写路径 / 域名)引擎在开跑时发
- * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
- * `skillDenyInertEntryOf`,两处调用:提交口拒点 + 存量体重放预判)。形对之后两道门再问 {@link skillToolListRefusal}(协议名的服务器段铸不出 / 缺段 ⇒ 400)——
- * 不是文法,是「写得出却永远不生效」,判据与请求的 allow 桶、运维的 allow 表同一份(`rule-entry-list.ts`)。
- * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界 —— 引擎逐条播种是平方级;与请求 allow 桶、运维表同一只),
+ * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法与名字**是引擎的读法:允侧读不出的条目(`*` / 写路径 / 域名 / 退役名 …)引擎在开跑时发
+ * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目(文法或名字层)在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
+ * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 + 引擎读不到的那一形 ⇒ 400)。
+ * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界;与请求 allow 桶、运维表同一只),
  * 在 {@link skillToolListRefusal} 里判;无长度帽([ref])。
  */
 export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 /**
  * 一条技能(形已过两道门的字符串数组判)的两只清单在受理口的拒因 —— 都过 ⇒ `undefined`。两处受理口同调:顶层 `skills[]`
- * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。判据是 `rule-entry-list.ts` 那一份:
- * 任一只清单里「协议名写得出、却永远匹配不到」的条目(与请求的 allow 桶、配置表、会话规则写口同一只判官)。
- * 拒侧读成空的条目**不在这里判**:那一问在 `resolveSpec`(`rule-entry-list.ts` 的 `skillDenyInertEntryOf`;新提交与每条续跑腿都经过那一处)与存量体重放前的
- * 预判(`http/checkpoint-ctx.ts` `storedBodyReplayRefusal`)—— 一只判、两处调用。
+ * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。两问:条数帽;引擎读不到、却永远匹配不到的
+ * 条目(工具段为空的协议名,`rule-entry-list.ts` 那一份,与配置表、会话规则写口同一只)。退役名 / 对端段铸不出 / 读成空的条目是引擎的读法(见上):
+ * 允侧交引擎通告,拒侧由 `resolveSpec` 拒。
  */
 export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
- *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。⚠️ 已知残账(core 半场):
- *  core 只对 allowTools 未知项 fail-loud,denyTools 未知项(如 typo)静默失效 —— 已上板请 core 镜像。
+ *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
+ *  **名字归引擎一只判**(core 7.45.0 #1377 / #1385,开跑前,三来源同判):没有工具能是的拼法(带空白 / 括号形坏 / 不可见字符)、非字符串条目 ⇒ 整 run 拒
+ *  `config.agent.unknown_tool`;无人挂的名 ⇒ 不拒、经 `onError`(phase `"config"`)告一次(本仓汇点 `runner_config_advisory`);大小写孪生 / 退役名(`bash`)
+ *  **在本仓部署形上也只告不拒** —— 主车道的委派工具带 extraTools 工厂(`capabilities/builtin-tools.ts`),引擎开跑前列不全子代工具池(`agentToolPool` 缺席)就不把
+ *  像 `Bash` 的名字判成拼错;引擎给宿主「声明可注入名册」的座后本仓声明名册、这两形回到开跑前拒;
+ *  `denyTools` 的 `Tool(content)` ⇒ 整只工具对该子代藏起并告。本仓不在受理口另做名字对照(那会是同一问的第二个判官)。
  *  ⚠️ 键判断必须 Object.hasOwn:`in` 走原型链,JSON 里的 "toString"/"constructor"/"__proto__" 键会被
  *  误判为白名单字段,随后 SHAPES[k].ok 不是函数 ⇒ TypeError(fresh 500 / resume 砖;cross-review 复现)。 */
 export declare function taskAgentIssue(item: unknown): string | null;

package/dist/spec-fields.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
-import { allowLayerEntryCountIssue, describeRetiredRuleEntry, describeUnreachableRuleEntry, retiredRuleEntryOf, ruleEntryListShapeOk, unreachableRuleEntryOf } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -76,12 +76,9 @@ export function skillToolListRefusal(skill) {
         const over = allowLayerEntryCountIssue(`skill.${key}`, list);
         if (over !== undefined)
             return over.message;
-        const retired = retiredRuleEntryOf(list);
-        if (retired !== undefined)
-            return describeRetiredRuleEntry(`skill.${key}`, retired);
-        const unreachable = unreachableRuleEntryOf(list);
-        if (unreachable !== undefined)
-            return describeUnreachableRuleEntry(`skill.${key}`, unreachable);
+        const empty = emptyToolSegmentEntryOf(list);
+        if (empty !== undefined)
+            return describeEmptyToolSegmentEntry(`skill.${key}`, empty);
     }
     return undefined;
 }

package/dist/standing-answer-grant.d.ts

@@ -1,8 +1,20 @@
-/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、待决条目、停驻行的 `tool_approval` 臂)都结构上满足。 */
+/** 读口的入参:任何一种载着「这一问」的形(活的 `AskRequest`、`ToolCallRequest`、停驻行的 `tool_approval` 臂)都结构上满足。 */
 export interface StandingAnswerGrantCarrier {
     readonly toolName?: unknown;
     readonly boundGrantDigest?: unknown;
 }
-/** 这一问的应答是否授予这一次调用之外的东西(读法见文件头注)。 */
+/** 一问的授予绑定(闭集):`none` = 应答只覆盖这一次调用;`bound` = 授予、绑定可读;`unreadable` = 授予、绑定读不出。 */
+export type GrantBinding = {
+    readonly kind: "none";
+} | {
+    readonly kind: "bound";
+    readonly digest: string;
+} | {
+    readonly kind: "unreadable";
+};
+/** 这一问的授予绑定(读法见文件头注)。 */
+export declare function grantBindingOf(carrier: StandingAnswerGrantCarrier): GrantBinding;
+/** 这一问的应答是否授予这一次调用之外的东西(= 绑定不是 `none`)。**按工具名记**的读者(耐久豁免店的读写口、豁免列表)据它不碰这类问:
+ *  它们的键没有绑定这一维,记下 / 代答都会越过绑定。 */
 export declare function answerGrantsBeyondCall(carrier: StandingAnswerGrantCarrier): boolean;
 //# sourceMappingURL=standing-answer-grant.d.ts.map

package/dist/standing-answer-grant.js

@@ -1,5 +1,12 @@
 import { SKILL_TOOL_NAME } from "@sema-agent/core";
+export function grantBindingOf(carrier) {
+    if (Object.hasOwn(carrier, "boundGrantDigest")) {
+        const d = carrier.boundGrantDigest;
+        return typeof d === "string" && d.length > 0 ? { kind: "bound", digest: d } : { kind: "unreadable" };
+    }
+    return carrier.toolName === SKILL_TOOL_NAME ? { kind: "unreadable" } : { kind: "none" };
+}
 export function answerGrantsBeyondCall(carrier) {
-    return Object.hasOwn(carrier, "boundGrantDigest") || carrier.toolName === SKILL_TOOL_NAME;
+    return grantBindingOf(carrier).kind !== "none";
 }
 //# sourceMappingURL=standing-answer-grant.js.map

package/dist/store-posture.d.ts

@@ -8,24 +8,32 @@
  *
  * ## 形
  * `declared` = 运维的声明(`DB_BACKEND` 词,含缺省推导);`backend` = **装配出的**后端 kind(没装出后端 = `memory`);两者不等是合法的
- * 形(`DB_BACKEND=pg` + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久;auto 降级;缺省推导 local 起不来)—— 两位都上 wire,
+ * 形(`DB_BACKEND=pg` + `SESSION_BACKEND=memory` = 声明 pg、刻意不持久;缺省推导 local 起不来)—— 两位都上 wire,
  * 由调用方自己读出落差。`degradedReason` present-iff 降级臂走过(按后端族定词,{@link storeDegradedReasonFor})。
  * 顶层 `sql` 并入 `store.sql`(硬 breaking,零别名;对象逐字同形)。
  */
 import type { StoreBackend as StoreBackendWord } from "@sema-agent/settings-schema/execution-lanes";
+import type { ServiceConfig } from "./config-types.js";
 import type { StoreBackend } from "./plugins/store-backend.js";
 import type { SqlEngineFacts } from "./plugins/sql-driver.js";
 import { type SqlEngineCapability } from "./sql-engine-posture.js";
 /**
- * 降级词闭集(**按后端族**,不按失败发生在哪一步 —— SQL 池懒连,连接失败第一次就出现在 `ensureSchema` 里,与 DDL 失败同一个调用,
- * 按调用位置分不出「连不上」与「建表失败」):
- *  · `db_unreachable` —— SQL 族(`mysql` / `pg`)在 `SESSION_BACKEND=auto` 下打不开(连接或建表);
+ * 降级词闭集(**按后端族**,不按失败发生在哪一步):
  *  · `local_unwritable` —— **缺省推导**的 local 文件店构造期失败(mkdir / 数据根锁 / 权限 / 只读挂载 / 磁盘满)。
+ *
+ * 🔴 SQL 族**没有**降级词:配了 DSN 的库当下打不开 ⇒ 窗内重试、到窗拒启(`plugins/store-open-wait.ts` / `openStoreBackendWithFallback`),
+ * 从来不退成内存 —— 修前这里有第二个词 `db_unreachable`(`SESSION_BACKEND=auto` 下 SQL 族打不开 ⇒ 内存 + 本位置位),那是 [ref] P 类的静默 fail-open,随降级臂一并退役。
  */
-export declare const STORE_DEGRADED_REASONS: readonly ["db_unreachable", "local_unwritable"];
+export declare const STORE_DEGRADED_REASONS: readonly ["local_unwritable"];
 export type StoreDegradedReason = (typeof STORE_DEGRADED_REASONS)[number];
-/** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。`memory` 从不尝试打开后端,走不到降级臂 —— 到了就是装配缺陷,响亮抛。 */
+/** 降级臂按后端族定词(穷举 switch:词表加员 ⇒ 编译红)。只有缺省推导的 `local` 走得到降级臂;`mysql` / `pg` / `memory` 走到这里 = 装配缺陷,响亮抛。 */
 export declare function storeDegradedReasonFor(declared: StoreBackendWord): StoreDegradedReason;
+/**
+ * `/health.sessionBackend` 与 `listening` 日志 `session` 位的**唯一读法**:装配后的 `config.sessionBackend`(`memory` | `tidb`;`tidb` = 「后端自己的 durable 店」的泛指标签)
+ * + 装配出的后端 kind ⇒ 对运维说人话的有效店 —— `durable(pg)` / `durable(mysql)` / `durable(local)` / `memory`。`sessionBackend` 缺 backend 的 `tidb`
+ * 不替它编一个后端名(那是装配缺陷,`createSessionStore` 会先拒)。部署侧的 smoke(`deploy/sema-up/lib/health.sh`)按这一形读同一位。
+ */
+export declare function sessionStoreLabelOf(sessionBackend: ServiceConfig["sessionBackend"], backendKind: StoreBackend["kind"] | undefined): string;
 /** 装配值(纯数据;`boot/stores.ts` 铸一次,gauge / `/health` / caps 三面同读)。 */
 export interface StorePosture {
     readonly declared: StoreBackendWord;

package/dist/store-posture.js

@@ -1,12 +1,12 @@
 import { projectSqlEngineCapability } from "./sql-engine-posture.js";
-export const STORE_DEGRADED_REASONS = ["db_unreachable", "local_unwritable"];
+export const STORE_DEGRADED_REASONS = ["local_unwritable"];
 export function storeDegradedReasonFor(declared) {
     switch (declared) {
-        case "mysql":
-        case "pg":
-            return "db_unreachable";
         case "local":
             return "local_unwritable";
+        case "mysql":
+        case "pg":
+            throw new Error(`store posture: DB_BACKEND=${declared} never degrades to memory (a configured SQL store is retried then refused, never replaced) — this is a wiring defect`);
         case "memory":
             throw new Error("store posture: DB_BACKEND=memory never opens a backend, so it cannot degrade — this is a wiring defect");
         default: {
@@ -15,6 +15,9 @@ export function storeDegradedReasonFor(declared) {
         }
     }
 }
+export function sessionStoreLabelOf(sessionBackend, backendKind) {
+    return sessionBackend === "tidb" && backendKind !== undefined ? `durable(${backendKind})` : sessionBackend;
+}
 export function buildStorePosture(a) {
     return { declared: a.declared, backend: a.assembled ?? "memory", ...(a.degradedReason !== undefined ? { degradedReason: a.degradedReason } : {}) };
 }

package/dist/task-settings.d.ts

@@ -27,8 +27,8 @@
  *    `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO` (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell).
  *    A request-carried skill's `allowedTools` is the same member's twin (same grammar, same predicate, same admission judge
  *    `rule-entry-list.ts`). Pinned on the real assembly: `test/allow-layer-operator-knobs.test.ts`.
- *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收**五**模式
- *    (default | acceptEdits | plan | bypassPermissions | auto),bypass/auto 被 HONOR 为 gate-shape 选择
+ *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收 core `PERMISSION_MODES` **全集**
+ *    (default | acceptEdits | plan | auto | bypassPermissions | dontAsk),bypass/auto 被 HONOR 为 gate-shape 选择
  *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
  *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[ref] 拍照。
  *
@@ -51,60 +51,32 @@ import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy,
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
 import { type KeyClosureIssue } from "./request-key-closure.js";
 /**
- * S-902(7.107.0,车QY 候裁 11 裁 A;[ref])—— core 的**每一个**权限模式词,本仓请求面收不收:`"request"` = 受理(顶层 `permissionMode` /
- * `settings.permissions.defaultMode` / `?permissionMode=` 查询串三处同读),`"excluded"` = 显式排除(不上请求面)。
- *
- * 🔴 这张表是**表态**,不是词表的第二份:词与词序只从 core `PERMISSION_MODES` 来(下面 {@link SETTINGS_PERMISSION_MODES} 按它过滤);
- * 表只对每个词说一句「收 / 不收」。`satisfies Record<PermissionMode, …>` 对 core 的词型**穷举**:core 加一个词 ⇒ 本表缺键 **编译红**
- * (新词必须被表态一次,不会被静默收进请求面、也不会被静默漏掉);core 删 / 改名一个词 ⇒ 本表多键编译红(残条目不留)。
- *
- * 今天的表态(与 7.106.0 逐字同行为):五词受理;`dontAsk`(CC 的「自动拒」档,core 7.34.0 起第六词)**排除** —— 它上不上请求面是一件
- * 新能力(未裁,本表不替它裁);不收它时提交面 400 `request.field_invalid`,续跑重放腿按 {@link coercePermissionMode} 的既有宽读折 `default`。
- * 语义沿革(为什么是这五个、`bypassPermissions` / `auto` 何时进来):[ref] / [ref] / [ref] —— CC 自己的全集是六词,CC 托管 / 远端形收四词
- * (= 本仓 − `bypassPermissions`),本仓 = {CC 远端四词} ∪ {`bypassPermissions`},登记过的偏离;生效模式原样过境 `TaskSpec.permissionMode`(S-877)。
+ * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
+ * `?permissionMode=` 查询串三处同读)。本仓不持有第二份词表,也不持有「收 / 不收」的表态:判据 = core 的 `isPermissionMode`,型 = core 的
+ * `PermissionMode`,wire 句子里的词表只从这里取词({@link PERMISSION_MODE_WORDS})。core 加一个词 ⇒ 请求面自动收它,它在派生腿上的去向由
+ * {@link deriveSettingsPolicy} 的穷举 `switch` 逼出来(缺一臂 ⇒ 编译红);core 删 / 改名一个词 ⇒ 本文件里按名写出它的那一臂编译红。
+ * 生效模式原样过境 `TaskSpec.permissionMode`(S-877):引擎自己解释模式 —— 含 `dontAsk`(CC 的「自动拒」档:凡是要问的一律由模式拒,零卡,
+ * 门记录 `deniedBy:"mode"`),本仓不另写判。
  */
-export declare const PERMISSION_MODE_REQUEST_FACE: {
-    readonly default: "request";
-    readonly acceptEdits: "request";
-    readonly plan: "request";
-    readonly auto: "request";
-    readonly bypassPermissions: "request";
-    readonly dontAsk: "excluded";
-};
-/** 请求面受理的模式词的型形 —— 从表态表派生(`"request"` 那几行的键)。 */
-export type SettingsPermissionMode = {
-    [M in PermissionMode]: (typeof PERMISSION_MODE_REQUEST_FACE)[M] extends "request" ? M : never;
-}[PermissionMode];
-/** 请求面受理的模式词(core 序)= core `PERMISSION_MODES` 过滤表态 `"request"`。wire 门、coerce 两族、两句 400 文案同读这一份。 */
-export declare const SETTINGS_PERMISSION_MODES: readonly SettingsPermissionMode[];
-/** 显式排除集(core 序)= core `PERMISSION_MODES` 过滤表态 `"excluded"`;今天恰是 `["dontAsk"]`。只作披露 / 钉读,不参与判定。 */
-export declare const SETTINGS_PERMISSION_MODES_EXCLUDED: readonly Exclude<PermissionMode, SettingsPermissionMode>[];
-/** 五词表的 wire 文案形(`"a" | "b" | …`)—— 两条 400 的句子从这里取词,不再各抄一份。 */
-export declare const SETTINGS_PERMISSION_MODE_WORDS: string;
-/** 闭集成员判定(`unknown` 入口用)—— 词表的**唯一**运行期读者:wire 门与 coerce 两族同调。 */
-export declare function isSettingsPermissionMode(raw: unknown): raw is SettingsPermissionMode;
+/** 请求面闭集的 wire 文案形(`"a" | "b" | …`,core 序)—— 三处 400(顶层 / bundle / 查询串)的句子从这里取词,不再各抄一份。 */
+export declare const PERMISSION_MODE_WORDS: string;
 /**
- * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
- * CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
+ * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends
+ * the CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
  * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the mode only selects the CLIENT-derived
  * gate ({@link deriveSettingsPolicy}); it can never subtract from the deployment/operator policy (applyTaskSettings
- * folds via tightenTaskSpec, deny-wins). Post-[ref] the honored set is the five-word table above (NOT "CC verbatim" —
- * see the {@link SettingsPermissionMode} header for the three-set contrast; the earlier "five CC modes" wording here
- * was [ref] P2-1's finding: no CC set has five members). `acceptEdits`,
- * `bypassPermissions` and `auto` are HONORED as gate-shape choices (they no longer coerce to `default`, which
- * would FORCE the manual ask gate onto a caller that explicitly asked for less asking — with the gate live, the old
- * coercion would have been a behavior change for them, incl. a headless-deny regression for bypass callers). An
- * UNKNOWN string still coerces to `default` (fail-safe: the most-asking mode).
- * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-five-mode value
- * (server.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
+ * folds via tightenTaskSpec, deny-wins). The honored set is core's `PERMISSION_MODES` in full — every word passes
+ * through verbatim (`dontAsk` included: folding the auto-deny mode to `default`, the asking mode, would turn a refusal
+ * into a card). An UNKNOWN string coerces to `default` (fail-safe: the most-asking mode).
+ * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-member value
+ * (admission.ts, sibling of promptProfile) and the wire type is a closed enum. This lenient fold stays for the one
  * population the gate deliberately does not cover: RESUME replay of a persisted pre-gate body (outputStyle/model
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
-export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
-/** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
- *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠。
- *  S-496:词表单点已上移到 {@link SETTINGS_PERMISSION_MODES},本函数只是它的 `undefined` 形读者。 */
-export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
+export declare function coercePermissionMode(raw: unknown): PermissionMode | undefined;
+/** 闭集的**严格**读法(`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,不走上面那条给 resume 重放留的 `default` 宽臂)。
+ *  上面的宽读只是本函数外再包一层折叠;词表只有 core 的 `PERMISSION_MODES`(判据 `isPermissionMode`)。 */
+export declare function coercePermissionModeStrict(raw: unknown): PermissionMode | undefined;
 /**
  * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
  * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
@@ -116,8 +88,8 @@ export declare function coercePermissionModeStrict(raw: unknown): SettingsPermis
  * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
  * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
  *
- * 🔴 **不手抄词表**:`satisfies readonly SettingsPermissionMode[]` 让「本表的成员必须仍是本仓受理的
- * 模式词」成为**编译期**事实 —— 五词表某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
+ * 🔴 **不手抄词表**:`satisfies readonly PermissionMode[]` 让「本表的成员必须仍是 core 的模式词」成为**编译期**事实 ——
+ * core 某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
  */
 export declare const PLAN_APPROVE_PERMISSION_MODES_AFTER: readonly ["default", "acceptEdits"];
 /** {@link PLAN_APPROVE_PERMISSION_MODES_AFTER} 的类型形(值表单点,类型从值派生 —— 两处各写一份就会漂)。 */
@@ -139,7 +111,7 @@ export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is P
 export declare function storedBodyPermissionMode(body: {
     permissionMode?: unknown;
     settings?: unknown;
-}): SettingsPermissionMode | undefined;
+}): PermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
@@ -148,7 +120,7 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
 /** R4: fold a top-level `body.permissionMode` onto the parsed settings as `permissions.defaultMode` (the top-level
  *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
-export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
+export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: PermissionMode): ParsedTaskSettings;
 /**
  * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
@@ -161,7 +133,7 @@ export declare function withPermissionMode(settings: ParsedTaskSettings | undefi
  */
 export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
-}, settings: ParsedTaskSettings | undefined): SettingsPermissionMode | undefined;
+}, settings: ParsedTaskSettings | undefined): PermissionMode | undefined;
 /**
  * S-346 —— [ref] 技能清单预算两旋钮的**值域谓词**(一对具名单铸点)。
  *
@@ -187,7 +159,7 @@ export interface ParsedTaskSettings {
         deny?: string[];
         /** Carried for completeness; v1 folds `ask` into the gate via the deny-wins base (see {@link applyTaskSettings}). */
         ask?: string[];
-        defaultMode?: SettingsPermissionMode;
+        defaultMode?: PermissionMode;
         /** [ref] 件⑥([ref] §3.4,[ref];PM 裁 [ref]):CC settings 的 kill-switch `permissions.disableAutoMode`,cli 投影
          *  (settingsRulesWire.ts toWireSettings)而此前本白名单丢弃 ⇒ 用户/managed 层关 auto 到不了引擎。语义 = 只能关
          *  不能开(tighten-only):把生效模式 auto 折 default(座不写 ⇒ 不武装)。折叠单点 = {@link effectivePermissionMode}。

package/dist/task-settings.js

@@ -1,25 +1,13 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
-import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeAllowLayerOverCap, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
-export const PERMISSION_MODE_REQUEST_FACE = {
-    default: "request",
-    acceptEdits: "request",
-    plan: "request",
-    auto: "request",
-    bypassPermissions: "request",
-    dontAsk: "excluded",
-};
-export const SETTINGS_PERMISSION_MODES = PERMISSION_MODES.filter((m) => PERMISSION_MODE_REQUEST_FACE[m] === "request");
-export const SETTINGS_PERMISSION_MODES_EXCLUDED = PERMISSION_MODES.filter((m) => PERMISSION_MODE_REQUEST_FACE[m] === "excluded");
-export const SETTINGS_PERMISSION_MODE_WORDS = SETTINGS_PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
-export function isSettingsPermissionMode(raw) {
-    return typeof raw === "string" && SETTINGS_PERMISSION_MODES.includes(raw);
-}
+import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
+export const PERMISSION_MODE_WORDS = PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function coercePermissionMode(raw) {
     const strict = coercePermissionModeStrict(raw);
     if (strict !== undefined)
@@ -29,7 +17,7 @@ export function coercePermissionMode(raw) {
     return undefined;
 }
 export function coercePermissionModeStrict(raw) {
-    return isSettingsPermissionMode(raw) ? raw : undefined;
+    return isPermissionMode(raw) ? raw : undefined;
 }
 export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
 export function isPlanApprovePermissionModeAfter(raw) {
@@ -304,7 +292,8 @@ function createWorkflowAskPolicy(isExempt) {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
                 return { action: "allow" };
-            if (isExempt) {
+            const ask = { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
+            if (isExempt && standingAnswerDurablyRecordable(policyAskStandingAnswerFacts(req, ask, false))) {
                 try {
                     if (await isExempt(req.toolName))
                         return { action: "allow", decisionReason: "rule" };
@@ -312,7 +301,7 @@ function createWorkflowAskPolicy(isExempt) {
                 catch {
                 }
             }
-            return { action: "ask", message: `dynamic workflow "${req.toolName}" requires approval in this permission mode`, decisionReason: "rule" };
+            return ask;
         },
         nameSets: [{ ask: WORKFLOW_ASK_NAMES }],
     };
@@ -346,7 +335,6 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
     const judgments = [
         ["permissions.ask", perms.ask, { consumer: "rule-policy", behavior: "ask", ...(pathBases !== undefined ? { pathBases } : {}) }],
         ["permissions.deny", perms.deny, { consumer: "rule-policy", behavior: "deny", ...(pathBases !== undefined ? { pathBases } : {}) }],
-        ["permissions.allow", perms.allow, { consumer: "allow-layer" }],
     ];
     for (const [field, names, judgment] of judgments) {
         if (!names)
@@ -355,6 +343,9 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
     }
+    const emptyAllow = perms.allow !== undefined ? emptyToolSegmentEntryOf(perms.allow) : undefined;
+    if (emptyAllow !== undefined)
+        throw new Error(describeEmptyToolSegmentEntry("permissions.allow", emptyAllow));
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
@@ -396,7 +387,8 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
             return p ? { toolPolicy: p } : {};
         }
         case "default":
-        case "auto": {
+        case "auto":
+        case "dontAsk": {
             const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }