@sema-agent/server 7.117.0 → 7.119.0

package/dist/capabilities/code-review-council.js

@@ -35,8 +35,10 @@ export function createCouncilTool(subRunner, repoTools, objective, opts = {}) {
         parameters: Type.Object({}),
         execute: async (_args, ctx) => {
             const active = pickLenses(opts.lensCount);
-            const lenses = await runLensReviews(subRunner, repoTools, objective, ctx.signal, active);
-            const findings = lenses.map((l) => `### ${l.lens} reviewer\n${l.text}`).join("\n\n");
+            const outcomes = await runLensReviews(subRunner, repoTools, objective, ctx.signal, active);
+            const lenses = outcomes.filter((o) => o.ok);
+            const failedLenses = outcomes.flatMap((o) => (o.ok ? [] : [{ lens: o.lens, reason: o.reason }]));
+            const findings = outcomes.map((o) => `### ${o.lens} reviewer\n${o.ok ? o.text : `(lens errored: ${o.reason})`}`).join("\n\n");
             const converge = await runConvergence(subRunner, repoTools, objective, findings, opts, ctx.signal, active);
             const totalTokens = lenses.reduce((s, l) => s + l.tokens, 0) + converge.tokens;
             const totalTurns = lenses.reduce((s, l) => s + l.turns, 0) + converge.turns;
@@ -46,10 +48,10 @@ export function createCouncilTool(subRunner, repoTools, objective, opts = {}) {
             opts.metrics?.inc("council_runs_total", { mode });
             opts.metrics?.inc("task_tokens_total", {}, totalTokens);
             opts.metrics?.observe("council_tokens", totalTokens);
-            opts.logger?.info("council_done", { mode, lenses: lenses.length, totalTokens, totalTurns });
+            opts.logger?.info("council_done", { mode, lenses: lenses.length, failedLenses, totalTokens, totalTurns });
             return {
                 content: converge.review,
-                details: { council: { mode, totalTokens, totalTurns, perLens: lenses.map((l) => ({ lens: l.lens, tokens: l.tokens })) } },
+                details: { council: { mode, totalTokens, totalTurns, perLens: lenses.map((l) => ({ lens: l.lens, tokens: l.tokens })), failedLenses } },
             };
         },
     };
@@ -65,16 +67,11 @@ async function runLensReviews(subRunner, repoTools, objective, signal, lenses) {
             enableBlockedReport: false,
             signal,
         });
-        return { lens: lens.name, text: r.result?.trim() || "(no findings)", tokens: r.stats.tokens, turns: r.stats.turns };
+        return { ok: true, lens: lens.name, text: r.result?.trim() || "(no findings)", tokens: r.stats.tokens, turns: r.stats.turns };
     }));
     return settled.map((s, i) => s.status === "fulfilled"
         ? s.value
-        : {
-            lens: lenses[i].name,
-            text: `(lens errored: ${s.reason instanceof Error ? s.reason.message : String(s.reason)})`,
-            tokens: 0,
-            turns: 0,
-        });
+        : { ok: false, lens: lenses[i].name, reason: s.reason instanceof Error ? s.reason.message : String(s.reason) });
 }
 async function runConvergence(subRunner, repoTools, objective, findings, opts, signal, lenses) {
     if (opts.debate) {

package/dist/capabilities/hands-lane.d.ts

@@ -33,6 +33,31 @@ export interface HandsRunnerPair {
 }
 /** 按场景表态取 Runner。**穷举 switch**:`ScenarioHands` 加词而此处不改 = 编译错(无 default 臂)。 */
 export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerPair): Runner;
+/**
+ * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
+ *
+ * 两段来源,都不是拍脑袋:
+ *  · `handBandEffects()`(core 7.8.0 B1 起的导出面;此前是手抄表常量 `HAND_TOOL_EFFECTS`)—— band 的
+ *    effect 表,由**静态工具目录**按 `mountedBy.includes("hands")` 派生。名册单源之后这张表不再是一张
+ *    手抄名表,加/退工具由目录一处说了算。
+ *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
+ *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
+ *    core 加/改 band 成员时红,防漂移)。
+ *
+ * ⚠️ 本全集是**观测口径**(用于防漂移对账),**不是** deny 名单 —— deny 用下面的
+ * {@link HANDS_EXCLUSIVE_TOOL_NAMES},理由见那里。
+ *
+ * 🚨 [ref] P0(2026-08-09):派生时必须过滤 core 的 `RETIRED_TOOL_NAMES` —— core 5.21.0 的
+ * `HAND_TOOL_EFFECTS` 里残留已退役的 `MultiEdit`,而 core `prepare-task` 的策略名审计见退役名
+ * **无条件 throw**(`config.legacy_tool_name`);不过滤,deny 名单一进 `spec.toolPolicy`,
+ * `hands: none` 三场景(scan/code-review/team)在**所有部署**上零 turn 全灭。core 5.21.1 已删
+ * 那条死条目([ref]),这道 filter 是结构性防御:将来 core 再退役任何 band 名都不会重演
+ * (test/scenario-hands-lane.test.ts 格7/格8 双钉:真 Runner 过审计 + 零交集门)。
+ * filter 打在**整表**(effect 表 + 锚定补集)之后 —— caret floor 下装置会解析到更新的 core,
+ * 补集名哪天被退役,只滤前半就是同一次故障换个名字(codex 复审 finding,2026-08-09)。
+ * S-1047(core 7.41.0 #1156):判据换成 core 导出的**那一只** `judgeRuleToolName`(策略名审计、会话规则店、本仓写口与配置表同调)——
+ * 修前这里直读 `RETIRED_TOOL_NAMES` 表,是本仓第三份「这是不是旧名」的手写判据。名册 = 空集(这张 deny 名单不挂在任何一跑的名册上判)。
+ */
 export declare const HANDS_BAND_TOOL_NAMES: readonly string[];
 /**
  * band 里**只有手才可能出现**的那批(= deny 名单)。

package/dist/capabilities/hands-lane.js

@@ -1,4 +1,5 @@
 import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
+import { NO_DECLARED_TOOL_NAMES } from "../namespaced-rule-name.js";
 export function withoutExecutionEnv(deps) {
     const { executionEnvFactory: _handsDropped, ...rest } = deps;
     return rest;
@@ -11,7 +12,6 @@ export function pickHandsRunner(hands, pair) {
             return pair.handsless;
     }
 }
-const NO_DECLARED_TOOL_NAMES = new Set();
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     ...handBandEffects().keys(),
     "SendMessage",

package/dist/capabilities/mcp-probe.d.ts

@@ -79,7 +79,7 @@ export declare const MCP_PROBE_MAX_INFLIGHT = 32;
  *
  * 🔴 **不是新旋钮**:没有 env、不进 config-catalog、部署方改不了它 —— 「不新铸旋钮」这条要求管的是
  * **旋钮**,不是常量。数值与既有 `GET /v1/sessions/:id/mcp` 面板的物化上界同阶(那边 10s),而**名字刻意
- * 独立**:本仓 `sessions.ts` 的四枚同族时限逐字写着理由 ——「两条腿的物化成本不同族,将来任一侧调窗时不该
+ * 独立**:本仓 `sessions.ts` 的同族时限(MCP / A2A / memory-status 各一枚)逐字写着理由 ——「两条腿的物化成本不同族,将来任一侧调窗时不该
  * 被另一侧的名字绑架」。那边界的是**整次物化**,这边界的是**每台的裁决**,连语义都不是一回事。
  *
  * ⚠️ core 的硬条款(d.ts 逐字):`timeoutMs` 界**裁决**不界**拨号** —— 被时钟放弃的那次拨号仍在跑,
@@ -99,7 +99,7 @@ export declare const MCP_PROBE_VERDICT_TIMEOUT_MS = 10000;
  * 与 core 自己成文的走查时长公式**逐字同形**(d.ts:"its own duration is those per-dial times summed over
  * `ceil(n / concurrency)` rounds"),所以在一台**对端会答或会失败**的部署上这口钟结构上摸不到 —— 摸到它
  * 就是真有一台对端在卡发送。读数:1 台 ⇒ 14s;32 台 ⇒ 44s。
- * 兄弟先例:`GET /v1/sessions/:id/mcp` 面板的 `MCP_MATERIALIZE_TIMEOUT_MS`(那边界的也是整次物化,但它是
+ * 兄弟先例:`GET /v1/sessions/:id/mcp` 面板的 `MCP_DIAL_DEADLINE_MS`(`http/mcp-dial-deadline.ts`;那边界的也是整次物化,但它是
  * 一个定值;本面的申报条数由调用方决定,所以定值在这里就是那个「与所问无关的宽限」)。
  * **纯数据** ⇒ `build*`。
  */

package/dist/capabilities/scenarios.d.ts

@@ -174,7 +174,12 @@ export declare function semaIdentityProvider(): PromptProvider;
  */
 export declare function codePromptProvider(brand: boolean): PromptProvider;
 export declare function buildScenarios(deps: ScenarioDeps): Record<string, Scenario>;
-/** Resolve the scenario for a request (falls back to `default`). */
+/**
+ * Resolve the scenario bundle for a name. `undefined` = no preference ⇒ the built-in `default`; any OTHER name must be
+ * registered — an unregistered one is a caller bug and THROWS (it never falls back to `default`: a restricted principal's
+ * bundle must not silently widen). Request paths get their name from {@link gateScenarioRequest}, whose result is always
+ * registered, so the throw is unreachable from them; it is the loud arm for a direct caller that skipped the gate.
+ */
 export declare function selectScenario(scenarios: Record<string, Scenario>, name: string | undefined): Scenario;
 /** web 渲染契约(定稿形状;knobs 现在没有=整字段省略)。 */
 export interface ScenarioDetail {
@@ -259,16 +264,38 @@ export interface ScenarioRuling {
     /** 纯场景名集合(principal/组名不上 wire);空 = 该 principal 无任何指派 = 无治理。 */
     allowlist: string[];
 }
+/**
+ * 一个场景名的**来源**(闭集:新增一词 ⇒ {@link danglingScenarioRefusal} 的穷尽 switch 编译红)。
+ *  · `ruling` —— 中心按主体指派的场景(`ScenarioRuling.scenario`);
+ *  · `deployment` —— 部署自己写的缺省(`DEFAULT_SCENARIO` / config `defaultScenario`)。
+ * 请求体显式给的名字不在此列:那是调用方的话,不在册 ⇒ 400 `scenario_unknown`(见 {@link gateScenarioRequest})。
+ */
+export type ScenarioNameSource = "ruling" | "deployment";
+/**
+ * 🔴 **悬空场景名的判据与拒句 —— 全仓唯一属主。**
+ *
+ * 指派 / 部署缺省指向不在册的名字,此前一路被折成 `default`(工具 / 提示 / skills / mcp 整包跟着换,零 warn):受限场景的主体被
+ * 悄悄放进更宽的 default。本函数把那条回退链换成两条出路,**没有第三条**:
+ *  · `deployment` 悬空 ⇒ 起服拒启(`boot/stage-07-capability-layer.ts` 在 center 场景 overlay 之后调它、`throw new Error`);
+ *  · `ruling` 悬空 ⇒ 该 run 503 `state.scenario_assignment_unknown`({@link gateScenarioRequest} 调它);
+ *  · `deployment` 悬空到得了 run(只有自己装配 `resolveSpec`、没经过起服的嵌入方)⇒ 同码同判据同一句话 —— 起服拒启与这一条是同一个答案。
+ *
+ * 返回 `undefined` = 在册;否则是**拒句**(点名名字与来源、给在册词表、说怎么修)。判据按**自有键**(`known` 是场景表的
+ * `Object.keys`,`constructor` / `__proto__` 不是场景名)。
+ */
+export declare function danglingScenarioRefusal(name: string, source: ScenarioNameSource, known: readonly string[]): string | undefined;
 /**
  * resolveSpec 的执法入口(指派为默认、body.scenario 可换但限 allowlist)。返回本请求的
- * 生效场景名(未做 unknown→default 回退——那是 resolveSpec 既有职责,保持单点)。
+ * **在册**生效场景名 —— 返回值一定在 `known` 里:下游直接按它取场景,没有「未知名 → default」的回退臂。
  *
- *   - body.scenario 显式给出:allowlist 非空且集外 ⇒ typed 拒绝(400 `scenario_not_allowed`,附 allowlist
- *     ——机器码归 wire、人话归壳/web);集内 ⇒ 用户主动切换赢。allowlist 为空(无 ruling / 该 principal
- *     三层皆无指派 / caps 面故障)⇒ 无治理约束,现状放行(与「null 落兜底链」同一语义:分配面未覆盖 =
+ *   - body.scenario 显式给出:不在册 ⇒ typed 400 `scenario_unknown`(调用方的错);allowlist 非空且集外 ⇒ typed 拒绝
+ *     (400 `scenario_not_allowed`,附 allowlist ——机器码归 wire、人话归壳/web);集内 ⇒ 用户主动切换赢。allowlist 为空
+ *     (无 ruling / 该 principal 三层皆无指派 / caps 面故障)⇒ 无治理约束,现状放行(与「null 落兜底链」同一语义:分配面未覆盖 =
  *     不收紧,恒不比没有治理时更宽;caps 故障不把用户锁死在 default——场景切换不是权限放大面,fail-open
  *     到现状,与 workflows 面的 fail-closed 是刻意的 posture 差异,见 runtime-caps-resolver)。
- *   - body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者 ⇒ defaultScenario 现状链。
+ *   - body.scenario 未给:ruling 胜者 ⇒ 指派为默认;无胜者 ⇒ defaultScenario 现状链。链上的名字不在册 ⇒ 503
+ *     `state.scenario_assignment_unknown`(部署的错 / 中心的错,不是调用方的错),**不**折 default
+ *     ({@link danglingScenarioRefusal})。`principal` 只进那一行运维日志,不参与判定。
  */
-export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger): string;
+export declare function gateScenarioRequest(ruling: ScenarioRuling | undefined, bodyScenario: unknown, defaultScenario: string, known: readonly string[], logger?: Logger, principal?: string): string;
 //# sourceMappingURL=scenarios.d.ts.map

package/dist/capabilities/scenarios.js

@@ -1,5 +1,5 @@
 import { CODE_AGENT_PROMPT, CODE_SYSTEM_PROMPT, DEFAULT_SYSTEM_PROMPT, WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
-import { HttpError } from "../security.js";
+import { HttpError, createCodedHttpError } from "../security.js";
 import { createSubagentExtraTools, nowTool } from "./builtin-tools.js";
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { createCouncilTool, clampRounds } from "./code-review-council.js";
@@ -120,8 +120,12 @@ export function buildScenarios(deps) {
     };
 }
 export function selectScenario(scenarios, name) {
-    const resolved = name;
-    return (resolved && Object.hasOwn(scenarios, resolved) && scenarios[resolved]) || scenarios.default;
+    if (name === undefined)
+        return scenarios.default;
+    const picked = Object.hasOwn(scenarios, name) ? scenarios[name] : undefined;
+    if (picked === undefined)
+        throw new Error(`scenario "${name}" is not registered — resolve a request's scenario through gateScenarioRequest, which only returns registered names`);
+    return picked;
 }
 function availabilityFields(deps, toolset) {
     const verdict = scenarioAvailability(deps, toolset);
@@ -295,11 +299,28 @@ export function mergeUserSkills(scenarioSkills, userSkills, logger) {
         logger?.warn("user_skills_dropped", { reason: "name reserved by scenario (or duplicate)", names: dropped });
     return out;
 }
-export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known, logger) {
+function registeredScenariosClause(known) {
+    return `this deployment's scenarios are: ${known.join(", ")}`;
+}
+export function danglingScenarioRefusal(name, source, known) {
+    if (known.includes(name))
+        return undefined;
+    switch (source) {
+        case "ruling":
+            return `the scenario assigned to this principal, "${name}", is not a scenario of this deployment — ${registeredScenariosClause(known)}; nothing ran — re-point the assignment (or add that scenario to this deployment) and retry`;
+        case "deployment":
+            return `DEFAULT_SCENARIO "${name}" does not name a scenario of this deployment — ${registeredScenariosClause(known)}; set DEFAULT_SCENARIO to one of them`;
+        default: {
+            const unhandled = source;
+            return unhandled;
+        }
+    }
+}
+export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known, logger, principal) {
     if (typeof bodyScenario === "string") {
         const requested = bodyScenario;
         if (!known.includes(requested)) {
-            throw new HttpError(400, `unknown scenario "${bodyScenario}" — this deployment's scenarios are: ${known.join(", ")}`, {
+            throw new HttpError(400, `unknown scenario "${bodyScenario}" — ${registeredScenariosClause(known)}`, {
                 code: "scenario_unknown",
                 extra: { known: [...known] },
             });
@@ -313,6 +334,12 @@ export function gateScenarioRequest(ruling, bodyScenario, defaultScenario, known
         }
         return requested;
     }
-    return ruling?.scenario ?? defaultScenario;
+    const [name, source] = ruling?.scenario != null ? [ruling.scenario, "ruling"] : [defaultScenario, "deployment"];
+    const refusal = danglingScenarioRefusal(name, source, known);
+    if (refusal !== undefined) {
+        logger?.warn("scenario_assignment_unknown", { scenario: name, source, ...(principal !== undefined ? { principal } : {}) });
+        throw createCodedHttpError(503, "state.scenario_assignment_unknown", refusal, { detail: { scenario: name, source } });
+    }
+    return name;
 }
 //# sourceMappingURL=scenarios.js.map

package/dist/config-catalog.js

@@ -104,7 +104,7 @@ export const CONFIG_CATALOG = [
     r("CROSS_SESSION_INBOUND", "approval", "enum", "入站跨会话消息的部署/组织层治理(CC settings 键名 crossSessionInbound 的 managed 层;未设=本层不表态≠ next-turn;词表外拒启)", { danger: SEC, enumValues: [...CROSS_SESSION_INBOUND_SETTINGS], configKey: "crossSessionInbound", derivedDefaultNote: "缺席 ⇒ managed 层不设,由其余层与 mode-parity 决定", resolve: (c) => c.crossSessionInbound ?? null }),
     r("DB_BACKEND", "store", "enum", "store 后端引擎选择(mysql 兼容/pg/本机文件店/纯内存)", { enumValues: STORE_BACKENDS, danger: DATA, derivedDefaultNote: "裸 boot ⇒ local(多租户裸 boot ⇒ memory + notice);有 SQL 信号 ⇒ mysql", configKey: "dbBackend", resolve: (c) => c.dbBackend }),
     r("DB_QUERY_TIMEOUT_MS", "store", "number", "per-query DB 超时(ms;坏值回默认姿态+warn,绝不 NaN 进 driver)", { derivedDefaultNote: "缺席 ⇒ 池级不设/计数族 30s(按引擎)", configKey: "dbQueryTimeoutMs" }),
-    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回)", { staticDefault: "code", configKey: "defaultScenario" }),
+    r("DEFAULT_SCENARIO", "integrations", "string", "出厂缺省场景(编码产品出厂态;通用中性 persona 用 default 显式选回);必须是本部署在册的场景名(内建 ∪ 配置中心声明的),不在册 ⇒ 拒启", { staticDefault: "code", configKey: "defaultScenario" }),
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
     r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
     r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
@@ -411,7 +411,7 @@ export const CONFIG_CATALOG = [
     r("SERVICE_AUTH_TOKEN", "auth", "secret", "共享 service token(写面门;缺席且未开 ALLOW_UNAUTHED_WRITES ⇒ 拒提交)", { danger: SEC }),
     r("SERVICE_AUTH_TOKENS", "auth", "secret", "per-system 凭据表(tok=system CSV;source 从凭据派生,绝不自报)", { danger: SEC }),
     r("SESSION_AUTO_TITLE", "orchestration", "boolean", "首次提交自动铸 session 标题(一次 cheap 调用)", { staticDefault: "true", danger: BILL, configKey: "sessionAutoTitle" }),
-    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=探到 DB 用 DB,探不到回内存;回显=boot 解析后的真引擎)", { enumValues: SESSION_BACKENDS, danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
+    r("SESSION_BACKEND", "store", "enum", "session 店引擎(auto=配了该引擎的坐标就用那只库、没配就是内存;配了而此刻连不上 ⇒ 在 STORE_LOCK_WAIT_MS 窗内重试、到窗拒启,绝不落内存;回显=boot 解析后的真引擎)", { enumValues: SESSION_BACKENDS, danger: DATA, derivedDefaultNote: "缺席:显式 DB_BACKEND=mysql|pg ⇒ mysql,否则 memory", configKey: "sessionBackend", resolve: (c) => (c.sessionBackend === "tidb" ? "mysql" : c.sessionBackend) }),
     r("SESSION_CACHE_TTL_SEC", "store", "number", "session 读缓存 TTL(秒;0=关)", { staticDefault: "300", configKey: "sessionCacheTtlSec" }),
     r("SESSION_EVENTS_HOT_MS", "limitsHttp", "number", "session SSE 订阅热探针间隔(ms)", { derivedDefaultNote: "缺席 ⇒ 200" }),
     r("SESSION_EVENTS_MAX_CONNS", "limitsHttp", "number", "session SSE 并发连接帽", { derivedDefaultNote: "缺席 ⇒ 256" }),
@@ -431,7 +431,7 @@ export const CONFIG_CATALOG = [
     r("SSH_PORT", "orchestration", "number", "ssh 端口", { derivedDefaultNote: "缺席 ⇒ 22" }),
     r("SSH_PRIVATE_KEY", "orchestration", "secret", "ssh 私钥(adapter 持有,绝不进 workspace)", { danger: SEC }),
     r("SSH_USER", "orchestration", "string", "ssh 用户(必需件)"),
-    r("STORE_LOCK_WAIT_MS", "store", "number", "local 数据根 LOCK 撞上活持锁人时的有界等待窗(ms;0=当场拒;到窗仍拿不到 ⇒ 原码拒启,永不放行第二个写者)", { staticDefault: "60000", danger: DATA, configKey: "storeLockWaitMs" }),
+    r("STORE_LOCK_WAIT_MS", "store", "number", "store 启动期的有界等待窗(ms):local 数据根 LOCK 撞上活持锁人,或已配置的 SQL 库此刻连不上 / 建表失败;0=当场拒;到窗仍开不了 ⇒ 拒启(local 保持原码,永不放行第二个写者;SQL 点名后端与 host:port,永不退成内存)", { staticDefault: "60000", danger: DATA, configKey: "storeLockWaitMs" }),
     r("STORE_PROBE_INTERVAL_MS", "store", "number", "/health 活体 store 后台探针间隔(ms;0=显式关;仅 SQL 后端挂环)", { staticDefault: "15000", configKey: "storeProbeIntervalMs" }),
     r("STREAM_APPROVAL_ADHOC_GRACE_MS", "approval", "number", "流内审批 adhoc 腿窗后宽限(ms;须 window+grace < orphanTtl,破坏形拒启)", { staticDefault: "60000" }),
     r("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "approval", "number", "流内审批 per-owner 未决帽", { staticDefault: "256" }),

package/dist/config.d.ts

@@ -297,10 +297,10 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *   - 退役名(`bash`/`Task`/`KillShell`…)与 pre-prefix 短名(`figma__x`):S-1047(core 7.41.0 #1156)起判据是 core 导出的
  *     **那一只** `judgeRuleToolName`(准备阶段、两只会话规则店、本仓会话规则写口同调),本函数零手写臂;指引 = core 表给的现役指引 /
  *     补全协议前缀。
- *   - 够不着挂载工具的协议名:缺段(`mcp__`、`mcp__srv__`、`mcp____x`)与**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、
- *     超长 / 归一后带连串下划线的服务器段;服务器段带通配的 `mcp__*` 单列判词 `wildcard_peer`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。
- *     判官与句子是 `namespaced-rule-name.ts` 的那**一只**(判据 = core `mintNamespacePrefix` 的自铸对照;会话规则写口两腿与 SQL 店写口同调),
- *     本文件零手写臂。修前(7.116.0 之前)这里只有缺段一臂外加一条只排 `*` 的特例(`coversAServer`),对端段带点号 / 超长的覆盖形在每个面都照收。
+ *   - 够不着挂载工具的协议名:**对端段铸不出**(`mcp__github.com`、`mcp__github.com__*`、`mcp__*`、超长 / 归一后带连串下划线的服务器段、对端段为空的
+ *     `mcp__` / `mcp____x`)—— 前缀对,但引擎铸注册名时归一对端段,而规则对对端段逐字比,永不匹配。判官是引擎的 `judgeRuleToolName`(core 7.43.0 #1355 (b)
+ *     的判词 `unmintable_segment`,句子带它的 guidance 与 1:1 现名);本仓 7.116.0–7.117.x 那只自比 `mintNamespacePrefix` 的对照随之退役。
+ *     引擎判官放行、却一只工具都够不着的一形 —— **工具段为空**(`mcp__srv__`)—— 由本仓判(`namespaced-rule-name.ts`,会话规则写口两腿与 SQL 店写口同调)。
  *     ⚠️ 两段覆盖形 `mcp__<server>`(服务器段是自铸形)够得着(S-1047 收掉的分叉,见下)。
  *   - **core 的文法编不出来的串**(名字里带反斜杠、单条 >512 字符、空串):判词取自 core 自己的
  *     `validatePermissionRules`,见 {@link uncompilableRuleGuidance}。[ref]①([ref])补齐 ——
@@ -338,23 +338,19 @@ export interface UnmatchableToolName {
  *  · `"rule-policy"` —— 消费者是 core 的**规则编译器**(`createPermissionRulePolicy`):`settings.permissions.deny` / `.ask`
  *    (S-177 / core 7.9.0 起)。引擎**真的按内容匹配** deny / ask 的内容形(`Bash(rm -r:*)` / `Edit(~/.sema/**)`),所以本仓不许再替它拒 ——
  *    判据整条交回 core 的 `validatePermissionRules`,按这张表自己的 behavior 问。core 7.42.0 起策略只说 deny / ask(allow 表不再是本消费者)。
- *  · `"allow-layer"` —— 消费者是引擎的 **allow 层**(`TaskSpec.allowedTools`):`settings.permissions.allow`(7.117.0 起)。本仓**只判名字**
- *    (退役名 / 无前缀短名 / 协议名够不着挂载工具 —— 与另两张桶同一只判、同一句),**不判内容**:条目的文法、匹配、读成空都归引擎
- *    (读成空的引擎在开跑时通告)。没有 behavior 一问(引擎的 allow 层不经规则编译器)。
- *    翻转条件:引擎的 allow 层对非现行名也出通告(core 7.43.0 起在条目编译拿到工具名册时给「不是工具名 / 近似名」这类原因)—— 提到那一版、
- *    并把名册交给条目编译之后,本消费者的名字判退役(allow 侧整只交引擎)。
+ * (7.117.0 有过第三种 `"allow-layer"` —— 请求的 `settings.permissions.allow` 只判名字。7.118.0 / core 7.43.0 #1358 起引擎的 allow 层自己按名册读条目名并通告
+ *  (`permission.allowed_tool_not_granted`,`reason: "tool_name"` / `near_miss`)⇒ 本仓的名字判退役,allow 侧整只交引擎,只剩引擎读不到的那一形在
+ *  `task-settings.ts` 经 `rule-entry-list.ts` 拒。)
  */
-export type RuleEntryConsumer = "tool-name-table" | "rule-policy" | "allow-layer";
+export type RuleEntryConsumer = "tool-name-table" | "rule-policy";
 /**
  * {@link unmatchableToolNamesRefusal} 的判据入参:这张表喂给谁(名表 / 规则编译器 / allow 层);前两种按哪种态度问 core 的文法、路径基 ——
  * allow 层没有文法一问(见 {@link RuleEntryConsumer}),型上就不带这两位。
  */
 export type UnmatchableToolNameJudgment = {
-    readonly consumer: "tool-name-table" | "rule-policy";
+    readonly consumer: RuleEntryConsumer;
     readonly behavior: PermissionRule["behavior"];
     readonly pathBases?: PathRuleBases;
-} | {
-    readonly consumer: "allow-layer";
 };
 /**
  * 「这张表里有永远不会生效的条目」的**判据与拒因句,同一只函数**(返回 `undefined` = 通过;拒 ⇒ 句子 + 被点名的条目)。
@@ -372,13 +368,13 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
 } | undefined;
 /**
  * 运维 allow 表 `APPROVAL_GRANT` 的**拒启判据与拒因句**(同一只函数;`config-invariants.ts` 的 `…Refusal` 形:返回句子 = 拒,`undefined` = 通过)。
- * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据改成**引擎的读法**,与请求的两张
+ * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张
  * allow 表同一份(`rule-entry-list.ts`):
  *  ① 值不是字符串表 ⇒ 拒(env 的 CSV 恒给字符串表;判在这里是为了「值一旦换了来源,第一道判仍在」);
- *  ② 协议名对端段铸不出 / 缺段 / 对端段写通配 ⇒ 拒(与技能清单、请求 allow 桶同一只函数);
- *  ③ 引擎读成空的条目(`compileAllowList(names, "allow").inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字)⇒ 拒,
- *     句子点名条目、引擎给的原因词、该怎么写。请求的 allow 侧对 ③ 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,
- *     而引擎在 Runner 构造期对读成空的部署条目只发一条无会话的通告。
+ *  ② 引擎读不到的那一形(工具段为空的协议名)⇒ 拒(与技能清单、请求 allow 桶同一只函数);
+ *  ③ 引擎读成空的条目(`compileAllowList(names, "allow", 名册 = 空集).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
+ *     core 7.43.0 起条目名过引擎判官读成 `tool_name` 的退役名 / 无前缀短名 / 对端段铸不出)⇒ 拒,句子点名条目、引擎给的原因词(名字层带判词与现名)、
+ *     该怎么写。请求的 allow 侧对 ③ 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,而引擎对读成空的部署条目只在每一跑发一条通告。
  * 文法随引擎:工具名、协议名覆盖形、`Bash(...)` 命令规则、`Read(//dir/**)` 读目录都收(内容形里带逗号的写不进 CSV —— 这张表的分隔符就是逗号)。
  */
 export declare function approvalGrantRefusal(names: unknown): string | undefined;

package/dist/config.js

@@ -18,12 +18,12 @@ import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-post
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { describeUnreachableNamespacedRuleName, ruleEntryToolName, unreachableNamespacedRuleNameOf } from "./namespaced-rule-name.js";
+import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeInertRuleEntries, describeRetiredRuleEntry, describeUnreachableRuleEntry, inertRuleEntriesOf, retiredRuleEntryOf, ruleEntryListShapeOk, unreachableRuleEntryOf } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, describeInertRuleEntries, emptyToolSegmentEntryOf, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
@@ -842,13 +842,13 @@ function buildUnusedCoordinatesRefusal(keys, auto) {
     const engine = keys.length === 1 ? (keys[0] === "PG_HOST" ? "pg" : "mysql") : "mysql|pg";
     const probedHostKey = auto?.autoProbes === "pg" ? "PG_HOST" : "MYSQL_HOST";
     const why = auto !== undefined
-        ? `SESSION_BACKEND=auto probes the ${auto.autoProbes} engine (DB_BACKEND ${process.env.DB_BACKEND ? "names it" : "unset ⇒ mysql"}), whose host key ${probedHostKey} is not set`
+        ? `SESSION_BACKEND=auto follows the ${auto.autoProbes} engine (DB_BACKEND ${process.env.DB_BACKEND ? "names it" : "unset ⇒ mysql"}), whose host key ${probedHostKey} is not set`
         : "no durable session store is selected (neither DB_BACKEND=mysql|pg nor SESSION_BACKEND=mysql|auto), so the store would run IN MEMORY";
     return (`${keys.join(" and ")} ${keys.length === 1 ? "is" : "are"} set but the current configuration never uses ${keys.length === 1 ? "it" : "them"}: ${why}. ` +
         `Refusing to boot rather than running in memory silently. ` +
         `To persist: DB_BACKEND=${engine} (or SESSION_BACKEND=mysql for the MySQL-protocol engine); ` +
         `to run in memory: remove the coordinates, or set DB_BACKEND=memory; ` +
-        `for best effort (persist while the store is reachable, memory otherwise): SESSION_BACKEND=auto with the engine pointed right (DB_BACKEND=pg with PG_HOST, DB_BACKEND=mysql with MYSQL_HOST).`);
+        `SESSION_BACKEND=auto persists exactly when the engine's coordinates are configured (DB_BACKEND=pg with PG_HOST, DB_BACKEND=mysql with MYSQL_HOST) — and then refuses to boot, rather than falling back to memory, while the store is unreachable.`);
 }
 function parseStoreDomain(ctx) {
     const { requirePrincipal } = ctx;
@@ -1243,29 +1243,21 @@ function findUnmatchableToolNames(names, opts) {
             }
         }
         const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
-        const verdict = judgeRuleToolName(subject, NO_DECLARED_TOOL_NAMES);
-        if (verdict.kind === "retired") {
-            out.push({ name, guidance: verdict.guidance });
+        const verdict = unmatchableRuleNameOf(subject);
+        if (verdict?.kind === "retired") {
+            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
             continue;
         }
-        if (opts.consumer !== "allow-layer") {
-            const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
-            if (uncompilable !== undefined) {
-                out.push({ name, guidance: uncompilable });
-                continue;
-            }
-        }
-        if (verdict.kind === "unprefixed_namespace") {
-            out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
+        const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
+        if (uncompilable !== undefined) {
+            out.push({ name, guidance: uncompilable });
             continue;
         }
-        const unreachable = unreachableNamespacedRuleNameOf(subject);
-        if (unreachable !== undefined)
-            out.push({ name, guidance: describeUnreachableNamespacedRuleName(unreachable) });
+        if (verdict !== undefined)
+            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
     }
     return out;
 }
-const NO_DECLARED_TOOL_NAMES = new Set();
 export function unmatchableToolNamesRefusal(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)
@@ -1282,12 +1274,9 @@ export function approvalGrantRefusal(names) {
     const over = allowLayerEntryCountIssue(APPROVAL_GRANT_ENV, names);
     if (over !== undefined)
         return `${over.message} — refusing to start rather than running with a truncated list`;
-    const retired = retiredRuleEntryOf(names);
-    if (retired !== undefined)
-        return `${describeRetiredRuleEntry(APPROVAL_GRANT_ENV, retired)} — refusing to start rather than running without it`;
-    const unreachable = unreachableRuleEntryOf(names);
-    if (unreachable !== undefined)
-        return `${describeUnreachableRuleEntry(APPROVAL_GRANT_ENV, unreachable)} — refusing to start rather than running without it`;
+    const empty = emptyToolSegmentEntryOf(names);
+    if (empty !== undefined)
+        return `${describeEmptyToolSegmentEntry(APPROVAL_GRANT_ENV, empty)} — refusing to start rather than running without it`;
     const inert = inertRuleEntriesOf(names, "allow");
     if (inert.length > 0)
         return `${describeInertRuleEntries(APPROVAL_GRANT_ENV, inert)} — the engine would grant nothing for ${inert.length === 1 ? "it" : "them"}; refusing to start rather than running with an allow rule that never takes effect`;

package/dist/deployment-governance.d.ts

@@ -1,5 +1,5 @@
 import { FileError, StubExecutionEnv, type ExecutionEnv, type Result, type ToolPolicy } from "@sema-agent/core";
-import { type DurableAskOptions } from "./approval.js";
+import { type DeploymentListExemption } from "./approval.js";
 import type { ServiceConfig } from "./config.js";
 import type { applyRuntimeGovernance } from "./runtime-governance.js";
 /** `applyRuntimeGovernance` 的 governance 实参 —— 从折叠属主的签名位**推导**,不复制形状
@@ -92,12 +92,10 @@ export interface DurableApprovalSeat {
     readonly kind: "durable";
     /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
     readonly question: LiveQuestionFace | undefined;
-    /** 每会话「本会话不再询问」探针(canonical toolName 键空间)。 */
-    readonly exempt?: DurableAskOptions["exempt"];
-    /** 豁免短路时的审计钩子。 */
-    readonly onExempted?: DurableAskOptions["onExempted"];
+    /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createDeploymentListExemption`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
+    readonly exemption?: DeploymentListExemption;
 }
-/** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店)。 */
+/** live 席:Runner 的活 onAsk 当场服 ask(无 park、无会话豁免店:run-local 一次性腿)。 */
 export interface LiveApprovalSeat {
     readonly kind: "live";
 }
@@ -268,7 +266,7 @@ export declare function buildApprovalGrantNotice(config: {
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
  * 三形,按席穷举(S-694,席的定义见 {@link ApprovalSeat}):
- *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/会话豁免全在
+ *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
  *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
  *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
  *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。

package/dist/deployment-governance.js

@@ -126,9 +126,9 @@ export function buildApprovalGrantNotice(config) {
 export function createApprovalBaselinePolicy(config, seat) {
     switch (seat.kind) {
         case "durable":
-            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat));
+            return combinePolicies(createDurableQuestionGate(seat.question), createApprovalListPolicy(config, seat.exemption));
         case "live":
-            return createApprovalListPolicy(config, {});
+            return createApprovalListPolicy(config, undefined);
         case "absent":
             if (hasApprovalListIntent(config)) {
                 throw new Error("approval baseline: this leg has no approval seat (nobody can answer an ask), yet an approval list is in force " +
@@ -142,14 +142,13 @@ export function createApprovalBaselinePolicy(config, seat) {
         }
     }
 }
-function createApprovalListPolicy(config, memory) {
+function createApprovalListPolicy(config, exemption) {
     return createDurableAskPolicy({
         requireApproval: config.approvalRequire,
         deny: config.approvalDeny,
         autoBudget: config.approvalAutoBudget,
         neverAuto: config.approvalNeverAuto,
-        ...(memory.exempt ? { exempt: memory.exempt } : {}),
-        ...(memory.onExempted ? { onExempted: memory.onExempted } : {}),
+        ...(exemption !== undefined ? { exemption } : {}),
     });
 }
 //# sourceMappingURL=deployment-governance.js.map