@sema-agent/server 7.118.0 → 7.119.0

package/dist/http/routes/runs.js

@@ -1,7 +1,7 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventForRead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { RUN_HOLDER_DEATH_CODES, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -15,14 +15,14 @@ import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
-import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
+import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
 import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { readTurnActivityMs } from "../../turn-activity.js";
 import { mintCancelledResult } from "../../run-cancel-context.js";
-import { userInputLaneOf } from "../../user-input-ledger.js";
+import { acceptedInputKindOf } from "../../user-input-ledger.js";
 import { INJECTION_TIERS } from "../../trace/injection-tier.js";
 import { buildCrossSliceUsage, readResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
@@ -150,8 +150,9 @@ function sendSteerReplayRefusal(res, refusal) {
 async function acceptLiveUserInput(deps, res, at) {
     if (!deps.userInputLedger)
         return undefined;
+    const input = acceptedInputKindOf(at.tier);
     try {
-        return await deps.userInputLedger.accept({ input: userInputLaneOf(at.tier), messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+        return await deps.userInputLedger.accept({ input, messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
     }
     catch (e) {
         deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
@@ -1372,6 +1373,11 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const parsedBody = AskDecisionBodySchema.safeParse(rawBody);
         if (!parsedBody.success) {
+            const retired = retiredDecisionKeyFacts(rawBody);
+            if (retired !== undefined) {
+                sendError(res, 400, "request.body_shape", retired.error, retired.extra);
+                return;
+            }
             sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / decidedBy");
             return;
         }
@@ -1517,7 +1523,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendTerminal(row0);
             return;
         }
-        if (policyCannotAllow(decidedBy, body.decision === "approve", storedCardDemandsAPerson(row0.cardJson))) {
+        if (body.decision === "approve" && policyCannotAnswer(heldAskOf(storedCardDemandsAPerson(row0.cardJson)), decidedBy)) {
             sendError(res, 400, "request.field_conflict", POLICY_CANNOT_ALLOW_PERSON_ASK);
             return;
         }

package/dist/http/routes/sessions.js

@@ -1,7 +1,7 @@
-import { materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
+import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
 import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
-import { windowMessages, truncateMessageBlobs } from "../../audit.js";
+import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
@@ -596,9 +596,13 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "the session audit view requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const audit = await readOwnedSessionView(auditFact.sessionAudit, match.params.sessionId);
-            if (audit === undefined)
+            const owned = await readOwnedSessionView(auditFact.sessionAudit, match.params.sessionId);
+            if (owned === undefined)
                 return;
+            if (!Array.isArray(owned.messages)) {
+                throw new SessionError("corrupt_session", `session ${match.params.sessionId} is unreadable: its archive projection carries "messages" as ${owned.messages === null ? "null" : typeof owned.messages}, not an array`);
+            }
+            const ownedMessages = owned.messages;
             const q = new URLSearchParams(match.search);
             const qi = (k) => {
                 const v = q.get(k);
@@ -609,12 +613,12 @@ export async function handleSessions(req, res, match, ctx) {
             };
             const msgIndex = qi("message");
             if (msgIndex !== undefined) {
-                const messages = audit.messages;
-                if (msgIndex >= messages.length) {
-                    sendError(res, 404, "not_found.message_index", "message index out of range", { total: messages.length });
+                if (msgIndex >= ownedMessages.length) {
+                    sendError(res, 404, "not_found.message_index", "message index out of range", { total: ownedMessages.length });
                     return;
                 }
-                sendJson(res, 200, { sessionId: audit.sessionId, floorEntryId: audit.floorEntryId, index: msgIndex, message: messages[msgIndex] });
+                const one = redactSessionViewForRead({ ...owned, messages: [ownedMessages[msgIndex]] });
+                sendJson(res, 200, { sessionId: owned.sessionId, floorEntryId: owned.floorEntryId, index: msgIndex, message: one.messages[0] });
                 return;
             }
             const tail = qi("tail");
@@ -631,19 +635,19 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const undrainedKey = undrained !== undefined ? { userInputUndrained: undrained } : {};
             if (tail === undefined && before === undefined && blobCap === undefined) {
-                sendJson(res, 200, { ...audit, ...undrainedKey });
+                sendJson(res, 200, { ...redactSessionViewForRead(owned), ...undrainedKey });
                 return;
             }
-            let messages = audit.messages;
+            let selected = ownedMessages;
             let window;
             if (tail !== undefined || before !== undefined) {
-                const w = windowMessages(messages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
-                messages = w.messages;
+                const w = windowMessages(ownedMessages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
+                selected = w.messages;
                 window = w.window;
             }
-            if (blobCap !== undefined && blobCap > 0)
-                messages = truncateMessageBlobs(messages, blobCap);
-            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}), ...undrainedKey });
+            const view = redactSessionViewForRead({ ...owned, messages: selected });
+            const messages = blobCap !== undefined && blobCap > 0 ? truncateMessageBlobs(view.messages, blobCap) : view.messages;
+            sendJson(res, 200, { ...view, messages, ...(window ? { window } : {}), ...undrainedKey });
             return;
         }
     }
@@ -756,7 +760,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             if (owner === null) {
-                sendError(res, 409, "conflict.session_ownerless", "session policy requires an owned session (set REQUIRE_PRINCIPAL / attach a principal); this session is ownerless");
+                sendError(res, 409, "conflict.session_ownerless", "this session has no recorded owner, so its rules can be neither read nor changed through this route; rules already stored for it keep applying to the runs of the principal they were stored under. Ways out: on the local backend, during the upgrade window, the first task submitted with a principal on a session written by an earlier version claims it for that principal (this route then serves its owner); or delete the session (DELETE /v1/sessions/:id), which removes its rules with it");
                 return;
             }
             const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);

package/dist/http/wire-types.d.ts

@@ -6,8 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, SkillSpec } from "@sema-agent/core";
-import type { SettingsPermissionMode } from "../task-settings.js";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec } from "@sema-agent/core";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -17,7 +16,9 @@ export interface TaskRequestBody {
      *  table — e.g. "default"/"code-review"/"scan"/"discuss"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
      *  `scenario_unknown`, a known-but-not-allowed one a typed 400 `scenario_not_allowed`; absent ⇒ the ruling's
-     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`).
+     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`). A name
+     *  on that default chain this deployment does not have is NEVER folded to `default`: an assigned one is a typed 503
+     *  `state.scenario_assignment_unknown`, a dangling `DEFAULT_SCENARIO` refuses to boot.
      *  ⚠️ scenario-SPECIFIC keys (`repo`/`lenses`/`rounds`, read through `ScenarioRequest`'s index signature) are
      *  deliberately NOT declared here — they belong to one scenario each, not to the shared submit surface. */
     scenario?: string;
@@ -333,18 +334,16 @@ export interface TaskRequestBody {
     toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
      *  the RAW mode (axis-agnostic, no client-side interpretation); the SERVICE interprets it tighten-only vs the
-     *  deployment baseline. Post-[ref] all FIVE modes are honored as gate-SHAPE choices (`plan` ⇒ read-only hands +
-     *  `present_plan`; `acceptEdits`/`bypassPermissions`/`auto` select how much the mode-derived fs-write ask gate
-     *  asks — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins; the old "LOOSEN →
-     *  coerced to default" note was pre-[ref] doc-rot). Folds onto the SAME tighten-only governance as
-     *  `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
+     *  deployment baseline. All SIX core modes are honored (`plan` ⇒ read-only hands + `present_plan`;
+     *  `acceptEdits` selects how much the mode-derived fs-write ask gate asks; `bypassPermissions`/`auto`/`dontAsk` ride the
+     *  engine's own mode table verbatim — `dontAsk` refuses every ask by the mode, zero cards, the gate records
+     *  `deniedBy:"mode"`) — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins). Folds onto the SAME
+     *  tighten-only governance as `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
      *  [ref]-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
      *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
-     *  (coercePermissionMode). */
-    /**  🔴 型**从值表派生**(S-496 U1 / [ref]):闭集的属主是 `task-settings.ts` 的
-     *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
-     *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
-    permissionMode?: SettingsPermissionMode;
+     *  (coercePermissionMode).
+     *  🔴 型与闭集的属主是 core 的 `PermissionMode` / `PERMISSION_MODES`(受理腿 `isPermissionMode` 与三句 400 文案同读那一份)—— 本仓不持词表。 */
+    permissionMode?: PermissionMode;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries

package/dist/images/manifest.d.ts

@@ -6,7 +6,13 @@
  * one-time seed and the P3 atomic-publish pipeline — kept side-effect-free so it is unit-tested without a DB.
  */
 import type { ImageIndexUpsert, ImageNestedBuildMode, ImageStatus } from "../plugins/store-contracts.js";
-/** Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract). */
+/**
+ * Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract).
+ *
+ * 声明型 = 闭集词 | `true`(老写法的裸布尔,含义 = `rootless-buildkit`)| `false` / 缺席(= `none`)。**其余一律抛** —— 修前「未知的非空词」
+ * 被上调成 `rootless-buildkit`(一条没人声明过的 nested-build 能力写进 index),运行期的非声明型真值(数字 / 对象 …)走 `v ? … : …` 同样被上调。
+ * 抛出的句子沿用该面既有的拒法:`done` 帧的 auto-register 把它收成「built-but-unregistered」终局 FAILED,错误句带这一句(见 `http/routes/images.ts`)。
+ */
 export declare function nestedBuildModeOf(v: string | boolean | undefined): ImageNestedBuildMode;
 /** The fields of build.sh's `sandbox-manifest.json` this projection reads (a superset is fine; extras ignored). */
 export interface BuildManifest {

package/dist/images/manifest.js

@@ -1,18 +1,19 @@
-const NESTED_BUILD_MODES = [
-    "none",
-    "docker-cli-only",
-    "rootless-buildkit",
-    "privileged-dind",
-];
+const NESTED_BUILD_MODE_WORDS = {
+    none: true,
+    "docker-cli-only": true,
+    "rootless-buildkit": true,
+    "privileged-dind": true,
+};
+const isNestedBuildMode = (v) => Object.prototype.hasOwnProperty.call(NESTED_BUILD_MODE_WORDS, v);
 export function nestedBuildModeOf(v) {
-    if (typeof v === "string") {
-        return NESTED_BUILD_MODES.includes(v)
-            ? v
-            : v
-                ? "rootless-buildkit"
-                : "none";
-    }
-    return v ? "rootless-buildkit" : "none";
+    if (v === undefined || v === false)
+        return "none";
+    if (v === true)
+        return "rootless-buildkit";
+    if (typeof v === "string" && isNestedBuildMode(v))
+        return v;
+    const got = typeof v === "string" ? `the string ${JSON.stringify(v.slice(0, 64))}` : v === null ? "null" : Array.isArray(v) ? "an array" : `type ${typeof v}`;
+    throw new Error(`manifest capabilities.nestedBuild must be one of ${Object.keys(NESTED_BUILD_MODE_WORDS).join(" | ")} (or a bare boolean); got ${got}`);
 }
 export function shmToMB(v) {
     if (!v)
@@ -32,11 +33,12 @@ export function profileFromManifest(m) {
 export function manifestToIndexEntry(m, opts) {
     const profile = profileFromManifest(m);
     const tag = (m.tag ?? "").includes(":") ? (m.tag ?? "").split(":")[1] : (m.tag ?? "");
+    const nestedBuildMode = nestedBuildModeOf(m.capabilities?.nestedBuild);
     const capabilities = {
         browser: !!m.capabilities?.browser,
         db: !!m.capabilities?.db,
-        nestedBuild: !!m.capabilities?.nestedBuild,
-        nestedBuildMode: nestedBuildModeOf(m.capabilities?.nestedBuild),
+        nestedBuild: nestedBuildMode !== "none",
+        nestedBuildMode,
     };
     const pc = m.capabilities?.podContract;
     const devShmMB = shmToMB(pc?.devShm);

package/dist/memory-store-refusal.d.ts

@@ -34,27 +34,22 @@
  * 路径不上 wire,只进这一条运维 warn —— 它是**日志行**不是 wire 错误体,所以铸点跟读法属主住在一起(不住 `http/`:`http/` 全树门
  * `test/error-code-key-gate.test.ts` 咬的是错误体里的 `code:` 键位,日志字段名不该借 wire 层的目录去过它)。
  */
+import { type ScopeHomeForm, type StoreFormRefusalCode } from "@sema-agent/core";
 import type { Logger } from "./observability/logger.js";
-/** core 的两码(`dist/core/memory-engine/layout.js` `TARGET_OUTSIDE_STORE` / `SCOPE_HOME_NOT_DIRECTORY`;core 不在包根导出它们,这两个常量是它们在本仓的唯一写点)。 */
-export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-export declare const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
-/** 店形拒族(闭集;core 加第三码 ⇒ 它落未分类 500 + 运维 warn,由人裁归不归这一族)。 */
-export declare const STORE_FORM_REFUSAL_CODES: readonly ["memory.target_outside_store", "memory.scope_home_not_directory"];
-export type StoreFormRefusalCode = (typeof STORE_FORM_REFUSAL_CODES)[number];
 /** 一次店形拒的读数(纯数据)。`path` / `form` 取自 core 的 `detail`(读不出 ⇒ `undefined`,不猜、不从句子里抠)。 */
-export interface StoreFormRefusal {
+export interface StoreFormRefusalReading {
     readonly code: StoreFormRefusalCode;
     /** core 原句(以码领头;7.44.0 起不含宿主路径)。 */
     readonly message: string;
     /** `detail.path`:落点 / 被改指的根 / 不是目录的 scope home —— **只给运维行**。 */
     readonly path: string | undefined;
-    /** `detail.form`(只在 home 那一码上):原样字符串,不镜像 core 的闭集(本仓只把它写进运维行,不按它分支)。 */
-    readonly form: string | undefined;
+    /** `detail.form`(只在 home 那一码上),经 core 闭集读;本仓只把它写进运维行,不按它分支。 */
+    readonly form: ScopeHomeForm | undefined;
 }
-/** 抛出面:`err` 是店形拒 ⇒ 读数;否则 `undefined`。形 = core 的 `Error` + `.code` + `.detail`。 */
-export declare function storeFormRefusalOf(err: unknown): StoreFormRefusal | undefined;
+/** 抛出面:`err` 是店形拒(core `StoreFormRefusal` 的形:码在族里)⇒ 读数;否则 `undefined`。`detail` 读不全不改判(码定族,`detail` 只供运维行)。 */
+export declare function storeFormRefusalOf(err: unknown): StoreFormRefusalReading | undefined;
 /** 两受众共用的运维行(一处铸点):码 + core `detail` 里的宿主路径与 home 形。`logger` 缺席(只有不接 logger 的测试装配)⇒ 不落。 */
-export declare function logStoreFormRefusal(logger: Pick<Logger, "warn"> | undefined, refusal: StoreFormRefusal): void;
+export declare function logStoreFormRefusal(logger: Pick<Logger, "warn"> | undefined, refusal: StoreFormRefusalReading): void;
 /** 报告面:harvest `incident` 是这一族拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成店形拒)。 */
 export declare function storeFormRefusalInIncident(incident: {
     readonly kind: string;

package/dist/memory-store-refusal.js

@@ -1,7 +1,6 @@
-export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
-export const STORE_FORM_REFUSAL_CODES = [TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY];
-const isStoreFormRefusalCode = (code) => typeof code === "string" && STORE_FORM_REFUSAL_CODES.includes(code);
+import { SCOPE_HOME_FORMS, STORE_FORM_REFUSAL_CODES } from "@sema-agent/core";
+const isStoreFormRefusalCode = (code) => STORE_FORM_REFUSAL_CODES.includes(code);
+const isScopeHomeForm = (form) => SCOPE_HOME_FORMS.includes(form);
 export function storeFormRefusalOf(err) {
     if (!(err instanceof Error))
         return undefined;
@@ -9,7 +8,7 @@ export function storeFormRefusalOf(err) {
     if (!isStoreFormRefusalCode(code))
         return undefined;
     const d = typeof detail === "object" && detail !== null ? detail : {};
-    return { code, message: err.message, path: typeof d.path === "string" ? d.path : undefined, form: typeof d.form === "string" ? d.form : undefined };
+    return { code, message: err.message, path: typeof d.path === "string" ? d.path : undefined, form: isScopeHomeForm(d.form) ? d.form : undefined };
 }
 export function logStoreFormRefusal(logger, refusal) {
     logger?.warn("memory_store_form_refused", {

package/dist/namespaced-rule-name.d.ts

@@ -14,9 +14,10 @@
  *  · 会话规则写口(`session-policy-wire.ts`)与 SQL 会话规则店的写口(`assertSessionRuleNamesReachable`);
  *  · 引擎 allow 层的条目表:请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT`、技能的两只清单 `allowedTools` / `disallowedTools`(顶层 `skills[]` 与子代
  *    `agents[].skills[]` 两处受理口)—— 经 `rule-entry-list.ts` 的 `emptyToolSegmentEntryOf`(本仓这一问;退役名 / 铸不出的判词那一半由引擎 `compileAllowList` 给)。
- * **不调它的面**(如实,未接):`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`、`rules-consent.ts` 与两只持久规则店零判官调用)、子代的工具名表
- * `agents[].allowTools` / `denyTools`(`spec-fields.ts` 只判形与条数)。在这两处写铸不出的服务器段、工具段为空的协议名仍被收下、永不命中。把这些面接上判官 = 另一件事
- * (本版不做,也不在本文件里加特例;`unmatchableRuleNameOf` 就是现成的那一只)。
+ * **不调它的面**:`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`、`rules-consent.ts` 与两只持久规则店零判官调用)—— 如实未接,
+ * 在那里写铸不出的服务器段、工具段为空的协议名仍被收下、永不命中;把它接上判官 = 另一件事(不在本文件里加特例;`unmatchableRuleNameOf` 就是现成的那一只)。
+ * 子代的工具名表 `agents[].allowTools` / `denyTools` 不是本文件的面:core 7.45.0 #1377 / #1385 起名字归引擎在开跑前一只判(三来源同判,`spec-fields.ts`
+ * 受理口只判形与条数),本仓不对它另做对照。
  * **精确名的工具段归一不在这里判**:包根没有导出工具段的铸法,不手抄 —— 精确名的工具段按字面收,本仓每张表上都不判它。
  *
  * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表与技能清单同读)。

package/dist/observability/fail-open.d.ts

@@ -356,7 +356,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.session-repo.corrupt-record-skipped": {
         readonly cls: "F";
-        readonly note: "S-990(`plugins/store-backend.ts` 的 `FileSessionRepo` 座,local 车道的会话存档):一份会话存档里有记录读不出(整行毁 / 半截 JSON / 形不对,core 记成 `kind:\"record\"` 逐条披露)或存档文件 / 目录整体读不出(`kind:\"file\"`)⇒ core 的成文处置是跳过 + 披露,会话照常打开、列表少一行。最坏后果 = 模型读到的历史少了一截 / 列表静默少一份会话 —— 都是**可用性**损失,不开任何门;发起这一轮的人另有 wire 面披露(打开自己存档时的 `engine_notice` 码 `session.records_skipped`,与本 tag 无关、不动)⇒ F。**计数单位 = 一条被跳过的记录 = 一次命中**(`replay` 级是同一批记录的汇总,不计,S-616 同教训);**每命中一行探针**(`SEMA_FAILOPEN_PROBE`)带 `path` / `sessionId` / `line` / `form` / `reason` 逐条明细 —— 运维要看「哪份存档的哪一行坏了」读探针,不读本条 warn:本条是每进程每 tag 一次的告警(`detail` 是首条明细,不是全部)。修前:每命中一行 warn,一份 113 行坏记录的存档做一次列表 + 一次查看打出 342 行,存档没修好每读再发。";
+        readonly note: "S-990(`plugins/local-session-store.ts` `createLocalSessionRepo` 的 `FileSessionRepo` 座,local 车道的会话存档;`LocalSessionStore` 与会话视图口 `audit.ts` 共用,S-879):一份会话存档里有记录读不出(整行毁 / 半截 JSON / 形不对,core 记成 `kind:\"record\"` 逐条披露)或存档文件 / 目录整体读不出(`kind:\"file\"`)⇒ core 的成文处置是跳过 + 披露,会话照常打开、列表少一行。最坏后果 = 模型读到的历史少了一截 / 列表静默少一份会话 —— 都是**可用性**损失,不开任何门;发起这一轮的人另有 wire 面披露(打开自己存档时的 `engine_notice` 码 `session.records_skipped`,与本 tag 无关、不动)⇒ F。**计数单位 = 一条被跳过的记录 = 一次命中**(`replay` 级是同一批记录的汇总,不计,S-616 同教训);**每命中一行探针**(`SEMA_FAILOPEN_PROBE`)带 `path` / `sessionId` / `line` / `form` / `reason` 逐条明细 —— 运维要看「哪份存档的哪一行坏了」读探针,不读本条 warn:本条是每进程每 tag 一次的告警(`detail` 是首条明细,不是全部)。修前:每命中一行 warn,一份 113 行坏记录的存档做一次列表 + 一次查看打出 342 行,存档没修好每读再发。";
     };
     readonly "server.workflow-journal.corrupt-record-skipped": {
         readonly cls: "F";
@@ -390,6 +390,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。";
     };
+    readonly "server.snapshot-bucket.presence-unproven": {
+        readonly cls: "F";
+        readonly note: "S-1195(7.119.0;`plugins/snapshot-bucket-presence.ts` 的 `ensureSnapshotBucket`,boot 期核一次快照桶 `SESSION_SNAPSHOT_BUCKET`;detail = `bucket=… endpoint=<buildDisplaySafeUrl 的显示形> <HTTP 状态 | request failed: 错类>`):presigned 列举对 `MINIO_ENDPOINT` **连不上 / 403 / 5xx / 没有 NoSuchBucket 的 404**,或探针到窗尾一次都没答过(detail 写 `probe still pending when the window ended`)⇒ **证明不了桶缺**,不拒启、照常起服(只有 404 + `NoSuchBucket` 才是「缺」,那一形窗内重试、到窗拒启,不走本 tag)。三问:①错误落到哪 —— 本 tag 的计数 / 探针行 / 记录器的一次性 warn,detail 带端点显示形与状态或错类;②谁受害 —— 桶其实不存在、或凭据不能列举的部署:之后每一次快照 offload 写与 SendUserFile 私有 presigned 请求会答 404 / 403,孤儿 sweep 每分钟一条失败,运维读到的是一串失败请求而不是「桶没建」(与 7.118.x 的既有形状同形,不是新损失);③缺席倒向哪边 —— 倒向**放行起服**:没有证据既不拒启、也不伪造「桶在场」或「桶缺」,不是门 / 权限 / 凭证。最坏后果 = 缺桶的部署晚一步才暴露;不放行的代价是对象存储一次抖动 / 一次 403 就让整只服务起不来。计数非零 = 这台部署启动时没能确认快照桶,按 detail 的端点与状态去核对网络 / 凭据 / 桶。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -329,7 +329,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.session-repo.corrupt-record-skipped": {
         cls: "F",
-        note: "S-990(`plugins/store-backend.ts` 的 `FileSessionRepo` 座,local 车道的会话存档):一份会话存档里有记录读不出(整行毁 / 半截 JSON / 形不对,core 记成 `kind:\"record\"` 逐条披露)或存档文件 / 目录整体读不出(`kind:\"file\"`)⇒ core 的成文处置是跳过 + 披露,会话照常打开、列表少一行。最坏后果 = 模型读到的历史少了一截 / 列表静默少一份会话 —— 都是**可用性**损失,不开任何门;发起这一轮的人另有 wire 面披露(打开自己存档时的 `engine_notice` 码 `session.records_skipped`,与本 tag 无关、不动)⇒ F。**计数单位 = 一条被跳过的记录 = 一次命中**(`replay` 级是同一批记录的汇总,不计,S-616 同教训);**每命中一行探针**(`SEMA_FAILOPEN_PROBE`)带 `path` / `sessionId` / `line` / `form` / `reason` 逐条明细 —— 运维要看「哪份存档的哪一行坏了」读探针,不读本条 warn:本条是每进程每 tag 一次的告警(`detail` 是首条明细,不是全部)。修前:每命中一行 warn,一份 113 行坏记录的存档做一次列表 + 一次查看打出 342 行,存档没修好每读再发。",
+        note: "S-990(`plugins/local-session-store.ts` `createLocalSessionRepo` 的 `FileSessionRepo` 座,local 车道的会话存档;`LocalSessionStore` 与会话视图口 `audit.ts` 共用,S-879):一份会话存档里有记录读不出(整行毁 / 半截 JSON / 形不对,core 记成 `kind:\"record\"` 逐条披露)或存档文件 / 目录整体读不出(`kind:\"file\"`)⇒ core 的成文处置是跳过 + 披露,会话照常打开、列表少一行。最坏后果 = 模型读到的历史少了一截 / 列表静默少一份会话 —— 都是**可用性**损失,不开任何门;发起这一轮的人另有 wire 面披露(打开自己存档时的 `engine_notice` 码 `session.records_skipped`,与本 tag 无关、不动)⇒ F。**计数单位 = 一条被跳过的记录 = 一次命中**(`replay` 级是同一批记录的汇总,不计,S-616 同教训);**每命中一行探针**(`SEMA_FAILOPEN_PROBE`)带 `path` / `sessionId` / `line` / `form` / `reason` 逐条明细 —— 运维要看「哪份存档的哪一行坏了」读探针,不读本条 warn:本条是每进程每 tag 一次的告警(`detail` 是首条明细,不是全部)。修前:每命中一行 warn,一份 113 行坏记录的存档做一次列表 + 一次查看打出 342 行,存档没修好每读再发。",
     },
     "server.workflow-journal.corrupt-record-skipped": {
         cls: "F",
@@ -363,6 +363,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。",
     },
+    "server.snapshot-bucket.presence-unproven": {
+        cls: "F",
+        note: "S-1195(7.119.0;`plugins/snapshot-bucket-presence.ts` 的 `ensureSnapshotBucket`,boot 期核一次快照桶 `SESSION_SNAPSHOT_BUCKET`;detail = `bucket=… endpoint=<buildDisplaySafeUrl 的显示形> <HTTP 状态 | request failed: 错类>`):presigned 列举对 `MINIO_ENDPOINT` **连不上 / 403 / 5xx / 没有 NoSuchBucket 的 404**,或探针到窗尾一次都没答过(detail 写 `probe still pending when the window ended`)⇒ **证明不了桶缺**,不拒启、照常起服(只有 404 + `NoSuchBucket` 才是「缺」,那一形窗内重试、到窗拒启,不走本 tag)。三问:①错误落到哪 —— 本 tag 的计数 / 探针行 / 记录器的一次性 warn,detail 带端点显示形与状态或错类;②谁受害 —— 桶其实不存在、或凭据不能列举的部署:之后每一次快照 offload 写与 SendUserFile 私有 presigned 请求会答 404 / 403,孤儿 sweep 每分钟一条失败,运维读到的是一串失败请求而不是「桶没建」(与 7.118.x 的既有形状同形,不是新损失);③缺席倒向哪边 —— 倒向**放行起服**:没有证据既不拒启、也不伪造「桶在场」或「桶缺」,不是门 / 权限 / 凭证。最坏后果 = 缺桶的部署晚一步才暴露;不放行的代价是对象存储一次抖动 / 一次 403 就让整只服务起不来。计数非零 = 这台部署启动时没能确认快照桶,按 detail 的端点与状态去核对网络 / 凭据 / 桶。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/operator-ask.d.ts

@@ -54,15 +54,16 @@ export declare function operatorAsk(rule: string, message: string): OperatorAskR
  * 任何 scope)退不掉,只有**这一次**的应答能答它。
  *
  * **为什么现在需要**:修前这两类 ask 挡住会话授权靠的是策略层的**次序**(`createDurableAskPolicy` 先判 neverAuto / 预算耗尽,再查
- * 豁免探针)。候裁 16 把会话授权的兑现位收到**审批席**(协调器 `standingGrantSettles`,判据 = `standingAnswerMayRetire`),而审批席
+ * 豁免探针)。候裁 16 把会话授权的兑现位收到**审批席**(协调器 `standingGrantSettles`,判据 = `standingAnswerHome`),而审批席
  * 读不到 `matchedAskRule`(core 刻意不上卡)—— 不盖出身,一条 `remember:"session"` 就会在审批席上退役「恒问人」。盖了之后
  * 席的同一只判据按 `mandated` 挡住它,耐久 `/decide` 腿的可记性(park 行 `mandated` 孪生位)同判 ⇒ 回执 `rememberApplied:false`。
  * live 腿修前这里本就是个洞(进程内 `allow_session` 授权可退役 neverAuto 卡),随类收掉。
  *
- * ⚠️ **只**这两类:普通 `APPROVAL_REQUIRE` 仍只经 {@link operatorAsk}(不盖出身)。它的问带 `matchedAskRule` ⇒ 引擎类 `ask_rule`;站着的答案
- * (「本会话放行」、耐久豁免行)清不清得掉它,出处是引擎类表 `foldArbitrationRow(classes).ruleMayClear` —— `ask_rule` 那一行说清不掉
- * (`tool-approval.ts` 的 `standingAnswerMayRetire` 与它同读)。所以在「站着的答案清不掉」这一问上它与「恒问人」两类同答;不同在出身位
- * (只这两类盖部署出身 ⇒ core 读 `operator_forced`、盖 `mandated`),其余各列按引擎类表各读各的行。
+ * ⚠️ **只**这两类:普通 `APPROVAL_REQUIRE` 仍只经 {@link operatorAsk}(不盖出身)。它的问带 `matchedAskRule` ⇒ 引擎类 `ask_rule`:bypass 放不掉、
+ * auto 分类器答不了(引擎眼里的免疫只靠这一位 —— core 7.44.0 的类表里 `operator_forced` 分类器**可答**,所以不拿出身位替它)。它是 server 自己的问,
+ * 它的站着的答案(「本会话放行」、耐久豁免行)由名单门在出问之前读 server 的会话豁免店(`approval.ts`),引擎的类表只裁引擎铸的问
+ * (`tool-approval.ts` 的 `standingAnswerHome` 按问的属主分读)。不盖出身还有第二个理由:出身位让引擎盖 `mandated`,卡面就成了「强制卡」——
+ * 名单卡要带「本会话放行」,而强制卡上没有。「恒问人」两类盖出身 ⇒ core 读 `operator_forced`、盖 `mandated`,站着的答案在哪一层都退不掉它们。
  */
 export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
 /**

package/dist/plugins/approval-exemption-store.d.ts

@@ -1,6 +1,10 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import type { Logger } from "../observability/logger.js";
+/** The server's own audit event for a question a row answered without asking anyone — one name for both reading positions
+ *  (the list gate: field `seat: "deployment_list"`; the approval seat: `seat: "approval_seat"`). Not a settlement record: nobody
+ *  was asked, so it names no human / person / policy and carries no `remember`. */
+export declare const APPROVAL_EXEMPTED_EVENT = "approval_exempted";
 export interface ApprovalExemptionRow {
     toolName: string;
     grantedBy: string | null;

package/dist/plugins/approval-exemption-store.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { existsSync, readdirSync, rmSync } from "node:fs";
 import { AppendLog, ensureDir, sanitizePathComponent } from "@sema-agent/core";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
+export const APPROVAL_EXEMPTED_EVENT = "approval_exempted";
 export class TiDBApprovalExemptionStore {
     pool;
     constructor(pool) {

package/dist/plugins/blob-backend.d.ts

@@ -108,6 +108,15 @@ export interface MinioBlobBackendConfig {
  *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
  *  注释同口径),远小于病形。send-user-file 与 leader/diffup 同 import 此常量。 */
 export declare const OBJECT_STORE_IO_TIMEOUT_MS = 120000;
+/** 桶存在性探针的结果(闭集):`present` = 列举 2xx;`missing` = 404 且体里是 `NoSuchBucket`(**唯一**能证明缺桶的形);其余一切 = `unknown`(带一句原因,不回显体)。 */
+export type BucketProbe = {
+    readonly state: "present";
+} | {
+    readonly state: "missing";
+} | {
+    readonly state: "unknown";
+    readonly detail: string;
+};
 export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
     private readonly keyPrefix;
@@ -160,6 +169,10 @@ export declare class MinioBlobBackend implements BlobBackend {
     headObject(hash: string): Promise<{
         lastModifiedMs: number;
     } | undefined>;
+    /** 桶存在性探针(boot 期核**一次**,`plugins/snapshot-bucket-presence.ts`):presigned ListObjectsV2 `max-keys=1`(与 sweep 的列举同一条签名路径,零新依赖)。
+     *  🔴 只有「404 且体里是 `NoSuchBucket`」才算缺桶;网络不通 / 403(凭据不能列举 ≠ 桶不在)/ 5xx / 没有 NoSuchBucket 的 404(代理 / 路径错)
+     *  都**证明不了**缺桶 ⇒ `unknown`,调用方不拒启、只报一次。总函数:不抛。`timeoutMs`:boot 期调用方给的单次上界(黑洞端点不许把起服拖到 120s)。 */
+    probeBucket(timeoutMs?: number): Promise<BucketProbe>;
     /** Byte-delete the given hashes — called ONLY from the async sweepOrphanBlobs reaper (NEVER the synchronous purge
      *  path). Honors the SAME created_at grace window as the SQL backend: with an index, DELETE the grace-passed index
      *  rows first (the index's created_at is the authoritative age — an S3 object carries no service-controlled timestamp

package/dist/plugins/blob-backend.js

@@ -253,6 +253,32 @@ export class MinioBlobBackend {
         const ms = lm ? Date.parse(lm) : NaN;
         return { lastModifiedMs: Number.isFinite(ms) ? ms : Date.now() };
     }
+    async probeBucket(timeoutMs = OBJECT_STORE_IO_TIMEOUT_MS) {
+        const f = this.cfg.fetchImpl ?? fetch;
+        const url = presignS3ListUrl({
+            endpoint: this.cfg.endpoint,
+            bucket: this.cfg.bucket,
+            prefix: this.keyPrefix,
+            maxKeys: 1,
+            accessKey: this.cfg.accessKey,
+            secretKey: this.cfg.secretKey,
+            ...(this.cfg.region ? { region: this.cfg.region } : {}),
+            expiresSec: this.ttl,
+        });
+        let res;
+        try {
+            res = await f(url, { method: "GET", signal: AbortSignal.timeout(timeoutMs) });
+        }
+        catch (err) {
+            return { state: "unknown", detail: `request failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        if (res.ok)
+            return { state: "present" };
+        const body = await res.text().catch(() => "");
+        if (res.status === 404 && /<Code>NoSuchBucket<\/Code>/.test(body))
+            return { state: "missing" };
+        return { state: "unknown", detail: `HTTP ${res.status}` };
+    }
     async deleteBlobs(hashes) {
         if (hashes.length === 0)
             return 0;