@sema-agent/server 7.120.0 → 7.122.0

package/dist/runtime-governance.js

@@ -1,4 +1,4 @@
-import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
+import { clampPermissionMode, combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, modePolicyOf, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { tightenGoverned } from "./governance-overrides.js";
@@ -7,13 +7,6 @@ import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
 export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
-export function isDelegationToolName(name) {
-    return name === DEFAULT_SUBAGENT_TOOL_NAME;
-}
-export function stripDelegationTools(tools) {
-    const kept = tools.filter((t) => !isDelegationToolName(t.name));
-    return kept.length === tools.length ? tools : kept;
-}
 const COARSE_SHELL_TOOLS = CORE_COARSE_SHELL_TOOLS;
 export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
@@ -104,15 +97,36 @@ export function compileCommandPolicyLayers(rules) {
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
-        case "plan":
             return { handsReadOnly: true, writeFace: "roots" };
         case "ask":
             return { shellGate: "always" };
+        case "plan":
         case "auto":
         case undefined:
             return {};
     }
 }
+export function autonomyModeFloor(autonomy) {
+    switch (autonomy) {
+        case "plan":
+            return "plan";
+        case "read-only":
+        case "ask":
+        case "auto":
+        case undefined:
+            return undefined;
+        default: {
+            const unhandled = autonomy;
+            throw new Error(`autonomy "${String(unhandled)}" has no entry-floor arm`);
+        }
+    }
+}
+export function autonomyKeepsOpenWriteFace(autonomy) {
+    const floor = autonomyModeFloor(autonomy);
+    const entry = floor === undefined ? "bypassPermissions" : clampPermissionMode("bypassPermissions", floor).effective;
+    const folded = tightenGoverned({ objective: "", permissionMode: entry }, autonomyOverrides(autonomy));
+    return folded.writeFace !== "roots" && folded.permissionMode !== undefined && modePolicyOf(folded.permissionMode).writeFace === "open";
+}
 export function governanceMandatesShellGateAlways(governance) {
     return autonomyOverrides(governance.autonomy).shellGate === "always" || governance.manualModeShellGate === "always";
 }

package/dist/sighup-idle.d.ts

@@ -8,11 +8,17 @@
  * 有界自灭=T11 保留;第二个 SIGHUP 升级 escalate(既有 drain 路径,操作员硬梯子)。
  *
  * 诚实边界:idle-but-live 的 peer(两 turn 之间静默超过窗口)会碰到引擎已退→壳 dead-respawn 1-2s 自愈
- * (伤害面从 mid-turn 斩降级为冷启动)。若壳侧确认每活会话对引擎持长连,可把连接数并入 inflight 判据。
+ * (伤害面从 mid-turn 斩降级为冷启动)。
+ * S-1281:附着(打开着的 SSE 流)是判据的第二格 `attached` —— 只读订阅自此不进 inflight(排空不该等一个看着的壳),而一个只挂着订阅流的
+ * peer 壳(cli 附着形:`GET /v1/approvals/stream` 常开)仍然是「有人在用」,靠这一格不被当成孤儿。修前这一形是订阅流被算进 inflight
+ * 时顺带挡住的;拆开之后两件事各有一格,规则不变:inflight = 0 ∧ attached = 0 ∧ 活性静默满窗才关。
  */
 export interface SighupIdleDeps {
     /** This replica's in-flight legs (drainState.inflight). */
     inflight: () => number;
+    /** S-1281:打开着的 SSE 流条数(drainState.attachedStreams,附着租约同一只 getter)。> 0 ⇒ 有壳挂着,同 inflight 一样重置窗口。
+     *  缺席 ⇒ 视为 0(单测 / 嵌入形)。 */
+    attached?: () => number;
     /** MONOTONIC-clock ms of the last non-probe HTTP request (drainState.lastActivityAt). Covers what inflight
      *  can't: admitted-but-not-yet-registered requests (auth/prepare/claim phases) and sub-tick short requests —
      *  and keeps an idle-but-live peer (still listing/browsing) alive. Absent ⇒ inflight-only semantics.

package/dist/sighup-idle.js

@@ -22,16 +22,16 @@ export function createSighupIdleHandler(deps) {
         }
         armedAt = now();
         const inflight = deps.inflight();
-        idleSince = inflight === 0 ? now() : null;
-        deps.log("sighup_idle_watch_armed", { inflight, idleGraceMs: deps.idleGraceMs });
+        const attached = deps.attached?.() ?? 0;
+        idleSince = inflight === 0 && attached === 0 ? now() : null;
+        deps.log("sighup_idle_watch_armed", { inflight, attached, idleGraceMs: deps.idleGraceMs });
         watch = setInterval(() => {
             if (deps.isStopped()) {
                 clearInterval(watch);
                 watch = undefined;
                 return;
             }
-            const n = deps.inflight();
-            if (n > 0) {
+            if (deps.inflight() > 0 || (deps.attached?.() ?? 0) > 0) {
                 idleSince = null;
                 return;
             }

package/dist/task-settings.d.ts

@@ -13,8 +13,8 @@
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3) —— **scope: the `settings.permissions` channel this module projects, and only it**:
  *  - `deny` / `ask` are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
- *    LOOSEN a stricter base safety field. Through those two buckets the client can only ADD denies / asks / handsReadOnly on
- *    top of the deployment + operator baseline.
+ *    LOOSEN a stricter base safety field. Through those two buckets the client can only ADD denies / asks on top of the
+ *    deployment + operator baseline.
  *  - `allow` (server 7.117.0, core 7.42.0) is NOT a policy: the list rides WHOLE and verbatim into `TaskSpec.allowedTools`,
  *    the request member of the engine's ONE allow layer (beside a deployment's `RunnerDeps.allowedTools`, a person's stored
  *    rows, an active skill's `allowed-tools` and a PreToolUse hook's `allow`), read under one predicate. It IS an accepted
@@ -81,12 +81,13 @@ export declare function coercePermissionModeStrict(raw: unknown): PermissionMode
  * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
  * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
  * continues (and any read-only restriction is lifted)」—— 而 core 顶层 resume 把宿主的续跑配置**整体**
- * 展开成新一段 spec、不继承停靠点的 `handsReadOnly` / `enablePlanMode`(`runtask.ts`),所以「松开」这
- * 件事的属主在**本仓装配续跑配置的那一处**。批准者要说的正是「松到哪一档」。
+ * 展开成新一段 spec、读的是那段 spec 上的模式词(`TaskSpec.permissionMode`),所以「松开」这件事的属主在
+ * **本仓装配续跑配置的那一处**(改写续跑体上的模式词)。批准者要说的正是「松到哪一档」。
  *
  * 🔴 **闭集为什么只有这两个词**:它是 CC `ExitPlanMode` 三选卡上那两张 Yes 卡(「Yes, and auto-accept
- * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
- * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `reject` 表达,
+ * `bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ * 收这一位的决定 = 把计划带出 plan 的决定(`approve` / `edit`,{@link planReviewDecisionExitsPlan})。
  *
  * 🔴 **不手抄词表**:`satisfies readonly PermissionMode[]` 让「本表的成员必须仍是 core 的模式词」成为**编译期**事实 ——
  * core 某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
@@ -97,16 +98,40 @@ export type PlanApprovePermissionModeAfter = (typeof PLAN_APPROVE_PERMISSION_MOD
 /** S-433 值闭集判据(wire 门用)。**宽臂一个都没有**:词表外的值 400 响亮拒 —— 这一位选的是批准之后
  *  模型有没有手,把一个拼错的词折成任何一档都是安全轴上的静默降级([ref]「无静默 fail-open」)。 */
 export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is PlanApprovePermissionModeAfter;
+/**
+ * `plan_review` 的这个决定把计划**带出 plan** 吗 —— 判据与引擎**同一句**:引擎在 plan_review 的续跑上出 plan 的条件是「决定不是 `reject`」
+ * (`approve` 按原计划开干、`edit` 按人改过的计划开干;`reject` 送回去重做计划,plan 保留)。两个读者读这一只:HTTP 门(`permissionModeAfter`
+ * 只配出 plan 的决定)与写回(`drivePlanReview` 把存储体的词写成 `permissionModeAfter ?? "default"`)。两处各写一句判据,就会出现
+ * 「写回按 approve / edit 写、门只在 approve 上收」那种分家。闭集穷尽 switch:决定词表加一词 ⇒ 编译红。
+ */
+export declare function planReviewDecisionExitsPlan(decision: "approve" | "edit" | "reject"): boolean;
+/**
+ * 运维 `AUTONOMY=plan` 的**入口词地板**盖进提交体 —— 此后一条 run 的模式词只有存储体顶层 `permissionMode` 一个源。
+ *
+ * 规则:入口词 = core `clampPermissionMode(体的生效词, 地板).effective`(体无词 ⇒ 地板;比地板松的词 ⇒ 钳成地板;秩是 core 的,本仓不另写)。
+ * 地板缺席 ⇒ 体**原物**交回(零字节变化)。盖章 = 新体 `{ ...body, permissionMode: 入口词 }`:调用方的对象不改;bundle 的
+ * `settings.permissions.defaultMode` 不动 —— 顶层赢过它({@link effectivePermissionMode} 的优先序),再改它就是同一语义的第二个写者。
+ *
+ * 调用点两个:提交入口(`http/admission.ts` 的 `prepareSpec`:值形门全部判完之后、`resolveSpec` 之前)与 leader run 的入口体(`leader/wire.ts`:
+ * leader 请求不带模式词,盖的是一份空体 ⇒ 入口词 = 地板本身;本车道的每一条 spec 与 worker 的续跑体都从它取词)。提交入口那一份体就是首跑装配读的体,也是 `buildCheckpointCtx` 持久化的体 ⇒ 一处盖章同时覆盖首跑与每一次续跑重建;
+ * 装配腿与续跑腿都不读地板(两处读 = 两个源)。run-local 自建 spec、收不到客户端表态,在它的出生点直接写地板本身(同一个入口词)。
+ * 另一个写者是 `plan_review` 写回(`http/resume-legs.ts` `drivePlanReview`,判据 {@link planReviewDecisionExitsPlan})。
+ * 热改 `AUTONOMY` 只影响之后提交的任务:在飞的 run 保持它出生时盖下的词。地板的属主是 `runtime-governance.ts` 的 `autonomyModeFloor`。
+ */
+export declare function stampEntryPermissionMode<B extends {
+    permissionMode?: unknown;
+    settings?: unknown;
+}>(body: B, floor: PermissionMode | undefined): B;
 /**
  * S-433 —— **一条已持久化的提交体的生效 permission mode**,单点。
  *
  * 它只是把 {@link effectivePermissionMode} 与「拿哪一份 settings 去问」这**一对**绑在一起:后者是
  * `parseTaskSettings(body.settings)`(resume 重放共用的宽容解析层)。两处各写一遍这一对,就会在
  * 「某天改成用别的 settings 去算生效模式」的那一拍静默分家 —— 而分家在这条轴上的形态是「wire 门说
- * 这条任务不是只读起步、装配腿却按只读起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
+ * 这条任务不是 plan 起步、装配腿却按 plan 起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
  *
- * ⚠️ 射程:**只管持久化体这一路**。首跑那一路的生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是
- * 场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
+ * ⚠️ 射程:**只管持久化体这一路**(含即将成为持久化体的那一份提交体 —— {@link stampEntryPermissionMode} 读它)。首跑那一路的
+ * 生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
  */
 export declare function storedBodyPermissionMode(body: {
     permissionMode?: unknown;
@@ -430,14 +455,12 @@ export interface FsWriteGateWiring {
 }
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;
-    handsReadOnly?: boolean;
-    enablePlanMode?: boolean;
 };
 /**
  * Apply a client's parsed per-request settings onto a base `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link
- * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1 — and
- * `handsReadOnly`/`onAsk` can only narrow). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any override would
- * LOOSEN a stricter base — surfaced by the caller as a 4xx (a client settings stamp that tries to widen is a
+ * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1). `tightenTaskSpec`
+ * THROWS `TaskSpecTightenError` if any override would LOOSEN a stricter base — surfaced by the caller as a 4xx (a
+ * client settings stamp that tries to widen is a
  * client error, never a silent weakening). `model`/`outputStyle` are applied directly (model is the caller's
  * choice WITHIN the catalog — the caller gates it before calling; outputStyle appends to the system prompt).
  *

package/dist/task-settings.js

@@ -1,4 +1,4 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { clampPermissionMode, combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { allowLayerEntryCountIssue, describeAllowLayerOverCap, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
@@ -23,6 +23,20 @@ export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
 export function isPlanApprovePermissionModeAfter(raw) {
     return PLAN_APPROVE_PERMISSION_MODES_AFTER.includes(raw);
 }
+export function planReviewDecisionExitsPlan(decision) {
+    switch (decision) {
+        case "approve":
+        case "edit":
+            return true;
+        case "reject":
+            return false;
+    }
+}
+export function stampEntryPermissionMode(body, floor) {
+    if (floor === undefined)
+        return body;
+    return { ...body, permissionMode: clampPermissionMode(storedBodyPermissionMode(body), floor).effective };
+}
 export function storedBodyPermissionMode(body) {
     return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);
 }
@@ -306,16 +320,6 @@ function createWorkflowAskPolicy(isExempt) {
         nameSets: [{ ask: WORKFLOW_ASK_NAMES }],
     };
 }
-function createWorkflowPlanDenyPolicy() {
-    return {
-        check(req) {
-            return heldRuleName(req, isWorkflowName) !== undefined
-                ? { action: "deny", message: `Plan mode is active — "${req.toolName}" is a write/mutating tool and is read-only-blocked.`, decisionReason: "rule" }
-                : { action: "allow" };
-        },
-        nameSets: [{ deny: WORKFLOW_ASK_NAMES }],
-    };
-}
 function rejectUnmatchableSettingsNames(perms, pathBases) {
     if (pathBases?.home === undefined) {
         for (const [field, names, behavior] of [
@@ -380,15 +384,14 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     };
     const basePolicy = compose();
     switch (defaultMode) {
-        case "plan":
-            return { toolPolicy: compose(createWorkflowPlanDenyPolicy()), handsReadOnly: true, enablePlanMode: true };
         case "acceptEdits": {
             const p = compose(fsWriteGate(true), createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }
         case "default":
         case "auto":
-        case "dontAsk": {
+        case "dontAsk":
+        case "plan": {
             const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }
@@ -398,13 +401,10 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     }
 }
 export function applyTaskSettings(base, settings, gate, workflowGate) {
-    const { toolPolicy, handsReadOnly, enablePlanMode } = deriveSettingsPolicy(settings, gate, workflowGate);
+    const { toolPolicy } = deriveSettingsPolicy(settings, gate, workflowGate);
     let next = base;
-    if (toolPolicy !== undefined || handsReadOnly !== undefined) {
-        next = tightenGoverned(next, { ...(toolPolicy !== undefined ? { toolPolicy } : {}), ...(handsReadOnly !== undefined ? { handsReadOnly } : {}) });
-    }
-    if (enablePlanMode)
-        next = { ...next, enablePlanMode: true };
+    if (toolPolicy !== undefined)
+        next = tightenGoverned(next, { toolPolicy });
     const allow = settings.permissions?.allow;
     if (allow !== undefined)
         next = { ...next, allowedTools: allow };

package/dist/tool-approval.d.ts

@@ -19,6 +19,12 @@ export type ApprovalGateKind = (typeof APPROVAL_GATE_KINDS)[number];
 export declare function isApprovalGateKind(k: string | undefined): k is ApprovalGateKind;
 /** 两方言同形的 SQL IN 片段(值为闭集常量字面,无注入面)。 */
 export declare const APPROVAL_GATE_KINDS_SQL_IN: string;
+/**
+ * 耐久回决口 `POST /v1/approvals/:sessionId/decide` 的路径串 —— S-1280:迟到回决口 PARKING 臂 202 体的机读指路 `decidePath`。
+ * 路由表那一行(`http/routes/approvals-assistant.ts` 的 `approval-decide`)按 pattern 匹配它;两者同形由往返钉守
+ * (`test/parked-late-decision.test.ts` G3-c:本函数的输出经 `lookupRoute` 落 `approval-decide`)。会话段按路由的 `safeDecode` 对称编码。
+ */
+export declare function approvalDecidePath(sessionId: string): string;
 /**
  * 🔴 [ref](案A)追记 F6 —— durable 回决口(`POST /v1/tasks/:taskId/asks/:askId/decision`)的 **200 体
  * additive 判别位**:这次决议在**本副本**上有没有被一条活着的腿消费掉。
@@ -1341,6 +1347,13 @@ export declare class ToolApprovalCoordinator {
      *  流没了,值相等即目标集;极端复用形下多转的那条也只是从流内卡变 durable 卡,方向保守。
      *  返回触发条数(0 = 无流内未决 ask,调用方照旧 abort)。幂等:已结算条目跳过,重复调用无害。 */
     parkOpenAsksForTask(wireTaskId: string): number;
+    /**
+     * 编排器片 2 件 2 —— 下面 `drainForShutdown` 的第 ① 步,提前到**排空进入**那一拍(`boot/shutdown.ts` 的唯一排空入口调):锁存
+     * {@link shutdownDraining},本进程握着的每一张未决卡按断连同路改路耐久停驻(core `onAsk` 答 "unavailable" 的合同 —— 有 park 设施则停驻、
+     * 没有则无头自动拒,fail-closed);之后**登记**的卡在登记那一拍同路(`askBroadcast` 读同一位)。幂等(再调只是再扫一遍未决表)。
+     * 让出放在进入那一拍而不是硬停那一拍:活卡在排空窗里没有人能答到一只正在下线的副本上,早一拍停驻 = 早一拍能在替补上赎回。
+     */
+    beginDrain(): void;
     /**
      * 🔴 **S-929 —— 有序关停的审批面收尾(一只;`boot/shutdown.ts` 的 `hardShutdown` 起点调,SIGTERM / SIGINT / SIGHUP 三条停止路同一处)。**
      *

package/dist/tool-approval.js

@@ -39,6 +39,12 @@ const DEFAULT_PARK_TOMBSTONE_MAX = 2000;
 const DEFAULT_PARK_TOMBSTONE_TTL_MS = 60 * 60_000;
 const DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX = 128;
 const PARKING_RETRY_AFTER_MS = 250;
+export function approvalDecidePath(sessionId) {
+    return `/v1/approvals/${encodeURIComponent(sessionId)}/decide`;
+}
+function parkSessionOf(row) {
+    return row.sourceTaskId === row.sessionId && row.sessionId !== row.taskId ? row.sessionId : undefined;
+}
 function ruleMaterialCarriesCredentialShape(command) {
     return redactSecretsWithArms(command, { observe: false }).arms.has("full");
 }
@@ -707,11 +713,14 @@ export class ToolApprovalCoordinator {
         }
         return n;
     }
-    async drainForShutdown(deadlineMs) {
+    beginDrain() {
         this.shutdownDraining = true;
         for (const e of [...this.pending.values()])
             if (e.settledOutcome === undefined)
                 e.forceParkNow();
+    }
+    async drainForShutdown(deadlineMs) {
+        this.beginDrain();
         while ((this.asksInFlight > 0 || this.pending.size > 0 || this.streams.size > 0 || this.parksAwaitingCommit.size > 0) && Date.now() < deadlineMs) {
             await new Promise((r) => setTimeout(r, SHUTDOWN_DRAIN_POLL_MS));
         }
@@ -1958,17 +1967,23 @@ export class ToolApprovalCoordinator {
                 return this.replayDecidedAsk(id, row, parsed);
             case "PARKED":
                 return this.redeemParkedAsk(id, tomb, row, parsed, httpReq, principal);
-            case "PARKING":
+            case "PARKING": {
+                const parkSession = parkSessionOf(row);
                 return {
                     status: 202,
                     body: {
                         approvalId: id,
                         askId: row.askId,
                         reason: "parking_in_progress",
+                        message: parkSession !== undefined
+                            ? "parking in progress — not applied; retry after retryAfterMs or answer through decidePath"
+                            : "parking in progress — not applied; retry after retryAfterMs or answer through the parent session's durable decide",
                         retryAfterMs: PARKING_RETRY_AFTER_MS,
+                        ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}),
                         ...this.lateRuleRefusal(parsed),
                     },
                 };
+            }
             case "DENIED":
                 return this.notPending("denied");
             case "VOID":

package/dist/trace/core-keyset-guard.d.ts

@@ -148,8 +148,8 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";

package/dist/trace/redact.d.ts

@@ -179,9 +179,9 @@ export declare function redactDeepWith(value: unknown, leaf: (s: string) => stri
  */
 export declare function redactedPreview(value: unknown, cap?: number): string | null;
 /**
- * **这一位是不是一个层级式绝对 URL**(有 authority 的那一族)—— 本铸点与**模型路由三键拒启**
- * (`model-route-url.ts` 第一臂)共用的**同一只**判据:两处曾各判各的,而 `URL.canParse` 单独为真的
- * **不透明** URL 恰好是「凭据位看不见」的那一形。
+ * **这一位是不是一个层级式绝对 URL**(有 authority 的那一族)—— 本铸点与 `url-shape.ts` 的 http(s) 形判官
+ * (模型路由三键 / 中心基址三席 / 公告地址 / embedder / A2A 的拒启都经它问到这里)共用的**同一只**判据:两处曾各判各的,
+ * 而 `URL.canParse` 单独为真的**不透明** URL 恰好是「凭据位看不见」的那一形。
  *
  * ⚠️ **射程如实**(车JC 复审去幻觉轮:此处原文写的是「本仓唯一判据」,亲读证伪)—— 仓里**另有一处**仍用
  * 裸 `URL.canParse` 回答同一个问题,且**刻意不在射程内**(改它是一次新的行为面拒启,按三问另开车):

package/dist/trace/self-minted-wire.d.ts

@@ -169,6 +169,70 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /** 7.121.0:`GET /health` 自报位 `auth.kinds[]` 的成员(验过的身份来源闭集;这台部署的装配能回的那几个)。 */
+    readonly healthAuthKind: {
+        readonly at: "GET /health auth.kinds[]";
+        readonly members: {
+            service_token: {
+                attr: string;
+                since: string;
+            };
+            sso: {
+                attr: string;
+                since: string;
+            };
+            direct_door_jwt: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 7.121.0:`GET /health` 自报位 `auth.identityAttach`。 */
+    readonly healthIdentityAttach: {
+        readonly at: "GET /health auth.identityAttach";
+        readonly members: {
+            available: {
+                attr: string;
+                since: string;
+            };
+            unavailable: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 7.121.0:`GET /health` 自报位 `operator`。 */
+    readonly healthOperator: {
+        readonly at: "GET /health operator";
+        readonly members: {
+            present: {
+                attr: string;
+                since: string;
+            };
+            absent: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 7.121.0:`GET /health` 自报位 `center.sessionsVisible`(两个布尔 + 一个词;成员按 JSON 字面登记)。 */
+    readonly healthSessionsVisible: {
+        readonly at: "GET /health center.sessionsVisible";
+        readonly members: {
+            true: {
+                attr: string;
+                since: string;
+            };
+            false: {
+                attr: string;
+                since: string;
+            };
+            unknown: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /** 本仓在出口对 core 值做的变换(值变、键不变)。 */
     readonly wireValueRule: {
         readonly at: "出口值变换(<端点>#<键> → 变换)";

package/dist/trace/self-minted-wire.js

@@ -60,6 +60,36 @@ export const SELF_MINTED_WIRE = {
             shutdown_before_park: { attr: "-", since: "7.116.0" },
         },
     },
+    healthAuthKind: {
+        at: "GET /health auth.kinds[]",
+        members: {
+            service_token: { attr: "-", since: "7.121.0" },
+            sso: { attr: "-", since: "7.121.0" },
+            direct_door_jwt: { attr: "-", since: "7.121.0" },
+        },
+    },
+    healthIdentityAttach: {
+        at: "GET /health auth.identityAttach",
+        members: {
+            available: { attr: "-", since: "7.121.0" },
+            unavailable: { attr: "-", since: "7.121.0" },
+        },
+    },
+    healthOperator: {
+        at: "GET /health operator",
+        members: {
+            present: { attr: "-", since: "7.121.0" },
+            absent: { attr: "-", since: "7.121.0" },
+        },
+    },
+    healthSessionsVisible: {
+        at: "GET /health center.sessionsVisible",
+        members: {
+            true: { attr: "-", since: "7.121.0" },
+            false: { attr: "-", since: "7.121.0" },
+            unknown: { attr: "-", since: "7.121.0" },
+        },
+    },
     wireValueRule: {
         at: "出口值变换(<端点>#<键> → 变换)",
         members: {

package/dist/unattended-permission-mode.d.ts

@@ -5,7 +5,9 @@
  * 本仓**自己铸** spec、**没有调用方**能在请求上表态模式的腿 —— leader worker(`src/leader/wire.ts` provisionWorker 两车道)、leader 的
  * 修复腿(集成沙箱修复 `mkRepair`、模块门修复 `leader.ts` `runModuleGate`、单代理修复环 `repair-wire.ts` `attachRepairLoopDeps`)、run-local
  * (`src/run-local.ts`,一次性 CLI)与这些腿的 durable 续跑重挂(`CheckpointCtx.unattendedLeg`)—— 经 {@link withUnattendedLeg} 这**一只**
- * 合并口铸两键:`permissionMode: "default"`(显式:续跑时盖过 checkpoint 记下的旧模式)与 `onAsk` = {@link createUnattendedOnAsk}。
+ * 合并口铸两键:`permissionMode`(`"default"`,显式:续跑时盖过 checkpoint 记下的旧模式;**钳在 spec 自带的模式词之下** —— run-local 在
+ * 它自建 spec 的出生点盖下的运维 `AUTONOMY=plan` 地板、续跑重建读到的存储体的 `plan` 都是天花板,本腿的 `default` 落在它下面就是 `plan`,
+ * 不把它降回去)与 `onAsk` = {@link createUnattendedOnAsk}。
  * 那只 onAsk 读 `AskRequest.classes` **整体**:集非空且每一类都在 {@link UNATTENDED_ANSWERED_CLASSES}(= `{ordinary}`,常量,不是旋钮)⇒ 答 yes
  * —— **以策略的名义**(S-953 / core 7.39.0 #1265:`{allow:true, settledBy:"policy", approver:"unattended_class_answer"}` ⇒ core 结算 `policy_allowed` /
  * `who.party:"policy"`;修前是裸 `true`,core 把机器的放行记成**人**批 `human_allowed` / `person`);
@@ -17,18 +19,17 @@
  *    不答 ⇒ 整问不答。
  *  · **缺席 = 不答的类**:没盖 `origin` 的站(共享制品读确认,KL-1214-a)、部署自铸的请求、7.37.0 之前 park 的行续跑(KL-1214-b,续跑不补)
  *    都不带类 ⇒ 不答。
- *  · **答集只 `ordinary`**:七个保护类(`probe` / `write_protection` / `rule_unreadable` / `tool_marks_mcp` / `tool_marks_a2a` /
- *    `transcript_write` / `artifact_shared_read`)与 `mode`(plan 的写问)留给人;`RELEASABLE_ASK_CLASSES` 之外的类(hook / ask_rule /
- *    org_rule / operator_forced / …,权威为人提的问)恒不答。function approver 的 yes 是「这一次调用的答」—— 它连 `requiresRealApproval`
+ *  · **答集只 `ordinary`**:引擎可放行的类(core `releasableAskClassesFor(face)`,按问的面读 —— 哪些类、哪一面放得行以引擎的表为准,本注不抄名单)里除 `ordinary`
+ *    之外的保护类与 `mode`(plan 的写问)留给人;可放行类之外的类(权威为人提的问)恒不答。function approver 的 yes 是「这一次调用的答」—— 它连 `requiresRealApproval`
  *    都清得掉(引擎分不出函数与人),所以带那一位的类(`transcript_write` / `rule_unreadable` / `artifact_shared_read` / `policy_rra`)不进答集
- *    (钉:test/unattended-permission-mode.test.ts「答集 ⊆ RELEASABLE_ASK_CLASSES,且与 RRA_EXPLAINERS ∪ {policy_rra} 不交」)。
+ *    (钉:test/unattended-permission-mode.test.ts「答集 ⊆ 每一面的 releasableAskClassesFor(face),且与 RRA_EXPLAINERS ∪ {policy_rra} 不交」)。
  *  · **`ordinary` 覆盖什么**(core 原句):`Read` 工具的根外读、shell 的根外**写**(`echo x > <outside>` —— 写守卫只判保护表)、模式写门对每一次
  *    covered write 的问、形状层对非只读 shell 的问;shell 的根外**读**(`cat <outside>`)是 `probe`,不答。
  *
  * ## 三问
  *  · **谁需要**:用 leader / run-local 的部署 —— 普通写与非只读命令照跑(7.105.0 行为;7.106.0–7.108.0 过渡形靠 `bypassPermissions` 宽放给出的同一结果)。
- *  · **谁受伤**:① 设了 `UNATTENDED_PERMISSION_MODE` 的部署 —— 起服拒启(`config.ts` 墓碑表,`removed` 族);② 靠过渡形缺省 bypass 放行
- *    `probe` / MCP·A2A 标记工具 / 转录写 / 规则店读不出 / 共享制品读这六类的无人值守流程 —— 改成不答(有席交席、无席 park 或拒)。安全轴收紧。
+ *  · **谁受伤**:① 设了 `UNATTENDED_PERMISSION_MODE` 的部署 —— 起服拒启(`config.ts` 墓碑表,`removed` 族);② 靠过渡形缺省 bypass 放行答集之外的保护类
+ *    (哪些类见 `releasableAskClassesFor` 与答集的不变量钉,本注不抄名单)的无人值守流程 —— 改成不答(有席交席、无席 park 或拒)。安全轴收紧。
  *  · **什么补偿**:有人的腿照问人(run-local 在终端里跑;leader 配 durable 审批块 ⇒ park 到 `/decide`);答集是 core 推荐形的常量 ——
  *    要放更多类的部署先立案候裁,不开旋钮。
  *
@@ -43,10 +44,11 @@
  *  · 续跑腿上的协调器席:`http/resume-legs.ts` 只在「run 行在场 ∧ 活卡协调器在场」时给 spec 另装活席(`deps.toolApproval && taskId`)——
  *    leader worker 的会话没有 run 行,那一装今天够不着本腿;哪天够着了,活席会盖掉本层(方向 = 多问人,fail-closed),见收车档 ⑤。
  */
-import type { AskClass, AskRequest, OnAsk, TaskSpec } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type OnAsk, type PermissionMode, type TaskSpec } from "@sema-agent/core";
 /**
  * 按类作答的**答集** —— core §4.6e 推荐形:机器只答 `ordinary`。**常量,不是旋钮**([ref]):要放更多类是部署级的安全决定,先立案候裁。
- * 不变量(测试钉):答集 ⊆ core `RELEASABLE_ASK_CLASSES`,且与带 `requiresRealApproval` 的类(core `RRA_EXPLAINERS` ∪ `policy_rra`)不交;`mode` 不在其中。
+ * 不变量(测试钉):答集 ⊆ core 每一面的可放行类 `releasableAskClassesFor(face)`(本层不读问的面,同一只答集答每一面的问),且与带 `requiresRealApproval` 的类
+ * (core `RRA_EXPLAINERS` ∪ `policy_rra`)不交;`mode` 不在其中。
  */
 export declare const UNATTENDED_ANSWERED_CLASSES: ReadonlySet<AskClass>;
 /**
@@ -66,13 +68,15 @@ export declare function unattendedAnswers(req: Pick<AskRequest, "classes">): boo
 export declare function createUnattendedOnAsk(seat: UnattendedSeat | undefined): UnattendedSeat;
 /** {@link withUnattendedLeg} 铸进 spec 的两键。 */
 export type UnattendedLegSpec = {
-    readonly permissionMode: "default";
+    readonly permissionMode: PermissionMode;
     readonly onAsk: UnattendedSeat;
 };
 /**
- * 无人值守腿并进一条 spec —— 各腿的**唯一**合并口:`permissionMode: "default"` + `onAsk: createUnattendedOnAsk(seat)`。`seat` = 本腿的
- * 活审批席(run-local 递它的 `createLocalApprover`;leader 各腿与续跑重挂无席,不递)—— 席只经这个参数进来,从不从 spec 上读。
- * 调用点必须在 spec 其余键(含治理折叠)**之后**调它;本口不碰 `toolPolicy`(没有策略层要并:过渡形的写保护拒层已退役)。
+ * 无人值守腿并进一条 spec —— 各腿的**唯一**合并口:`permissionMode` = `"default"` 钳在 spec 已有的模式词之下(core `clampPermissionMode`,与
+ * `tightenTaskSpec` 对模式词的合并同一只;spec 无词 ⇒ `"default"`)+ `onAsk: createUnattendedOnAsk(seat)`。`seat` = 本腿的活审批席(run-local
+ * 递它的 `createLocalApprover`;leader 各腿与续跑重挂无席,不递)—— 席只经这个参数进来,从不从 spec 上读。
+ * 调用点必须在 spec 其余键(含治理折叠)**之后**调它 —— spec 自带的 `plan` 由此被读到、留住;本口不碰 `toolPolicy`(没有策略层要并:过渡形的
+ * 写保护拒层已退役)。
  */
 export declare function withUnattendedLeg<S extends Partial<TaskSpec>>(spec: S, seat?: UnattendedSeat): S & UnattendedLegSpec;
 //# sourceMappingURL=unattended-permission-mode.d.ts.map

package/dist/unattended-permission-mode.js

@@ -1,3 +1,4 @@
+import { clampPermissionMode } from "@sema-agent/core";
 export const UNATTENDED_ANSWERED_CLASSES = new Set(["ordinary"]);
 export const UNATTENDED_POLICY_APPROVER = "unattended_class_answer";
 function unattendedPolicyYes() {
@@ -11,6 +12,7 @@ export function createUnattendedOnAsk(seat) {
     return (req, signal) => (unattendedAnswers(req) ? unattendedPolicyYes() : seat !== undefined ? seat(req, signal) : "unavailable");
 }
 export function withUnattendedLeg(spec, seat) {
-    return { ...spec, permissionMode: "default", onAsk: createUnattendedOnAsk(seat) };
+    const permissionMode = spec.permissionMode === undefined ? "default" : clampPermissionMode("default", spec.permissionMode).effective;
+    return { ...spec, permissionMode, onAsk: createUnattendedOnAsk(seat) };
 }
 //# sourceMappingURL=unattended-permission-mode.js.map

package/dist/url-shape.d.ts

@@ -0,0 +1,31 @@
+/** 座位可以禁掉的部件(闭集;判序 = 本数组序)。 */
+export declare const HTTP_URL_PARTS: readonly ["userinfo", "query", "fragment"];
+export type HttpUrlPart = (typeof HTTP_URL_PARTS)[number];
+/** 判官的拒因词(闭集):形不对,或一件被禁的部件在场。 */
+export type HttpUrlFlaw = "not-http-url" | HttpUrlPart;
+/** 「不是一个 http(s) URL」的规则词 —— 不透明形、不可解析、层级式非 http(s) 同一句;只点名规则,不回显 scheme。钉读这一只,不手抄。 */
+export declare const HTTP_URL_SHAPE_RULE = "is not a parseable http(s) URL (scheme must be http or https; it must look like http(s)://host[:port][/path])";
+/**
+ * 判:合格 ⇒ `[]`;否则按判序交回规则词。形不对且不透明 ⇒ 只有 `not-http-url`(部件在不透明形上无从判,
+ * 也不需要判 —— 那一形整只不收);层级式非 http(s) ⇒ `not-http-url` 之后照判部件。
+ * 返回类型按 `forbid` 收窄:座位没禁的部件不会出现在答案里(调用方的穷举 switch 因此不需要一条「不可达」臂)。
+ */
+export declare function httpUrlFlaws<P extends HttpUrlPart>(raw: string, forbid: readonly P[]): ReadonlyArray<"not-http-url" | P>;
+/** 一个拒因词的规则句(穷举;新词不补 = 编译红)。句子只说规则,不含值。 */
+export declare function httpUrlRule(flaw: HttpUrlFlaw): string;
+/**
+ * 拒句里值的样子(纯函数):合格的 http(s) 形 ⇒ 只到 origin(`scheme://host[:port]`,过展示铸点),origin 之后还有东西(userinfo /
+ * 路径 / query / fragment)⇒ 接一枚 `/…`;其余(不透明 / 不可解析 / 层级式非 http(s))⇒ 展示铸点的占位 `«redacted:url»` ——
+ * 拒句里不出现非 http(s) 的 scheme 词(主会话增补裁:写成 scheme 的令牌 `<48hex>://host` 曾原样进 fatal 行)。
+ *
+ * 🔴 为什么只到 origin(车内 codex 对抗复审 r1 [high],亲跑复现):展示铸点的路径段**逐字**保留、只靠形状律认令牌形 ——
+ * 形状律认不出的令牌(48 位十六进制拉取令牌就是一例)放在路径上会原样进拒句。拒句落在 fatal 行、stderr、每一轮的请求失败日志,
+ * 这几处不赌形状律的覆盖面:座位名 + 规则词已经说清了哪一席错在哪,值只需要认得出是哪一台主机。
+ */
+export declare function buildRefusalShownUrl(raw: string): string;
+/**
+ * 拒句的**唯一**铸点:`<subject> <规则句>[; <规则句>…]; got "<值的样子>"`(`build*` = 纯数据)。
+ * 值只经 {@link buildRefusalShownUrl} 出现;`flaws` 来自 {@link httpUrlFlaws}(调用方按首个拒因选自己的码与出路句)。
+ */
+export declare function buildHttpUrlRefusal(subject: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
+//# sourceMappingURL=url-shape.d.ts.map