@sema-agent/server 7.121.0 → 7.123.0

package/dist/plugins/park-commit-watch.js

@@ -12,28 +12,16 @@ export function createParkCommitWatch(inner) {
     let inFlight = 0;
     const idleWaiters = new Set();
     const unconfirmed = new Set();
-    const notify = (row) => {
+    const notify = async (row) => {
         const calls = committedParkCallsOf(row);
         if (calls !== undefined)
             for (const l of listeners)
-                l(calls);
+                await l(calls);
     };
-    const put = async (token, cp) => {
+    const counted = async (work) => {
         inFlight += 1;
         try {
-            try {
-                await inner.put(token, cp);
-            }
-            catch (err) {
-                unconfirmed.add(token);
-                if (unconfirmed.size > UNCONFIRMED_PUT_TOKENS_MAX) {
-                    const oldest = unconfirmed.values().next();
-                    if (oldest.done !== true)
-                        unconfirmed.delete(oldest.value);
-                }
-                throw err;
-            }
-            notify(cp);
+            return await work();
         }
         finally {
             inFlight -= 1;
@@ -42,13 +30,28 @@ export function createParkCommitWatch(inner) {
                     wake();
         }
     };
+    const put = (token, cp) => counted(async () => {
+        try {
+            await inner.put(token, cp);
+        }
+        catch (err) {
+            unconfirmed.add(token);
+            if (unconfirmed.size > UNCONFIRMED_PUT_TOKENS_MAX) {
+                const oldest = unconfirmed.values().next();
+                if (oldest.done !== true)
+                    unconfirmed.delete(oldest.value);
+            }
+            throw err;
+        }
+        await notify(cp);
+    });
     const get = async (token) => {
         if (!unconfirmed.has(token))
             return inner.get(token);
         unconfirmed.delete(token);
         const row = await inner.get(token);
         if (row !== null)
-            notify(row);
+            await counted(() => notify(row));
         return row;
     };
     const store = new Proxy(inner, {
@@ -65,6 +68,10 @@ export function createParkCommitWatch(inner) {
         onParkCommitted(listener) {
             listeners.push(listener);
         },
+        track(work) {
+            void counted(() => work).catch(() => undefined);
+            return work;
+        },
         quiesce(deadlineMs) {
             if (inFlight === 0 || Date.now() >= deadlineMs)
                 return Promise.resolve({ inFlight });

package/dist/plugins/session-policy-store-sql.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { assertSessionRuleNamesCurrent, loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
-import { assertSessionRuleNamesReachable, readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
 import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText } from "./sql-json-column.js";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
@@ -105,7 +105,6 @@ export class SqlSessionPolicyStore {
             }
             const clean = normalizeRules(stripRev(rules));
             assertSessionRuleNamesCurrent(clean);
-            assertSessionRuleNamesReachable(clean);
             if (prior && opts?.operator !== true) {
                 const loosens = loosenReasons(prior, clean);
                 if (loosens.length > 0) {

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -68,8 +68,10 @@ type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 export declare const MAX_RUN_BLOB_BYTES: number;
 declare const onWarnType: (msg: string, meta: Record<string, unknown>) => void;
 export type InboxWarn = typeof onWarnType;
-/** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`,core 源头不脱)在**两条写腿**(put / update 常态 + oversize 降级)
- *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。 */
+/** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`)在**两条写腿**(put / update 常态 + oversize 降级)
+ *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。
+ *  core 7.48.0 起 `error` 在铸点也过 core 的 `redactSecrets`,但两张脱敏表互不为超集(本仓的表多认几种记号,core 的表多认另几种)⇒ 这一口暂留;
+ *  退役条件 = core 的脱敏表成为两表的并集(本仓的每一种记号它都认)—— 到那时这一口与它的两条调用一起删。 */
 export declare function withRedactedError<T extends {
     error?: string | undefined;
 }>(run: T): T;

package/dist/router/route-orchestration.d.ts

@@ -1,4 +1,4 @@
-import type { Autonomy } from "../runtime-governance.js";
+import { type Autonomy } from "../runtime-governance.js";
 import type { GovernanceOverrides } from "../governance-overrides.js";
 export type OrchestrationMode = "single" | "supervisor" | "team";
 /** The DETERMINISTIC signals the routing decision reads (extracted by {@link deriveRoutingSignals} from the
@@ -54,7 +54,9 @@ export declare function deriveRoutingSignals(ctx: RoutingContext): RoutingSignal
  * derivation + {@link deriveRoutingSignals} + {@link routeOrchestration} in one tested call; main.ts's resolveSpec
  * calls this). Signal mapping:
  *  - `isolatedExecEnv` ⟺ a sandboxed remote-exec backend (`e2b`/`k8s` Kata) — `ssh`/`host`/`adb` are NOT isolated.
- *  - hand tools (write_file/bash) are mounted only when an executionEnv exists AND hands aren't read-only/plan.
+ *  - hand tools (write_file/bash) are mounted only when an executionEnv exists AND the autonomy does not clamp the hands
+ *    read-only (read off {@link autonomyOverrides} — the one place an autonomy word becomes a hands clamp; `plan` is the
+ *    engine's plan mode, whose hands stay mounted and are gated at call time, so it is not read-only here).
  *  - `canEgress` is left false in v1 (per-tool egress detection deferred; danger derives from non-isolation).
  *  - `delegatedOrLongHorizon` is false on the single-task path (the (b) value lives on the /v1/leader path).
  */

package/dist/router/route-orchestration.js

@@ -1,4 +1,5 @@
 import { COARSE_SHELL_TOOLS } from "@sema-agent/core";
+import { autonomyOverrides } from "../runtime-governance.js";
 import { operatorAlwaysHumanAsk } from "../operator-ask.js";
 import { heldRuleName } from "../tool-rule-names.js";
 export function routeOrchestration(s) {
@@ -20,7 +21,7 @@ export function deriveRoutingSignals(ctx) {
     };
 }
 export function routeServiceTask(input) {
-    const readOnlyHands = input.autonomy === "read-only" || input.autonomy === "plan";
+    const readOnlyHands = autonomyOverrides(input.autonomy).handsReadOnly === true;
     return routeOrchestration(deriveRoutingSignals({
         ...(input.explicitTeam ? { explicitMode: "team" } : {}),
         ...(input.autonomy ? { autonomy: input.autonomy } : {}),

package/dist/rule-entry-list.d.ts

@@ -9,10 +9,10 @@
  *  ① **形**({@link ruleEntryListShapeOk}):字符串数组。引擎逐条迭代;一个裸字符串会被逐字符读成几条(deny 侧 = 意图静默落空)。
  *     本谓词不带条数帽(引擎的 `screenAllowedToolsValue` 只判形);条数帽是另一只函数 {@link allowLayerEntryCountIssue}(`MAX_ALLOW_LAYER_ENTRIES`,
  *     请求 allow 桶、技能两只清单、运维表四张表同一只、同一句)。
- *  ② **引擎读不到的一形**({@link emptyToolSegmentEntryOf}):工具段为空的协议名(`mcp__srv__`)—— 引擎的判官答 `current`、条目读成一条精确名行、永不命中;
- *     判据与句子在 `namespaced-rule-name.ts`(配置表、会话规则写口同一只)。四张表都拒。
+ *  ② (7.116.0–7.122.x 的「引擎读不到的一形」—— 工具段为空的协议名 `mcp__srv__` 四张表都拒 —— 随 core 7.48.0 #1400 退役:引擎判官给它判词
+ *     `unmintable_segment`,条目由下面 ③ 读成 `tool_name`,与对端段铸不出的名字同一条路。)
  *  ③ **引擎读成空的条目**({@link inertRuleEntriesOf},判据 = 引擎包根 `compileAllowList(entries, behavior, 名册)`,名册 = 空集 `NO_DECLARED_TOOL_NAMES`
- *     —— 条目的工具名也过引擎判官:退役名 / 无前缀短名 / 对端段铸不出读成 `tool_name`,带判词与 1:1 现名;原因词是引擎的 `ALLOW_ENTRY_INERT_REASONS`):
+ *     —— 条目的工具名也过引擎判官:退役名 / 无前缀短名 / 对端段或工具段铸不出、为空读成 `tool_name`,带判词与 1:1 现名;原因词是引擎的 `ALLOW_ENTRY_INERT_REASONS`):
  *     运维的 allow 表拒启(运维自己的配置,写错了当场改);技能的拒侧(`disallowedTools`)拒 —— 提交 400、存量体重放 409(下面的 {@link skillDenyInertEntryOf});
  *     请求的 allow 侧(`settings.permissions.allow`、技能 `allowedTools`)不拒:引擎在开跑时发 `permission.allowed_tool_not_granted`(受众 = 用户)。
  *     技能拒侧那一拒与引擎 #1372(core 7.43.0:那只技能不激活)是同一件事的两处 —— 7.118.0 重估过、本版**不退**:本仓的续跑腿把引擎的
@@ -20,7 +20,6 @@
  *     (重估读数与退役条件在下面那只函数头注)。
  */
 import { compileAllowList } from "@sema-agent/core";
-import { emptyToolSegmentOf } from "./namespaced-rule-name.js";
 /** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
 export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
 /**
@@ -42,15 +41,6 @@ export declare function allowLayerEntryCountIssue(field: string, list: readonly
     readonly count: number;
     readonly cap: number;
 } | undefined;
-/** 一张表里第一条「引擎读不到、却永远匹配不到」的条目(工具段为空的协议名)。 */
-export interface EmptyToolSegmentEntry {
-    readonly entry: string;
-    readonly ns: NonNullable<ReturnType<typeof emptyToolSegmentOf>>;
-}
-/** ② 第一条工具段为空的协议名条目(没有 ⇒ `undefined`)。纯字符串运算。 */
-export declare function emptyToolSegmentEntryOf(list: readonly string[]): EmptyToolSegmentEntry | undefined;
-/** ② 的句子(`<field> names "<entry>", which can never match a tool (…)`;后半与配置表 / 会话规则写口同一只)。 */
-export declare function describeEmptyToolSegmentEntry(field: string, u: EmptyToolSegmentEntry): string;
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
 /** ③ 引擎按 `behavior` 读这张表时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己);条目名过引擎判官(名册 = 空集)。 */

package/dist/rule-entry-list.js

@@ -1,6 +1,6 @@
 import { compileAllowList } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
-import { describeEmptyToolSegment, emptyToolSegmentOf, NO_DECLARED_TOOL_NAMES, ruleEntryToolName } from "./namespaced-rule-name.js";
+import { NO_DECLARED_TOOL_NAMES } from "./namespaced-rule-name.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
 export function describeAllowLayerOverCap(field, count) {
@@ -12,17 +12,6 @@ export function allowLayerEntryCountIssue(field, list) {
         return undefined;
     return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
 }
-export function emptyToolSegmentEntryOf(list) {
-    for (const entry of list) {
-        const ns = emptyToolSegmentOf(ruleEntryToolName(entry));
-        if (ns !== undefined)
-            return { entry, ns };
-    }
-    return undefined;
-}
-export function describeEmptyToolSegmentEntry(field, u) {
-    return `${field} names ${displayListEntry(u.entry)}, which can never match a tool (${describeEmptyToolSegment(u.ns)})`;
-}
 export function inertRuleEntriesOf(list, behavior) {
     return compileAllowList(list, behavior, NO_DECLARED_TOOL_NAMES).inert;
 }

package/dist/run-local.js

@@ -14,7 +14,7 @@ import { withUnattendedLeg } from "./unattended-permission-mode.js";
 import { buildUnattendedPolicyRefusal } from "./tool-approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, buildApprovalGrantNotice, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
-import { applyRuntimeGovernance } from "./runtime-governance.js";
+import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
@@ -344,7 +344,7 @@ export async function runLocal(argv, deps = {}) {
             for (const de of r.domainErrors ?? [])
                 logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "domain fell to schema defaults; other domains applied normally" });
             for (const d of r.droppedEntries ?? [])
-                logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
+                logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
             effective = r.effective;
             applyEffective(config, r.effective, logger, { leg: "boot" });
             if (effective?.mcp)
@@ -633,7 +633,9 @@ export async function runLocal(argv, deps = {}) {
         ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
+    const entryWord = entryPermissionMode(undefined, autonomyModeFloor(config.autonomy)).effective;
     const spec = withUnattendedLeg(applyLocalGovernance({
+        ...(entryWord !== undefined ? { permissionMode: entryWord } : {}),
         objective: mention.cleanedObjective,
         sessionId,
         backgroundScope: "session",

package/dist/runtime-governance.d.ts

@@ -14,16 +14,16 @@
  *   toolPolicy rule is `combinePolicies(base, override)` (deny-wins) — the command gate can only ADD denies/asks
  *   on top of the baseline, never clear it.
  *
- *   TRAP #2 — `autonomy` must EXPAND INTO the three core primitives (`handsReadOnly` / `shellGate` / a
- *   `toolPolicy`), NOT become a parallel enum on the spec (design-research §10: a parallel `autonomy` field +
- *   `handsReadOnly:true` would conflict). The expansion is tighten-only and routed through `tightenTaskSpec`, so
+ *   TRAP #2 — `autonomy` must EXPAND INTO core primitives (`handsReadOnly` + `writeFace` / `permissionMode` /
+ *   `shellGate` / a `toolPolicy`), NOT become a parallel enum on the spec (design-research §10: a parallel `autonomy`
+ *   field + `handsReadOnly:true` would conflict). The expansion is tighten-only and routed through `tightenTaskSpec`, so
  *   `auto` (the loosest mode) can never LOOSEN a stricter base — `tightenTaskSpec` THROWS instead.
  *
  * ⚠️ `commandPolicy` is a COARSE name-level filter, NOT a sandbox. `sh -c …` / `$(…)` / pipes / `env X=…` /
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { type PermissionMode, type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernanceOverrides } from "./governance-overrides.js";
@@ -33,26 +33,6 @@ export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
  *  契约给 `command` 加一条 refine / 给 `decision` 加一个判词,本仓的型当场跟上(或在下面的
  *  `RANK` / 穷尽 switch 上编译红),而不是靠人记得把手写联合改一遍。 */
 export type CommandRule = NonNullable<GovernanceConfig["commandPolicy"]>[number];
-/** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
- *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 [ref]:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
- *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
- *  fail-open(那个教训的解=引用常量,不是折叠)。 */
-export declare function isDelegationToolName(name: string): boolean;
-/** The hands-read-only DELEGATION STRIP (the main.ts governed-spec site, extracted here so the actual filter —
- *  not just the name predicate — is pinned by tests): a read-only (plan-mode) run does not mount a delegation
- *  tool at all.
- *
- *  🔴 原始理由已被上游收编(2026-08-05 亲验安装包 core 5.13.x):子任务 spec 现在**继承** `handsReadOnly`
- *  (`dist/agents/subagent.js` 的 `...(ctx.handsReadOnly === true ? { handsReadOnly: true } : {})`,resume
- *  resume 腿同款)与 `shellGate`(`dist/core/runner/prepare-task.js` 的 `inheritedGateForChildren`),所以
- *  「子任务会拿到可写的手」这个当年的缺口在 core 侧已经补上。本 strip 因此是**同向的第二层**(更严,不更松):
- *  它保证 read-only 一档下连委派工具面都不铸,与继承是否存在无关。拆掉它是一次行为变更(read-only 任务将
- *  重新能委派),需要单独决定——不要因为「上游修好了」就顺手删。
- *
- *  Identity (the same array) when nothing matches, so the caller's spec-object churn stays minimal. */
-export declare function stripDelegationTools<T extends {
-    name: string;
-}>(tools: readonly T[]): T[];
 /** The operator autonomy mode (registry `governance.autonomy`) —— 契约派生(见 {@link AUTONOMY_MODES})。 */
 export type Autonomy = NonNullable<GovernanceConfig["autonomy"]>;
 /** 导出给 `test/coarse-shell-tools-mirror.test.ts` 的同源钉用(见那里的顶注)。 */
@@ -99,20 +79,33 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  */
 export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
 /**
- * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
- *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
- *    §6 verifier read-only boundary). `plan` shares the SAME safety boundary as `read-only`; the "present a plan
- *    for approval" intent is higher up (UX), not a distinct TaskSpec safety field, so both map to read-only hands.
+ * Expand an autonomy mode into the TIGHTEN-ONLY `TaskSpec` FENCES that are re-folded on EVERY leg (first run and every
+ * resume rebuild) — the primitives, TRAP #2:
+ *  - `read-only` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read, never mutate; the §6 verifier read-only
+ *    boundary). The hands clamp travels to every delegated child by core itself (`childClampSeats` — tighten-only), so the
+ *    delegation tool stays mounted: a read-only run can delegate, and its children are read-only too.
  *  - `ask` → `shellGate: "always"` (every `Bash` command tightens to an `irreversible_ask` durable suspend —
  *    the fail-closed default for an unattended deployment with no parsed classifier).
- *  - `auto` / `undefined` → `{}` (no extra tightening; still subject to the deployment baseline + commandPolicy).
+ *  - `plan` / `auto` / `undefined` → `{}` (nothing re-folded per leg; still subject to the deployment baseline + commandPolicy).
  *
- * 🔴 **为什么只读那两档同时说 `writeFace:"roots"`**([ref] 随批;不是补丁,是把这一档的表态说全):
+ * 🔴 **规则:按段重折的只有静态围栏,模式词不在这里。** 只读手 + roots、shell 地板没有出口 —— 每一段续跑都该在,所以每一段都折。
+ * `plan` 是有出口的**生命周期词**(`plan_review` 把计划带出 plan),不是围栏:它是**提交入口的模式词地板**({@link autonomyModeFloor}),
+ * 盖在每一个 spec 出生点一次(词 = {@link entryPermissionMode} 的 `effective`):受理门盖进存储的提交体(`task-settings.ts` `stampEntryPermissionMode`)、run-local 盖在它自建的 spec 上、
+ * leader run 盖在它出生时的入口体上(`leader/run-entry.ts`;入口词是 `plan` 的 leader run 进不了那条车道 —— worker 会话没有计划审阅通道 ⇒ 受理口响亮拒)。此后一条 run 的模式词
+ * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)与 `plan_review` 写回。按段折一个模式词 = 第二个源:被批准的计划会在下一次挂起→续跑
+ * 被拉回 plan。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
+ * 写面 `roots`、与 `read-only` 同形 —— 运维 plan 那时根本不进 plan 模式,见下一段。)
+ *
+ * 🔴 **为什么 `plan` 不再与 `read-only` 同形**:修前两档同映「只读手 + roots」,外加 `resolve-spec.ts` 见只读手就剥委派工具 —— 于是 `plan` 有三套
+ * 实现(运维 plan = 只读手、用户选 plan = 模式词 + 只读手 + 剥委派、模型自进 plan = 只有模式词),而剥委派撞上请求体的 `agents` 就是 core 的
+ * `config.agents.no_delegation_tool` 整轮拒。现在 plan 只有引擎一个判官,`read-only` 只是只读手这一个词。
+ *
+ * 🔴 **为什么 `read-only` 同时说 `writeFace:"roots"`**([ref] 随批;不是补丁,是把这一档的表态说全):
  * core 7.18.0 的 `resolveContainmentFace` 第 1 行把「只读(verifier)挂载 × 任务层 `writeFace:"open"`」
  * 判成**真实矛盾**并**抛** `config.write_face_readonly_conflict`(理由逐字:那种挂载根本不带写面,
  * 声明一个开放写面 = 为一次调用没有的工具表态)。而 `permissionMode:"bypassPermissions"` 自 [ref] 起
  * 会在阶段④铸出 `writeFace:"open"` —— 于是「`AUTONOMY=read-only` 的部署 × 一个 bypass 请求」这一格
- * 不修就是**整条 run 当场配置错误失败**。
+ * 不修就是**整条 run 当场配置错误失败**(`plan` 一档不需要它:提交入口把模式词钳成 `plan`,bypass 那一列根本不生效)。
  *
  * 修在这里而不是在写点加一条「若 handsReadOnly 则别写」的判据:两个字段**在这一档里是同一件事**
  * (「这条 run 没有写面」),而 `tightenTaskSpec` 本来就把 `writeFace` 当 tighten-only 安全字段收
@@ -122,6 +115,48 @@ export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefi
  * 它照样把键写出来(不是「只在有 open 时才压」——那又是一条判据)。
  */
 export declare function autonomyOverrides(autonomy: Autonomy | undefined): GovernanceOverrides;
+/**
+ * 运维 autonomy 给**提交入口**的模式词地板 —— 唯一属主(规则全文见 {@link autonomyOverrides} 顶注)。`plan` ⇒ `"plan"`:每个新提交的 run
+ * 以 plan 起步,请求的词按 core 的模式秩钳到它之下;其余三档与缺席 ⇒ 无地板(它们的表态全在按段的围栏里)。
+ * 「一个词在这块地板下变成什么」只有一只函数答:{@link entryPermissionMode}(读者全表在它的头注)。
+ * 闭集**穷尽** switch:契约给 autonomy 加一档 ⇒ 这里编译红([ref])。
+ */
+export declare function autonomyModeFloor(autonomy: Autonomy | undefined): PermissionMode | undefined;
+/**
+ * 一个模式词进入一块地板之后的**读数** —— {@link entryPermissionMode} 的答。四键:调用方声明的词(`requested`,缺席 = 没声明)、地板(`floor`,
+ * 缺席 = 这里没有地板)、生效词(`effective`)与「地板改了调用方的词」(`clamped`,core 的同名位:只在声明了词、且那个词被折回地板时为真 ——
+ * 没声明词而取地板本身不算改词)。
+ */
+export interface EntryPermissionMode<W extends PermissionMode | undefined = PermissionMode | undefined> {
+    readonly requested: W;
+    readonly floor: PermissionMode | undefined;
+    readonly effective: W | PermissionMode;
+    readonly clamped: boolean;
+}
+/**
+ * 「请求词 `word` 在地板 `floor` 下变成什么」—— **唯一**的一只函数(本仓对 core `clampPermissionMode` 的唯一调用点;秩只在 core 一处)。
+ *
+ * 规则:地板缺席 ⇒ 词原样、`clamped:false`;地板在场 ⇒ core `clampPermissionMode(word, floor)` 的答(词缺席 ⇒ 地板本身;比地板松的词 ⇒ 折回地板、`clamped:true`)。
+ * 本仓「地板」即 core 的天花板(`plan` 秩最低:比它松的词都折成它)。
+ *
+ * 读者(都调这一只,不另写「缺席原样否则钳」):
+ *  · spec 出生点写 `effective` —— 受理门(`task-settings.ts` `stampEntryPermissionMode` 盖进存储体)、run-local 自建的 spec、
+ *    leader run 的入口词(`leader/run-entry.ts` `leaderRunEntry`)、leader 车道合并口(`leader/leader.ts` `withLeaderLeg`:spec 的词钳在入口词之下)、
+ *    无人值守腿(`unattended-permission-mode.ts` `withUnattendedLeg`:`default` 钳在 spec 的词之下);
+ *  · 「这个词会变成什么」的读者 —— 能力面写面开不开({@link autonomyKeepsOpenWriteFace}:bypass 声明过地板)、能力面 auto 读面
+ *    (`auto-mode-face.ts` `judgeAutoModeArming`:意图过地板;`clamped` 且不是 auto ⇒ 未武装原因 `operator_floor`)、
+ *    存量停驻体能否按此刻的地板重放(`http/stored-body-replay.ts`:体的词经钳会变 ⇒ 拒)。
+ * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,上面八处各调本函数一次。
+ */
+export declare function entryPermissionMode<W extends PermissionMode | undefined>(word: W, floor: PermissionMode | undefined): EntryPermissionMode<W>;
+/**
+ * 运维 autonomy 留不留得住请求层「掀开写围栏」那条声明(`permissionMode:"bypassPermissions"`,引擎模式表那一列 `writeFace:"open"`)——
+ * 能力面 `taskWriteFaceOpen` 的治理那一半。判据读**两只属主本身**,与一条真提交走的路同序:bypass 声明先过入口地板({@link entryPermissionMode},
+ * 与受理门的盖章同一只函数),再交给本档的按段围栏(`tightenGoverned` → core `tightenTaskSpec`),
+ * 看折出来的 spec 还开不开写面 —— 显式席 `"roots"` 胜过模式列(`read-only`),入口词被钳成别的词时读那个词的模式列(`plan`)。
+ * 本仓不另写一张「哪几档钳写面」的表:档位怎么钳 / 怎么折由两只属主说,写面开不开由引擎的模式表说。
+ */
+export declare function autonomyKeepsOpenWriteFace(autonomy: Autonomy | undefined): boolean;
 /**
  * [ref]:**部署级**判据 —— 本部署的治理层自己是否把 shellGate 抬到 `"always"`。
  *
@@ -207,7 +242,7 @@ export declare function governanceOriginOf(gate: {
  * Apply the operator's runtime governance (autonomy + commandPolicy + manualModeShellGate + the guard set) onto a base
  * `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link tightenTaskSpec} call: commandPolicy compiles to a `toolPolicy`
  * override (combined onto the baseline by `tightenTaskSpec` — TRAP #1), and autonomy expands to
- * `handsReadOnly` / `shellGate` overrides (TRAP #2). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
+ * `handsReadOnly` + `writeFace` / `shellGate` overrides (TRAP #2; the plan floor is the submission entrance's, never a per-leg fold). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any
  * override would LOOSEN a stricter base safety field — surfacing a misconfiguration loudly instead of silently
  * weakening the gate. Returns `base` untouched when there is nothing to apply.
  *

package/dist/runtime-governance.js

@@ -1,4 +1,4 @@
-import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
+import { clampPermissionMode, combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, modePolicyOf, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { tightenGoverned } from "./governance-overrides.js";
@@ -7,13 +7,6 @@ import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
 export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
-export function isDelegationToolName(name) {
-    return name === DEFAULT_SUBAGENT_TOOL_NAME;
-}
-export function stripDelegationTools(tools) {
-    const kept = tools.filter((t) => !isDelegationToolName(t.name));
-    return kept.length === tools.length ? tools : kept;
-}
 const COARSE_SHELL_TOOLS = CORE_COARSE_SHELL_TOOLS;
 export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
@@ -104,15 +97,41 @@ export function compileCommandPolicyLayers(rules) {
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
         case "read-only":
-        case "plan":
             return { handsReadOnly: true, writeFace: "roots" };
         case "ask":
             return { shellGate: "always" };
+        case "plan":
         case "auto":
         case undefined:
             return {};
     }
 }
+export function autonomyModeFloor(autonomy) {
+    switch (autonomy) {
+        case "plan":
+            return "plan";
+        case "read-only":
+        case "ask":
+        case "auto":
+        case undefined:
+            return undefined;
+        default: {
+            const unhandled = autonomy;
+            throw new Error(`autonomy "${String(unhandled)}" has no entry-floor arm`);
+        }
+    }
+}
+export function entryPermissionMode(word, floor) {
+    if (floor === undefined)
+        return { requested: word, floor, effective: word, clamped: false };
+    const { effective, clamped } = clampPermissionMode(word, floor);
+    return { requested: word, floor, effective, clamped };
+}
+export function autonomyKeepsOpenWriteFace(autonomy) {
+    const entry = entryPermissionMode("bypassPermissions", autonomyModeFloor(autonomy)).effective;
+    const folded = tightenGoverned({ objective: "", permissionMode: entry }, autonomyOverrides(autonomy));
+    return folded.writeFace !== "roots" && folded.permissionMode !== undefined && modePolicyOf(folded.permissionMode).writeFace === "open";
+}
 export function governanceMandatesShellGateAlways(governance) {
     return autonomyOverrides(governance.autonomy).shellGate === "always" || governance.manualModeShellGate === "always";
 }

package/dist/session-policy-wire.d.ts

@@ -29,13 +29,14 @@
  * 里同点同调它;准备阶段的名审计与本仓配置表读的是同一只 `judgeRuleToolName`)—— 本仓手写的那一只(`legacyToolNameOf`)删除,零双读;
  * 「哪几桶装工具名」归 core(它的 `HOLDS_TOOL_NAMES`)。
  *
- * ── 7.116.0:写口读者再多判一问 —— 够不着挂载工具的协议名;7.118.0 收窄到引擎读不到的那一形 ─────────────────────────
- * 对端段铸不出 / 对端段为空(`mcp__github.com__*`、`mcp__`)自 core 7.43.0 #1355 (b) 起是引擎判官自己的判词 `unmintable_segment` ——
- * `assertSessionRuleNamesCurrent` 拒(`legacy_tool_name`,`detail.verdict`)、本仓映射 `400 rules.legacy_tool_name`,与退役名同码同句族;本仓 7.116.0 起
- * 那只自比对端段的对照随之退役。引擎判官放行、却一只工具都够不着的只剩**工具段为空**(`mcp__srv__`):判据与句子是 `namespaced-rule-name.ts` 那一只
- * (配置表同调),码 `400 request.field_invalid`(会话规则写口既有的字段值码;不往 core 的判词闭集里塞本仓的词)。这一问要逐桶判,而 core 不导出
- * `HOLDS_TOOL_NAMES` 的运行期值 ⇒ 桶表 {@link TOOL_NAME_FIELDS} 的键集从 core 判官交回的 `field` 型派生(两向 tsc 配对),随引擎判官给这一形判词那天整只退役。
- * SQL 店写口经 {@link assertSessionRuleNamesReachable} 同判。
+ * ── 7.123.0(core 7.48.0):两问都只剩引擎的判 ──────────────────────────────────────────────────────────────────────
+ * ① **桶**能不能写:core 7.48.0 #1471 起 `normalizeRules` 对「不是一列非空字符串」的桶抛 `TypeError`(裸字符串、`null`、混入非字符串、`""` /
+ *    纯空白项),句子点名桶与值类型。写口读者逐桶问它({@link engineRuleListOf})⇒ 两条写口是唯一拒点(`400 request.field_invalid`,句子原样),
+ *    店里的 `normalizeRules` 对这两条写口的输入不再可能抛。修前本仓的形读者只判「字符串数组」,`[""]` / `["  "]` 过它、在店里抛 ⇒ 500。
+ *    本仓自己的「字符串数组」判只留在**读回**({@link readSessionPermissionRules}:SQL 店读出的行,读不出形 ⇒ `corrupt`)—— 读回与写口是两个问题,
+ *    读回不许判「引擎还肯不肯写」:7.47.x 及以前写下的空串项存量行必须读得出来(运营方清它、准备阶段照常执行它都要先读到它)。
+ * ② **名字**够不够得着工具:core 7.48.0 #1400 起工具段为空的协议名(`mcp__srv__`)也是引擎判官的判词 `unmintable_segment` ⇒ 本仓 7.116.0 起
+ *    自答的那一问(「引擎判官放行、却一只工具都够不着」)整只退役,写口拒码随之由 `request.field_invalid` 变 `rules.legacy_tool_name`。
  *
  * ── 文案也在这里(codex 一轮追加:两条腿各铸一份句子 = 第二份手抄)───────────────────────────────
  * 初版把 wire 文案留在两个路由各自铸,理由是错误文案冻结门(`test/api-error-text-freeze.test.ts`)锚的是
@@ -46,24 +47,9 @@
  */
 import { SessionPolicyError } from "@sema-agent/core";
 import type { SessionPermissionRules, SessionRuleNameRefusal, SessionRulesRecord } from "@sema-agent/core";
-import { emptyToolSegmentOf } from "./namespaced-rule-name.js";
 /** core `SessionPermissionRules` 的桶名全集(派生,不是手抄)。 */
 export declare const SESSION_PERMISSION_RULE_FIELDS: readonly (keyof SessionPermissionRules)[];
-/** 工具名桶里一条引擎判官放行、却一只工具都够不着的协议名(工具段为空);`ns` = 它的协议。 */
-export interface SessionRuleUnreachableName {
-    readonly field: SessionRuleNameRefusal["field"];
-    readonly name: string;
-    readonly ns: NonNullable<ReturnType<typeof emptyToolSegmentOf>>;
-}
-/** 逐桶逐条问引擎读不到的那一形;第一条交回,全部够得着 ⇒ `undefined`。调用方先过引擎判官({@link legacyToolNameRefusalOf} / `assertSessionRuleNamesCurrent`)。 */
-export declare function unreachableSessionRuleNameOf(rules: SessionPermissionRules): SessionRuleUnreachableName | undefined;
-/**
- * SQL 会话规则店写口的同一问(core 判官之后、收紧门之前,与 `assertSessionRuleNamesCurrent` 同点):够不着 ⇒ 抛,一条写语句都不发。
- * 抛的是普通 `Error`(不是 `SessionPolicyError`:core 那张闭集里没有这个词,也不往里塞)—— 本服务的两条 HTTP 写口在读者那一层先拒,
- * 走到这里 = 有一个绕过写口读者的写者,HTTP 上落 500(服务端自身的失误,响亮)。
- */
-export declare function assertSessionRuleNamesReachable(rules: SessionPermissionRules): void;
-/** 一条规则体的**形**问题。判词而非文案(见文件头注的「文案属主」一段)。 */
+/** **读回**的形问题(SQL 店读出的行;判词而非文案,见文件头注的「文案属主」一段)。 */
 export type SessionPermissionRulesShapeProblem = 
 /** 整体不是一只普通对象(`null` / 数组 / 标量 / 缺席)。 */
 {
@@ -74,18 +60,23 @@ export type SessionPermissionRulesShapeProblem =
     kind: "field-not-string-array";
     field: keyof SessionPermissionRules;
 };
-/** 一条**要写进店**的规则体的问题 = 形问题 ∪ S-800 的名字问题(判官 = core 的 `assertSessionRuleNamesCurrent`)。 */
-export type SessionPermissionRulesProblem = SessionPermissionRulesShapeProblem
-/** S-800 / S-1047:形对,但工具名桶里有一条写进去就跑不了的名字;`refusal` = core 判官交回的 detail(原样上 wire)。 */
+/** 一条**要写进店**的规则体的问题 —— 三问都只有一个判官:容器形(本仓)、桶(引擎 `normalizeRules`)、名字(引擎 `assertSessionRuleNamesCurrent`)。 */
+export type SessionPermissionRulesWriteProblem = {
+    kind: "not-an-object";
+}
+/** 引擎不肯把这一桶写成规则表(core 7.48.0 #1471);`refusal` = 引擎的句子(点名桶与值类型),原样上 wire。 */
  | {
-    kind: "legacy-tool-name";
-    refusal: SessionRuleNameRefusal;
+    kind: "field-not-rule-list";
+    field: keyof SessionPermissionRules;
+    refusal: string;
 }
-/** 形对、core 判官也放行,但工具名桶里有一条一只工具都够不着的协议名(工具段为空 —— 引擎读不到的那一形)。 */
+/** S-800 / S-1047:桶形对,但工具名桶里有一条引擎判官判非现役的名字;`refusal` = core 判官交回的 detail(原样上 wire)。 */
  | {
-    kind: "unreachable-tool-name";
-    unreachable: SessionRuleUnreachableName;
+    kind: "legacy-tool-name";
+    refusal: SessionRuleNameRefusal;
 };
+/** 两只读者的判词并集(句子铸点 {@link describeSessionPermissionRulesProblem} 读它)。 */
+export type SessionPermissionRulesProblem = SessionPermissionRulesShapeProblem | SessionPermissionRulesWriteProblem;
 /** 两只读者的读数:有问题给判词,没问题给**已收窄**的规则体(调用方零 cast)。`P` = 这只读者会给的判词集。 */
 export type SessionPermissionRulesRead<P extends SessionPermissionRulesProblem = SessionPermissionRulesProblem> = {
     problem: P;
@@ -95,27 +86,34 @@ export type SessionPermissionRulesRead<P extends SessionPermissionRulesProblem =
     rules: SessionPermissionRules;
 };
 /**
- * **形读者**:读一只 `SessionPermissionRules`,形不对给判词,形对给**只含五桶**的规则体。三个消费者:两条写入腿
- * (经 {@link readWritableSessionPermissionRules})与 SQL 店的**读回**(`session-policy-store-sql.ts` 的
- * `readSessionRulesBody`:读不出形的行判 `corrupt`)。
+ * **读回**的形读者:读一只 `SessionPermissionRules`,形不对给判词,形对给**只含五桶**的规则体。消费者 = SQL 店的读回
+ * (`session-policy-store-sql.ts` 的 `readSessionRulesBody`:读不出形的行判 `corrupt`)。
  *
- * 认识面窄得刻意:**只判形**,不判内容(桶内字符串的 pattern 文法、路径是否可达、tighten-only 是否成立
- * 都不在这里 —— 前两者归 core 的 rule 文法与 `normalizeRules`,后者归 `putRules` 的收紧门;S-800 的名字判官
- * 只在**写口**那一只读者里,见下)。未知键**照旧忽略**(不是新的拒因):core 的 `normalizeRules` 本来就只搬这五桶,
- * 本读者与它同口径。
+ * 认识面窄得刻意:**只判「五桶各是字符串数组」**,不判引擎还肯不肯写(空串 / 纯空白项)、不判名字 —— 那是写口的问题
+ * ({@link readWritableSessionPermissionRules})。7.47.x 及以前写下的空串项存量行必须读得出:读回把它判坏 ⇒ 运营方清它的 PUT 在写前快照上 500、
+ * 准备阶段也读不到它(同 S-800 的「判官只在写口」)。未知键**照旧忽略**:core 的 `normalizeRules` 本来就只搬这五桶,本读者与它同口径。
  */
 export declare function readSessionPermissionRules(raw: unknown): SessionPermissionRulesRead<SessionPermissionRulesShapeProblem>;
 /**
- * **写口读者**(S-800)= 形读者 + 名字判官:两条写入腿(`PUT /v1/sessions/:id/policy`、sync/import 的 `policy`
- * 面经 {@link readSessionRulesRecords})往会话规则店写之前的**唯一**判据。两问,按序:
- *  ① 形(同 {@link readSessionPermissionRules};一份坏形的体答形的 400);
- *  ② 工具名桶里的每一条过 core 的判官({@link legacyToolNameRefusalOf})—— 写进去就让会话之后每一跑都起不来的名字,在写口拒;
- *  ③ 工具名桶里的每一条问引擎读不到的那一形({@link unreachableSessionRuleNameOf}:工具段为空的协议名)—— 写进去永远匹配不到任何挂载工具,在写口拒。
- * 🔴 **只在写口,不在读回**:SQL 店读回同一行时只判形(形读者)。一条早先写进去的退役名行(或够不着的协议名行)必须**读得出来** ——
- * 那是运营方清掉它的唯一路径(operator 的 PUT 先读写前快照),也是 core 准备阶段报 `config.legacy_tool_name`
- * 而不是一只 500 `corrupt` 的前提。把判官放进形读者会让读回把它判坏(7.105.0 车QQ 双库套件实抓,修在同批)。
+ * 一份规则体(写口的入参,或店里读出来的一行)里**引擎不肯写**的第一只桶 —— 没有 ⇒ `undefined`。判官同 {@link engineRuleListOf}。
+ * 两个读者:写口读者(拒)与 2c 重放的同内容判据(`session-sync.ts` 的 `sameRulesContent`:目的端存量行是这一形 ⇒ 答「不同内容」,写交给店的收紧门)。
+ */
+export declare function unwritableRuleListOf(rules: Readonly<Partial<Record<keyof SessionPermissionRules, unknown>>>): {
+    field: keyof SessionPermissionRules;
+    refusal: string;
+} | undefined;
+/**
+ * **写口读者**(S-800)—— 两条写入腿(`PUT /v1/sessions/:id/policy`、sync/import 的 `policy` 面经 {@link readSessionRulesRecords})往会话规则店
+ * 写之前的**唯一**判据,三问按序、每问一个判官:
+ *  ① 容器形 —— 一只普通对象(本仓);
+ *  ② 每一只桶 —— 引擎肯不肯把它写成规则表({@link engineRuleListOf},core 7.48.0 #1471;与引擎店同序:先 `normalizeRules` 再判名);
+ *  ③ 工具名桶里的每一条 —— 引擎判官({@link legacyToolNameRefusalOf}:退役名 / 无前缀 `__` 名 / 对端段或工具段铸不出、为空)。
+ * 拿到规则体 = 店里的 `normalizeRules` 与 `assertSessionRuleNamesCurrent` 对它都不会再抛(同一只判官先问过)。
+ * 🔴 **只在写口,不在读回**:SQL 店读回同一行时只判形({@link readSessionPermissionRules})。早先写进去的退役名行 / 空串项行必须**读得出来** ——
+ * 那是运营方清掉它的唯一路径(operator 的 PUT 先读写前快照),也是 core 准备阶段报 `config.legacy_tool_name` 而不是一只 500 `corrupt` 的前提
+ * (7.105.0 车QQ 双库套件实抓,修在同批)。
  */
-export declare function readWritableSessionPermissionRules(raw: unknown): SessionPermissionRulesRead;
+export declare function readWritableSessionPermissionRules(raw: unknown): SessionPermissionRulesRead<SessionPermissionRulesWriteProblem>;
 /** 一条 `SessionRulesRecord` 的形问题(`policy[]` 的元素级;桶级问题原样转载在 `rules` 位)。 */
 export type SessionRulesRecordProblem = 
 /** `policy` 本身不是数组。 */
@@ -133,11 +131,11 @@ export type SessionRulesRecordProblem =
     kind: "principal-not-a-string";
     index: number;
 }
-/** 第 `index` 条的 `rules` 形不对(转载桶级判词)。 */
+/** 第 `index` 条的 `rules` 写不进(转载写口读者的判词)。 */
  | {
     kind: "rules";
     index: number;
-    problem: SessionPermissionRulesProblem;
+    problem: SessionPermissionRulesWriteProblem;
 };
 /** {@link readSessionRulesRecords} 的读数。 */
 export type SessionRulesRecordsRead = {