@sema-agent/server 7.121.0 → 7.123.0

package/dist/session-policy-wire.js

@@ -1,6 +1,5 @@
-import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent } from "@sema-agent/core";
+import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent, normalizeRules } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
-import { describeEmptyToolSegment, emptyToolSegmentOf } from "./namespaced-rule-name.js";
 const RULE_FIELDS = {
     toolAllow: true,
     toolDeny: true,
@@ -20,33 +19,18 @@ function legacyToolNameRefusalOf(rules) {
         throw e;
     }
 }
-const TOOL_NAME_FIELD_TABLE = { toolAllow: "toolAllow", toolDeny: "toolDeny" };
-const TOOL_NAME_FIELDS = Object.values(TOOL_NAME_FIELD_TABLE);
-export function unreachableSessionRuleNameOf(rules) {
-    for (const field of TOOL_NAME_FIELDS) {
-        for (const name of rules[field] ?? []) {
-            const ns = emptyToolSegmentOf(name);
-            if (ns !== undefined)
-                return { field, name, ns };
-        }
-    }
-    return undefined;
-}
-export function assertSessionRuleNamesReachable(rules) {
-    const unreachable = unreachableSessionRuleNameOf(rules);
-    if (unreachable !== undefined)
-        throw new Error(describeUnreachableSessionRuleName(unreachable));
-}
 function protocolToolNameShapes() {
     return PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(" or ");
 }
+function isRulesObject(raw) {
+    return raw !== null && typeof raw === "object" && !Array.isArray(raw);
+}
 export function readSessionPermissionRules(raw) {
-    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+    if (!isRulesObject(raw))
         return { problem: { kind: "not-an-object" } };
-    const src = raw;
     const rules = {};
     for (const field of SESSION_PERMISSION_RULE_FIELDS) {
-        const v = src[field];
+        const v = raw[field];
         if (v === undefined)
             continue;
         if (!Array.isArray(v) || !v.every((x) => typeof x === "string"))
@@ -55,17 +39,42 @@ export function readSessionPermissionRules(raw) {
     }
     return { rules };
 }
+function engineRuleListOf(field, value) {
+    let normalized;
+    try {
+        normalized = normalizeRules({ [field]: value });
+    }
+    catch (e) {
+        if (e instanceof TypeError)
+            return { refusal: e.message };
+        throw e;
+    }
+    const list = normalized[field];
+    return list === undefined ? {} : { list };
+}
+export function unwritableRuleListOf(rules) {
+    for (const field of SESSION_PERMISSION_RULE_FIELDS) {
+        const judged = engineRuleListOf(field, rules[field]);
+        if ("refusal" in judged)
+            return { field, refusal: judged.refusal };
+    }
+    return undefined;
+}
 export function readWritableSessionPermissionRules(raw) {
-    const read = readSessionPermissionRules(raw);
-    if (read.problem !== undefined)
-        return read;
-    const refusal = legacyToolNameRefusalOf(read.rules);
+    if (!isRulesObject(raw))
+        return { problem: { kind: "not-an-object" } };
+    const rules = {};
+    for (const field of SESSION_PERMISSION_RULE_FIELDS) {
+        const judged = engineRuleListOf(field, raw[field]);
+        if ("refusal" in judged)
+            return { problem: { kind: "field-not-rule-list", field, refusal: judged.refusal } };
+        if (judged.list !== undefined)
+            rules[field] = judged.list;
+    }
+    const refusal = legacyToolNameRefusalOf(rules);
     if (refusal !== undefined)
         return { problem: { kind: "legacy-tool-name", refusal } };
-    const unreachable = unreachableSessionRuleNameOf(read.rules);
-    if (unreachable !== undefined)
-        return { problem: { kind: "unreachable-tool-name", unreachable } };
-    return read;
+    return { rules };
 }
 export function readSessionRulesRecords(raw) {
     if (!Array.isArray(raw))
@@ -91,17 +100,14 @@ export function describeSessionPermissionRulesProblem(p) {
     switch (p.kind) {
         case "not-an-object": return "rules must be a SessionPermissionRules object";
         case "field-not-string-array": return `${p.field} must be an array of strings`;
+        case "field-not-rule-list": return p.refusal;
         case "legacy-tool-name": return describeLegacyToolName(p.refusal);
-        case "unreachable-tool-name": return describeUnreachableSessionRuleName(p.unreachable);
         default: {
             const unhandled = p;
             throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
         }
     }
 }
-function describeUnreachableSessionRuleName(u) {
-    return `${u.field} names ${displayListEntry(u.name)}, which can never match a tool (${describeEmptyToolSegment(u.ns)}), so nothing was written`;
-}
 function describeLegacyToolName(r) {
     const why = r.guidance !== undefined ? ` (${r.guidance})` : "";
     switch (r.verdict) {
@@ -126,8 +132,7 @@ export function legacyToolNameProblemOf(p) {
         case "rules":
             switch (p.problem.kind) {
                 case "not-an-object":
-                case "field-not-string-array":
-                case "unreachable-tool-name":
+                case "field-not-rule-list":
                     return undefined;
                 case "legacy-tool-name":
                     return p.problem.refusal;

package/dist/session-sync.d.ts

@@ -159,7 +159,11 @@ export declare function planSync(sessionId: string, srcBackend: StoreBackend, ds
  *  无条件写都 rev+1,而 rev 是 operator 乐观锁的 CAS 令牌(`PutRulesOptions.expectedRev`),
  *  幂等重试/无害重复同步不该把在途 CAS 打失败。归一化用 core 的 `normalizeRules`(store 落盘
  *  前走同一函数 ⇒ 两侧同坐标);`stripRev` 去掉记录内嵌的 rev(`listBySession` 的 rules 含 rev,
- *  它不是内容)。 */
+ *  它不是内容)。
+ *  🔴 core 7.48.0 起 `normalizeRules` 对「不是一列非空字符串」的桶抛 `TypeError`。`incoming` 由写口读者保证是引擎肯写的
+ *  (`session-policy-wire.ts` `readSessionRulesRecords`);`stored` 可能是 7.47.x 及以前写下的空串项存量行 —— 读得出、引擎却不肯再写。
+ *  这种行与任何肯写的 `incoming` 都**不同内容**(它多一个空项),所以答 `false`(判官 = 写口读者那一只 `unwritableRuleListOf`,不拿它跑 normalize):
+ *  写照常交给店 —— 店的收紧门对它照常判(operator 照写,是清旧行的出路;非 operator 删空串 deny 项被读成放宽 ⇒ 403,与 7.122.0 同答)。 */
 export declare function sameRulesContent(stored: StoredSessionRules | null, incoming: SessionPermissionRules): boolean;
 /** [ref] ① 的重放腿共享实现:PUSH 路由的两条 policy 重放腿(Phase A identical 短路支 / Phase B
  *  commit 后支)都从这里走 —— 等内容跳过(rev 零漂移),真变更照常落地(E6 tighten-only 门在

package/dist/session-sync.js

@@ -1,5 +1,6 @@
 import { classifySyncRelationship } from "./session-sync-kernel.js";
 import { normalizeRules, stripRev } from "@sema-agent/core";
+import { unwritableRuleListOf } from "./session-policy-wire.js";
 export function fileHistoryImportFace(fs) {
     const candidate = fs?.importHistory;
     if (typeof candidate !== "function")
@@ -54,7 +55,7 @@ export async function planSync(sessionId, srcBackend, dstBackend) {
     return classifySyncRelationship(srcEntries, dstEntries);
 }
 export function sameRulesContent(stored, incoming) {
-    if (stored === null)
+    if (stored === null || unwritableRuleListOf(stored) !== undefined)
         return false;
     const norm = (r) => JSON.stringify(normalizeRules(stripRev(r)));
     return norm(stored) === norm(incoming);

package/dist/sighup-idle.d.ts

@@ -8,11 +8,17 @@
  * 有界自灭=T11 保留;第二个 SIGHUP 升级 escalate(既有 drain 路径,操作员硬梯子)。
  *
  * 诚实边界:idle-but-live 的 peer(两 turn 之间静默超过窗口)会碰到引擎已退→壳 dead-respawn 1-2s 自愈
- * (伤害面从 mid-turn 斩降级为冷启动)。若壳侧确认每活会话对引擎持长连,可把连接数并入 inflight 判据。
+ * (伤害面从 mid-turn 斩降级为冷启动)。
+ * S-1281:附着(打开着的 SSE 流)是判据的第二格 `attached` —— 只读订阅自此不进 inflight(排空不该等一个看着的壳),而一个只挂着订阅流的
+ * peer 壳(cli 附着形:`GET /v1/approvals/stream` 常开)仍然是「有人在用」,靠这一格不被当成孤儿。修前这一形是订阅流被算进 inflight
+ * 时顺带挡住的;拆开之后两件事各有一格,规则不变:inflight = 0 ∧ attached = 0 ∧ 活性静默满窗才关。
  */
 export interface SighupIdleDeps {
     /** This replica's in-flight legs (drainState.inflight). */
     inflight: () => number;
+    /** S-1281:打开着的 SSE 流条数(drainState.attachedStreams,附着租约同一只 getter)。> 0 ⇒ 有壳挂着,同 inflight 一样重置窗口。
+     *  缺席 ⇒ 视为 0(单测 / 嵌入形)。 */
+    attached?: () => number;
     /** MONOTONIC-clock ms of the last non-probe HTTP request (drainState.lastActivityAt). Covers what inflight
      *  can't: admitted-but-not-yet-registered requests (auth/prepare/claim phases) and sub-tick short requests —
      *  and keeps an idle-but-live peer (still listing/browsing) alive. Absent ⇒ inflight-only semantics.

package/dist/sighup-idle.js

@@ -22,16 +22,16 @@ export function createSighupIdleHandler(deps) {
         }
         armedAt = now();
         const inflight = deps.inflight();
-        idleSince = inflight === 0 ? now() : null;
-        deps.log("sighup_idle_watch_armed", { inflight, idleGraceMs: deps.idleGraceMs });
+        const attached = deps.attached?.() ?? 0;
+        idleSince = inflight === 0 && attached === 0 ? now() : null;
+        deps.log("sighup_idle_watch_armed", { inflight, attached, idleGraceMs: deps.idleGraceMs });
         watch = setInterval(() => {
             if (deps.isStopped()) {
                 clearInterval(watch);
                 watch = undefined;
                 return;
             }
-            const n = deps.inflight();
-            if (n > 0) {
+            if (deps.inflight() > 0 || (deps.attached?.() ?? 0) > 0) {
                 idleSince = null;
                 return;
             }

package/dist/spec-fields.d.ts

@@ -51,16 +51,16 @@ export declare const MAX_TASK_AGENTS = 32;
  * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
  * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法与名字**是引擎的读法:允侧读不出的条目(`*` / 写路径 / 域名 / 退役名 …)引擎在开跑时发
  * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目(文法或名字层)在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
- * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 + 引擎读不到的那一形 ⇒ 400)。
+ * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 ⇒ 400)。
  * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界;与请求 allow 桶、运维表同一只),
  * 在 {@link skillToolListRefusal} 里判;无长度帽([ref])。
  */
 export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 /**
  * 一条技能(形已过两道门的字符串数组判)的两只清单在受理口的拒因 —— 都过 ⇒ `undefined`。两处受理口同调:顶层 `skills[]`
- * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。两问:条数帽;引擎读不到、却永远匹配不到的
- * 条目(工具段为空的协议名,`rule-entry-list.ts` 那一份,与配置表、会话规则写口同一只)。退役名 / 对端段铸不出 / 读成空的条目是引擎的读法(见上):
- * 允侧交引擎通告,拒侧由 `resolveSpec` 拒。
+ * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。一问:条数帽。退役名 / 对端段或工具段铸不出、为空 /
+ * 读成空的条目是引擎的读法(见上):允侧交引擎通告,拒侧由 `resolveSpec` 拒(7.116.0–7.122.x 本仓在这里另拒工具段为空的协议名,core 7.48.0 #1400 起
+ * 它是引擎判官的判词,随之退役)。
  */
 export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。

package/dist/spec-fields.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
-import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -76,9 +76,6 @@ export function skillToolListRefusal(skill) {
         const over = allowLayerEntryCountIssue(`skill.${key}`, list);
         if (over !== undefined)
             return over.message;
-        const empty = emptyToolSegmentEntryOf(list);
-        if (empty !== undefined)
-            return describeEmptyToolSegmentEntry(`skill.${key}`, empty);
     }
     return undefined;
 }

package/dist/task-settings.d.ts

@@ -13,8 +13,8 @@
  *
  * 🔒 SECURITY INVARIANTS (SDK settings.ts §3.3) —— **scope: the `settings.permissions` channel this module projects, and only it**:
  *  - `deny` / `ask` are folded via `tightenTaskSpec` (deny-wins `combinePolicies`); it THROWS on any override that would
- *    LOOSEN a stricter base safety field. Through those two buckets the client can only ADD denies / asks / handsReadOnly on
- *    top of the deployment + operator baseline.
+ *    LOOSEN a stricter base safety field. Through those two buckets the client can only ADD denies / asks on top of the
+ *    deployment + operator baseline.
  *  - `allow` (server 7.117.0, core 7.42.0) is NOT a policy: the list rides WHOLE and verbatim into `TaskSpec.allowedTools`,
  *    the request member of the engine's ONE allow layer (beside a deployment's `RunnerDeps.allowedTools`, a person's stored
  *    rows, an active skill's `allowed-tools` and a PreToolUse hook's `allow`), read under one predicate. It IS an accepted
@@ -81,12 +81,13 @@ export declare function coercePermissionModeStrict(raw: unknown): PermissionMode
  * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的
  * `permissionModeAfter`)。core 的契约句是 `present-plan-tool.js`:「If the plan is approved, the run
  * continues (and any read-only restriction is lifted)」—— 而 core 顶层 resume 把宿主的续跑配置**整体**
- * 展开成新一段 spec、不继承停靠点的 `handsReadOnly` / `enablePlanMode`(`runtask.ts`),所以「松开」这
- * 件事的属主在**本仓装配续跑配置的那一处**。批准者要说的正是「松到哪一档」。
+ * 展开成新一段 spec、读的是那段 spec 上的模式词(`TaskSpec.permissionMode`),所以「松开」这件事的属主在
+ * **本仓装配续跑配置的那一处**(改写续跑体上的模式词)。批准者要说的正是「松到哪一档」。
  *
  * 🔴 **闭集为什么只有这两个词**:它是 CC `ExitPlanMode` 三选卡上那两张 Yes 卡(「Yes, and auto-accept
- * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `edit`/`reject` 两个
- * 决裁表达,`bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ * edits」/「Yes, and manually approve edits」)的对位;`plan` 自己(= 不松开)由 `reject` 表达,
+ * `bypassPermissions` / `auto` 不在这张卡上 —— 一个批准动作不该顺带把部署的 ask 面整个关掉。
+ * 收这一位的决定 = 把计划带出 plan 的决定(`approve` / `edit`,{@link planReviewDecisionExitsPlan})。
  *
  * 🔴 **不手抄词表**:`satisfies readonly PermissionMode[]` 让「本表的成员必须仍是 core 的模式词」成为**编译期**事实 ——
  * core 某天改名/删词,这里就是红的,而不是静默留一个没人认的词。
@@ -97,16 +98,39 @@ export type PlanApprovePermissionModeAfter = (typeof PLAN_APPROVE_PERMISSION_MOD
 /** S-433 值闭集判据(wire 门用)。**宽臂一个都没有**:词表外的值 400 响亮拒 —— 这一位选的是批准之后
  *  模型有没有手,把一个拼错的词折成任何一档都是安全轴上的静默降级([ref]「无静默 fail-open」)。 */
 export declare function isPlanApprovePermissionModeAfter(raw: unknown): raw is PlanApprovePermissionModeAfter;
+/**
+ * `plan_review` 的这个决定把计划**带出 plan** 吗 —— 判据与引擎**同一句**:引擎在 plan_review 的续跑上出 plan 的条件是「决定不是 `reject`」
+ * (`approve` 按原计划开干、`edit` 按人改过的计划开干;`reject` 送回去重做计划,plan 保留)。两个读者读这一只:HTTP 门(`permissionModeAfter`
+ * 只配出 plan 的决定)与写回(`drivePlanReview` 把存储体的词写成 `permissionModeAfter ?? "default"`)。两处各写一句判据,就会出现
+ * 「写回按 approve / edit 写、门只在 approve 上收」那种分家。闭集穷尽 switch:决定词表加一词 ⇒ 编译红。
+ */
+export declare function planReviewDecisionExitsPlan(decision: "approve" | "edit" | "reject"): boolean;
+/**
+ * 运维 `AUTONOMY=plan` 的**入口词地板**盖进提交体 —— 此后一条 run 的模式词只有存储体顶层 `permissionMode` 一个源。
+ *
+ * 入口词 = `runtime-governance.ts` `entryPermissionMode(体的生效词, 地板).effective`(「词在地板下变成什么」的唯一一只函数;秩是 core 的)。本函数只加
+ * 「写进体」这一半:地板缺席 ⇒ 体**原物**交回(零字节变化);地板在场 ⇒ 新体 `{ ...body, permissionMode: 入口词 }`,调用方的对象不改;bundle 的
+ * `settings.permissions.defaultMode` 不动 —— 顶层赢过它({@link effectivePermissionMode} 的优先序),再改它就是同一语义的第二个写者。
+ *
+ * 调用点一个:提交入口(`http/admission.ts` 的 `prepareSpec`:值形门全部判完之后、`resolveSpec` 之前)。那一份体就是首跑装配读的体,也是
+ * `buildCheckpointCtx` 持久化的体 ⇒ 一处盖章同时覆盖首跑与每一次续跑重建;装配腿与续跑腿都不读地板(两处读 = 两个源)。
+ * 另一个写者是 `plan_review` 写回(`http/resume-legs.ts` `drivePlanReview`,判据 {@link planReviewDecisionExitsPlan})。
+ * 热改 `AUTONOMY` 只影响之后提交的任务:在飞的 run 保持它出生时盖下的词。地板的属主是 `runtime-governance.ts` 的 `autonomyModeFloor`。
+ */
+export declare function stampEntryPermissionMode<B extends {
+    permissionMode?: unknown;
+    settings?: unknown;
+}>(body: B, floor: PermissionMode | undefined): B;
 /**
  * S-433 —— **一条已持久化的提交体的生效 permission mode**,单点。
  *
  * 它只是把 {@link effectivePermissionMode} 与「拿哪一份 settings 去问」这**一对**绑在一起:后者是
  * `parseTaskSettings(body.settings)`(resume 重放共用的宽容解析层)。两处各写一遍这一对,就会在
  * 「某天改成用别的 settings 去算生效模式」的那一拍静默分家 —— 而分家在这条轴上的形态是「wire 门说
- * 这条任务不是只读起步、装配腿却按只读起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
+ * 这条任务不是 plan 起步、装配腿却按 plan 起步重建」,两个 4xx/行为各说各话,tsc 一声不响。
  *
- * ⚠️ 射程:**只管持久化体这一路**。首跑那一路的生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是
- * 场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
+ * ⚠️ 射程:**只管持久化体这一路**(含即将成为持久化体的那一份提交体 —— {@link stampEntryPermissionMode} 读它)。首跑那一路的
+ * 生效模式在 `boot/resolve-spec.ts` 单点算(它吃的是场景折叠后的 settings),本函数刻意不去冒充那一处的属主。
  */
 export declare function storedBodyPermissionMode(body: {
     permissionMode?: unknown;
@@ -430,14 +454,12 @@ export interface FsWriteGateWiring {
 }
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;
-    handsReadOnly?: boolean;
-    enablePlanMode?: boolean;
 };
 /**
  * Apply a client's parsed per-request settings onto a base `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link
- * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1 — and
- * `handsReadOnly`/`onAsk` can only narrow). `tightenTaskSpec` THROWS `TaskSpecTightenError` if any override would
- * LOOSEN a stricter base — surfaced by the caller as a 4xx (a client settings stamp that tries to widen is a
+ * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1). `tightenTaskSpec`
+ * THROWS `TaskSpecTightenError` if any override would LOOSEN a stricter base — surfaced by the caller as a 4xx (a
+ * client settings stamp that tries to widen is a
  * client error, never a silent weakening). `model`/`outputStyle` are applied directly (model is the caller's
  * choice WITHIN the catalog — the caller gates it before calling; outputStyle appends to the system prompt).
  *

package/dist/task-settings.js

@@ -1,11 +1,12 @@
 import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
-import { allowLayerEntryCountIssue, describeAllowLayerOverCap, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { entryPermissionMode } from "./runtime-governance.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 export const PERMISSION_MODE_WORDS = PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function coercePermissionMode(raw) {
@@ -23,6 +24,19 @@ export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
 export function isPlanApprovePermissionModeAfter(raw) {
     return PLAN_APPROVE_PERMISSION_MODES_AFTER.includes(raw);
 }
+export function planReviewDecisionExitsPlan(decision) {
+    switch (decision) {
+        case "approve":
+        case "edit":
+            return true;
+        case "reject":
+            return false;
+    }
+}
+export function stampEntryPermissionMode(body, floor) {
+    const entry = entryPermissionMode(storedBodyPermissionMode(body), floor);
+    return entry.floor === undefined ? body : { ...body, permissionMode: entry.effective };
+}
 export function storedBodyPermissionMode(body) {
     return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);
 }
@@ -306,16 +320,6 @@ function createWorkflowAskPolicy(isExempt) {
         nameSets: [{ ask: WORKFLOW_ASK_NAMES }],
     };
 }
-function createWorkflowPlanDenyPolicy() {
-    return {
-        check(req) {
-            return heldRuleName(req, isWorkflowName) !== undefined
-                ? { action: "deny", message: `Plan mode is active — "${req.toolName}" is a write/mutating tool and is read-only-blocked.`, decisionReason: "rule" }
-                : { action: "allow" };
-        },
-        nameSets: [{ deny: WORKFLOW_ASK_NAMES }],
-    };
-}
 function rejectUnmatchableSettingsNames(perms, pathBases) {
     if (pathBases?.home === undefined) {
         for (const [field, names, behavior] of [
@@ -343,9 +347,6 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
     }
-    const emptyAllow = perms.allow !== undefined ? emptyToolSegmentEntryOf(perms.allow) : undefined;
-    if (emptyAllow !== undefined)
-        throw new Error(describeEmptyToolSegmentEntry("permissions.allow", emptyAllow));
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
@@ -380,15 +381,14 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     };
     const basePolicy = compose();
     switch (defaultMode) {
-        case "plan":
-            return { toolPolicy: compose(createWorkflowPlanDenyPolicy()), handsReadOnly: true, enablePlanMode: true };
         case "acceptEdits": {
             const p = compose(fsWriteGate(true), createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }
         case "default":
         case "auto":
-        case "dontAsk": {
+        case "dontAsk":
+        case "plan": {
             const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
             return p ? { toolPolicy: p } : {};
         }
@@ -398,13 +398,10 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
     }
 }
 export function applyTaskSettings(base, settings, gate, workflowGate) {
-    const { toolPolicy, handsReadOnly, enablePlanMode } = deriveSettingsPolicy(settings, gate, workflowGate);
+    const { toolPolicy } = deriveSettingsPolicy(settings, gate, workflowGate);
     let next = base;
-    if (toolPolicy !== undefined || handsReadOnly !== undefined) {
-        next = tightenGoverned(next, { ...(toolPolicy !== undefined ? { toolPolicy } : {}), ...(handsReadOnly !== undefined ? { handsReadOnly } : {}) });
-    }
-    if (enablePlanMode)
-        next = { ...next, enablePlanMode: true };
+    if (toolPolicy !== undefined)
+        next = tightenGoverned(next, { toolPolicy });
     const allow = settings.permissions?.allow;
     if (allow !== undefined)
         next = { ...next, allowedTools: allow };

package/dist/tool-approval.d.ts

@@ -19,6 +19,12 @@ export type ApprovalGateKind = (typeof APPROVAL_GATE_KINDS)[number];
 export declare function isApprovalGateKind(k: string | undefined): k is ApprovalGateKind;
 /** 两方言同形的 SQL IN 片段(值为闭集常量字面,无注入面)。 */
 export declare const APPROVAL_GATE_KINDS_SQL_IN: string;
+/**
+ * 耐久回决口 `POST /v1/approvals/:sessionId/decide` 的路径串 —— S-1280:迟到回决口 PARKING 臂 202 体的机读指路 `decidePath`。
+ * 路由表那一行(`http/routes/approvals-assistant.ts` 的 `approval-decide`)按 pattern 匹配它;两者同形由往返钉守
+ * (`test/parked-late-decision.test.ts` G3-c:本函数的输出经 `lookupRoute` 落 `approval-decide`)。会话段按路由的 `safeDecode` 对称编码。
+ */
+export declare function approvalDecidePath(sessionId: string): string;
 /**
  * 🔴 [ref](案A)追记 F6 —— durable 回决口(`POST /v1/tasks/:taskId/asks/:askId/decision`)的 **200 体
  * additive 判别位**:这次决议在**本副本**上有没有被一条活着的腿消费掉。

package/dist/tool-approval.js

@@ -39,6 +39,12 @@ const DEFAULT_PARK_TOMBSTONE_MAX = 2000;
 const DEFAULT_PARK_TOMBSTONE_TTL_MS = 60 * 60_000;
 const DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX = 128;
 const PARKING_RETRY_AFTER_MS = 250;
+export function approvalDecidePath(sessionId) {
+    return `/v1/approvals/${encodeURIComponent(sessionId)}/decide`;
+}
+function parkSessionOf(row) {
+    return row.sourceTaskId === row.sessionId && row.sessionId !== row.taskId ? row.sessionId : undefined;
+}
 function ruleMaterialCarriesCredentialShape(command) {
     return redactSecretsWithArms(command, { observe: false }).arms.has("full");
 }
@@ -1961,17 +1967,23 @@ export class ToolApprovalCoordinator {
                 return this.replayDecidedAsk(id, row, parsed);
             case "PARKED":
                 return this.redeemParkedAsk(id, tomb, row, parsed, httpReq, principal);
-            case "PARKING":
+            case "PARKING": {
+                const parkSession = parkSessionOf(row);
                 return {
                     status: 202,
                     body: {
                         approvalId: id,
                         askId: row.askId,
                         reason: "parking_in_progress",
+                        message: parkSession !== undefined
+                            ? "parking in progress — not applied; retry after retryAfterMs or answer through decidePath"
+                            : "parking in progress — not applied; retry after retryAfterMs or answer through the parent session's durable decide",
                         retryAfterMs: PARKING_RETRY_AFTER_MS,
+                        ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}),
                         ...this.lateRuleRefusal(parsed),
                     },
                 };
+            }
             case "DENIED":
                 return this.notPending("denied");
             case "VOID":

package/dist/trace/redact.d.ts

@@ -179,9 +179,9 @@ export declare function redactDeepWith(value: unknown, leaf: (s: string) => stri
  */
 export declare function redactedPreview(value: unknown, cap?: number): string | null;
 /**
- * **这一位是不是一个层级式绝对 URL**(有 authority 的那一族)—— 本铸点与**模型路由三键拒启**
- * (`model-route-url.ts` 第一臂)共用的**同一只**判据:两处曾各判各的,而 `URL.canParse` 单独为真的
- * **不透明** URL 恰好是「凭据位看不见」的那一形。
+ * **这一位是不是一个层级式绝对 URL**(有 authority 的那一族)—— 本铸点与 `url-shape.ts` 的 http(s) 形判官
+ * (模型路由三键 / 中心基址三席 / 公告地址 / embedder / A2A 的拒启都经它问到这里)共用的**同一只**判据:两处曾各判各的,
+ * 而 `URL.canParse` 单独为真的**不透明** URL 恰好是「凭据位看不见」的那一形。
  *
  * ⚠️ **射程如实**(车JC 复审去幻觉轮:此处原文写的是「本仓唯一判据」,亲读证伪)—— 仓里**另有一处**仍用
  * 裸 `URL.canParse` 回答同一个问题,且**刻意不在射程内**(改它是一次新的行为面拒启,按三问另开车):

package/dist/unattended-permission-mode.d.ts

@@ -5,7 +5,9 @@
  * 本仓**自己铸** spec、**没有调用方**能在请求上表态模式的腿 —— leader worker(`src/leader/wire.ts` provisionWorker 两车道)、leader 的
  * 修复腿(集成沙箱修复 `mkRepair`、模块门修复 `leader.ts` `runModuleGate`、单代理修复环 `repair-wire.ts` `attachRepairLoopDeps`)、run-local
  * (`src/run-local.ts`,一次性 CLI)与这些腿的 durable 续跑重挂(`CheckpointCtx.unattendedLeg`)—— 经 {@link withUnattendedLeg} 这**一只**
- * 合并口铸两键:`permissionMode: "default"`(显式:续跑时盖过 checkpoint 记下的旧模式)与 `onAsk` = {@link createUnattendedOnAsk}。
+ * 合并口铸两键:`permissionMode`(`"default"`,显式:续跑时盖过 checkpoint 记下的旧模式;**钳在 spec 自带的模式词之下** —— run-local 在
+ * 它自建 spec 的出生点盖下的运维 `AUTONOMY=plan` 地板、续跑重建读到的存储体的 `plan` 都是天花板,本腿的 `default` 落在它下面就是 `plan`,
+ * 不把它降回去)与 `onAsk` = {@link createUnattendedOnAsk}。
  * 那只 onAsk 读 `AskRequest.classes` **整体**:集非空且每一类都在 {@link UNATTENDED_ANSWERED_CLASSES}(= `{ordinary}`,常量,不是旋钮)⇒ 答 yes
  * —— **以策略的名义**(S-953 / core 7.39.0 #1265:`{allow:true, settledBy:"policy", approver:"unattended_class_answer"}` ⇒ core 结算 `policy_allowed` /
  * `who.party:"policy"`;修前是裸 `true`,core 把机器的放行记成**人**批 `human_allowed` / `person`);
@@ -17,18 +19,17 @@
  *    不答 ⇒ 整问不答。
  *  · **缺席 = 不答的类**:没盖 `origin` 的站(共享制品读确认,KL-1214-a)、部署自铸的请求、7.37.0 之前 park 的行续跑(KL-1214-b,续跑不补)
  *    都不带类 ⇒ 不答。
- *  · **答集只 `ordinary`**:七个保护类(`probe` / `write_protection` / `rule_unreadable` / `tool_marks_mcp` / `tool_marks_a2a` /
- *    `transcript_write` / `artifact_shared_read`)与 `mode`(plan 的写问)留给人;`RELEASABLE_ASK_CLASSES` 之外的类(hook / ask_rule /
- *    org_rule / operator_forced / …,权威为人提的问)恒不答。function approver 的 yes 是「这一次调用的答」—— 它连 `requiresRealApproval`
+ *  · **答集只 `ordinary`**:引擎可放行的类(core `releasableAskClassesFor(face)`,按问的面读 —— 哪些类、哪一面放得行以引擎的表为准,本注不抄名单)里除 `ordinary`
+ *    之外的保护类与 `mode`(plan 的写问)留给人;可放行类之外的类(权威为人提的问)恒不答。function approver 的 yes 是「这一次调用的答」—— 它连 `requiresRealApproval`
  *    都清得掉(引擎分不出函数与人),所以带那一位的类(`transcript_write` / `rule_unreadable` / `artifact_shared_read` / `policy_rra`)不进答集
- *    (钉:test/unattended-permission-mode.test.ts「答集 ⊆ RELEASABLE_ASK_CLASSES,且与 RRA_EXPLAINERS ∪ {policy_rra} 不交」)。
+ *    (钉:test/unattended-permission-mode.test.ts「答集 ⊆ 每一面的 releasableAskClassesFor(face),且与 RRA_EXPLAINERS ∪ {policy_rra} 不交」)。
  *  · **`ordinary` 覆盖什么**(core 原句):`Read` 工具的根外读、shell 的根外**写**(`echo x > <outside>` —— 写守卫只判保护表)、模式写门对每一次
  *    covered write 的问、形状层对非只读 shell 的问;shell 的根外**读**(`cat <outside>`)是 `probe`,不答。
  *
  * ## 三问
  *  · **谁需要**:用 leader / run-local 的部署 —— 普通写与非只读命令照跑(7.105.0 行为;7.106.0–7.108.0 过渡形靠 `bypassPermissions` 宽放给出的同一结果)。
- *  · **谁受伤**:① 设了 `UNATTENDED_PERMISSION_MODE` 的部署 —— 起服拒启(`config.ts` 墓碑表,`removed` 族);② 靠过渡形缺省 bypass 放行
- *    `probe` / MCP·A2A 标记工具 / 转录写 / 规则店读不出 / 共享制品读这六类的无人值守流程 —— 改成不答(有席交席、无席 park 或拒)。安全轴收紧。
+ *  · **谁受伤**:① 设了 `UNATTENDED_PERMISSION_MODE` 的部署 —— 起服拒启(`config.ts` 墓碑表,`removed` 族);② 靠过渡形缺省 bypass 放行答集之外的保护类
+ *    (哪些类见 `releasableAskClassesFor` 与答集的不变量钉,本注不抄名单)的无人值守流程 —— 改成不答(有席交席、无席 park 或拒)。安全轴收紧。
  *  · **什么补偿**:有人的腿照问人(run-local 在终端里跑;leader 配 durable 审批块 ⇒ park 到 `/decide`);答集是 core 推荐形的常量 ——
  *    要放更多类的部署先立案候裁,不开旋钮。
  *
@@ -43,10 +44,11 @@
  *  · 续跑腿上的协调器席:`http/resume-legs.ts` 只在「run 行在场 ∧ 活卡协调器在场」时给 spec 另装活席(`deps.toolApproval && taskId`)——
  *    leader worker 的会话没有 run 行,那一装今天够不着本腿;哪天够着了,活席会盖掉本层(方向 = 多问人,fail-closed),见收车档 ⑤。
  */
-import type { AskClass, AskRequest, OnAsk, TaskSpec } from "@sema-agent/core";
+import type { AskClass, AskRequest, OnAsk, PermissionMode, TaskSpec } from "@sema-agent/core";
 /**
  * 按类作答的**答集** —— core §4.6e 推荐形:机器只答 `ordinary`。**常量,不是旋钮**([ref]):要放更多类是部署级的安全决定,先立案候裁。
- * 不变量(测试钉):答集 ⊆ core `RELEASABLE_ASK_CLASSES`,且与带 `requiresRealApproval` 的类(core `RRA_EXPLAINERS` ∪ `policy_rra`)不交;`mode` 不在其中。
+ * 不变量(测试钉):答集 ⊆ core 每一面的可放行类 `releasableAskClassesFor(face)`(本层不读问的面,同一只答集答每一面的问),且与带 `requiresRealApproval` 的类
+ * (core `RRA_EXPLAINERS` ∪ `policy_rra`)不交;`mode` 不在其中。
  */
 export declare const UNATTENDED_ANSWERED_CLASSES: ReadonlySet<AskClass>;
 /**
@@ -66,13 +68,15 @@ export declare function unattendedAnswers(req: Pick<AskRequest, "classes">): boo
 export declare function createUnattendedOnAsk(seat: UnattendedSeat | undefined): UnattendedSeat;
 /** {@link withUnattendedLeg} 铸进 spec 的两键。 */
 export type UnattendedLegSpec = {
-    readonly permissionMode: "default";
+    readonly permissionMode: PermissionMode;
     readonly onAsk: UnattendedSeat;
 };
 /**
- * 无人值守腿并进一条 spec —— 各腿的**唯一**合并口:`permissionMode: "default"` + `onAsk: createUnattendedOnAsk(seat)`。`seat` = 本腿的
- * 活审批席(run-local 递它的 `createLocalApprover`;leader 各腿与续跑重挂无席,不递)—— 席只经这个参数进来,从不从 spec 上读。
- * 调用点必须在 spec 其余键(含治理折叠)**之后**调它;本口不碰 `toolPolicy`(没有策略层要并:过渡形的写保护拒层已退役)。
+ * 无人值守腿并进一条 spec —— 各腿的**唯一**合并口:`permissionMode` = `"default"` 钳在 spec 已有的模式词之下(`runtime-governance.ts`
+ * `entryPermissionMode("default", spec 的词)`,与入口地板同一只函数、底下是 core 的钳;spec 无词 ⇒ `"default"`)+ `onAsk: createUnattendedOnAsk(seat)`。`seat` = 本腿的活审批席(run-local
+ * 递它的 `createLocalApprover`;leader 各腿与续跑重挂无席,不递)—— 席只经这个参数进来,从不从 spec 上读。
+ * 调用点必须在 spec 其余键(含治理折叠)**之后**调它 —— spec 自带的 `plan` 由此被读到、留住;本口不碰 `toolPolicy`(没有策略层要并:过渡形的
+ * 写保护拒层已退役)。
  */
 export declare function withUnattendedLeg<S extends Partial<TaskSpec>>(spec: S, seat?: UnattendedSeat): S & UnattendedLegSpec;
 //# sourceMappingURL=unattended-permission-mode.d.ts.map

package/dist/unattended-permission-mode.js

@@ -1,3 +1,4 @@
+import { entryPermissionMode } from "./runtime-governance.js";
 export const UNATTENDED_ANSWERED_CLASSES = new Set(["ordinary"]);
 export const UNATTENDED_POLICY_APPROVER = "unattended_class_answer";
 function unattendedPolicyYes() {
@@ -11,6 +12,7 @@ export function createUnattendedOnAsk(seat) {
     return (req, signal) => (unattendedAnswers(req) ? unattendedPolicyYes() : seat !== undefined ? seat(req, signal) : "unavailable");
 }
 export function withUnattendedLeg(spec, seat) {
-    return { ...spec, permissionMode: "default", onAsk: createUnattendedOnAsk(seat) };
+    const permissionMode = entryPermissionMode("default", spec.permissionMode).effective;
+    return { ...spec, permissionMode, onAsk: createUnattendedOnAsk(seat) };
 }
 //# sourceMappingURL=unattended-permission-mode.js.map

package/dist/url-shape.d.ts

@@ -0,0 +1,31 @@
+/** 座位可以禁掉的部件(闭集;判序 = 本数组序)。 */
+export declare const HTTP_URL_PARTS: readonly ["userinfo", "query", "fragment"];
+export type HttpUrlPart = (typeof HTTP_URL_PARTS)[number];
+/** 判官的拒因词(闭集):形不对,或一件被禁的部件在场。 */
+export type HttpUrlFlaw = "not-http-url" | HttpUrlPart;
+/** 「不是一个 http(s) URL」的规则词 —— 不透明形、不可解析、层级式非 http(s) 同一句;只点名规则,不回显 scheme。钉读这一只,不手抄。 */
+export declare const HTTP_URL_SHAPE_RULE = "is not a parseable http(s) URL (scheme must be http or https; it must look like http(s)://host[:port][/path])";
+/**
+ * 判:合格 ⇒ `[]`;否则按判序交回规则词。形不对且不透明 ⇒ 只有 `not-http-url`(部件在不透明形上无从判,
+ * 也不需要判 —— 那一形整只不收);层级式非 http(s) ⇒ `not-http-url` 之后照判部件。
+ * 返回类型按 `forbid` 收窄:座位没禁的部件不会出现在答案里(调用方的穷举 switch 因此不需要一条「不可达」臂)。
+ */
+export declare function httpUrlFlaws<P extends HttpUrlPart>(raw: string, forbid: readonly P[]): ReadonlyArray<"not-http-url" | P>;
+/** 一个拒因词的规则句(穷举;新词不补 = 编译红)。句子只说规则,不含值。 */
+export declare function httpUrlRule(flaw: HttpUrlFlaw): string;
+/**
+ * 拒句里值的样子(纯函数):合格的 http(s) 形 ⇒ 只到 origin(`scheme://host[:port]`,过展示铸点),origin 之后还有东西(userinfo /
+ * 路径 / query / fragment)⇒ 接一枚 `/…`;其余(不透明 / 不可解析 / 层级式非 http(s))⇒ 展示铸点的占位 `«redacted:url»` ——
+ * 拒句里不出现非 http(s) 的 scheme 词(主会话增补裁:写成 scheme 的令牌 `<48hex>://host` 曾原样进 fatal 行)。
+ *
+ * 🔴 为什么只到 origin(车内 codex 对抗复审 r1 [high],亲跑复现):展示铸点的路径段**逐字**保留、只靠形状律认令牌形 ——
+ * 形状律认不出的令牌(48 位十六进制拉取令牌就是一例)放在路径上会原样进拒句。拒句落在 fatal 行、stderr、每一轮的请求失败日志,
+ * 这几处不赌形状律的覆盖面:座位名 + 规则词已经说清了哪一席错在哪,值只需要认得出是哪一台主机。
+ */
+export declare function buildRefusalShownUrl(raw: string): string;
+/**
+ * 拒句的**唯一**铸点:`<subject> <规则句>[; <规则句>…]; got "<值的样子>"`(`build*` = 纯数据)。
+ * 值只经 {@link buildRefusalShownUrl} 出现;`flaws` 来自 {@link httpUrlFlaws}(调用方按首个拒因选自己的码与出路句)。
+ */
+export declare function buildHttpUrlRefusal(subject: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
+//# sourceMappingURL=url-shape.d.ts.map