@sema-agent/server 7.122.0 → 7.123.0

package/dist/session-policy-wire.js

@@ -1,6 +1,5 @@
-import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent } from "@sema-agent/core";
+import { PROTOCOL_TABLE, SessionPolicyError, assertSessionRuleNamesCurrent, normalizeRules } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
-import { describeEmptyToolSegment, emptyToolSegmentOf } from "./namespaced-rule-name.js";
 const RULE_FIELDS = {
     toolAllow: true,
     toolDeny: true,
@@ -20,33 +19,18 @@ function legacyToolNameRefusalOf(rules) {
         throw e;
     }
 }
-const TOOL_NAME_FIELD_TABLE = { toolAllow: "toolAllow", toolDeny: "toolDeny" };
-const TOOL_NAME_FIELDS = Object.values(TOOL_NAME_FIELD_TABLE);
-export function unreachableSessionRuleNameOf(rules) {
-    for (const field of TOOL_NAME_FIELDS) {
-        for (const name of rules[field] ?? []) {
-            const ns = emptyToolSegmentOf(name);
-            if (ns !== undefined)
-                return { field, name, ns };
-        }
-    }
-    return undefined;
-}
-export function assertSessionRuleNamesReachable(rules) {
-    const unreachable = unreachableSessionRuleNameOf(rules);
-    if (unreachable !== undefined)
-        throw new Error(describeUnreachableSessionRuleName(unreachable));
-}
 function protocolToolNameShapes() {
     return PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(" or ");
 }
+function isRulesObject(raw) {
+    return raw !== null && typeof raw === "object" && !Array.isArray(raw);
+}
 export function readSessionPermissionRules(raw) {
-    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+    if (!isRulesObject(raw))
         return { problem: { kind: "not-an-object" } };
-    const src = raw;
     const rules = {};
     for (const field of SESSION_PERMISSION_RULE_FIELDS) {
-        const v = src[field];
+        const v = raw[field];
         if (v === undefined)
             continue;
         if (!Array.isArray(v) || !v.every((x) => typeof x === "string"))
@@ -55,17 +39,42 @@ export function readSessionPermissionRules(raw) {
     }
     return { rules };
 }
+function engineRuleListOf(field, value) {
+    let normalized;
+    try {
+        normalized = normalizeRules({ [field]: value });
+    }
+    catch (e) {
+        if (e instanceof TypeError)
+            return { refusal: e.message };
+        throw e;
+    }
+    const list = normalized[field];
+    return list === undefined ? {} : { list };
+}
+export function unwritableRuleListOf(rules) {
+    for (const field of SESSION_PERMISSION_RULE_FIELDS) {
+        const judged = engineRuleListOf(field, rules[field]);
+        if ("refusal" in judged)
+            return { field, refusal: judged.refusal };
+    }
+    return undefined;
+}
 export function readWritableSessionPermissionRules(raw) {
-    const read = readSessionPermissionRules(raw);
-    if (read.problem !== undefined)
-        return read;
-    const refusal = legacyToolNameRefusalOf(read.rules);
+    if (!isRulesObject(raw))
+        return { problem: { kind: "not-an-object" } };
+    const rules = {};
+    for (const field of SESSION_PERMISSION_RULE_FIELDS) {
+        const judged = engineRuleListOf(field, raw[field]);
+        if ("refusal" in judged)
+            return { problem: { kind: "field-not-rule-list", field, refusal: judged.refusal } };
+        if (judged.list !== undefined)
+            rules[field] = judged.list;
+    }
+    const refusal = legacyToolNameRefusalOf(rules);
     if (refusal !== undefined)
         return { problem: { kind: "legacy-tool-name", refusal } };
-    const unreachable = unreachableSessionRuleNameOf(read.rules);
-    if (unreachable !== undefined)
-        return { problem: { kind: "unreachable-tool-name", unreachable } };
-    return read;
+    return { rules };
 }
 export function readSessionRulesRecords(raw) {
     if (!Array.isArray(raw))
@@ -91,17 +100,14 @@ export function describeSessionPermissionRulesProblem(p) {
     switch (p.kind) {
         case "not-an-object": return "rules must be a SessionPermissionRules object";
         case "field-not-string-array": return `${p.field} must be an array of strings`;
+        case "field-not-rule-list": return p.refusal;
         case "legacy-tool-name": return describeLegacyToolName(p.refusal);
-        case "unreachable-tool-name": return describeUnreachableSessionRuleName(p.unreachable);
         default: {
             const unhandled = p;
             throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
         }
     }
 }
-function describeUnreachableSessionRuleName(u) {
-    return `${u.field} names ${displayListEntry(u.name)}, which can never match a tool (${describeEmptyToolSegment(u.ns)}), so nothing was written`;
-}
 function describeLegacyToolName(r) {
     const why = r.guidance !== undefined ? ` (${r.guidance})` : "";
     switch (r.verdict) {
@@ -126,8 +132,7 @@ export function legacyToolNameProblemOf(p) {
         case "rules":
             switch (p.problem.kind) {
                 case "not-an-object":
-                case "field-not-string-array":
-                case "unreachable-tool-name":
+                case "field-not-rule-list":
                     return undefined;
                 case "legacy-tool-name":
                     return p.problem.refusal;

package/dist/session-sync.d.ts

@@ -159,7 +159,11 @@ export declare function planSync(sessionId: string, srcBackend: StoreBackend, ds
  *  无条件写都 rev+1,而 rev 是 operator 乐观锁的 CAS 令牌(`PutRulesOptions.expectedRev`),
  *  幂等重试/无害重复同步不该把在途 CAS 打失败。归一化用 core 的 `normalizeRules`(store 落盘
  *  前走同一函数 ⇒ 两侧同坐标);`stripRev` 去掉记录内嵌的 rev(`listBySession` 的 rules 含 rev,
- *  它不是内容)。 */
+ *  它不是内容)。
+ *  🔴 core 7.48.0 起 `normalizeRules` 对「不是一列非空字符串」的桶抛 `TypeError`。`incoming` 由写口读者保证是引擎肯写的
+ *  (`session-policy-wire.ts` `readSessionRulesRecords`);`stored` 可能是 7.47.x 及以前写下的空串项存量行 —— 读得出、引擎却不肯再写。
+ *  这种行与任何肯写的 `incoming` 都**不同内容**(它多一个空项),所以答 `false`(判官 = 写口读者那一只 `unwritableRuleListOf`,不拿它跑 normalize):
+ *  写照常交给店 —— 店的收紧门对它照常判(operator 照写,是清旧行的出路;非 operator 删空串 deny 项被读成放宽 ⇒ 403,与 7.122.0 同答)。 */
 export declare function sameRulesContent(stored: StoredSessionRules | null, incoming: SessionPermissionRules): boolean;
 /** [ref] ① 的重放腿共享实现:PUSH 路由的两条 policy 重放腿(Phase A identical 短路支 / Phase B
  *  commit 后支)都从这里走 —— 等内容跳过(rev 零漂移),真变更照常落地(E6 tighten-only 门在

package/dist/session-sync.js

@@ -1,5 +1,6 @@
 import { classifySyncRelationship } from "./session-sync-kernel.js";
 import { normalizeRules, stripRev } from "@sema-agent/core";
+import { unwritableRuleListOf } from "./session-policy-wire.js";
 export function fileHistoryImportFace(fs) {
     const candidate = fs?.importHistory;
     if (typeof candidate !== "function")
@@ -54,7 +55,7 @@ export async function planSync(sessionId, srcBackend, dstBackend) {
     return classifySyncRelationship(srcEntries, dstEntries);
 }
 export function sameRulesContent(stored, incoming) {
-    if (stored === null)
+    if (stored === null || unwritableRuleListOf(stored) !== undefined)
         return false;
     const norm = (r) => JSON.stringify(normalizeRules(stripRev(r)));
     return norm(stored) === norm(incoming);

package/dist/spec-fields.d.ts

@@ -51,16 +51,16 @@ export declare const MAX_TASK_AGENTS = 32;
  * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
  * (deny 侧 = 意图静默落空,安全轴上的放宽方向)。条目的**文法与名字**是引擎的读法:允侧读不出的条目(`*` / 写路径 / 域名 / 退役名 …)引擎在开跑时发
  * `permission.allowed_tool_not_granted`(受众 = 用户);拒侧读成空的条目(文法或名字层)在 `resolveSpec` 拒(提交 400 / 续跑 409,`rule-entry-list.ts` 的
- * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 + 引擎读不到的那一形 ⇒ 400)。
+ * `skillDenyInertEntryOf`,判据 = 引擎的条目读法)。形对之后两道门再问 {@link skillToolListRefusal}(条数帽 ⇒ 400)。
  * 条数帽 = 条目表那一只(`rule-entry-list.ts` `allowLayerEntryCountIssue`,准备开销的界;与请求 allow 桶、运维表同一只),
  * 在 {@link skillToolListRefusal} 里判;无长度帽([ref])。
  */
 export declare const skillToolListOk: (v: unknown) => v is readonly string[];
 /**
  * 一条技能(形已过两道门的字符串数组判)的两只清单在受理口的拒因 —— 都过 ⇒ `undefined`。两处受理口同调:顶层 `skills[]`
- * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。两问:条数帽;引擎读不到、却永远匹配不到的
- * 条目(工具段为空的协议名,`rule-entry-list.ts` 那一份,与配置表、会话规则写口同一只)。退役名 / 对端段铸不出 / 读成空的条目是引擎的读法(见上):
- * 允侧交引擎通告,拒侧由 `resolveSpec` 拒。
+ * (`http/admission.ts` 的 `validateUserSkills`)、子代 `agents[].skills[]`({@link validateTaskAgents})。一问:条数帽。退役名 / 对端段或工具段铸不出、为空 /
+ * 读成空的条目是引擎的读法(见上):允侧交引擎通告,拒侧由 `resolveSpec` 拒(7.116.0–7.122.x 本仓在这里另拒工具段为空的协议名,core 7.48.0 #1400 起
+ * 它是引擎判官的判词,随之退役)。
  */
 export declare function skillToolListRefusal(skill: Record<string, unknown>): string | undefined;
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。

package/dist/spec-fields.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
 import { isValidCwd } from "./task-cwd.js";
-import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
         return true;
@@ -76,9 +76,6 @@ export function skillToolListRefusal(skill) {
         const over = allowLayerEntryCountIssue(`skill.${key}`, list);
         if (over !== undefined)
             return over.message;
-        const empty = emptyToolSegmentEntryOf(list);
-        if (empty !== undefined)
-            return describeEmptyToolSegmentEntry(`skill.${key}`, empty);
     }
     return undefined;
 }

package/dist/task-settings.d.ts

@@ -108,13 +108,12 @@ export declare function planReviewDecisionExitsPlan(decision: "approve" | "edit"
 /**
  * 运维 `AUTONOMY=plan` 的**入口词地板**盖进提交体 —— 此后一条 run 的模式词只有存储体顶层 `permissionMode` 一个源。
  *
- * 规则:入口词 = core `clampPermissionMode(体的生效词, 地板).effective`(体无词 ⇒ 地板;比地板松的词 ⇒ 钳成地板;秩是 core 的,本仓不另写)。
- * 地板缺席 ⇒ 体**原物**交回(零字节变化)。盖章 = 新体 `{ ...body, permissionMode: 入口词 }`:调用方的对象不改;bundle 的
+ * 入口词 = `runtime-governance.ts` `entryPermissionMode(体的生效词, 地板).effective`(「词在地板下变成什么」的唯一一只函数;秩是 core 的)。本函数只加
+ * 「写进体」这一半:地板缺席 ⇒ 体**原物**交回(零字节变化);地板在场 ⇒ 新体 `{ ...body, permissionMode: 入口词 }`,调用方的对象不改;bundle 的
  * `settings.permissions.defaultMode` 不动 —— 顶层赢过它({@link effectivePermissionMode} 的优先序),再改它就是同一语义的第二个写者。
  *
- * 调用点两个:提交入口(`http/admission.ts` 的 `prepareSpec`:值形门全部判完之后、`resolveSpec` 之前)与 leader run 的入口体(`leader/wire.ts`:
- * leader 请求不带模式词,盖的是一份空体 ⇒ 入口词 = 地板本身;本车道的每一条 spec 与 worker 的续跑体都从它取词)。提交入口那一份体就是首跑装配读的体,也是 `buildCheckpointCtx` 持久化的体 ⇒ 一处盖章同时覆盖首跑与每一次续跑重建;
- * 装配腿与续跑腿都不读地板(两处读 = 两个源)。run-local 自建 spec、收不到客户端表态,在它的出生点直接写地板本身(同一个入口词)。
+ * 调用点一个:提交入口(`http/admission.ts` 的 `prepareSpec`:值形门全部判完之后、`resolveSpec` 之前)。那一份体就是首跑装配读的体,也是
+ * `buildCheckpointCtx` 持久化的体 ⇒ 一处盖章同时覆盖首跑与每一次续跑重建;装配腿与续跑腿都不读地板(两处读 = 两个源)。
  * 另一个写者是 `plan_review` 写回(`http/resume-legs.ts` `drivePlanReview`,判据 {@link planReviewDecisionExitsPlan})。
  * 热改 `AUTONOMY` 只影响之后提交的任务:在飞的 run 保持它出生时盖下的词。地板的属主是 `runtime-governance.ts` 的 `autonomyModeFloor`。
  */

package/dist/task-settings.js

@@ -1,11 +1,12 @@
-import { clampPermissionMode, combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
-import { allowLayerEntryCountIssue, describeAllowLayerOverCap, describeEmptyToolSegmentEntry, emptyToolSegmentEntryOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { entryPermissionMode } from "./runtime-governance.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 export const PERMISSION_MODE_WORDS = PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function coercePermissionMode(raw) {
@@ -33,9 +34,8 @@ export function planReviewDecisionExitsPlan(decision) {
     }
 }
 export function stampEntryPermissionMode(body, floor) {
-    if (floor === undefined)
-        return body;
-    return { ...body, permissionMode: clampPermissionMode(storedBodyPermissionMode(body), floor).effective };
+    const entry = entryPermissionMode(storedBodyPermissionMode(body), floor);
+    return entry.floor === undefined ? body : { ...body, permissionMode: entry.effective };
 }
 export function storedBodyPermissionMode(body) {
     return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);
@@ -347,9 +347,6 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
         if (unmatchable !== undefined)
             throw new Error(unmatchable.message);
     }
-    const emptyAllow = perms.allow !== undefined ? emptyToolSegmentEntryOf(perms.allow) : undefined;
-    if (emptyAllow !== undefined)
-        throw new Error(describeEmptyToolSegmentEntry("permissions.allow", emptyAllow));
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;

package/dist/unattended-permission-mode.d.ts

@@ -44,7 +44,7 @@
  *  · 续跑腿上的协调器席:`http/resume-legs.ts` 只在「run 行在场 ∧ 活卡协调器在场」时给 spec 另装活席(`deps.toolApproval && taskId`)——
  *    leader worker 的会话没有 run 行,那一装今天够不着本腿;哪天够着了,活席会盖掉本层(方向 = 多问人,fail-closed),见收车档 ⑤。
  */
-import { type AskClass, type AskRequest, type OnAsk, type PermissionMode, type TaskSpec } from "@sema-agent/core";
+import type { AskClass, AskRequest, OnAsk, PermissionMode, TaskSpec } from "@sema-agent/core";
 /**
  * 按类作答的**答集** —— core §4.6e 推荐形:机器只答 `ordinary`。**常量,不是旋钮**([ref]):要放更多类是部署级的安全决定,先立案候裁。
  * 不变量(测试钉):答集 ⊆ core 每一面的可放行类 `releasableAskClassesFor(face)`(本层不读问的面,同一只答集答每一面的问),且与带 `requiresRealApproval` 的类
@@ -72,8 +72,8 @@ export type UnattendedLegSpec = {
     readonly onAsk: UnattendedSeat;
 };
 /**
- * 无人值守腿并进一条 spec —— 各腿的**唯一**合并口:`permissionMode` = `"default"` 钳在 spec 已有的模式词之下(core `clampPermissionMode`,与
- * `tightenTaskSpec` 对模式词的合并同一只;spec 无词 ⇒ `"default"`)+ `onAsk: createUnattendedOnAsk(seat)`。`seat` = 本腿的活审批席(run-local
+ * 无人值守腿并进一条 spec —— 各腿的**唯一**合并口:`permissionMode` = `"default"` 钳在 spec 已有的模式词之下(`runtime-governance.ts`
+ * `entryPermissionMode("default", spec 的词)`,与入口地板同一只函数、底下是 core 的钳;spec 无词 ⇒ `"default"`)+ `onAsk: createUnattendedOnAsk(seat)`。`seat` = 本腿的活审批席(run-local
  * 递它的 `createLocalApprover`;leader 各腿与续跑重挂无席,不递)—— 席只经这个参数进来,从不从 spec 上读。
  * 调用点必须在 spec 其余键(含治理折叠)**之后**调它 —— spec 自带的 `plan` 由此被读到、留住;本口不碰 `toolPolicy`(没有策略层要并:过渡形的
  * 写保护拒层已退役)。

package/dist/unattended-permission-mode.js

@@ -1,4 +1,4 @@
-import { clampPermissionMode } from "@sema-agent/core";
+import { entryPermissionMode } from "./runtime-governance.js";
 export const UNATTENDED_ANSWERED_CLASSES = new Set(["ordinary"]);
 export const UNATTENDED_POLICY_APPROVER = "unattended_class_answer";
 function unattendedPolicyYes() {
@@ -12,7 +12,7 @@ export function createUnattendedOnAsk(seat) {
     return (req, signal) => (unattendedAnswers(req) ? unattendedPolicyYes() : seat !== undefined ? seat(req, signal) : "unavailable");
 }
 export function withUnattendedLeg(spec, seat) {
-    const permissionMode = spec.permissionMode === undefined ? "default" : clampPermissionMode("default", spec.permissionMode).effective;
+    const permissionMode = entryPermissionMode("default", spec.permissionMode).effective;
     return { ...spec, permissionMode, onAsk: createUnattendedOnAsk(seat) };
 }
 //# sourceMappingURL=unattended-permission-mode.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.122.0",
+  "version": "7.123.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -64,8 +64,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.47.0",
-    "@sema-agent/settings-schema": "9.0.0",
+    "@sema-agent/core": "7.48.0",
+    "@sema-agent/settings-schema": "10.1.1",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",