@sema-agent/server 7.129.1 → 7.131.0

package/dist/plugins/remote-env-ssh.js

@@ -3,6 +3,7 @@ import { Client } from "ssh2";
 import { createSshHostKeyVerifier } from "../ssh-host-key.js";
 import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
@@ -335,7 +336,7 @@ export class RemoteSshExecutionEnv {
             w?.();
         };
         let lastChunk = Date.now();
-        const idleMs = options?.readTimeoutMs;
+        const liveness = commandBoundsOf({ readTimeoutMs: options?.readTimeoutMs }, undefined).liveness;
         let streamRef;
         let onAbort;
         let paused = false;
@@ -422,7 +423,7 @@ export class RemoteSshExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => {
@@ -434,8 +435,8 @@ export class RemoteSshExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs && !finished && Date.now() - lastChunk >= idleMs)
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (provider hang / unreachable host)`);
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms)
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
             }
             while (queue.length)
                 yield queue.shift();

package/dist/question.d.ts

@@ -23,20 +23,29 @@ export interface QuestionFrame {
     /** "question" only: `serverNowMs + expiresInMs` — absolute deadline on the server's clock. */
     expiresAtMs?: number;
 }
-/** The per-run context `onQuestion` recovers via ALS. `emit` delivers a frame to the run's live stream; `abortSignal`
- *  (the run's own cancel signal) releases a question parked awaiting a human when the run aborts. */
+/** The per-run context `onQuestion` recovers via ALS. `emit` delivers a frame to the run's stream; `abortSignal`
+ *  (the run's own cancel signal) releases a question parked awaiting a human when the run aborts.
+ *
+ *  🔴 ONE LAW for every leg: a question frame that enters a run's stream has a LEDGER TWIN (the row
+ *  `GET /v1/runs/:id/events` replays — a page reload recovers the open card from it); the leg decides only whether it
+ *  ALSO writes a live socket. The background leg has no socket, so its `emit` IS the durable append; the synchronous
+ *  stream leg lands the same frame in the ledger first and then writes the SSE connection (`createLedgerTwinEmit`).
+ *  The ledger carries the CARD, not the answer door: `POST /v1/questions/:id/respond` stays live-only (this replica's
+ *  memory, `ttlMs`), so a replayed card is answerable only until its own `expiresAtMs` and only on this replica. */
 export interface QuestionRunContext {
     taskId: string;
     owner: string | null;
     emit: (frame: QuestionFrame) => void | Promise<void>;
     abortSignal?: AbortSignal;
-    /** OPTIONAL reachability predicate for this leg's delivery face, consulted by {@link QuestionCoordinator.hasLiveContext}
-     *  (the park-vs-live adjudication probe), NOT by `question` itself. CONSTRAINT: a leg whose face can go away WHILE the
-     *  leg keeps running MUST supply it — `/v1/tasks/stream` under `x-detach-on-disconnect: true` keeps executing inside
-     *  this ALS scope after the client left, and `emit` there writes to a dead socket and is silently dropped (question
-     *  frames have no durable ledger twin, unlike SendUserFile's ledgerSink). Without the predicate the adjudication would
-     *  read "live" and hand the leg to a face nobody can reach. ABSENT ⇒ always reachable, which is exactly right for the
-     *  background leg (emit appends to the durable events tail, readable whenever a client attaches). */
+    /** OPTIONAL reachability predicate for this leg's LIVE delivery face — one reading, two consumers:
+     *  {@link QuestionCoordinator.hasLiveContext} (the park-vs-live adjudication probe) and the OPEN frame itself (a face
+     *  that cannot show the card right now refuses the ask on the spot, the same failed-delivery arm, instead of parking it
+     *  to TTL on a ledger row nobody is watching). CONSTRAINT: a leg whose face can go away WHILE the leg keeps running MUST
+     *  supply it — `/v1/tasks/stream` under `x-detach-on-disconnect: true` keeps executing inside this ALS scope after the
+     *  client left. Without the predicate the adjudication would read "live" and hand the leg to a face nobody can reach.
+     *  ABSENT ⇒ always reachable, which is exactly right for the background leg (its face IS the durable events tail,
+     *  readable whenever a client attaches). The CLOSE frame never asks it: it is a record, and it lands in the ledger twin
+     *  whether or not the socket is still there. */
     deliverable?: () => boolean;
 }
 /** The per-run question window the deployment owns (core caps nothing). Env: `QUESTION_MAX_CONCURRENT_PER_RUN` /

package/dist/question.js

@@ -3,6 +3,16 @@ import { uuidv7 } from "@sema-agent/core";
 import { redactDeep } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 const MAX_QUESTIONS_BYTES = 16384;
+function isFaceReachable(ctx) {
+    if (ctx.deliverable === undefined)
+        return true;
+    try {
+        return ctx.deliverable();
+    }
+    catch {
+        return false;
+    }
+}
 export const DEFAULT_QUESTION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
@@ -103,13 +113,20 @@ export class QuestionCoordinator {
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
         const emitted = (async () => {
+            if (!isFaceReachable(ctx))
+                throw new Error("question delivery face unreachable — the open frame has nobody to show it to");
             const now = Date.now();
-            return ctx.emit({ type: "question", questionId: id, questions, serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs });
+            await ctx.emit({ type: "question", questionId: id, questions, serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs });
+            return isFaceReachable(ctx) ? "ok" : "landed-face-gone";
         })()
-            .then(() => "ok", () => "failed");
+            .then((r) => r, () => "failed");
         const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
-        if (delivery === "ok") {
+        if (delivery === "ok" || delivery === "landed-face-gone") {
             rc.total += 1;
+            if (delivery === "landed-face-gone") {
+                recordFailOpen("server.question.open-frame-undelivered", `question=${id} face-gone-while-landing`);
+                settle(UNAVAILABLE, "unanswered");
+            }
         }
         else if (delivery === "failed") {
             recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
@@ -146,16 +163,7 @@ export class QuestionCoordinator {
     }
     hasLiveContext() {
         const ctx = this.als.getStore();
-        if (ctx === undefined)
-            return false;
-        if (ctx.deliverable === undefined)
-            return true;
-        try {
-            return ctx.deliverable();
-        }
-        catch {
-            return false;
-        }
+        return ctx !== undefined && isFaceReachable(ctx);
     }
     countersFor(taskId) {
         let rc = this.counters.get(taskId);

package/dist/request-key-closure.d.ts

@@ -54,9 +54,9 @@ export type ContentSteerBody = {
 export type InterruptSteerBody = {
     readonly [K in (typeof INTERRUPT_STEER_BODY_KEYS)[number]]?: unknown;
 };
-/** 送话口的三种体形(闭集;词外是编译错)。 */
+/** 送话口的体形(闭集;词外是编译错)。`interrupt` = `POST /v1/runs/:id/interrupt` 整扇门(bare 与带 `text` 两形同一张受理集)。 */
 export type SteerBodyForm = "run" | "content" | "interrupt";
-/** 送话口的顶层键裁决(四扇门同一只;`form` 选受理集)。 */
+/** 送话口的顶层键裁决(各形同一只;`form` 选受理集)。 */
 export declare function steerBodyKeyIssue(raw: unknown, form: SteerBodyForm): KeyClosureIssue | null;
 export {};
 //# sourceMappingURL=request-key-closure.d.ts.map

package/dist/request-key-closure.js

@@ -28,25 +28,28 @@ const TASK_BODY_DECLARED_KEYS = [
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
-    "userInvokedSkills", "verify", "verifyRounds",
+    "userAttachments", "userInvokedSkills", "verify", "verifyRounds",
 ];
 const TASK_BODY_SCENARIO_KEYS = ["repo"];
 const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);
-const UNSUPPORTED_BODY_KEYS = ["handsReadOnly", "readDenyPatterns", "readFace", "shellGate", "userAttachments", "writeFace"];
-const UNSUPPORTED_BODY = new Set(UNSUPPORTED_BODY_KEYS);
-const UNSUPPORTED_LABEL = "unsupported (an engine seat this service does not read from the request body — set by the deployment, or not offered in this version)";
-function closedBodyKeyIssue(raw, accepted, door) {
+const UNSUPPORTED_BODY_KEYS = ["handsReadOnly", "readDenyPatterns", "readFace", "shellGate", "writeFace"];
+const UNSUPPORTED_BODY = {
+    keys: new Set(UNSUPPORTED_BODY_KEYS),
+    label: "unsupported (an engine seat this door does not read from the request body — set by the deployment)",
+};
+const OBJECTIVE_ONLY_BODY_KEYS = ["userAttachments"];
+function closedBodyKeyIssue(raw, accepted, unsupported, door) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
         return null;
     const buckets = { unknown: [], unsupported: [] };
-    scanKeyClosure(raw, "", accepted, UNSUPPORTED_BODY, buckets);
+    scanKeyClosure(raw, "", accepted, unsupported.keys, buckets);
     if (buckets.unknown.length === 0 && buckets.unsupported.length === 0)
         return null;
     buckets.unknown.sort();
     buckets.unsupported.sort();
     const parts = [
         ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, `unknown (not ${door} key — check the spelling)`)] : []),
-        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, UNSUPPORTED_LABEL)] : []),
+        ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, unsupported.label)] : []),
     ];
     return {
         message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
@@ -57,7 +60,7 @@ function closedBodyKeyIssue(raw, accepted, door) {
     };
 }
 export function taskBodyKeyIssue(raw) {
-    return closedBodyKeyIssue(raw, ACCEPTED_BODY, "a task-request");
+    return closedBodyKeyIssue(raw, ACCEPTED_BODY, UNSUPPORTED_BODY, "a task-request");
 }
 const RUN_STEER_BODY_KEYS = ["mode", "priority", "text"];
 const CONTENT_STEER_BODY_KEYS = ["content"];
@@ -67,7 +70,11 @@ const STEER_DOORS = {
     content: { accepted: new Set(CONTENT_STEER_BODY_KEYS), door: "a steer-request" },
     interrupt: { accepted: new Set(INTERRUPT_STEER_BODY_KEYS), door: "an interrupt-request" },
 };
+const STEER_UNSUPPORTED = {
+    keys: new Set([...UNSUPPORTED_BODY_KEYS, ...OBJECTIVE_ONLY_BODY_KEYS]),
+    label: "unsupported (an engine seat this door does not read from the request body — set by the deployment, or carried only by a new objective)",
+};
 export function steerBodyKeyIssue(raw, form) {
-    return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_DOORS[form].door);
+    return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_UNSUPPORTED, STEER_DOORS[form].door);
 }
 //# sourceMappingURL=request-key-closure.js.map

package/dist/rule-entry-list.d.ts

@@ -11,13 +11,22 @@
  *     请求 allow 桶、技能两只清单、运维表四张表同一只、同一句)。
  *  ② (7.116.0–7.122.x 的「引擎读不到的一形」—— 工具段为空的协议名 `mcp__srv__` 四张表都拒 —— 随 core 7.48.0 #1400 退役:引擎判官给它判词
  *     `unmintable_segment`,条目由下面 ③ 读成 `tool_name`,与对端段铸不出的名字同一条路。)
- *  ③ **引擎读成空的条目**({@link inertRuleEntriesOf},判据 = 引擎包根 `compileAllowList(entries, behavior, 名册)`,名册 = 空集 `NO_DECLARED_TOOL_NAMES`
- *     —— 条目的工具名也过引擎判官:退役名 / 无前缀短名 / 对端段或工具段铸不出、为空读成 `tool_name`,带判词与 1:1 现名;原因词是引擎的 `ALLOW_ENTRY_INERT_REASONS`):
- *     运维的 allow 表拒启(运维自己的配置,写错了当场改);技能的拒侧(`disallowedTools`)拒 —— 提交 400、存量体重放 409(下面的 {@link skillDenyInertEntryOf});
- *     请求的 allow 侧(`settings.permissions.allow`、技能 `allowedTools`)不拒:引擎在开跑时发 `permission.allowed_tool_not_granted`(受众 = 用户)。
+ *  ③ **引擎读成空的条目**({@link inertRuleEntriesOf},判据 = 引擎包根 `compileAllowList(entries, behavior, 名册)`;原因词是引擎的 `ALLOW_ENTRY_INERT_REASONS`)。
+ *     条目的工具名也过引擎判官:退役名 / 无前缀短名 / 对端段或工具段铸不出、为空读成 `tool_name`,带判词与 1:1 现名;名册里有那只工具、条目只差大小写 ⇒ `near_miss`(`BASH` ⇒ 现名 `Bash`)。
+ *     **名册只有一张**({@link TOOL_NAME_ROSTER}:引擎目录 ∪ 本仓自铸的工具名),每一处读条目名的地方都传它 —— 请求体的规则表(`settings.permissions.*`)、技能清单、选择器清单、
+ *     运维 / 中心的审批名单读同一份,没有「这一处空名册、那一处带名册」的两种读法。
+ *     **读成空的哪些原因词是拒面,按方向定**:**限制侧**(读成空 = 静默放行:技能 `disallowedTools`、`excludeTools` / 子代 `denyTools`、`settings.permissions.deny` / `ask`、运维 / 中心的审批名单)四类全拒 ——
+ *     近似名 · 退役名 · 文法读不出 · 不带内容形的工具带内容;**放行侧**(读成空 = 想放的什么也没放:`settings.permissions.allow`、根 / 子代 `allowTools`、技能 `allowedTools`)**只拒近似名**
+ *     ({@link allowSideReadsAsNothing}):近似名现名唯一、确定是笔误;退役名 / 内容形 / 文法读不出 / 协议名对端段通配照 7.130.0 受理、交引擎既有通告(引擎侧的终形是把退役名归一到现名并在用户面点名,到货前放行侧不拒 ——
+ *     壳转投的 CC 用户 settings 里这些极常见,尤其内容形里的 `$VAR`(`Bash(echo $HOME)`)读成 `grammar`,拒了 = 每次提交 400)。运维的 `APPROVAL_GRANT` 是运维自己的配置:任何读成空都拒启(写错了当场改)。
  *     技能拒侧那一拒与引擎 #1372(core 7.43.0:那只技能不激活)是同一件事的两处 —— 7.118.0 重估过、本版**不退**:本仓的续跑腿把引擎的
  *     `checkpoint.config_refused`(`config.skill_deny_unreadable`)答得不一(资源停车续跑腿 500、`/decide` 先结了卡、`/wake` 先铸了 run 行),先统一那一层再退
- *     (重估读数与退役条件在下面那只函数头注)。
+ *     (重估读数与退役条件在下面 {@link skillDenyInertEntryOf} 头注)。
+ *  ④ **工具名选择器清单**(请求顶层 `allowTools` / `excludeTools`、子代定义的 `allowTools` / `denyTools`;引擎的可用性选择器,**不是**规则条目表):读成空的条目在受理口**开跑前拒并点名现名**
+ *     (拒面按 ③ 的方向分),拒句点名有界({@link MAX_NAMED_INERT_ENTRIES} 条 + 计数),清单先过条数帽({@link inertToolListEntryOf})。
+ *     **真未知名**(拼写合法、没有近似也没有退役对应 —— 懒挂载的合法形,例如一台之后才连上的 MCP 服务器的工具)不是读成空:原样保留、运维行告知一次,不拒。
+ *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
+ *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧 `mcp__*` / `a2a__*`(整个协议的拒)合法。
  */
 import { compileAllowList } from "@sema-agent/core";
 /** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
@@ -43,35 +52,133 @@ export declare function allowLayerEntryCountIssue(field: string, list: readonly
 } | undefined;
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
-/** ③ 引擎按 `behavior` 读这张表时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己);条目名过引擎判官(名册 = 空集)。 */
+/**
+ * ③ 引擎读一张**规则条目表**(`behavior` 方向)时读成空的条目(引擎的整表读法:allow 表里的 `*` 让整表读成空;deny 表里的 `*` 只读空它自己)。条目名过引擎判官,
+ * 名册是本仓**唯一**的一张({@link TOOL_NAME_ROSTER},`namespaced-rule-name.ts`:引擎目录 ∪ 本仓自铸的工具名)—— 两个方向、每一处读条目名的地方(请求体的规则表、技能清单、选择器清单、
+ * 运维 / 中心的审批名单)传同一张,没有「这一处空名册、那一处带名册」的两种读法。工具名选择器清单另走 {@link inertToolListEntryOf}。
+ */
 export declare function inertRuleEntriesOf(list: readonly string[], behavior: "allow" | "deny"): readonly InertRuleEntry[];
 /**
  * 原因词 → 「怎么写」(闭集穷举:引擎加一个原因词 ⇒ 编译红)。句子只说这一条为什么什么也不做、换成哪种写法;原因词本身原样带在句子里。
  * 名字层两词带引擎给的判词 / 1:1 现名(有就点名)。
  */
 export declare function inertRuleEntryGuidance(i: InertRuleEntry): string;
-/** ③ 的句子(`<field> entry "<e>" reads as nothing (<reason>): <怎么写>`;多条用分号连)。 */
+/**
+ * 拒句 / 通告句里点名条目的**条数上界**(点名有界,同引擎自己通告的「最多五条 + and N more」一个形:体再大,一句话的长度不随条目数长)。
+ * 每条点名至多约 600 字节(条目回显 ≤ 122 字符 + 原因词 + 引擎的怎么写),五条 + 尾 ≤ 3.5 KB。
+ */
+export declare const MAX_NAMED_INERT_ENTRIES = 5;
+/** ③ 的句子(`<field> entry "<e>" reads as nothing (<reason>): <怎么写>`;多条用分号连;只点名前 {@link MAX_NAMED_INERT_ENTRIES} 条,其余写成 `; and K more`)。全部读成空的句子的**唯一组句器**。 */
 export declare function describeInertRuleEntries(field: string, inert: readonly InertRuleEntry[]): string;
 /** 提交体里技能所在的层(命中句与排空读数点名用):顶层 `skills[]` / 子代 `agents[].skills[]`。 */
 export type SkillListLayer = "skills" | "agents.skills";
-/** 一份提交体里第一处「技能的拒侧清单里有引擎读成空的条目」:在哪一层、拒句是什么。 */
-export interface SkillDenyInertEntry {
-    readonly layer: SkillListLayer;
+/** 清单的方向:`allow` = 放行名单(读成空 = 想放的什么也没放 = 静默收窄),`deny` = 限制名单(读成空 = 放行)。续跑重放按方向分流(见 {@link inertToolListEntryOf})。 */
+export type ToolListSide = "allow" | "deny";
+/**
+ * 每一张清单(闭集;"层")的方向、读法与拒码。拒码沿用该清单此前的码:技能与请求规则表 ⇒ 请求字段非法;子代定义的两张选择器 ⇒ 引擎的子代名单拒码;顶层两张选择器 ⇒ 引擎的
+ * 根 run 名单拒码(同一张表的文法形 / `*` 引擎仍拒这一码,一张表一个码)。续跑腿把同一只码放进 409 的 `blockedBy`。加一张清单 ⇒ 这里加一行,{@link toolListsOf} 的扫描一起编译红。
+ */
+declare const TOOL_LIST_FACES: {
+    readonly skills: {
+        readonly side: "deny";
+        readonly kind: "rule_table";
+        readonly code: "request.field_invalid";
+    };
+    readonly "agents.skills": {
+        readonly side: "deny";
+        readonly kind: "rule_table";
+        readonly code: "request.field_invalid";
+    };
+    readonly "skills.allowedTools": {
+        readonly side: "allow";
+        readonly kind: "rule_table";
+        readonly code: "request.field_invalid";
+    };
+    readonly "agents.skills.allowedTools": {
+        readonly side: "allow";
+        readonly kind: "rule_table";
+        readonly code: "request.field_invalid";
+    };
+    readonly "agents.denyTools": {
+        readonly side: "deny";
+        readonly kind: "selector";
+        readonly code: "config.agent.unknown_tool";
+    };
+    readonly "agents.allowTools": {
+        readonly side: "allow";
+        readonly kind: "selector";
+        readonly code: "config.agent.unknown_tool";
+    };
+    readonly excludeTools: {
+        readonly side: "deny";
+        readonly kind: "selector";
+        readonly code: "config.tool_face_control";
+    };
+    readonly allowTools: {
+        readonly side: "allow";
+        readonly kind: "selector";
+        readonly code: "config.tool_face_control";
+    };
+    readonly "settings.permissions.allow": {
+        readonly side: "allow";
+        readonly kind: "rule_table";
+        readonly code: "request.field_invalid";
+    };
+};
+/** 提交体里读成空即拒的工具名清单所在的层(闭集 = {@link TOOL_LIST_FACES} 的键)。 */
+export type ToolListLayer = keyof typeof TOOL_LIST_FACES;
+/**
+ * 请求体 `settings.permissions.deny` / `ask`(规则编译器读的收紧表)所在的层 —— **不在** {@link toolListsOf} 的扫描里:它们的判与句子的唯一铸点在 `config.ts` 的
+ * `unmatchableToolNamesRefusal`(经 `task-settings.ts` 的 `rulePolicyBucketsRefusal`,单表桶序;拒点是 `applyTaskSettings`,422),存体预判(`http/stored-body-replay.ts`)调同一只函数(home 同源于部署配置),把命中装成本型。
+ * 层名进这个联合只为让命中能带坐标进 409 体与运维日志。
+ */
+export type RulePolicyLayer = "settings.permissions.deny" | "settings.permissions.ask";
+/** 一份提交体里第一处「工具名清单里有引擎读成空的条目」:在哪一层、哪个方向、拒码、拒句(超帽时另带机读字段,同 `settings.permissions.*` 桶超帽的形)。 */
+export interface InertToolListEntry {
+    readonly layer: ToolListLayer | RulePolicyLayer;
+    readonly side: ToolListSide;
+    readonly code: string;
     readonly message: string;
+    readonly extra?: Readonly<Record<string, unknown>>;
 }
 /**
- * ③ 的拒侧在**提交体**上的判(顶层 `skills[]` 与子代 `agents[].skills[]` 两层;第一处命中即答)。
+ * 存体预判里请求设置的命中装成本型(拒点自己抛:桶门在 `resolveSpec` 抛 400、deny / ask 的名字层与文法在 `applyTaskSettings` 抛 422,都不经本型)—— 两个来源一只装配函数:
+ * 桶门命中(三个桶任一,带机读字段 `extra`)与 deny / ask 的规则判命中(限制侧,无 `extra`)。
+ */
+export declare function replayInertEntry(layer: ToolListLayer | RulePolicyLayer, side: ToolListSide, code: string, message: string, extra?: Readonly<Record<string, unknown>>): InertToolListEntry;
+/** 技能层的命中(排空脚本只数这两层)。 */
+export interface SkillDenyInertEntry extends InertToolListEntry {
+    readonly layer: SkillListLayer;
+}
+/**
+ * ③ 的拒侧在**提交体**上的判,技能那两层(顶层 `skills[]` 与子代 `agents[].skills[]`;第一处命中即答)。全部工具名清单的判是 {@link inertToolListEntryOf}(调用点两处都调它);
+ * 本函数单独导出是给随包排空脚本:那条判据(`skill-deny-inert`)只数技能这两层,SQL 车道的孪生也只看技能的清单。
  *
- * 🔴 **调用点两处**:`resolveSpec`(`boot/resolve-spec.ts`,**拒点** —— 新提交与五条续跑腿都经过它,所以「新提交会被拒的体,续跑重放时同样拒」
- * 是结构性的)与 `http/checkpoint-ctx.ts` `storedBodyReplayRefusal`(存量体重放前的**预判**,五个续跑问点同调 —— 含 SLA 拒扫的跳过臂与终态 steer
- * 铸唤醒卡之前,这两处不经 `resolveSpec`)。提交腿 ⇒ 400 `request.field_invalid`;续跑腿 ⇒ 409 `resume_blocked_by_policy`(`blockedBy: request.field_invalid`,
- * 句子同一句,铸点 `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`),拒在认领之前,行 / 卡 / ctx 不动。随包排空判据 `skill-deny-inert`
- * (`scripts/drain-check-local.mjs` 调本函数)。判据就是引擎的读法(`compileAllowList(entries, "deny", 名册 = 空集)`,与 {@link inertRuleEntriesOf} 同一只;
- * 7.118.0 起条目名也过引擎判官,退役名 / 对端段铸不出读成 `tool_name` —— 技能清单的名字层在受理口不再另判)。
+ * 判据就是引擎的读法({@link inertRuleEntriesOf};7.118.0 起条目名也过引擎判官,退役名 / 对端段铸不出读成 `tool_name` —— 技能清单的名字层在受理口不再另判)。
  * 7.118.0 重估(core 7.43.0 #1372 到货:读成空的拒侧条目让那只技能不激活)—— **本版不退**。实测(本判退掉之后跑同一批夹具):引擎的拒到本仓各续跑腿的
  * 答法不一 —— 资源停车续跑腿把 `checkpoint.config_refused` 答成 500 `internal.error`;工具审批 `/decide` 在引擎拒之前已把卡结掉;`/wake` 在引擎拒之前已铸
  * run 行;子代 `agents[].skills[]` 不在引擎的认领前屏里(续跑放行、技能在调用时被拒)。退役条件:本仓续跑腿对引擎 `checkpoint.config_refused` 的答法
  * 收成一只(拒在认领前、行 / 卡不动、同一个 409)之后,本判与本仓的预判一起退,排空判据随之重估。
  */
 export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntry | undefined;
+/**
+ * **凡工具名清单,读成空的条目 = 开跑前拒并点名现名;真未知名只告** —— 提交体上全部这类清单的判(见 {@link TOOL_LIST_FACES}:技能的 `disallowedTools` 两层、子代定义的 `denyTools` / `allowTools`、
+ * 顶层 `excludeTools` / `allowTools`、请求的 `settings.permissions.allow`;第一处命中即答,顺序见 {@link toolListsOf})。判官只有一只:引擎的条目读法(名册 = {@link TOOL_NAME_ROSTER}),
+ * 本函数只是「在体的哪几处取清单」;句子只有一个有界的组句器({@link describeInertRuleEntries}),清单先过条数帽({@link allowLayerEntryCountIssue})。
+ *
+ * 为什么限制侧四类全拒、放行侧只拒近似名:引擎 7.51.x 把「没有任何工具答应的名字」改成条目原样保留 + 运维行告知一次。限制侧读成空 = **静默放行**(`denyTools:["BASH"]` 以为禁了 `Bash`,子代照用);
+ * 放行侧读成空 = 想放的什么也没放 —— 其中**近似名**(现名唯一)是确定的笔误,拒并点名现名;**退役名**、**内容形**与**文法读不出**在放行侧照 7.130.0 受理、交引擎既有通告(见头注 ③)。
+ * **真未知名**(没有近似也没有退役对应)不在读成空之列,原样保留、告运维一次(之后挂上同名工具即生效)。请求的 `settings.permissions.deny` / `ask`
+ * 与运维 / 中心的审批名单读同一张名册,走另一只入口({@link unmatchableToolNamesRefusal},`config.ts`),不在本函数(存体预判调同一只判据、home 同源于部署配置,见 `http/stored-body-replay.ts`)。
+ *
+ * `sides` = 只看哪个方向的清单(缺省两个都看)。**条数帽是资源帽,不分方向**:超帽的清单(整只拒,不逐条读)在任一方向的过滤下都命中 —— 引擎每次准备都逐条播种这些表,一份超帽的清单不论条目读得出读不出都会卡住事件循环。
+ * **提交腿两个方向都拒**;**续跑重放按方向分流**:限制方向(`deny`)的存量条目读成空 ⇒ 拒(409:放宽方向不能默认,那条限制从没生效过);放行方向(`allow`)的存量条目读成空 ⇒ 照旧续跑、条目原样留着
+ * (升级前它本就这样跑着、没那只工具,继续是安全方向)+ 一行运维 warn。
+ *
+ * 🔴 **调用点两处**:`resolveSpec`(`boot/resolve-spec.ts`,**拒点** —— 新提交与五条续跑腿都经过它)与 `http/stored-body-replay.ts` `storedBodyReplayRefusal`
+ * (存量体重放前的**预判**,五个续跑问点同调,只问限制方向)。提交腿 ⇒ 400,码 = 该层的拒码;续跑腿 ⇒ 409 `resume_blocked_by_policy`(`blockedBy` = 同一只码,句子同一句,铸点
+ * `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`),拒在认领之前,行 / 卡 / ctx 不动。
+ */
+export declare function inertToolListEntryOf(body: unknown, sides?: readonly ToolListSide[]): InertToolListEntry | undefined;
+export {};
 //# sourceMappingURL=rule-entry-list.d.ts.map

package/dist/rule-entry-list.js

@@ -1,6 +1,6 @@
-import { compileAllowList } from "@sema-agent/core";
+import { PROTOCOL_TABLE, compileAllowList, parsePermissionRule } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
-import { NO_DECLARED_TOOL_NAMES } from "./namespaced-rule-name.js";
+import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
 export function describeAllowLayerOverCap(field, count) {
@@ -13,11 +13,15 @@ export function allowLayerEntryCountIssue(field, list) {
     return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
 }
 export function inertRuleEntriesOf(list, behavior) {
-    return compileAllowList(list, behavior, NO_DECLARED_TOOL_NAMES).inert;
+    return compileAllowList(list, behavior, TOOL_NAME_ROSTER).inert;
+}
+function peerSegmentIsWild(entry) {
+    const at = entry.indexOf("__");
+    return at >= 0 && (entry.slice(at + 2).split("__")[0] ?? "").includes("*");
 }
 export function inertRuleEntryGuidance(i) {
     const reason = i.reason;
-    const write = i.currentName !== undefined ? ` — write ${displayListEntry(i.currentName)}` : "";
+    const write = i.currentName !== undefined && !peerSegmentIsWild(i.entry) ? ` — write ${displayListEntry(i.currentName)}` : "";
     switch (reason) {
         case "tool_name":
             return `the tool name can never match a mounted tool (${i.verdict ?? "stale"})${write}`;
@@ -39,30 +43,85 @@ export function inertRuleEntryGuidance(i) {
         }
     }
 }
+export const MAX_NAMED_INERT_ENTRIES = 5;
 export function describeInertRuleEntries(field, inert) {
-    return inert.map((i) => `${field} entry ${displayListEntry(i.entry)} reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
+    const named = inert.slice(0, MAX_NAMED_INERT_ENTRIES).map((i) => `${field} entry ${displayListEntry(i.entry)} reads as nothing (${i.reason}): ${inertRuleEntryGuidance(i)}`).join("; ");
+    const more = inert.length - MAX_NAMED_INERT_ENTRIES;
+    return more > 0 ? `${named}; and ${more} more` : named;
+}
+const TOOL_LIST_FACES = {
+    "skills": { side: "deny", kind: "rule_table", code: "request.field_invalid" },
+    "agents.skills": { side: "deny", kind: "rule_table", code: "request.field_invalid" },
+    "skills.allowedTools": { side: "allow", kind: "rule_table", code: "request.field_invalid" },
+    "agents.skills.allowedTools": { side: "allow", kind: "rule_table", code: "request.field_invalid" },
+    "agents.denyTools": { side: "deny", kind: "selector", code: "config.agent.unknown_tool" },
+    "agents.allowTools": { side: "allow", kind: "selector", code: "config.agent.unknown_tool" },
+    "excludeTools": { side: "deny", kind: "selector", code: "config.tool_face_control" },
+    "allowTools": { side: "allow", kind: "selector", code: "config.tool_face_control" },
+    "settings.permissions.allow": { side: "allow", kind: "rule_table", code: "request.field_invalid" },
+};
+const LIST_OVER_CAP_CODE = "request.field_invalid";
+export function replayInertEntry(layer, side, code, message, extra) {
+    return { layer, side, code, message, ...(extra !== undefined ? { extra } : {}) };
 }
 const isPlainRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-function skillDenyInertSentence(skill) {
-    if (!isPlainRecord(skill))
-        return undefined;
-    const deny = skill["disallowedTools"];
-    if (!ruleEntryListShapeOk(deny))
-        return undefined;
-    const inert = inertRuleEntriesOf(deny, "deny");
-    if (inert.length === 0)
-        return undefined;
-    return `${describeInertRuleEntries("skill.disallowedTools", inert)} — a deny entry that reads as nothing refuses nothing, so it is refused here rather than taken as in effect`;
+const REFUSAL_TAIL = {
+    deny: "a deny entry that reads as nothing refuses nothing, so it is refused here rather than taken as in effect",
+    allow: "an allow entry that reads as nothing admits nothing, so it is refused here rather than taken as in effect",
+};
+function selectorEntryName(entry) {
+    return entry !== entry.trim() ? entry : parsePermissionRule(entry).toolName;
 }
-export function skillDenyInertEntryOf(body) {
-    if (!isPlainRecord(body))
-        return undefined;
+const isProtocolWideName = (name) => PROTOCOL_TABLE.some((e) => name === `${e.prefix}*`);
+function selectorInertEntriesOf(list, side) {
+    return list.flatMap((entry) => {
+        if (entry === "*" && side === "allow")
+            return [];
+        const name = selectorEntryName(entry);
+        if (side === "deny" && isProtocolWideName(name))
+            return [];
+        const inert = compileAllowList([name], "deny", TOOL_NAME_ROSTER).inert.map((i) => ({ ...i, entry }));
+        return side === "allow" ? inert.filter((i) => allowSideReadsAsNothing(i.reason)) : inert;
+    });
+}
+function allowSideReadsAsNothing(reason) {
+    switch (reason) {
+        case "near_miss":
+            return true;
+        case "grammar":
+        case "tool_name":
+        case "content_unsupported":
+        case "wildcard_all":
+        case "namespace_wildcard":
+            return false;
+        case "earlier_grammar":
+            throw new Error(`allow-entry inert reason ${JSON.stringify(reason)} belongs to the session-rule store's bucket reading, never to an allow list`);
+        default: {
+            const unhandled = reason;
+            throw new Error(`unhandled allow-entry inert reason: ${String(unhandled)}`);
+        }
+    }
+}
+function requestAllowRuleInertEntriesOf(list) {
+    return list.flatMap((entry) => compileAllowList([entry], "allow", TOOL_NAME_ROSTER).inert.filter((i) => allowSideReadsAsNothing(i.reason)));
+}
+function inertEntriesOfList(list, layer) {
+    const face = TOOL_LIST_FACES[layer];
+    if (face.kind === "selector")
+        return selectorInertEntriesOf(list, face.side);
+    return face.side === "deny" ? inertRuleEntriesOf(list, "deny") : requestAllowRuleInertEntriesOf(list);
+}
+function* toolListsOf(body) {
     const skills = body["skills"];
     if (Array.isArray(skills)) {
         for (const skill of skills) {
-            const sentence = skillDenyInertSentence(skill);
-            if (sentence !== undefined)
-                return { layer: "skills", message: sentence };
+            if (!isPlainRecord(skill))
+                continue;
+            yield { layer: "skills", field: "skill.disallowedTools", prefix: "", list: skill["disallowedTools"] };
+        }
+        for (const skill of skills) {
+            if (isPlainRecord(skill))
+                yield { layer: "skills.allowedTools", field: "skill.allowedTools", prefix: "", list: skill["allowedTools"] };
         }
     }
     const agents = body["agents"];
@@ -73,12 +132,69 @@ export function skillDenyInertEntryOf(body) {
             if (!Array.isArray(agentSkills))
                 continue;
             for (let j = 0; j < agentSkills.length; j++) {
-                const sentence = skillDenyInertSentence(agentSkills[j]);
-                if (sentence !== undefined)
-                    return { layer: "agents.skills", message: `agents[${i}]: skills[${j}]: ${sentence}` };
+                const skill = agentSkills[j];
+                if (isPlainRecord(skill))
+                    yield { layer: "agents.skills", field: "skill.disallowedTools", prefix: `agents[${i}]: skills[${j}]: `, list: skill["disallowedTools"] };
             }
         }
+        for (let i = 0; i < agents.length; i++) {
+            const agent = agents[i];
+            const agentSkills = isPlainRecord(agent) ? agent["skills"] : undefined;
+            if (!Array.isArray(agentSkills))
+                continue;
+            for (let j = 0; j < agentSkills.length; j++) {
+                const skill = agentSkills[j];
+                if (isPlainRecord(skill))
+                    yield { layer: "agents.skills.allowedTools", field: "skill.allowedTools", prefix: `agents[${i}]: skills[${j}]: `, list: skill["allowedTools"] };
+            }
+        }
+        for (let i = 0; i < agents.length; i++) {
+            const agent = agents[i];
+            if (!isPlainRecord(agent))
+                continue;
+            yield { layer: "agents.denyTools", field: `agents[${i}].denyTools`, prefix: "", list: agent["denyTools"] };
+            yield { layer: "agents.allowTools", field: `agents[${i}].allowTools`, prefix: "", list: agent["allowTools"] };
+        }
+    }
+    yield { layer: "excludeTools", field: "excludeTools", prefix: "", list: body["excludeTools"] };
+    yield { layer: "allowTools", field: "allowTools", prefix: "", list: body["allowTools"] };
+    const settings = body["settings"];
+    const permissions = isPlainRecord(settings) ? settings["permissions"] : undefined;
+    if (isPlainRecord(permissions))
+        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", list: permissions["allow"] };
+}
+function entryOfList(l) {
+    const face = TOOL_LIST_FACES[l.layer];
+    if (Array.isArray(l.list)) {
+        const over = allowLayerEntryCountIssue(l.field, l.list);
+        if (over !== undefined)
+            return { layer: l.layer, side: face.side, code: LIST_OVER_CAP_CODE, message: `${l.prefix}${over.message}`, extra: { field: l.field, reason: "over_cap", count: over.count, cap: over.cap } };
+    }
+    if (!ruleEntryListShapeOk(l.list))
+        return undefined;
+    const inert = inertEntriesOfList(l.list, l.layer);
+    if (inert.length === 0)
+        return undefined;
+    return { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` };
+}
+function firstInertEntry(body, acceptLayer, acceptSide) {
+    if (!isPlainRecord(body))
+        return undefined;
+    for (const l of toolListsOf(body)) {
+        if (!acceptLayer(l.layer))
+            continue;
+        const entry = entryOfList(l);
+        if (entry === undefined)
+            continue;
+        if (entry.extra !== undefined || acceptSide(entry.side))
+            return entry;
     }
     return undefined;
 }
+export function skillDenyInertEntryOf(body) {
+    return firstInertEntry(body, (layer) => layer === "skills" || layer === "agents.skills", () => true);
+}
+export function inertToolListEntryOf(body, sides = ["allow", "deny"]) {
+    return firstInertEntry(body, () => true, (side) => sides.includes(side));
+}
 //# sourceMappingURL=rule-entry-list.js.map

package/dist/run-local.d.ts

@@ -54,15 +54,15 @@ export declare class UsageError extends Error {
  * set: …" list rather than letting the first brain call crash with a cryptic auth error. Returns a list of
  * missing items (empty = OK).
  *
- * 🔴 S-623:这里**不再**判网关 base URL。「配置能派发到的每一条 openai 路由都解析到显式端点」是 `loadConfig()`
- * 那一层的拒启判据(`model-route-endpoint.ts`,本入口在预检之前就调 `loadConfig()` —— 没设网关的配置根本走不到
+ * 🔴 S-623:这里**不再**判网关 base URL。「将要服务的那张表里每一条 openai 路由都解析到显式端点」是配置源应用之后的拒启判据
+ * (`model-route-endpoint.ts` 的 `judgeServedModelRoute`,本入口在预检之前就判过 —— 没设网关的配置根本走不到
  * 这里),原来那条臂(a)是它的一份更弱的手抄:注释要求「本机用户必须指向自己的网关」,判据却只查 `/v1` 后缀,
  * 旧的出厂缺省值恰好以 `/v1` 结尾 ⇒ 缺省值照样过(本仓自己也被骗)。`/v1` 后缀本身也一并删,理由三条:
  *  ① 同一个问题两个判官 —— `serve` 从不要求 `/v1`,同一份 .env 在 `serve` 起得来、在 `run-local` 被拒;
  *  ② 它会误拒真实存在的 OpenAI 兼容端点(DeepSeek 根路径直接服务 `/chat/completions`,本仓
  *     `src/bench/s1/live-deps.ts` 用的正是 `https://api.deepseek.com`;Gemini 的兼容面 `…/v1beta/openai`、Azure 的
  *     `…/openai/deployments/<name>` 也都不以 `/v1` 结尾);
- *  ③ 规则集只许变小:端点判据只有 loadConfig 那一只。
+ *  ③ 规则集只许变小:端点判据只有 `model-route-endpoint.ts` 那一只。
  *
  * NOTE: with an injected mock `brain` the gateway is irrelevant (no real call is made), so the caller skips
  * this check in that case — the check is about a REAL run, not the assembly.