@sema-agent/server 7.131.0 → 7.133.0

package/dist/read-face-posture.d.ts

@@ -17,9 +17,14 @@
  *  ② 运维面:`GET /v1/diagnostics/wiring` 报 `{face, source, note}`,「为什么这台机器是 open」有答案
  *     (裁定的补偿项:升级即放开,得让运维看得见并知道怎么钉回)。
  *
- * ## 优先序(三态,与 `config.ts` 的 `postureOn` 同形)
- * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
+ * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
+ * `env 显式` > `center 发布` > `lane 声明` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
+ * 🔴 **`lane` 一臂(S-1492,clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
+ * (`execution-lane-caps.ts` 的 `laneReadFaceDefault`;沙箱内部就是模型的整个世界)。运维没写 `READ_FACE` 时,车道声明比整机 posture 更具体 ⇒ 排在它前面;
+ * 声明 `roots` 的车道(`host` / `ssh` / `adb` / `device` / 未设车道)不替运维声明缺省,回到既有的 posture 派生,**一个字节不变**。
+ * 缺席这一态的派生**只有一只函数**({@link readFaceDefaultFor}),且读的是**最终生效的车道**(`loadConfig` 装配完 `remoteExec` 之后一次;
+ * local 形 `config.d/remote-exec.json` 覆写之后由车道合成步再派一次 —— 同一只 {@link settleDerivedReadFace})。
  *
  * ## 定界
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
@@ -31,13 +36,14 @@
  * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
+import { type LaneReadFaceDefault, type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type PostureSource } from "./posture-source.js";
 /**
  * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
  * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
  */
-export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
-/** 档位的来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
+/** 档位的来源(闭集五词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
 export type ReadFaceSource = PostureSource;
 /** 一台 worker 的 READ 面档位事实(值 + 来源)。`ServiceConfigFlat` 结构上满足本形。 */
 export interface ReadFacePostureFacts {
@@ -45,10 +51,29 @@ export interface ReadFacePostureFacts {
     readonly readFaceSource: ReadFaceSource;
 }
 /**
- * 缺席 `READ_FACE` 时的 posture 派生(`config.ts` 的铸点调用;显式值不经此口)。
- * 单用户 turnkey ⇒ `open`;多租户 ⇒ 不铸(引擎默认 `roots`,server 不复制上游默认)。
+ * 缺席 `READ_FACE` 时读面缺省的**唯一派生函数**(显式 env 值不经此口):
+ *  · 车道声明 `open`(隔离型车道)⇒ `open`,来源 `lane`(不论单用户还是多租户 —— 更具体的出处胜 posture);
+ *  · 车道声明 `roots` ⇒ 既有 posture 派生,逐字不变。
  */
-export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
+export declare function readFaceDefaultFor(input: {
+    readonly laneDefault: LaneReadFaceDefault;
+    readonly singleUserTurnkey: boolean;
+}): ReadFacePostureFacts;
+/** {@link settleDerivedReadFace} 动的那几格(`ServiceConfig` 结构上满足本形)。 */
+export interface ReadFaceDeploymentSeat {
+    readFace?: "open" | "roots" | undefined;
+    readFaceSource: ReadFaceSource;
+    remoteExec?: {
+        readonly provider: RemoteExecProvider;
+    } | undefined;
+}
+/**
+ * 把**派生的**读面缺省按这台部署**最终生效的车道**落到配置上(显式 env / center 发布的值与来源原样不动)。返回值 = 这一次有没有改动。
+ * 两个调用点,同一只函数:`loadConfig` 装配完 `remoteExec` 之后(env 三元链定的车道);车道合成步在 local 形文件覆写之后
+ * (`config.d/remote-exec.json` 能把车道换成 `host` / `local-docker`,读面缺省随最终车道重派 —— 否则它停在已作废的车道上)。
+ * 幂等:同一份配置再调一次不改。值与来源**同一处写**(`readFace` 缺席 ⟺ 来源 `engine-default`)。
+ */
+export declare function settleDerivedReadFace(seat: ReadFaceDeploymentSeat, singleUserTurnkey: boolean): boolean;
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
  *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
  *
@@ -67,13 +92,14 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     note: string;
 };
 /**
- * S-176 —— posture 派生的档位在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ * S-176 —— 派生的档位(`posture` 单机 ⇒ open,或 S-1492 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
  *
  * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
- * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。
- * 为什么只在 `posture` 一词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。S-1492 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
+ * 指路句带挂载告诫与钉回出路。
+ * 为什么只在 `posture` / `lane` 两词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
  * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。
- * 为什么是 info 不是 warn:每一台照常配置的单机每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
+ * 为什么是 info 不是 warn:每一台照常配置的部署每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
  *
  * 字段与极性表的 posture 行同名(`knob` / `value` / `source`),另带指路句;三格由 {@link buildReadFaceWiring} 投影出 ——
  * 拉取面与推送面**同一只函数**,不各算一次。`value` 是字符串:只有 `face` 在场的那一形才会走到这里。

package/dist/read-face-posture.js

@@ -1,13 +1,42 @@
+import { LANE_OPEN_READ_FACE_CAUTION, executionLaneOf, laneReadFaceDefault } from "./execution-lane-caps.js";
 import { POSTURE_SOURCE_WORDS, postureSourceNote } from "./posture-source.js";
 export const READ_FACE_SOURCE_WORDS = POSTURE_SOURCE_WORDS;
-export function readFaceForPosture(singleUserTurnkey) {
+function readFaceForPosture(singleUserTurnkey) {
     return singleUserTurnkey ? { readFace: "open", readFaceSource: "posture" } : { readFaceSource: "engine-default" };
 }
+export function readFaceDefaultFor(input) {
+    return input.laneDefault === "open" ? { readFace: "open", readFaceSource: "lane" } : readFaceForPosture(input.singleUserTurnkey);
+}
+function isDerivedSource(source) {
+    switch (source) {
+        case "env":
+        case "center":
+            return false;
+        case "lane":
+        case "posture":
+        case "engine-default":
+            return true;
+    }
+}
+export function settleDerivedReadFace(seat, singleUserTurnkey) {
+    if (!isDerivedSource(seat.readFaceSource))
+        return false;
+    const next = readFaceDefaultFor({ laneDefault: laneReadFaceDefault(executionLaneOf(seat.remoteExec?.provider)), singleUserTurnkey });
+    if (next.readFace === seat.readFace && next.readFaceSource === seat.readFaceSource)
+        return false;
+    if (next.readFace === undefined)
+        delete seat.readFace;
+    else
+        seat.readFace = next.readFace;
+    seat.readFaceSource = next.readFaceSource;
+    return true;
+}
 export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
         centerMeaning: "published by the web-admin and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
+        laneMeaning: `declared by the isolated execution lane this deployment runs on (REMOTE_EXEC=e2b|k8s|local-docker): the sandbox is the model's whole world, so reads are not fenced to the workspace roots by default; ${LANE_OPEN_READ_FACE_CAUTION}`,
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }
@@ -15,11 +44,11 @@ export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };
 }
 export function buildReadFacePostureNotice(facts) {
-    if (facts.readFaceSource !== "posture")
+    if (facts.readFaceSource !== "posture" && facts.readFaceSource !== "lane")
         return undefined;
     const wiring = buildReadFaceWiring(facts);
     if (wiring.face === null) {
-        throw new Error("read-face posture notice: source is `posture` but no face was minted — readFaceForPosture's invariant broke");
+        throw new Error(`read-face derived notice: source is \`${facts.readFaceSource}\` but no face was minted — readFaceDefaultFor's invariant broke`);
     }
     return { event: "config_knob_posture_derived", fields: { knob: "READ_FACE", value: wiring.face, source: wiring.source, note: wiring.note } };
 }

package/dist/request-key-closure.d.ts

@@ -1,8 +1,8 @@
 /** 拒体里逐字回显的键名条数上限。键名原样回显(不猜语义),但**条数有界** —— 一个塞满键的体不许把 400 响应
  *  放大成流量面。超出部分只报数。 */
 export declare const MAX_KEY_ECHO = 20;
-/** 键名回显的清洗:剥控制/双向字符(键名进的是 JSON 错误体与运维日志,一个 RLO 能把两行字读反),
- *  再按 {@link MAX_KEY_ECHO_CHARS} 截断。清洗之外**逐字**,不做大小写/近似猜测。 */
+/** 键名回显 = 前缀 + 调用方串的唯一回显口径(`caller-text-echo.ts`:剥控制 / 双向字符、截到 64 字 + …;键名进的是 JSON 错误体与运维日志,
+ *  一个 RLO 能把两行字读反)。清洗之外**逐字**,不做大小写/近似猜测。 */
 export declare function echoKeyName(prefix: string, key: string): string;
 /** 一次键闭集裁决的产物:一句 wire 文案 + 两张分类键名表(消费端可机读,不必解析文案)。 */
 export interface KeyClosureIssue {
@@ -58,5 +58,12 @@ export type InterruptSteerBody = {
 export type SteerBodyForm = "run" | "content" | "interrupt";
 /** 送话口的顶层键裁决(各形同一只;`form` 选受理集)。 */
 export declare function steerBodyKeyIssue(raw: unknown, form: SteerBodyForm): KeyClosureIssue | null;
+declare const PRINCIPAL_INBOX_BODY_KEYS: readonly ["to", "content", "urgent"];
+/** 受理口的体形(键 = 受理集,值形由路由逐键判)。 */
+export type PrincipalInboxBody = {
+    readonly [K in (typeof PRINCIPAL_INBOX_BODY_KEYS)[number]]?: unknown;
+};
+/** 受理口的顶层键裁决(与提交口 / 送话口同一只组句器)。 */
+export declare function principalInboxBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
 export {};
 //# sourceMappingURL=request-key-closure.d.ts.map

package/dist/request-key-closure.js

@@ -1,9 +1,8 @@
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { echoCallerText } from "./caller-text-echo.js";
+import { tightenOnlySeatField } from "./tighten-only-seats.js";
 export const MAX_KEY_ECHO = 20;
-const MAX_KEY_ECHO_CHARS = 64;
 export function echoKeyName(prefix, key) {
-    const clean = key.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return `${prefix}${clean.length > MAX_KEY_ECHO_CHARS ? `${clean.slice(0, MAX_KEY_ECHO_CHARS)}…` : clean}`;
+    return `${prefix}${echoCallerText(key)}`;
 }
 export function scanKeyClosure(bag, prefix, accepted, tolerated, into) {
     for (const k of Object.keys(bag)) {
@@ -33,6 +32,7 @@ const TASK_BODY_DECLARED_KEYS = [
 const TASK_BODY_SCENARIO_KEYS = ["repo"];
 const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);
 const UNSUPPORTED_BODY_KEYS = ["handsReadOnly", "readDenyPatterns", "readFace", "shellGate", "writeFace"];
+const BODY_KEY_SETTINGS_SEAT = { readDenyPatterns: tightenOnlySeatField("readDenyPatterns") };
 const UNSUPPORTED_BODY = {
     keys: new Set(UNSUPPORTED_BODY_KEYS),
     label: "unsupported (an engine seat this door does not read from the request body — set by the deployment)",
@@ -51,9 +51,10 @@ function closedBodyKeyIssue(raw, accepted, unsupported, door) {
         ...(buckets.unknown.length > 0 ? [keyClosureClause(buckets.unknown, `unknown (not ${door} key — check the spelling)`)] : []),
         ...(buckets.unsupported.length > 0 ? [keyClosureClause(buckets.unsupported, unsupported.label)] : []),
     ];
+    const seatHints = buckets.unsupported.flatMap((key) => (Object.hasOwn(BODY_KEY_SETTINGS_SEAT, key) ? [` \`${key}\` rides ${BODY_KEY_SETTINGS_SEAT[key]} instead.`] : []));
     return {
         message: `body: unrecognized top-level key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
-            `${parts.join("; ")}. ` +
+            `${parts.join("; ")}.${seatHints.join("")} ` +
             `Accepted: ${[...accepted].sort().join(",")}`,
         unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO),
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
@@ -77,4 +78,9 @@ const STEER_UNSUPPORTED = {
 export function steerBodyKeyIssue(raw, form) {
     return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_UNSUPPORTED, STEER_DOORS[form].door);
 }
+const PRINCIPAL_INBOX_BODY_KEYS = ["to", "content", "urgent"];
+const PRINCIPAL_INBOX_UNSUPPORTED = { keys: new Set(), label: "unsupported" };
+export function principalInboxBodyKeyIssue(raw) {
+    return closedBodyKeyIssue(raw, new Set(PRINCIPAL_INBOX_BODY_KEYS), PRINCIPAL_INBOX_UNSUPPORTED, "a principal-inbox message");
+}
 //# sourceMappingURL=request-key-closure.js.map

package/dist/request-value-closure.d.ts

@@ -71,6 +71,11 @@ export declare const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled'
  * 正是这个词关掉的记录 —— 两义都与关断词矛盾)。调用前值形已由上面的单成员表与既有布尔门判过。
  */
 export declare function fileHistoryRestoreConflict(body: Pick<TaskRequestBody, "fileHistory" | "restoreFiles" | "rewindFiles" | "rewindFilesTo">): boolean;
+/**
+ * 还原键里请求**真带了的**那几个(顺序固定:`restoreFiles` · `rewindFilesTo` · 退役的 `rewindFiles`)。{@link fileHistoryRestoreConflict} 的「还原」一半就是它非空 ——
+ * 判据只有这一份,拒体的 `detail.fields` 点名的也是它(判与点名不会各读各的)。
+ */
+export declare function fileHistoryRestoreKeysInBody(body: Pick<TaskRequestBody, "restoreFiles" | "rewindFiles" | "rewindFilesTo">): Array<"restoreFiles" | "rewindFilesTo" | "rewindFiles">;
 /**
  * **单成员闭集键表** —— 每键合法值只有它自己那一个关断词(`word`),缺席=照常,没有「开」的拼法。
  *

package/dist/request-value-closure.js

@@ -3,9 +3,17 @@ export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
 export const FILE_HISTORY_DISABLED_NO_RESTORE = "fileHistory: 'disabled' cannot ride with a file restore (restoreFiles, rewindFilesTo, or the retired rewindFiles) — the request turns this run's file history off and asks to restore files from it in the same breath; the engine would refuse it (rewind.capture_disabled) only after the session had already been branched at resumeAt, which it does not undo, so it is refused here, before any side effect. Drop fileHistory to restore, or drop the restore to run without file history";
 export function fileHistoryRestoreConflict(body) {
-    if (body.fileHistory !== "disabled")
-        return false;
-    return body.restoreFiles === true || body.rewindFiles === true || (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0);
+    return body.fileHistory === "disabled" && fileHistoryRestoreKeysInBody(body).length > 0;
+}
+export function fileHistoryRestoreKeysInBody(body) {
+    const out = [];
+    if (body.restoreFiles === true)
+        out.push("restoreFiles");
+    if (typeof body.rewindFilesTo === "string" && body.rewindFilesTo.length > 0)
+        out.push("rewindFilesTo");
+    if (body.rewindFiles === true)
+        out.push("rewindFiles");
+    return out;
 }
 const SINGLE_MEMBER_OFF_FIELDS = [
     { field: "memoryCapture", word: "off", message: MEMORY_CAPTURE_SPELLING_MESSAGE },

package/dist/rule-entry-list.d.ts

@@ -17,7 +17,7 @@
  *     运维 / 中心的审批名单读同一份,没有「这一处空名册、那一处带名册」的两种读法。
  *     **读成空的哪些原因词是拒面,按方向定**:**限制侧**(读成空 = 静默放行:技能 `disallowedTools`、`excludeTools` / 子代 `denyTools`、`settings.permissions.deny` / `ask`、运维 / 中心的审批名单)四类全拒 ——
  *     近似名 · 退役名 · 文法读不出 · 不带内容形的工具带内容;**放行侧**(读成空 = 想放的什么也没放:`settings.permissions.allow`、根 / 子代 `allowTools`、技能 `allowedTools`)**只拒近似名**
- *     ({@link allowSideReadsAsNothing}):近似名现名唯一、确定是笔误;退役名 / 内容形 / 文法读不出 / 协议名对端段通配照 7.130.0 受理、交引擎既有通告(引擎侧的终形是把退役名归一到现名并在用户面点名,到货前放行侧不拒 ——
+ *     ({@link allowSideReadsAsNothing}):近似名现名唯一、确定是笔误;退役名 / 内容形 / 文法读不出 / 协议名对端段通配照 7.130.0 受理、交引擎既有通告(其中选择器清单 `allowTools` 里**有后继**的退役名〔`Task` ⇒ `Agent`、`bash` ⇒ `Bash`〕core 7.52.0 起由引擎开跑前拒,不在本仓拒面;规则表上的退役名引擎照旧告运维 ——
  *     壳转投的 CC 用户 settings 里这些极常见,尤其内容形里的 `$VAR`(`Bash(echo $HOME)`)读成 `grammar`,拒了 = 每次提交 400)。运维的 `APPROVAL_GRANT` 是运维自己的配置:任何读成空都拒启(写错了当场改)。
  *     技能拒侧那一拒与引擎 #1372(core 7.43.0:那只技能不激活)是同一件事的两处 —— 7.118.0 重估过、本版**不退**:本仓的续跑腿把引擎的
  *     `checkpoint.config_refused`(`config.skill_deny_unreadable`)答得不一(资源停车续跑腿 500、`/decide` 先结了卡、`/wake` 先铸了 run 行),先统一那一层再退
@@ -27,8 +27,13 @@
  *     **真未知名**(拼写合法、没有近似也没有退役对应 —— 懒挂载的合法形,例如一台之后才连上的 MCP 服务器的工具)不是读成空:原样保留、运维行告知一次,不拒。
  *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
  *     `*` 在放行侧是「本层不设名单」、在限制侧读成空;限制侧 `mcp__*` / `a2a__*`(整个协议的拒)合法。
+ *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `detail.problems`,{@link inertToolListEntryOf} 铸);
+ *     放行侧选择器清单里受理口没拒、却什么也不放的条目随受理应答的 `warnings` 交回({@link allowSelectorWarningsOf})—— 两处读同一次条目读法({@link selectorReadings}),不另判。
  */
+import type { TightenOnlySeatField } from "./tighten-only-seats.js";
 import { compileAllowList } from "@sema-agent/core";
+import { type LimitRefusal } from "./limit-refusal.js";
+import { type EntryProblem } from "./entry-problems.js";
 /** ① 形:字符串数组(空串也是字符串 —— 引擎把它读成 `grammar` 并通告 / 拒,见 ③)。 */
 export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[];
 /**
@@ -42,14 +47,10 @@ export declare const ruleEntryListShapeOk: (v: unknown) => v is readonly string[
  * 没有真实用法需要上千条」。抬不抬这个数是产品判断,不随提货改。
  */
 export declare const MAX_ALLOW_LAYER_ENTRIES = 1000;
-/** 超帽的拒句(不截:截掉的尾项读起来像「在生效」)—— 句子的唯一铸点(请求 allow 桶的 wire 拒体按字段重铸也调它)。 */
+/** 超帽的拒句({@link allowLayerOverCap} 的句子;请求 allow 桶的拒句按字段重铸时读它)。 */
 export declare function describeAllowLayerOverCap(field: string, count: number): string;
-/** 一张条目表超了 {@link MAX_ALLOW_LAYER_ENTRIES} ⇒ 拒句 + 机读两数;没超 ⇒ `undefined`。四张表同调这一只。 */
-export declare function allowLayerEntryCountIssue(field: string, list: readonly unknown[]): {
-    readonly message: string;
-    readonly count: number;
-    readonly cap: number;
-} | undefined;
+/** 一张条目表超了 {@link MAX_ALLOW_LAYER_ENTRIES} ⇒ 拒(句子 + 机读位 `field` / `reason: "over_cap"` / `count` / `cap`);没超 ⇒ `undefined`。四张表同调这一只。 */
+export declare function allowLayerEntryCountIssue(field: string, list: readonly unknown[]): LimitRefusal | undefined;
 /** 一条引擎读成空的条目(引擎的形:原因词,名字层另带判词 / 1:1 现名;包根不导出这只具名型 ⇒ 从 `compileAllowList` 的返回型取,不手抄)。 */
 export type InertRuleEntry = ReturnType<typeof compileAllowList>["inert"][number];
 /**
@@ -130,9 +131,9 @@ export type ToolListLayer = keyof typeof TOOL_LIST_FACES;
 /**
  * 请求体 `settings.permissions.deny` / `ask`(规则编译器读的收紧表)所在的层 —— **不在** {@link toolListsOf} 的扫描里:它们的判与句子的唯一铸点在 `config.ts` 的
  * `unmatchableToolNamesRefusal`(经 `task-settings.ts` 的 `rulePolicyBucketsRefusal`,单表桶序;拒点是 `applyTaskSettings`,422),存体预判(`http/stored-body-replay.ts`)调同一只函数(home 同源于部署配置),把命中装成本型。
- * 层名进这个联合只为让命中能带坐标进 409 体与运维日志。
+ * 层名进这个联合只为让命中能带坐标进 409 体与运维日志。S-1351 起「只收紧」座位族的四座(`tighten-only-seats.ts`,坐标由座位表派生)同走这条路:座位门命中(形 / 超帽 / 条目)与 `permissions.neverAuto` 的名字层。
  */
-export type RulePolicyLayer = "settings.permissions.deny" | "settings.permissions.ask";
+export type RulePolicyLayer = "settings.permissions.deny" | "settings.permissions.ask" | TightenOnlySeatField;
 /** 一份提交体里第一处「工具名清单里有引擎读成空的条目」:在哪一层、哪个方向、拒码、拒句(超帽时另带机读字段,同 `settings.permissions.*` 桶超帽的形)。 */
 export interface InertToolListEntry {
     readonly layer: ToolListLayer | RulePolicyLayer;
@@ -150,6 +151,12 @@ export declare function replayInertEntry(layer: ToolListLayer | RulePolicyLayer,
 export interface SkillDenyInertEntry extends InertToolListEntry {
     readonly layer: SkillListLayer;
 }
+/**
+ * 一条技能(顶层 `skills[k]` / 子代 `agents[i].skills[j]`,`at` = 它的体内坐标)两只清单的**条数帽**:先 `allowedTools` 后 `disallowedTools`(与 7.131.0 的判序同)。
+ * 判与句子就是 {@link overCapOfList} 那一只(拒点 `resolveSpec` 两腿同经的 {@link inertToolListEntryOf} 先过的也是它):受理口在技能的两道形门处调它
+ * (`http/admission.ts` 的 `validateUserSkills` 与 `spec-fields.ts` 的 `validateTaskAgents`:两道门都逐条先形、后帽 —— 与 7.131.0 的拒点与判序同,码与先后不变),句子与机读位点体内坐标。
+ */
+export declare function skillToolListsOverCap(skill: unknown, at: string, scope: "top" | "agent"): InertToolListEntry | undefined;
 /**
  * ③ 的拒侧在**提交体**上的判,技能那两层(顶层 `skills[]` 与子代 `agents[].skills[]`;第一处命中即答)。全部工具名清单的判是 {@link inertToolListEntryOf}(调用点两处都调它);
  * 本函数单独导出是给随包排空脚本:那条判据(`skill-deny-inert`)只数技能这两层,SQL 车道的孪生也只看技能的清单。
@@ -167,7 +174,7 @@ export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntr
  * 本函数只是「在体的哪几处取清单」;句子只有一个有界的组句器({@link describeInertRuleEntries}),清单先过条数帽({@link allowLayerEntryCountIssue})。
  *
  * 为什么限制侧四类全拒、放行侧只拒近似名:引擎 7.51.x 把「没有任何工具答应的名字」改成条目原样保留 + 运维行告知一次。限制侧读成空 = **静默放行**(`denyTools:["BASH"]` 以为禁了 `Bash`,子代照用);
- * 放行侧读成空 = 想放的什么也没放 —— 其中**近似名**(现名唯一)是确定的笔误,拒并点名现名;**退役名**、**内容形**与**文法读不出**在放行侧照 7.130.0 受理、交引擎既有通告(见头注 ③)。
+ * 放行侧读成空 = 想放的什么也没放 —— 其中**近似名**(现名唯一)是确定的笔误,拒并点名现名;**退役名**(选择器清单里有后继的由引擎开跑前拒)、**内容形**与**文法读不出**在放行侧照 7.130.0 受理、交引擎既有通告(见头注 ③)。
  * **真未知名**(没有近似也没有退役对应)不在读成空之列,原样保留、告运维一次(之后挂上同名工具即生效)。请求的 `settings.permissions.deny` / `ask`
  * 与运维 / 中心的审批名单读同一张名册,走另一只入口({@link unmatchableToolNamesRefusal},`config.ts`),不在本函数(存体预判调同一只判据、home 同源于部署配置,见 `http/stored-body-replay.ts`)。
  *
@@ -180,5 +187,25 @@ export declare function skillDenyInertEntryOf(body: unknown): SkillDenyInertEntr
  * `checkpoint-ctx.ts` `resumeBlockedByPolicyAnswer`),拒在认领之前,行 / 卡 / ctx 不动。
  */
 export declare function inertToolListEntryOf(body: unknown, sides?: readonly ToolListSide[]): InertToolListEntry | undefined;
+/**
+ * 一个调用方工具的名字面(结构型,`ToolSpec` 满足它):主名、别名、委派工具声明的子代工具池里的行(主名与别名)—— 引擎认这些名字是「这条 run 挂着的工具」。
+ */
+export interface CallerToolNames {
+    readonly name: string;
+    readonly aliases?: readonly string[] | undefined;
+    readonly agentToolPool?: ReadonlyArray<{
+        readonly name: string;
+        readonly aliases?: readonly string[] | undefined;
+    }> | undefined;
+}
+/**
+ * **放行侧选择器清单的受理告知**(根 `allowTools`、子代定义的 `allowTools`)—— 这两张清单没有面向用户的通告通道(规则表与技能的放行清单读成空,引擎有受众 = 用户的通告
+ * `permission.allowed_tool_not_granted`;选择器清单上引擎只告运维一行),壳转投的 `.claude/agents` 文件里的 `tools:` 恰落在这两张表上。受理口**不拒**(引擎是这一面的判官,#1736 起
+ * 没有任何工具答应的名字保留、只告),把「这几条什么也不放」作为 `warnings` 随受理应答交回:每条 `{ code, field, entry, reason }`(形的属主 `entry-problems.ts`),`code` = 这张清单被拒时的码。
+ * 限制侧不告(`denyTools` / `excludeTools` 的近似名 / 退役名 / 文法读不出已是 400)。
+ *
+ * 在 `resolveSpec` **之后**问(近似名那一类已先 400):`tools` 是这一请求装配出的调用方工具(`spec.tools`,名字面见 {@link CallerToolNames})。超帽 / 形不对的清单不读(受理门先拒)。
+ */
+export declare function allowSelectorWarningsOf(body: unknown, tools: readonly CallerToolNames[]): readonly EntryProblem[];
 export {};
 //# sourceMappingURL=rule-entry-list.d.ts.map

package/dist/rule-entry-list.js

@@ -1,16 +1,19 @@
 import { PROTOCOL_TABLE, compileAllowList, parsePermissionRule } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
+import { limitRefusal } from "./limit-refusal.js";
 import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
+import { NOT_IN_ROSTER, entryProblem, entryProblemsFacts } from "./entry-problems.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
+const ALLOW_LAYER_OVER_CAP_TAIL = "Refused rather than truncated: a truncated list silently drops the entries past the cap. Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list";
+function allowLayerOverCap(field, count) {
+    return limitRefusal(field, "entries", count, MAX_ALLOW_LAYER_ENTRIES, { tail: ALLOW_LAYER_OVER_CAP_TAIL });
+}
 export function describeAllowLayerOverCap(field, count) {
-    return (`${field} has ${count} entries — at most ${MAX_ALLOW_LAYER_ENTRIES} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the cap. ` +
-        `Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list`);
+    return allowLayerOverCap(field, count).message;
 }
 export function allowLayerEntryCountIssue(field, list) {
-    if (list.length <= MAX_ALLOW_LAYER_ENTRIES)
-        return undefined;
-    return { message: describeAllowLayerOverCap(field, list.length), count: list.length, cap: MAX_ALLOW_LAYER_ENTRIES };
+    return list.length <= MAX_ALLOW_LAYER_ENTRIES ? undefined : allowLayerOverCap(field, list.length);
 }
 export function inertRuleEntriesOf(list, behavior) {
     return compileAllowList(list, behavior, TOOL_NAME_ROSTER).inert;
@@ -74,14 +77,17 @@ function selectorEntryName(entry) {
 }
 const isProtocolWideName = (name) => PROTOCOL_TABLE.some((e) => name === `${e.prefix}*`);
 function selectorInertEntriesOf(list, side) {
+    const readings = selectorReadings(list, side);
+    return side === "allow" ? readings.filter((i) => allowSideReadsAsNothing(i.reason)) : readings;
+}
+function selectorReadings(list, side) {
     return list.flatMap((entry) => {
         if (entry === "*" && side === "allow")
             return [];
         const name = selectorEntryName(entry);
         if (side === "deny" && isProtocolWideName(name))
             return [];
-        const inert = compileAllowList([name], "deny", TOOL_NAME_ROSTER).inert.map((i) => ({ ...i, entry }));
-        return side === "allow" ? inert.filter((i) => allowSideReadsAsNothing(i.reason)) : inert;
+        return compileAllowList([name], "deny", TOOL_NAME_ROSTER).inert.map((i) => ({ ...i, entry }));
     });
 }
 function allowSideReadsAsNothing(reason) {
@@ -114,14 +120,16 @@ function inertEntriesOfList(list, layer) {
 function* toolListsOf(body) {
     const skills = body["skills"];
     if (Array.isArray(skills)) {
-        for (const skill of skills) {
+        for (let k = 0; k < skills.length; k++) {
+            const skill = skills[k];
             if (!isPlainRecord(skill))
                 continue;
-            yield { layer: "skills", field: "skill.disallowedTools", prefix: "", list: skill["disallowedTools"] };
+            yield { layer: "skills", field: "skill.disallowedTools", prefix: "", at: `skills[${k}].disallowedTools`, list: skill["disallowedTools"] };
         }
-        for (const skill of skills) {
+        for (let k = 0; k < skills.length; k++) {
+            const skill = skills[k];
             if (isPlainRecord(skill))
-                yield { layer: "skills.allowedTools", field: "skill.allowedTools", prefix: "", list: skill["allowedTools"] };
+                yield { layer: "skills.allowedTools", field: "skill.allowedTools", prefix: "", at: `skills[${k}].allowedTools`, list: skill["allowedTools"] };
         }
     }
     const agents = body["agents"];
@@ -134,7 +142,7 @@ function* toolListsOf(body) {
             for (let j = 0; j < agentSkills.length; j++) {
                 const skill = agentSkills[j];
                 if (isPlainRecord(skill))
-                    yield { layer: "agents.skills", field: "skill.disallowedTools", prefix: `agents[${i}]: skills[${j}]: `, list: skill["disallowedTools"] };
+                    yield { layer: "agents.skills", field: "skill.disallowedTools", prefix: `agents[${i}]: skills[${j}]: `, at: `agents[${i}].skills[${j}].disallowedTools`, list: skill["disallowedTools"] };
             }
         }
         for (let i = 0; i < agents.length; i++) {
@@ -145,51 +153,72 @@ function* toolListsOf(body) {
             for (let j = 0; j < agentSkills.length; j++) {
                 const skill = agentSkills[j];
                 if (isPlainRecord(skill))
-                    yield { layer: "agents.skills.allowedTools", field: "skill.allowedTools", prefix: `agents[${i}]: skills[${j}]: `, list: skill["allowedTools"] };
+                    yield { layer: "agents.skills.allowedTools", field: "skill.allowedTools", prefix: `agents[${i}]: skills[${j}]: `, at: `agents[${i}].skills[${j}].allowedTools`, list: skill["allowedTools"] };
             }
         }
         for (let i = 0; i < agents.length; i++) {
             const agent = agents[i];
             if (!isPlainRecord(agent))
                 continue;
-            yield { layer: "agents.denyTools", field: `agents[${i}].denyTools`, prefix: "", list: agent["denyTools"] };
-            yield { layer: "agents.allowTools", field: `agents[${i}].allowTools`, prefix: "", list: agent["allowTools"] };
+            yield { layer: "agents.denyTools", field: `agents[${i}].denyTools`, prefix: "", at: `agents[${i}].denyTools`, list: agent["denyTools"] };
+            yield { layer: "agents.allowTools", field: `agents[${i}].allowTools`, prefix: "", at: `agents[${i}].allowTools`, list: agent["allowTools"] };
         }
     }
-    yield { layer: "excludeTools", field: "excludeTools", prefix: "", list: body["excludeTools"] };
-    yield { layer: "allowTools", field: "allowTools", prefix: "", list: body["allowTools"] };
+    yield { layer: "excludeTools", field: "excludeTools", prefix: "", at: "excludeTools", list: body["excludeTools"] };
+    yield { layer: "allowTools", field: "allowTools", prefix: "", at: "allowTools", list: body["allowTools"] };
     const settings = body["settings"];
     const permissions = isPlainRecord(settings) ? settings["permissions"] : undefined;
     if (isPlainRecord(permissions))
-        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", list: permissions["allow"] };
+        yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", at: "settings.permissions.allow", list: permissions["allow"] };
 }
-function entryOfList(l) {
+function inertReadingOfList(l) {
     const face = TOOL_LIST_FACES[l.layer];
-    if (Array.isArray(l.list)) {
-        const over = allowLayerEntryCountIssue(l.field, l.list);
-        if (over !== undefined)
-            return { layer: l.layer, side: face.side, code: LIST_OVER_CAP_CODE, message: `${l.prefix}${over.message}`, extra: { field: l.field, reason: "over_cap", count: over.count, cap: over.cap } };
-    }
     if (!ruleEntryListShapeOk(l.list))
         return undefined;
     const inert = inertEntriesOfList(l.list, l.layer);
     if (inert.length === 0)
         return undefined;
-    return { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` };
+    return { inert, entry: { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` } };
+}
+function inertProblemsOf(l, inert) {
+    const face = TOOL_LIST_FACES[l.layer];
+    return inert.map((i) => entryProblem(face.code, l.at, i.entry, i.reason));
+}
+function overCapOfList(l) {
+    if (!Array.isArray(l.list))
+        return undefined;
+    const over = allowLayerEntryCountIssue(l.at, l.list);
+    return over === undefined ? undefined : { layer: l.layer, side: TOOL_LIST_FACES[l.layer].side, code: LIST_OVER_CAP_CODE, message: over.message, extra: over.facts };
+}
+export function skillToolListsOverCap(skill, at, scope) {
+    if (!isPlainRecord(skill))
+        return undefined;
+    const allowLayer = scope === "top" ? "skills.allowedTools" : "agents.skills.allowedTools";
+    const denyLayer = scope === "top" ? "skills" : "agents.skills";
+    return (overCapOfList({ layer: allowLayer, field: "skill.allowedTools", prefix: "", at: `${at}.allowedTools`, list: skill["allowedTools"] }) ??
+        overCapOfList({ layer: denyLayer, field: "skill.disallowedTools", prefix: "", at: `${at}.disallowedTools`, list: skill["disallowedTools"] }));
 }
 function firstInertEntry(body, acceptLayer, acceptSide) {
     if (!isPlainRecord(body))
         return undefined;
+    let first;
+    const problems = [];
     for (const l of toolListsOf(body)) {
         if (!acceptLayer(l.layer))
             continue;
-        const entry = entryOfList(l);
-        if (entry === undefined)
+        const over = overCapOfList(l);
+        if (over !== undefined) {
+            if (first === undefined)
+                return over;
             continue;
-        if (entry.extra !== undefined || acceptSide(entry.side))
-            return entry;
+        }
+        const reading = inertReadingOfList(l);
+        if (reading === undefined || !acceptSide(reading.entry.side))
+            continue;
+        first ??= reading.entry;
+        problems.push(...inertProblemsOf(l, reading.inert));
     }
-    return undefined;
+    return first === undefined ? undefined : { ...first, extra: { ...entryProblemsFacts(problems) } };
 }
 export function skillDenyInertEntryOf(body) {
     return firstInertEntry(body, (layer) => layer === "skills" || layer === "agents.skills", () => true);
@@ -197,4 +226,51 @@ export function skillDenyInertEntryOf(body) {
 export function inertToolListEntryOf(body, sides = ["allow", "deny"]) {
     return firstInertEntry(body, () => true, (side) => sides.includes(side));
 }
+function callerToolNameSet(tools) {
+    const names = new Set();
+    for (const t of tools) {
+        names.add(t.name);
+        for (const a of t.aliases ?? [])
+            names.add(a);
+        for (const row of t.agentToolPool ?? []) {
+            names.add(row.name);
+            for (const a of row.aliases ?? [])
+                names.add(a);
+        }
+    }
+    return names;
+}
+const isProtocolNamespacedName = (name) => PROTOCOL_TABLE.some((e) => name.startsWith(e.prefix));
+function allowSelectorEntryWarning(entry, callerNames) {
+    if (entry === "*")
+        return undefined;
+    if (callerNames.has(selectorEntryName(entry)))
+        return undefined;
+    const read = selectorReadings([entry], "allow")[0];
+    if (read !== undefined)
+        return read.reason;
+    const name = selectorEntryName(entry);
+    if (isProtocolNamespacedName(name))
+        return undefined;
+    return TOOL_NAME_ROSTER.has(name) ? undefined : NOT_IN_ROSTER;
+}
+export function allowSelectorWarningsOf(body, tools) {
+    if (!isPlainRecord(body))
+        return [];
+    const callerNames = callerToolNameSet(tools);
+    const out = [];
+    for (const l of toolListsOf(body)) {
+        if (l.layer !== "allowTools" && l.layer !== "agents.allowTools")
+            continue;
+        if (!ruleEntryListShapeOk(l.list) || l.list.length > MAX_ALLOW_LAYER_ENTRIES)
+            continue;
+        const code = TOOL_LIST_FACES[l.layer].code;
+        for (const entry of l.list) {
+            const reason = allowSelectorEntryWarning(entry, callerNames);
+            if (reason !== undefined)
+                out.push(entryProblem(code, l.at, entry, reason));
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=rule-entry-list.js.map

package/dist/rules-consent.js

@@ -2,9 +2,9 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
-import { ABSOLUTE_HOST_PATH_MAX } from "@sema-agent/settings-schema";
+import { ABSOLUTE_HOST_PATH_MAX, hasControlOrBidi } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
-import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
+import { hasBidiControls } from "./text-bidi.js";
 import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
@@ -178,7 +178,7 @@ function screenLocalImportRow(row) {
             detail: "this project root carries bidirectional control characters — the directory a reader sees is not the directory the matcher would use",
         };
     }
-    if (scope.kind === "project" && CONTROL_AND_BIDI_DETECT_RE.test(scope.root)) {
+    if (scope.kind === "project" && hasControlOrBidi(scope.root)) {
         return {
             reason: "scope_control_chars",
             detail: "this project root carries control bytes (C0/DEL) — it is not a path, one SQL dialect refuses to store it at all, and it breaks the separator assumption this lane's comparison keys rest on",
@@ -220,7 +220,6 @@ function screenLocalImportRow(row) {
     return consistent(written.rule);
 }
 const LOCAL_IMPORT_LAYER_PATH = "local-import:rules";
-const CONTROL_AND_BIDI_DETECT_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
 const LOCAL_IMPORT_KEY_SEP = "\u0000";
 function buildLocalImportLayers(candidates) {
     const byRoot = new Map();