@sema-agent/server 7.131.0 → 7.133.0

package/dist/task-settings.d.ts

@@ -27,12 +27,12 @@
  *    `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO` (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell).
  *    A request-carried skill's `allowedTools` is the same member's twin (same grammar, same predicate, same admission judge
  *    `rule-entry-list.ts`). Pinned on the real assembly: `test/allow-layer-operator-knobs.test.ts`.
- *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收 core `PERMISSION_MODES` **全集**
- *    (default | acceptEdits | plan | auto | bypassPermissions | dontAsk),bypass/auto 被 HONOR 为 gate-shape 选择
- *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
- *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[ref] 拍照。
+ *  - permissionMode:`defaultMode` 收 core `PERMISSION_MODES` **全集**(default | acceptEdits | plan | auto | bypassPermissions | dontAsk),
+ *    生效词原样过境 `TaskSpec.permissionMode`,模式**做什么**只在引擎里答(core `modePolicyOf` / `arbitrateByMode`)。本模块的折叠
+ *    **不读**模式词:deny / ask 两张表在每一个词下编出同一只策略,部署基线照压(tightenTaskSpec deny-wins);bypass 放行的只是引擎
+ *    能放行的那几类问,部署 / 请求的 deny 与 ask 规则它一条都掀不掉。
  *
- * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
+ * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy compile MIRRORS
  * the shell's LOCAL-Runner resolver — both compose the SAME core primitives (`createAllowDenyPolicy` /
  * `combinePolicies` / `tightenTaskSpec`), so the deny-wins ENFORCEMENT is core-single-source. Only the COMPOSITION
  * is duplicated for the remote path; a proposed follow-up extracts it to `@sema-agent/sdk` for true
@@ -47,27 +47,29 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { type PathRuleBases, type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider, type PermissionMode } from "@sema-agent/core";
+import { type PathRuleBases, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PermissionMode } from "@sema-agent/core";
+import { type EntryProblem } from "./entry-problems.js";
 import { type KeyClosureIssue } from "./request-key-closure.js";
 import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import { type EntryPermissionMode } from "./runtime-governance.js";
+import { type TightenOnlySeatValues } from "./tighten-only-seats.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
  * `?permissionMode=` 查询串三处同读)。本仓不持有第二份词表,也不持有「收 / 不收」的表态:判据 = core 的 `isPermissionMode`,型 = core 的
- * `PermissionMode`,wire 句子里的词表只从这里取词({@link PERMISSION_MODE_WORDS})。core 加一个词 ⇒ 请求面自动收它,它在派生腿上的去向由
- * {@link deriveSettingsPolicy} 的穷举 `switch` 逼出来(缺一臂 ⇒ 编译红);core 删 / 改名一个词 ⇒ 本文件里按名写出它的那一臂编译红。
+ * `PermissionMode`,wire 句子里的词表只从这里取词({@link PERMISSION_MODE_WORDS})。core 加一个词 ⇒ 请求面自动收它、原样过境,本仓没有
+ * 按词分的臂要补;core 删 / 改名一个词 ⇒ 本仓按名写出它的地方(`PLAN_APPROVE_PERMISSION_MODES_AFTER` 等)编译红。
  * 生效模式原样过境 `TaskSpec.permissionMode`(S-877):引擎自己解释模式 —— 含 `dontAsk`(CC 的「自动拒」档:凡是要问的一律由模式拒,零卡,
- * 门记录 `deniedBy:"mode"`),本仓不另写判。
+ * 门记录 `deniedBy:"mode"`)与 acceptEdits 的免问写域(引擎的写根:任务根 + `additionalDirectories` + 宣告的可写目录),本仓不另写判。
  */
 /** 请求面闭集的 wire 文案形(`"a" | "b" | …`,core 序)—— 三处 400(顶层 / bundle / 查询串)的句子从这里取词,不再各抄一份。 */
 export declare const PERMISSION_MODE_WORDS: string;
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends
  * the CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
- * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the mode only selects the CLIENT-derived
- * gate ({@link deriveSettingsPolicy}); it can never subtract from the deployment/operator policy (applyTaskSettings
- * folds via tightenTaskSpec, deny-wins). The honored set is core's `PERMISSION_MODES` in full — every word passes
+ * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the word rides verbatim into `TaskSpec.permissionMode`
+ * and only the engine interprets it; no mode subtracts from the deployment/operator policy or from the request's own
+ * deny / ask rules (applyTaskSettings folds them via tightenTaskSpec, deny-wins, under every word alike). The honored set is core's `PERMISSION_MODES` in full — every word passes
  * through verbatim (`dontAsk` included: folding the auto-deny mode to `default`, the asking mode, would turn a refusal
  * into a card). An UNKNOWN string coerces to `default` (fail-safe: the most-asking mode).
  * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-member value
@@ -147,19 +149,13 @@ export declare function storedBodyPermissionMode(body: {
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
  *  future-proof). Awareness rides for free: core composes ORCHESTRATION_AWARENESS from thinking∈{xhigh,max}, no field. */
 export declare function effectiveThinking(reasoningEffort: unknown, ultracode: boolean): ThinkingLevel | undefined;
-/** R4: fold a top-level `body.permissionMode` onto the parsed settings as `permissions.defaultMode` (the top-level
- *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
- *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
-export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: PermissionMode): ParsedTaskSettings;
 /**
- * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
- * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
- * 都没有 ⇒ `undefined` = **无表态**(调用点据此不写键,而不是替调用方选一个默认值)。
+ * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序:顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的
+ * `settings.permissions.defaultMode`;两处都没有 ⇒ `undefined` = **无表态**(调用点据此不写键,而不是替调用方选一个默认值;引擎把缺席读成 `default`)。
  *
- * 🔴 为什么必须是一只函数:同一个「生效模式」此前在 resolve-spec 里被算了两次(hooks 腿的
- * `permission_mode` 载荷、settings 折叠腿的 `withPermissionMode`),三审同点判定翻译表**不得**成为
- * 第三个算点 —— 三处各算各的,任何一次优先序修订都会让三面分家,而分家在这条轴上的形态是
- * 「壳发的 bundle bypass 在 A 面生效、在 B 面没生效」这种最难被外部发现的静默偏差。
+ * 🔴 为什么必须是一只函数:同一个「生效模式」此前在 resolve-spec 里被算过两次(hooks 腿的 `permission_mode` 载荷、settings 折叠腿),
+ * 两处各算各的,任何一次优先序修订都会让两面分家,而分家在这条轴上的形态是「壳发的 bundle bypass 在 A 面生效、在 B 面没生效」这种
+ * 最难被外部发现的静默偏差。settings 折叠今天不再读模式词,这只函数的读者是 spec 过境点、托管天花板与存储体读法。
  */
 export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
@@ -216,7 +212,7 @@ export interface ParsedTaskSettings {
     ultracode?: boolean;
     /** hooks hook-runner(阶段一):经 `parseHooksConfig`(契约包分类器 + 服务侧上限 + 本仓会跑的条目类型)判过的 hooks 配置。像 shellEnv 一样
      *  这里只 PARSE;应用点(main.ts resolveSpec)按单用户闸(`requirePrincipal !== true`)决定翻不翻成
-     *  core `TaskSpec.hooks` 回调——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
+     *  任务座 `TaskSpec.mods` 上的一张注册 `settings.hooks`——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
     hooks?: RunnableHooksConfig;
     /** [ref](7.77.0)—— CC settings 同名键:上下文窗口里**留给技能清单**的比例((0,1];CC 默认 0.01 = 1%)。
      *  超预算时引擎把描述裁短、再不够退成 name-only(`cli259.js` 的清单渲染算法),**从不**拒掉一条技能 ——
@@ -225,6 +221,10 @@ export interface ParsedTaskSettings {
     skillListingBudgetFraction?: number;
     /** 同族第二键:每条技能描述在清单里的字符帽(正整数;CC 默认 1536)。超出由引擎**截断**,不是拒。 */
     skillListingMaxDescChars?: number;
+    /** S-1351 —— 「只收紧」座位族(`tighten-only-seats.ts` 的四座:读拒模式 / 写保护名的加法 / 合规额外禁项 / 永不自动放行名单)的归一值,**一个键**而不是四个散字段:
+     *  wire 位置由座位表说(三座在 `settings` 顶层,`neverAuto` 在 `settings.permissions`),解析后与位置无关。空数组 ≡ 缺席(不铸键)。
+     *  去处:三座经 {@link applyTaskSettings} 落 core 任务层席;`neverAuto` 经 {@link deriveSettingsPolicy} 落请求叶策略。 */
+    tightenOnly?: TightenOnlySeatValues;
 }
 /** The result of parsing an untrusted `body.settings`: the applied subset + the names of present-but-deferred
  *  fields (so the caller can log/advertise them — no silent drop). `null` settings ⇒ `{ settings: undefined }`. */
@@ -285,13 +285,17 @@ export declare function settingsPermissionBucketIssue(perms: unknown): SettingsP
  *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。
  *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
  *
+ *  🔴 `readDenyPatterns` / `writeProtectedExtra` / `complianceAdditionalDenies` 与 `permissions.neverAuto`(S-1351)= **「只收紧」座位族**:消费点 = `tighten-only-seats.ts`
+ *  的座位表(位置、条目律、去处都由那张表说),读入在 {@link parseTaskSettings},投影在 {@link applyTaskSettings} / {@link deriveSettingsPolicy}。这四个键不是 CC settings 键
+ *  (sdk 的 `SemaSettings` 尚未声明 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 的「server 先于 sdk」登记表记着它们)。
+ *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
  *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 的 `TaskSpec` 透传。语义(预算怎么花、描述怎么裁、
  *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。 */
-export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
+export declare const TASK_SETTINGS_KEYS: readonly ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
-export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 /** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响
  *  文案,不影响判决。前三个的出处 = `@sema-agent/sdk` `SemaSettings` 尾注逐字点名的 deferred CC 键。
  *
@@ -324,7 +328,7 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * 🔒 **`settings.hooks` 会不会被采纳** —— 全仓**唯一**的车道谓词(S-995,主会话裁):hook 命令跑在 WORKER HOST([ref] class ② 能力授予),所以只有单用户车道
  * (`requirePrincipal !== true`,与 scheduler / backgroundShell / lspHost / MCP 注入同一姿势)采纳;多租户车道收到 hooks **整只忽略**(`task_hooks_ignored`),绝不执行。
  * 三处读它,谁也不许内联 `requirePrincipal`(各写各的 = 迟早漂):
- *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不装 `TaskSpec.hooks` + 一条 `task_hooks_ignored`;
+ *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不铸 `TaskSpec.mods` 的 `settings.hooks` 注册 + 一条 `task_hooks_ignored`;
  *  · `http/routes/capabilities.ts` —— 能力位 `taskSettings.hooks`(「says yes ⟺ route works」);
  *  · `http/admission.ts` —— fresh 受理面的「别名 matcher 永不命中」判据的**求值深度**:采纳 ⇒ `"regex"`(运行期同一只匹配函数,带资源闸);不采纳 ⇒ `"literal"`
  *    (7.112.0 的字面判:零调用方正则执行 —— 受理面是所有车道,租户不能借一只灾难回溯的 matcher 占满事件循环)。
@@ -350,71 +354,39 @@ export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSetting
  *  value must not become active prompt content after rollout (context exhaustion / spend hole). Over-cap ⇒ dropped +
  *  warned — the rider was inert pre-upgrade, so dropping preserves the stored task's prior behavior; a 4xx here would
  *  permanently brick that task's resume instead (same defensive posture as parseTaskSettings' outputStyle drop).
- *  Cap value = the submit gate's (16384; MAX_SETTINGS_OUTPUT_STYLE_CHARS — both land in the same spec field). */
-/** TRUE when `text` is an ALREADY-ASSEMBLED system prompt — core's migration guard detects the same three
- *  constitution anchors and takes the pass-through assembler arm, whose section subset (OPAQUE_KEPT, dist-read)
- *  has NO `core/role.append`: any append rider (top-level or settings.outputStyle) would be SILENTLY discarded
- *  there. Shared predicate for the submit 400 gate, the resolveSpec resume mirror, and the center-declaration
- *  probe — one definition so the three gates can't drift. */
-export declare function hasConstitutionAnchors(text: unknown): boolean;
-/** codex R9 (provider-aware append-less detection): mirrors core's ACTUAL pass-through triggers instead of a raw
- *  body-text heuristic — the assembler's migration guard probes (a) `stableBlocks` identity declarations and
- *  (b) `stableSystem` OUTPUT for the three anchors; a plain `userSystemPrompt` under the DEFAULT provider (no
- *  scenario provider) never triggers it and `core/role.append` is retained, so an anchored systemPrompt there
- *  must NOT block/strip a rider (R9 false-positive: unbranded default / scan rejected valid combos). Probing
- *  calls the provider hooks with a minimal ctx — server providers (and centerPromptProvider) are pure functions
- *  of ctx, and the same hooks run again inside core's assembly; a hook throw = conservative false (core will
- *  fail the task loudly on its own). `replaceAll` owns the whole prompt(legacy free-form `system()` 腿已随 core 2.0.0 删除)
- *  (REPLACE_ALL_EXCLUDED strips role.append) → append-less true. */
-export declare function providerDropsAppend(provider: PromptProvider | undefined, userSystemPrompt: string | undefined): boolean;
-export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void, packDropsAppend?: boolean): string | undefined;
+ *  Cap value = the submit gate's (16384; MAX_SETTINGS_OUTPUT_STYLE_CHARS — both land in the same spec field).
+ *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
+ *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
+export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
+export declare function createWorkflowAskPolicy(isExempt?: WorkflowGateWiring["isExempt"]): ToolPolicy;
 /** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
- *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
- *  since [ref] — the sandbox lanes wire a gate of their own shape instead of no gate). */
+ *  fs-independent: one shape on every execution lane. */
 export interface WorkflowGateWiring {
-    /** The session "don't ask again" probe (approvalExemptionStore.has, canonical toolName key) — same store and
-     *  key space as the fs-write gate's probe; one remember="session" grant serves both. */
+    /** The session "don't ask again" probe (approvalExemptionStore.has, raw toolName key) — the same store and key space the
+     *  approval seat's standing grants read; one remember="session" grant serves them all. */
     isExempt?: (toolName: string) => boolean | Promise<boolean>;
 }
-/** [ref]/[ref]① — everything the mode-derived fs-write ask gate needs from the deployment, provided by
- *  `resolve-spec.ts`. Absent ⇒ no gate is derived (the pre-[ref] behavior).
- *
- *  WHY the `env` matters: core's `createFsWriteGatePolicy` canonicalizes every target/dir through the given `env`
- *  (real `exists`/`canonicalPath`/`readLink` fs access — read in dist, fs-write-gate-policy.js), so on a
- *  HOST-SEMANTICS lane (`REMOTE_EXEC` unset or "host") the env MUST be the fs the hand tools write.
+/**
+ * 请求的 deny / ask 两张表解析路径形规则用的**基**(`resolve-spec.ts` 每请求供)。只有这两件事:这条 task 的真根、执行环境的 home。
+ * 缺席 ⇒ 不声明(规则锚在装入这只策略的那条腿的真根,`~/` 形由 {@link rejectUnmatchableSettingsNames} 响亮拒)。
  *
- *  [ref]/[ref] — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) wire a gate TOO, but a different-shaped one: the
- *  tools run OFF this box and the per-task sandbox env is minted inside core (executionEnvFactory) AFTER spec
- *  build, so a worker-local env would adjudicate against the WRONG fs (a wrong ALLOW is worse than no gate — that
- *  is why [ref] left those lanes gate-less). They supply a `DeferredSandboxPathEnv`
- *  (`src/boot/deferred-sandbox-path-env.ts`) instead: a proxy that forwards the fs READ primitives to the task's
- *  REAL sandbox env at adjudication time (a per-session slot the factory decorator fills), keeping only
- *  `absolutePath` lexical so no relative path is resolved against the wrong base. Empty slot ⇒ fail-closed. */
+ * 修前本型还承运本仓自己的 acceptEdits cwd 域写门的四件(裁决 env / cwd / scratchpad 豁免域 / 会话豁免探针):acceptEdits 能免问写哪里
+ * 现在只由引擎的模式门答(写根 = 任务根 + `additionalDirectories` + 宣告的可写目录),本仓不再构造写门,那四件随之退役。
+ * 部署级旋钮(`SENSITIVE_WRITE_PATTERNS` 守卫集、`MANUAL_MODE_SHELL_GATE` 地板)早已不经本型:它们在治理层无条件施加
+ * (`runtime-governance.ts` `applyRuntimeGovernance`),client 表态掀不掉([ref] / [ref])。
+ */
 export interface FsWriteGateWiring {
-    /** The env the gate canonicalizes against — the worker host env on the host lane, the
-     *  `DeferredSandboxPathEnv` proxy over the task's real sandbox env on the sandbox lanes ([ref]). */
-    env: ExecutionEnv;
-    /** The task's working directory: the factory's `rootPath` (relative-path base) AND the acceptEdits accept domain.
-     *  ABSENT on the sandbox lanes ([ref]/[ref]): the sandbox cwd is the ENGINE's tracked cwd, not the env's own, so
-     *  neither spec time nor the env proxy can supply the right base — inventing one would mint a bogus auto-allow
-     *  domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths fail to resolve
-     *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
-     *  never-created sentinel dir (resolve-spec 修5). */
-    cwd?: string;
     /**
-     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基,与上面那个 `cwd` **刻意分成两个字段**。
+     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基(core `PathRuleBases.root`),**只在真任务根已知时**在场。
      *
-     * 两者在 host 腿上常常同值,但它们回答的不是同一个问题,而混用一个字段会让其中一个静默失效:
-     *  · `cwd` 是**写门**的基。它在「有 remoteExec 但这条 session 还没登记工作目录」时取的是一个
-     *    **永不创建的哨兵目录**(`resolve-spec` 的 `fs-write-gate-unrooted`)。对写门那是 fail-SAFE 的:
-     *    相对目标在哨兵下解析不出真身 ⇒ 落 ask。
-     *  · `taskRoot` 是**规则模式**的基(core `PathRuleBases.root`)。规则编译器按**词法**匹配,不问目录
-     *    存不存在 ⇒ 把哨兵递给它,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区
-     *    的 `<工作区>/src/secret.ts` 这类目标判 allow —— 一条运维亲手写下的收紧规则**静默失效**,方向与写门那条正相反。
+     * host 腿上「这条 session 还没登记工作目录」时,`resolve-spec` 的路径裁决 env 落在一个**永不创建的哨兵目录**上
+     * (`fs-write-gate-unrooted`,治理层守卫集的 cwd)。那对守卫是 fail-SAFE 的(相对目标在哨兵下解析不出真身);但规则编译器按**词法**匹配、
+     * 不问目录存不存在 ⇒ 把哨兵当根递进来,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区的
+     * `<工作区>/src/secret.ts` 判 allow —— 一条亲手写下的收紧规则**静默失效**。所以哨兵从不被声明成基。
      *
-     * ⇒ 本字段**只在真任务根已知时**在场。缺席 ⇒ 不声明根 ⇒ 需要该基的拼法(`Edit(src/**)` / `Edit(/etc/**)`)锚在**装入这只策略的那条腿**
-     * 的真根(core 7.46.0 #1383 车 B:锚装一次、在被装入处;`unsupported.path_base` 只剩「声明了一个用不了的基」)—— 哨兵从不被声明成基。
-     * 修前(core ≤7.45)缺席 ⇒ 整表拒(→ 422):沙箱车道上相对 / `/x` 形规则恒 422。绝对形(`//abs`)不需要基;`~/` 形见下一字段。
+     * 缺席 ⇒ 不声明根 ⇒ 需要该基的拼法(`Edit(src/**)` / `Edit(/etc/**)`)锚在**装入这只策略的那条腿**的真根(core 7.46.0 #1383 车 B:
+     * 锚装一次、在被装入处;`unsupported.path_base` 只剩「声明了一个用不了的基」)。修前(core ≤7.45)缺席 ⇒ 整表拒(→ 422):沙箱车道上
+     * 相对 / `/x` 形规则恒 422。绝对形(`//abs`)不需要基;`~/` 形见下一字段。
      */
     taskRoot?: string;
     /**
@@ -444,29 +416,20 @@ export interface FsWriteGateWiring {
      * 运维在**下单那一刻**就知道这条规则这条车道读不了,而不是等到跑起来每次都弹一张 ask。
      */
     taskHome?: string;
-    /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */
-    scratchpadDir?: string;
-    /** [ref]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),
-     *  called by core as `(canonicalToolName, canonicalPath)`. The host arm ignores the second argument (the key
-     *  comes from a real-fs canonicalize and the grant is deliberately name-keyed); the sandbox arm ([ref]) uses it
-     *  to confine the exemption to POSIX-absolute canonical keys — core's `canonicalizeTarget` short-circuits
-     *  backslash-UNC forms to `ok:true, key=raw` WITHOUT consulting the env, and an unconfined name-keyed grant
-     *  would turn those unresolvable forms into an allow (codex review 2026-08-05).
-     *  🔴 **坐标刷新(7.74.0 / core 7.17.0 [ref];结论不变,前提收窄了)**:那条短路现在**只在 `win` 家族上**
-     *  (`dist/tools/fs/safety.js` 的 `canonicalizeTarget`:`family === "win" && isUncSpelling(...)` 才折 UNC
-     *  并直接返回);在 `posix` 家族上,同一个反斜杠 UNC 拼法在更早一步的 `win32NamespaceScreen` 上就被
-     *  **拒**(`unc_on_posix_tree`),压根到不了短路。⇒ 今日部署形(posix 树)这条腿的暴露面比当年更小,
-     *  而本臂的 POSIX-absolute 收敛**继续是对的**:它挡的是「未经 env 解析的 key 拿到 name-keyed 放行」,
-     *  在两个家族上都成立,且方向仍是 fail-closed。不改实现。
-     *  The probe is consulted by the gate RIGHT BEFORE it would ask (after the exempt/accept dir layering — dist 亲读:true ⇒
-     *  allow with decisionReason "rule", a THROWN probe ⇒ not exempt = fail-closed to ask). Same canonical
-     *  toolName key space as the ask-policy layer's exemption probe — ONE grant serves both layers; the gate-level
-     *  check is what makes "allow all session" bite SAME-TURN for the parent and inherited child tasks (the ask
-     *  path is never re-entered). (codex M1 的边界注记:sensitive-path DENY 腿与本探针的「豁免越不过 deny」
-     *  保证仍成立——但那条腿已随 [ref] 搬到 governance 层,deny-wins 是 tightenTaskSpec 折叠给的,不再依赖
-     *  本 wiring 的组合点。) */
-    isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
 }
+/**
+ * 请求的 `settings.permissions.deny` / `ask` 有永远不生效的条目 ⇒ 拒点({@link rejectUnmatchableSettingsNames})抛的错:句子(`message`)与这一遍判下来的**全部**问题(`problems`,机读位的原料)。
+ * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体带 `field` + `detail.problems`);其余出口(收紧不得放宽)仍抛普通 `Error`。
+ */
+export declare class SettingsRuleRefusalError extends Error {
+    readonly problems: readonly EntryProblem[];
+    constructor(message: string, problems: readonly EntryProblem[]);
+}
+/**
+ * 请求设置里 deny / ask 规则拒的**码**:422 在折叠口上的状态派生粗码(`http/send.ts` 的 `httpErrorCode(422)`;`test/entry-problems.test.ts` 钉两者同值)。拒点铸 422 体、存体预判铸 409 的 `blockedBy`、
+ * 机读位每条问题的 `code` 三处读这一只常量,不各写一份字面量。
+ */
+export declare const SETTINGS_RULE_REFUSAL_CODE = "request.unprocessable";
 /**
  * deny / ask 两桶(core 规则编译器读的收紧表)的**问序,单表**:{@link rulePolicyBucketsRefusal} 的两段循环(名字层 + 文法 · `~/` 要 home)都迭代它 ——
  * 两桶都有坏条目时,拒点与存体预判点名同一个桶、说同一句。表里每个词同时是 core 规则的 `behavior`。
@@ -475,7 +438,8 @@ export declare const RULE_POLICY_BUCKETS: readonly ["ask", "deny"];
 export type RulePolicyBucket = (typeof RULE_POLICY_BUCKETS)[number];
 /**
  * deny / ask 两桶的**完整规则判**,唯一一只(拒点 {@link rejectUnmatchableSettingsNames} 与存体预判 `http/stored-body-replay.ts` 同调):
- *  ② 按 {@link RULE_POLICY_BUCKETS} 的序逐桶问 `unmatchableToolNamesRefusal`(名字层 + core 规则文法);③ 都过了,再逐桶判 `~/` 形要 home 的那一拒。第一个坏处答 `{ bucket, message }`。
+ *  ② 按 {@link RULE_POLICY_BUCKETS} 的序逐桶问 `judgeUnmatchableToolNames`(名字层 + core 规则文法);③ 再逐桶判 `~/` 形要 home 的那一拒。答 `{ bucket, message, problems }`:`bucket` 与 `message` 是**第一处**坏处的
+ *  (句子冻结,先撞上的那一条),`problems` 是**两段、两只桶判下来的全部**坏条目(机读位的原料,形的属主 `entry-problems.ts`)。
  * 入参:桶、{@link RulePolicyBases}。**home 同源**:拒点的 home 是 `resolve-spec.ts` 的 `laneHomeBase()` 经 `executionLaneHomeDir(config)` 算出的,预判传同一个函数对同一份部署配置算出的。
  * **声明给文法的基**只有拒点有(根 + home 的并集,执行车道才知道根):core 的规则文法对**没声明**的基不下判词(见 `config.ts` `uncompilableRuleGuidance`),所以预判什么也不声明、两腿逐字同句;
  * 预判不能把 home 当「半个基」声明给文法 —— core 的路径族只从根推,缺根时一个合法的 Windows 形 home 会按默认族被判 `unsupported.path_base`(V6-k)。
@@ -490,12 +454,35 @@ export interface RulePolicyBases {
 export declare function rulePolicyBucketsRefusal(permissions: Readonly<Partial<Record<RulePolicyBucket, readonly string[]>>>, bases: RulePolicyBases): {
     readonly bucket: RulePolicyBucket;
     readonly message: string;
+    readonly problems: readonly EntryProblem[];
 } | undefined;
 /** 请求的 settings 编不成生效的规则 / 有永远不生效的条目 ⇒ 422 的句首(三只桶同一个出口;`resolveSpec` 的拒点与存体重放预判的 409 句子同用这一个,不各写一份)。 */
 export declare const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
-export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
+/**
+ * Build the per-request permission ToolPolicy from the parsed settings: the two **rule lists** (`deny` / `ask`) through ONE compiler
+ * ({@link createRuleListPolicy} → core `createPermissionRulePolicy`) — a `deny` rule hard-blocks, an `ask` rule forces an approval
+ * gate, `deny` > `ask` on overlap. 两表的 **covering 语义同源**([ref]):底下是 core 的同一只 `namespacedRuleNameCovers`,本仓不持第二套 glob。
+ * The `allow` bucket is not here: a policy says deny / ask only (core 7.42.0); the list rides into `TaskSpec.allowedTools` at
+ * {@link applyTaskSettings}, the one write point.
+ *
+ * 🔴 **本函数不读模式词**:两张表在六个词与缺席下编出同一只策略(`test/settings-fold-mode-arms.test.ts` A2)。模式做什么只在引擎里答 ——
+ * 写门(`default` / `auto` / `dontAsk`:每次写先问;`acceptEdits`:写根内免问;`plan`:写与非只读调用以计划句问;`bypassPermissions`:不设门)
+ * 是引擎的模式门,`Workflow` 的问句腿在 `resolve-spec.ts` 按「这条 run 挂不挂得出 Workflow」装、由引擎的仲裁按模式处置({@link createWorkflowAskPolicy})。
+ * 修前这里按模式分四臂(acceptEdits 另铸一只 cwd 域写门、bypass / 缺席不装问句腿):本仓对模式的第二份解释,随之退役。
+ * Returns `{}` when there is no permission rule (nothing to project).
+ */
+export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, bases?: FsWriteGateWiring): {
     toolPolicy?: ToolPolicy;
 };
+/**
+ * 请求的 `settings.permissions.neverAuto` 有永远不生效的名字 ⇒ 拒因(句子 + 机读位),与 {@link rulePolicyBucketsRefusal} 同形 —— 拒点({@link deriveSettingsPolicy},422)与存体预判
+ * (`http/stored-body-replay.ts`)调这一只。判据与部署 `APPROVAL_NEVER_AUTO` 的 env 腿是**同一只**(`unmatchableToolNamesRefusal` 的名表消费者:退役名 / 无协议前缀的短名 / 缺段协议名 /
+ * 近似名 …),一条规则一种读法;机读位的 `field` = 座位在体内的坐标。无名字 / 全合法 ⇒ `undefined`。
+ */
+export declare function neverAutoNamesRefusal(names: readonly string[]): {
+    readonly message: string;
+    readonly problems: readonly EntryProblem[];
+} | undefined;
 /**
  * Apply a client's parsed per-request settings onto a base `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link
  * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1). `tightenTaskSpec`
@@ -506,5 +493,5 @@ export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?
  *
  * Returns `base` untouched when the parsed settings project nothing onto the spec.
  */
-export declare function applyTaskSettings(base: TaskSpec, settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): TaskSpec;
+export declare function applyTaskSettings(base: TaskSpec, settings: ParsedTaskSettings, bases?: FsWriteGateWiring): TaskSpec;
 //# sourceMappingURL=task-settings.d.ts.map

package/dist/task-settings.js

@@ -1,13 +1,17 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
-import { unmatchableToolNamesRefusal } from "./config.js";
+import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { judgeUnmatchableToolNames } from "./config.js";
+import { entryProblem } from "./entry-problems.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
 import { entryPermissionMode } from "./runtime-governance.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
+import { createRequestNeverAutoPolicy } from "./approval.js";
+import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySpecSeats } from "./tighten-only-seats.js";
 export const PERMISSION_MODE_WORDS = PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function coercePermissionMode(raw) {
     const strict = coercePermissionModeStrict(raw);
@@ -47,10 +51,6 @@ export function effectiveThinking(reasoningEffort, ultracode) {
     const ultra = resolveReasoningProfile("ultra").thinking;
     return explicit && rankOf(explicit) > rankOf(ultra) ? explicit : ultra;
 }
-export function withPermissionMode(settings, mode) {
-    const base = settings ?? {};
-    return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
-}
 export function effectivePermissionMode(body, settings) {
     const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
     const kill = settings?.permissions?.disableAutoMode;
@@ -93,8 +93,9 @@ function bucketIssueMessage(f, rule) {
         case "over_cap":
             switch (rule) {
                 case "rule_policy":
-                    return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
-                        `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+                    return limitRefusal(f.field, "entries", f.count, f.cap, {
+                        tail: "Refused rather than truncated: a truncated list silently drops the rules past the cap, and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list",
+                    }).message;
                 case "allow_layer":
                     return describeAllowLayerOverCap(f.field, f.count);
             }
@@ -138,7 +139,7 @@ export function settingsPermissionBucketIssue(perms) {
                 case "allow_layer": {
                     const over = allowLayerEntryCountIssue(field, v);
                     if (over !== undefined)
-                        fields = { field, reason: "over_cap", count: over.count, cap: over.cap };
+                        fields = { field, reason: "over_cap", count: over.facts.count, cap: over.facts.cap };
                     else if (!ruleEntryListShapeOk(v))
                         fields = { field, reason: "bad_entry", index: v.findIndex((x) => typeof x !== "string") };
                     break;
@@ -153,8 +154,8 @@ export function settingsPermissionBucketIssue(perms) {
 function acceptedRuleList(v) {
     return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
-export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
-export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+export const TASK_SETTINGS_KEYS = ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
 const ACCEPTED_TOP = new Set(TASK_SETTINGS_KEYS);
@@ -193,6 +194,9 @@ export function taskSettingsKeyIssue(raw) {
 export function taskHooksHonored(config) {
     return config.requirePrincipal !== true;
 }
+function tightenOnlySeatDeferredName(name) {
+    return tightenOnlySeatField(name).replace(/^settings\./, "");
+}
 export function parseTaskSettings(raw, seats = {}) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
@@ -260,36 +264,14 @@ export function parseTaskSettings(raw, seats = {}) {
     const maxDesc = s.skillListingMaxDescChars;
     if (skillListingMaxDescOk(maxDesc))
         out.skillListingMaxDescChars = maxDesc;
+    const tightenSeats = readTightenOnlySeats(raw);
+    for (const name of tightenSeats.rejected)
+        deferred.push(tightenOnlySeatDeferredName(name));
+    if (Object.keys(tightenSeats.values).length > 0)
+        out.tightenOnly = tightenSeats.values;
     return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
-export function hasConstitutionAnchors(text) {
-    return typeof text === "string" && text.includes(CYBER_RISK) && text.includes(URL_SAFETY) && text.includes(HARNESS_SECTION_ANCHOR);
-}
-export function providerDropsAppend(provider, userSystemPrompt) {
-    if (!provider)
-        return false;
-    if (provider.replaceAll === true)
-        return true;
-    const ctx = { userSystemPrompt, tools: [], memoryEnabled: false, consolidationEnabled: false };
-    if (provider.stableBlocks) {
-        try {
-            return provider.stableBlocks(ctx).some((d) => d.slot === "identity" && hasConstitutionAnchors(d.text));
-        }
-        catch {
-            return false;
-        }
-    }
-    if (provider.stableSystem) {
-        try {
-            return hasConstitutionAnchors(provider.stableSystem(ctx));
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
-}
-export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
+export function acceptAppendSystemPrompt(v, warn) {
     if (v === undefined)
         return undefined;
     if (typeof v !== "string" || v.length === 0) {
@@ -300,16 +282,12 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
         warn?.(`appendSystemPrompt dropped: ${v.length} chars exceeds the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (pre-cap stored body on a resume leg?)`);
         return undefined;
     }
-    if (packDropsAppend === true) {
-        warn?.("appendSystemPrompt dropped: the effective prompt pack cannot mount the append rider (assembled-identity/stableSystem pass-through, replaceAll, or legacy provider — no core/role.append section)");
-        return undefined;
-    }
     return v;
 }
 const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
-function createWorkflowAskPolicy(isExempt) {
+export function createWorkflowAskPolicy(isExempt) {
     return {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
@@ -331,17 +309,31 @@ function createWorkflowAskPolicy(isExempt) {
 function rejectUnmatchableSettingsNames(perms, pathBases) {
     const refused = rulePolicyBucketsRefusal(perms, { ...(pathBases !== undefined ? { declared: pathBases } : {}), ...(pathBases?.home !== undefined ? { home: pathBases.home } : {}) });
     if (refused !== undefined)
-        throw new Error(refused.message);
+        throw new SettingsRuleRefusalError(refused.message, refused.problems);
+}
+export class SettingsRuleRefusalError extends Error {
+    problems;
+    constructor(message, problems) {
+        super(message);
+        this.problems = problems;
+        this.name = "SettingsRuleRefusalError";
+    }
 }
+export const SETTINGS_RULE_REFUSAL_CODE = "request.unprocessable";
 export const RULE_POLICY_BUCKETS = ["ask", "deny"];
 export function rulePolicyBucketsRefusal(permissions, bases) {
+    let first;
+    const problems = [];
     for (const bucket of RULE_POLICY_BUCKETS) {
         const names = permissions[bucket];
         if (!names)
             continue;
-        const unmatchable = unmatchableToolNamesRefusal(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(bases.declared !== undefined ? { pathBases: bases.declared } : {}) });
-        if (unmatchable !== undefined)
-            return { bucket, message: unmatchable.message };
+        const judged = judgeUnmatchableToolNames(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(bases.declared !== undefined ? { pathBases: bases.declared } : {}) });
+        if (judged === undefined)
+            continue;
+        first ??= { bucket, message: judged.message };
+        for (const b of judged.bad)
+            problems.push(entryProblem(SETTINGS_RULE_REFUSAL_CODE, `settings.permissions.${bucket}`, b.name, b.reason));
     }
     if (bases.home === undefined) {
         for (const bucket of RULE_POLICY_BUCKETS) {
@@ -349,73 +341,60 @@ export function rulePolicyBucketsRefusal(permissions, bases) {
             for (const name of permissions[bucket] ?? []) {
                 const parsed = parseRuleText(name, bucket);
                 if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
-                    return {
+                    first ??= {
                         bucket,
                         message: `${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
                             `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
                             `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`,
                     };
+                    problems.push(entryProblem(SETTINGS_RULE_REFUSAL_CODE, `settings.${field}`, name, "home_unresolvable"));
                 }
             }
         }
     }
-    return undefined;
+    return first === undefined ? undefined : { ...first, problems };
 }
 export const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
-export function deriveSettingsPolicy(settings, gate, workflowGate) {
+export function deriveSettingsPolicy(settings, bases) {
     const perms = settings.permissions;
-    if (!perms)
+    const neverAuto = settings.tightenOnly?.neverAuto;
+    if (!perms && neverAuto === undefined)
         return {};
-    const { deny, ask, defaultMode } = perms;
-    const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
-        ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
-        : undefined;
-    rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (deny)
-        policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
-    if (ask)
-        policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
-    const fsWriteGate = (acceptCwd) => {
-        if (!gate)
-            return undefined;
-        const gatePolicy = createFsWriteGatePolicy({
-            env: gate.env,
-            ...(gate.cwd !== undefined ? { rootPath: gate.cwd } : {}),
-            ...(acceptCwd && gate.cwd !== undefined ? { acceptDirs: [gate.cwd] } : {}),
-            ...(gate.scratchpadDir ? { exemptDirs: [gate.scratchpadDir] } : {}),
-            ...(gate.isExempt ? { isExempt: gate.isExempt } : {}),
-            defaultWrite: "ask",
-        });
-        return gatePolicy;
-    };
-    const compose = (...extra) => {
-        const all = [...policies, ...extra.filter((p) => p !== undefined)];
-        return all.length === 0 ? undefined : all.length === 1 ? all[0] : combinePolicies(...all);
-    };
-    const basePolicy = compose();
-    switch (defaultMode) {
-        case "acceptEdits": {
-            const p = compose(fsWriteGate(true), createWorkflowAskPolicy(workflowGate?.isExempt));
-            return p ? { toolPolicy: p } : {};
-        }
-        case "default":
-        case "auto":
-        case "dontAsk":
-        case "plan": {
-            const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
-            return p ? { toolPolicy: p } : {};
-        }
-        case "bypassPermissions":
-        case undefined:
-            return basePolicy ? { toolPolicy: basePolicy } : {};
+    if (perms) {
+        const { deny, ask } = perms;
+        const pathBases = bases?.taskRoot !== undefined || bases?.taskHome !== undefined
+            ? { ...(bases.taskRoot !== undefined ? { root: bases.taskRoot } : {}), ...(bases.taskHome !== undefined ? { home: bases.taskHome } : {}) }
+            : undefined;
+        rejectUnmatchableSettingsNames(perms, pathBases);
+        if (deny)
+            policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
+        if (ask)
+            policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
+    }
+    if (neverAuto !== undefined) {
+        const refused = neverAutoNamesRefusal(neverAuto);
+        if (refused !== undefined)
+            throw new SettingsRuleRefusalError(refused.message, refused.problems);
+        policies.push(createRequestNeverAutoPolicy(neverAuto, tightenOnlySeatField("neverAuto")));
     }
+    if (policies.length === 0)
+        return {};
+    return { toolPolicy: policies.length === 1 ? policies[0] : combinePolicies(...policies) };
+}
+export function neverAutoNamesRefusal(names) {
+    const field = tightenOnlySeatField("neverAuto");
+    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: "deny" });
+    if (judged === undefined)
+        return undefined;
+    return { message: judged.message, problems: judged.bad.map((b) => entryProblem(SETTINGS_RULE_REFUSAL_CODE, field, b.name, b.reason)) };
 }
-export function applyTaskSettings(base, settings, gate, workflowGate) {
-    const { toolPolicy } = deriveSettingsPolicy(settings, gate, workflowGate);
+export function applyTaskSettings(base, settings, bases) {
+    const { toolPolicy } = deriveSettingsPolicy(settings, bases);
+    const seatSpec = settings.tightenOnly !== undefined ? tightenOnlySpecSeats(settings.tightenOnly) : {};
     let next = base;
-    if (toolPolicy !== undefined)
-        next = tightenGoverned(next, { toolPolicy });
+    if (toolPolicy !== undefined || Object.keys(seatSpec).length > 0)
+        next = tightenGoverned(next, { ...(toolPolicy !== undefined ? { toolPolicy } : {}), ...seatSpec });
     const allow = settings.permissions?.allow;
     if (allow !== undefined)
         next = { ...next, allowedTools: allow };