@sema-agent/server 7.132.0 → 7.133.0

package/dist/rule-entry-list.js

@@ -2,6 +2,7 @@ import { PROTOCOL_TABLE, compileAllowList, parsePermissionRule } from "@sema-age
 import { displayListEntry } from "./list-entry-display.js";
 import { limitRefusal } from "./limit-refusal.js";
 import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
+import { NOT_IN_ROSTER, entryProblem, entryProblemsFacts } from "./entry-problems.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
 export const MAX_ALLOW_LAYER_ENTRIES = 1_000;
 const ALLOW_LAYER_OVER_CAP_TAIL = "Refused rather than truncated: a truncated list silently drops the entries past the cap. Merge entries into broader ones (mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**)) or trim the list";
@@ -76,14 +77,17 @@ function selectorEntryName(entry) {
 }
 const isProtocolWideName = (name) => PROTOCOL_TABLE.some((e) => name === `${e.prefix}*`);
 function selectorInertEntriesOf(list, side) {
+    const readings = selectorReadings(list, side);
+    return side === "allow" ? readings.filter((i) => allowSideReadsAsNothing(i.reason)) : readings;
+}
+function selectorReadings(list, side) {
     return list.flatMap((entry) => {
         if (entry === "*" && side === "allow")
             return [];
         const name = selectorEntryName(entry);
         if (side === "deny" && isProtocolWideName(name))
             return [];
-        const inert = compileAllowList([name], "deny", TOOL_NAME_ROSTER).inert.map((i) => ({ ...i, entry }));
-        return side === "allow" ? inert.filter((i) => allowSideReadsAsNothing(i.reason)) : inert;
+        return compileAllowList([name], "deny", TOOL_NAME_ROSTER).inert.map((i) => ({ ...i, entry }));
     });
 }
 function allowSideReadsAsNothing(reason) {
@@ -167,17 +171,18 @@ function* toolListsOf(body) {
     if (isPlainRecord(permissions))
         yield { layer: "settings.permissions.allow", field: "settings.permissions.allow", prefix: "", at: "settings.permissions.allow", list: permissions["allow"] };
 }
-function entryOfList(l) {
+function inertReadingOfList(l) {
     const face = TOOL_LIST_FACES[l.layer];
-    const over = overCapOfList(l);
-    if (over !== undefined)
-        return over;
     if (!ruleEntryListShapeOk(l.list))
         return undefined;
     const inert = inertEntriesOfList(l.list, l.layer);
     if (inert.length === 0)
         return undefined;
-    return { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` };
+    return { inert, entry: { layer: l.layer, side: face.side, code: face.code, message: `${l.prefix}${describeInertRuleEntries(l.field, inert)} — ${REFUSAL_TAIL[face.side]}` } };
+}
+function inertProblemsOf(l, inert) {
+    const face = TOOL_LIST_FACES[l.layer];
+    return inert.map((i) => entryProblem(face.code, l.at, i.entry, i.reason));
 }
 function overCapOfList(l) {
     if (!Array.isArray(l.list))
@@ -196,16 +201,24 @@ export function skillToolListsOverCap(skill, at, scope) {
 function firstInertEntry(body, acceptLayer, acceptSide) {
     if (!isPlainRecord(body))
         return undefined;
+    let first;
+    const problems = [];
     for (const l of toolListsOf(body)) {
         if (!acceptLayer(l.layer))
             continue;
-        const entry = entryOfList(l);
-        if (entry === undefined)
+        const over = overCapOfList(l);
+        if (over !== undefined) {
+            if (first === undefined)
+                return over;
+            continue;
+        }
+        const reading = inertReadingOfList(l);
+        if (reading === undefined || !acceptSide(reading.entry.side))
             continue;
-        if (entry.extra !== undefined || acceptSide(entry.side))
-            return entry;
+        first ??= reading.entry;
+        problems.push(...inertProblemsOf(l, reading.inert));
     }
-    return undefined;
+    return first === undefined ? undefined : { ...first, extra: { ...entryProblemsFacts(problems) } };
 }
 export function skillDenyInertEntryOf(body) {
     return firstInertEntry(body, (layer) => layer === "skills" || layer === "agents.skills", () => true);
@@ -213,4 +226,51 @@ export function skillDenyInertEntryOf(body) {
 export function inertToolListEntryOf(body, sides = ["allow", "deny"]) {
     return firstInertEntry(body, () => true, (side) => sides.includes(side));
 }
+function callerToolNameSet(tools) {
+    const names = new Set();
+    for (const t of tools) {
+        names.add(t.name);
+        for (const a of t.aliases ?? [])
+            names.add(a);
+        for (const row of t.agentToolPool ?? []) {
+            names.add(row.name);
+            for (const a of row.aliases ?? [])
+                names.add(a);
+        }
+    }
+    return names;
+}
+const isProtocolNamespacedName = (name) => PROTOCOL_TABLE.some((e) => name.startsWith(e.prefix));
+function allowSelectorEntryWarning(entry, callerNames) {
+    if (entry === "*")
+        return undefined;
+    if (callerNames.has(selectorEntryName(entry)))
+        return undefined;
+    const read = selectorReadings([entry], "allow")[0];
+    if (read !== undefined)
+        return read.reason;
+    const name = selectorEntryName(entry);
+    if (isProtocolNamespacedName(name))
+        return undefined;
+    return TOOL_NAME_ROSTER.has(name) ? undefined : NOT_IN_ROSTER;
+}
+export function allowSelectorWarningsOf(body, tools) {
+    if (!isPlainRecord(body))
+        return [];
+    const callerNames = callerToolNameSet(tools);
+    const out = [];
+    for (const l of toolListsOf(body)) {
+        if (l.layer !== "allowTools" && l.layer !== "agents.allowTools")
+            continue;
+        if (!ruleEntryListShapeOk(l.list) || l.list.length > MAX_ALLOW_LAYER_ENTRIES)
+            continue;
+        const code = TOOL_LIST_FACES[l.layer].code;
+        for (const entry of l.list) {
+            const reason = allowSelectorEntryWarning(entry, callerNames);
+            if (reason !== undefined)
+                out.push(entryProblem(code, l.at, entry, reason));
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=rule-entry-list.js.map

package/dist/rules-consent.js

@@ -2,9 +2,9 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
-import { ABSOLUTE_HOST_PATH_MAX } from "@sema-agent/settings-schema";
+import { ABSOLUTE_HOST_PATH_MAX, hasControlOrBidi } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
-import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
+import { hasBidiControls } from "./text-bidi.js";
 import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
@@ -178,7 +178,7 @@ function screenLocalImportRow(row) {
             detail: "this project root carries bidirectional control characters — the directory a reader sees is not the directory the matcher would use",
         };
     }
-    if (scope.kind === "project" && CONTROL_AND_BIDI_DETECT_RE.test(scope.root)) {
+    if (scope.kind === "project" && hasControlOrBidi(scope.root)) {
         return {
             reason: "scope_control_chars",
             detail: "this project root carries control bytes (C0/DEL) — it is not a path, one SQL dialect refuses to store it at all, and it breaks the separator assumption this lane's comparison keys rest on",
@@ -220,7 +220,6 @@ function screenLocalImportRow(row) {
     return consistent(written.rule);
 }
 const LOCAL_IMPORT_LAYER_PATH = "local-import:rules";
-const CONTROL_AND_BIDI_DETECT_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
 const LOCAL_IMPORT_KEY_SEP = "\u0000";
 function buildLocalImportLayers(candidates) {
     const byRoot = new Map();

package/dist/run-acceptance.d.ts

@@ -22,12 +22,26 @@
  * 三条提交腿(同步 / 流式 / durable)各在两处喂同一只:持流的那一形把每一帧交给 {@link RunAcceptance.observe};终局落行之后调一次
  * {@link RunAcceptance.settle}。腿上不再有「什么时候起标题」的判断,标题器的唯一调用点是本文件的闩。座由提交门在 `prepareSpec` 里
  * 随 spec 一起铸(`PreparedTaskSubmission.acceptance`);不经提交门的内部车道铸一只不带标题器的座,也就不起标题。
+ *
+ * ## 标题写成之后(`session_titled` 帧,契约 §4a-ttl)
+ * 标题器写成时把那一帧交回本座({@link RunAcceptanceDeps.sessionTitler} 的 `onTitled`);本座是这条 run 的流与标题器之间**唯一**的接缝:
+ *  · 持**活流**的腿在开流时挂一只写口({@link RunAcceptance.attachStream};今天只有 `POST /v1/tasks/stream` 的 SSE 腿)—— 帧经它写到这条流上;
+ *  · 没有活流的腿(同步 JSON 腿 / durable 后台腿:读者走账本 tail,账本里没有这一帧)不挂 ⇒ 帧丢弃,会话行是真源;
+ *  · 终帧 `done` 已过 ⇒ 丢弃(终帧是流的最后一帧);连接已断 / 已结束(写口自报够不着)⇒ 丢弃。
+ * 丢弃不计失败:帧是「行刚刚变了」的活通知,读者随时可读行;唯一的读者门是「提交这条 run 的人」—— 写口只在本次提交自己的连接上,不广播。
  */
+import type { SessionTitler } from "./session-titler.js";
+import type { SessionTitledFrame } from "./session-titled-frame.js";
 export interface RunAcceptanceDeps {
     /** 标题器(缺席 = 本部署不自动起名)。 */
-    sessionTitler?: {
-        maybeTitle(sessionId: string, objective: string, model?: string): void;
-    };
+    sessionTitler?: SessionTitler;
+}
+/** 一条活流的写口(持活流的腿自己造)。 */
+export interface RunStreamSink {
+    /** 这条连接此刻还收得到帧(没结束、没断、腿没在收摊)。 */
+    reachable(): boolean;
+    /** 把一帧写到这条流上。 */
+    write(frame: SessionTitledFrame): void;
 }
 export interface RunAcceptanceInput {
     sessionId?: string;
@@ -46,6 +60,8 @@ export interface RunAcceptance {
             readonly turns: number;
         };
     }): void;
+    /** 持活流的腿开流时挂上它的写口(一次提交至多一条活流;重挂以最后一次为准)。不挂 = 本次提交没有可写的流,标题写成的帧丢弃。 */
+    attachStream(sink: RunStreamSink): void;
 }
 export declare function createRunAcceptance(deps: RunAcceptanceDeps, input: RunAcceptanceInput): RunAcceptance;
 //# sourceMappingURL=run-acceptance.d.ts.map

package/dist/run-acceptance.js

@@ -6,15 +6,24 @@ function isObjectiveApplied(ev) {
 }
 export function createRunAcceptance(deps, input) {
     let accepted = false;
+    let terminalSeen = false;
+    let stream;
+    const deliver = (frame) => {
+        if (stream === undefined || terminalSeen || !stream.reachable())
+            return;
+        stream.write(frame);
+    };
     const accept = () => {
         if (accepted)
             return;
         accepted = true;
         if (input.sessionId)
-            deps.sessionTitler?.maybeTitle(input.sessionId, input.objective, input.model);
+            deps.sessionTitler?.maybeTitle(input.sessionId, input.objective, input.model, deliver);
     };
     return {
         observe(ev) {
+            if (ev.type === "done")
+                terminalSeen = true;
             if (!accepted && isObjectiveApplied(ev))
                 accept();
         },
@@ -22,6 +31,9 @@ export function createRunAcceptance(deps, input) {
             if (result.stats.turns > 0)
                 accept();
         },
+        attachStream(sink) {
+            stream = sink;
+        },
     };
 }
 //# sourceMappingURL=run-acceptance.js.map

package/dist/run-local.js

@@ -28,6 +28,7 @@ import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-a
 import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
+import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { applyEffective, applyCenterReadFace, applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
@@ -36,12 +37,14 @@ import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
 import { webSearchConfigFromEnv, createWebSearchBackend } from "./plugins/web-search.js";
-import { buildPromptSeats, buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
+import { buildExcludeToolsSeat, buildPromptSeats, buildScenarios, createScenarioGate, selectScenario, centerScenarios } from "./capabilities/scenarios.js";
 import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+import { createMemoryProjectLayers } from "./memory-project-layer.js";
+import { assertProjectLayerOwnable } from "./project-identity.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
@@ -339,10 +342,18 @@ export async function runLocal(argv, deps = {}) {
     logConfigDiagnostics(logger);
     provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);
-    const providerInput = { provider: config.configProvider ?? "local", localDir: root };
+    const providerInput = { provider: config.configProvider ?? "local", localDir: root, localOwnerUid: config.configLocalOwnerUid };
     const configSource = configProviderKind(providerInput);
-    if (configSource === "local")
+    if (configSource === "local") {
+        try {
+            await assertLocalConfigDirTrusted({ root, declaredOwnerUid: config.configLocalOwnerUid });
+        }
+        catch (err) {
+            printErr(err instanceof Error ? err.message : String(err));
+            return 2;
+        }
         logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
+    }
     try {
         await composeExecutionLane(config, { configSource, localRoot: root, logger, drivesFromFile: ["host"] });
     }
@@ -384,6 +395,10 @@ export async function runLocal(argv, deps = {}) {
         }
     }
     catch (err) {
+        if (err instanceof ConfigDirUntrustedError) {
+            printErr(err.message);
+            return 2;
+        }
         if (applying)
             logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the candidate failed to apply at boot — running on env (run-local has no LKG); none of the candidate's domains is adopted; this is not a reachability failure" });
         else
@@ -478,7 +493,7 @@ export async function runLocal(argv, deps = {}) {
             ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
             ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
         });
-        logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySync.cursorPath });
+        logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySync.cursorPathFor(config.memorySync.scope) });
         memorySync.trigger("boot");
     }
     else if (config.memorySync) {
@@ -649,6 +664,20 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const scope = args.user ?? "local";
+    if (memoryEngine) {
+        try {
+            assertProjectLayerOwnable(scope, "--user");
+        }
+        catch (err) {
+            printErr(err instanceof Error ? err.message : String(err));
+            void lspManager?.dispose();
+            await fileBackend.dispose();
+            return 2;
+        }
+    }
+    const projectKey = memoryEngine
+        ? await createMemoryProjectLayers({ backend: memoryEngine.backend, syncRunner: memorySync, log: logger }).prepare(config, scope, workspaceDir)
+        : undefined;
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false);
     const mcp = mcpForScenario(config.mcpServers, scenarioName);
@@ -668,12 +697,13 @@ export async function runLocal(argv, deps = {}) {
         backgroundScope: "session",
         oneShot: true,
         principal: scope,
-        ...(memoryEngine ? { memory: memorySpecForRequest(scope, memoryProjectKeyFor(config, scope, workspaceDir), undefined) } : {}),
+        ...(memoryEngine ? { memory: memorySpecForRequest(scope, projectKey, undefined) } : {}),
         model: mention.model,
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,
         skills: cap.skills,
         ...buildPromptSeats(scenarioName, cap.prompt, undefined),
+        ...buildExcludeToolsSeat(cap.excludeTools, undefined),
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),

package/dist/runs.d.ts

@@ -1,4 +1,5 @@
 import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type RunInternals, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
+import { type EntryProblem } from "./entry-problems.js";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -113,8 +114,10 @@ export declare function syncRefusalHttpStatus(result: Pick<TaskResult, "terminal
  * 同步腿零工作拒体的机读事实(交 `refusalBody` 的 `facts`)—— 唯一一处。入参是**出口封口 + 脱敏后**的终局(调用方递 `redactTerminalResult(sealResultForExit(result)).terminal`,
  * 与 run 记录读面 / 流式 `done.result` 上的 `terminal` 同一只来源),本函数只按码取它的 `detail.detail`,不另读、不另脱。码不在登记表里、终局不是 `failed`、
  * 引擎没给 `coded` 因由 ⇒ `{}`(缺席不造键)。
+ * 两张工具名清单的码({@link ENGINE_TOOL_LIST_REFUSAL_CODES})是另一臂:体事实不取引擎的因由,取 `admissionReadings`(受理口对放行侧选择器清单的读数,`PreparedTaskSubmission.warnings`)
+ * 去掉 `not_in_roster`、且 `code` 与终局的码相同(同一族清单)的那些 —— 与受理口 400 同一只机读位形;没有读数 ⇒ `{}`。
  */
-export declare function zeroWorkRefusalFacts(terminal: unknown): Readonly<Record<string, unknown>>;
+export declare function zeroWorkRefusalFacts(terminal: unknown, admissionReadings?: readonly EntryProblem[]): Readonly<Record<string, unknown>>;
 /**
  * 一条提交腿把引擎终局落行之后的**唯一**收尾:**零工作的拒不占提交幂等键**。判据就是上面这只 {@link syncRefusalHttpStatus}
  * (零 turn、零 token 且是 prepare 期的拒码)—— 三条提交腿(同步 / 流式 / durable)同调这一只,不另开判据。
@@ -347,17 +350,15 @@ pendingEngineNotices?: readonly {
     sessionId?: unknown;
 }[], 
 /**
- * 🔴 **S-218:部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume`)。
+ * 🔴 **部署方铸的 TRUSTED run internals**(今天唯一成员 `workflowParkedResume` = 本会话已受理的 workflow 子代决定)。
  *
- * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。铸点只有
- * 一个:`/decide` 的 workflow 第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide`
- * 顶注 + `http/durable-run-leg.ts` 的 `TrustedRunInternals`)。本腿只负责把它摊进**下面那只**共享
- * 供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
+ * 它**不是** `TaskSpec` 字段、不是工具参数、不进请求体 —— 模型永远不能自己决定一次审批。产自决定进引擎的唯一读者
+ * (`parked-decide.ts` 的 `heldWorkflowParkDecisions`),由本腿唯一的调用方 `mintAndDriveDurableRun` 开跑前读一次传进来。
+ * 本腿只负责把它摊进**下面那只**共享供给座席,core 的 `prepareTask` 据它给 Workflow 工具挂 `parkedResume` dep。
  *
  * 位置在座席对象的**最后**:座席里那几位(onActivity/onForwardEvent/onTaskNotification/onSubagentSpawn)
- * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 真要撞名,撞的也只能是本腿自己新加的位,而那时
- * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
- * 缺席 ⇒ 座席与本位存在之前逐字相同。
+ * 是本腿自己的执行面供给,调用方无权覆盖它们 —— 型只开 `workflowParkedResume` 这一格(`Pick`),新开一格必须在这里显式点名。
+ * 缺席 / 空对象 ⇒ 座席与本位存在之前逐字相同。
  */
 trustedInternals?: Pick<RunInternals, "workflowParkedResume">, 
 /**

package/dist/runs.js

@@ -1,5 +1,6 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
+import { NOT_IN_ROSTER, entryProblemsFacts } from "./entry-problems.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js";
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
@@ -110,11 +111,29 @@ export function syncRefusalHttpStatus(result) {
     return resumeAtHttpStatus(result);
 }
 const ZERO_WORK_REFUSAL_DETAIL_CODES = new Set(["config.user_attachment_invalid"]);
-export function zeroWorkRefusalFacts(terminal) {
+const ENGINE_ENTRY_SPELLING_REASONS = new Set(["near_miss", "unknown_name"]);
+function engineReasonOf(detail) {
+    if (detail === null || typeof detail !== "object")
+        return undefined;
+    const c = detail;
+    if (c.kind !== "coded" || c.detail === null || typeof c.detail !== "object")
+        return undefined;
+    const reason = c.detail.reason;
+    return typeof reason === "string" ? reason : undefined;
+}
+const ENGINE_TOOL_LIST_REFUSAL_CODES = new Set(["config.tool_face_control", "config.agent.unknown_tool"]);
+export function zeroWorkRefusalFacts(terminal, admissionReadings = []) {
     if (terminal === null || typeof terminal !== "object")
         return {};
     const t = terminal;
-    if (t.kind !== "failed" || typeof t.code !== "string" || !ZERO_WORK_REFUSAL_DETAIL_CODES.has(t.code))
+    if (t.kind !== "failed" || typeof t.code !== "string")
+        return {};
+    if (ENGINE_TOOL_LIST_REFUSAL_CODES.has(t.code)) {
+        const readings = admissionReadings.filter((p) => p.code === t.code && p.reason !== NOT_IN_ROSTER);
+        const engineReason = engineReasonOf(t.detail);
+        return readings.length > 0 && engineReason !== undefined && ENGINE_ENTRY_SPELLING_REASONS.has(engineReason) ? { ...entryProblemsFacts(readings) } : {};
+    }
+    if (!ZERO_WORK_REFUSAL_DETAIL_CODES.has(t.code))
         return {};
     const cause = t.detail;
     if (cause === null || typeof cause !== "object")
@@ -489,7 +508,6 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 ? approval.coordinator.runWithContext({
                     taskId,
                     owner: elicitOwner ?? owner,
-                    emit: approvalEmit,
                     abortSignal: cancelCtrl.signal,
                     ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
                     emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),

package/dist/runtime-caps-resolver.d.ts

@@ -25,6 +25,9 @@
  *                        ⇒ **无 checkpoint 店的部署上这一面本就不成立**，该键在那里 inert）
  *  · `autoMode`        — prepare-task.js `=== true` **∧** `deps.autoMode !== undefined`（部署需先具备分类器；
  *                        显式 opt-in 极性，且 [ref] 起本侧传的是三态 org deny 位，见 toCoreRuntimeCaps 头注）
+ *  · `bypassPermissions` — `dist/core/mode-policy.js` 的模式折叠（请求 `bypassPermissions` ∧ 本位 `=== false` ⇒ 这条腿跑在
+ *                        `default`、发 `config.permission_mode_unavailable{by:"operator_deny"}`、回执 `foldedBy:"operator_deny"`）；
+ *                        deny 形，缺席 = 不阻。S-900 D2 起由 center 的 `allowBypassPermissions` 写（此前本仓零写点）
  *  · `allowMemoryOptOut` — prepare-memory.js `resolveCaptureEntitlementFresh`（+prepare-task.js
  *                        的 value/faulted 投影）；**极性反转，但只在 `open` 姿态下**——判决全表在
  *                        `dist/core/runner/memory-capture-optout.js` 的 `adjudicateCaptureOptOut`，按
@@ -34,7 +37,8 @@
  *                        · `"governed"`     :14-23 要**显式 `true`** 才准；`false` / 缺席 / fault **一律拒**
  *                          （拒由分「answered false」与「verdict absent / resolver fault」两句）
  *                        · `"capture-required"`:4-12 **完全不看本 verdict**（逐字「resolver-independent」），恒拒
- * 只有 `allowUltracode` 是被 DROP 的那一个（下文）。
+ * center 的键里只有 `allowUltracode` 被 DROP（下文）；center 的其余每一键都在 {@link toCoreRuntimeCaps} 的处置表里，
+ * settings-schema 加一键而这里没处置 ⇒ tsc 红（S-900 D2 之前 `allowBypassPermissions` / `allowAutoMode` 两键就是这样被静默丢掉的）。
  *
  * It pulls the PER-PRINCIPAL entitlement from center's `GET /api/config/effective?principal=` (via
  * {@link fetchPrincipalCaps}). center has ALREADY pre-resolved the tighten-only intersection (fleet defaults ∩
@@ -44,13 +48,16 @@
  *
  * 🔐 FAIL-CLOSED (core security mandate, prepare-task.ts): an entitlement-resolver outage must NEVER silently
  * GRANT a capability center may have denied. On a hard fetch error we mint `{ allowWorkflows: false, allowFork: false,
- * autoMode: false }` — the three OPTIONAL **amplification** caps — and do NOT force the durable gate (that could
+ * autoMode: false, autoModeDenySource: "org", bypassPermissions: false }` — the four OPTIONAL **amplification** caps
+ * (plus the auto bit's plane) — and do NOT force the durable gate (that could
  * strand an autonomous run on an absent operator). We never serve a STALE cached GRANT past its TTL on a
  * fresh-fetch failure (a revoked cap must not linger because center blipped).
  * ⚠️ [ref]① 纠失实：这段曾写作「降级为 `{ allowWorkflows: false }`」，与真码不符 —— 真铸点在本文件
- * `load()` 的 catch 臂（搜 `Caps face FAIL CLOSED`），逐字是上行那三键：`allowFork` 自提货批就在，
- * `autoMode` 由 [ref] / core [ref] 同车加入（org deny 位不能因一次抖动在 denyTtl 窗内抬起）。
- * 🔒 **三键以外的那三键刻意不铸**：`forceDurableGate` 同上（强挂人在环会搞死无人值守的 run）；
+ * `load()` 的 catch 臂（搜 `Caps face FAIL CLOSED`），逐字是上行那几键：`allowFork` 自提货批就在，
+ * `autoMode` 由 [ref] / core [ref] 同车加入（org deny 位不能因一次抖动在 denyTtl 窗内抬起），`bypassPermissions`
+ * 由 S-900 D2 加入（同一条律：center 可能已经拒了的 bypass 不能因一次抖动放出来；core 自己的 resolver-throw 降级臂
+ * 铸的也是这四位拒，`dist/core/runner/prepare-caps-and-workflow.js`）。
+ * 🔒 **四只放大位以外的那三键刻意不铸**：`forceDurableGate` 同上（强挂人在环会搞死无人值守的 run）；
  * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
  * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
@@ -62,6 +69,9 @@
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
  * this seam feeds the ENGINE, and `allowUltracode` is enforced at the service settings-resolution layer, not here.
+ * center's two MODE kill-switches are NOT dropped: `allowBypassPermissions:false` ⇒ `bypassPermissions:false`,
+ * `allowAutoMode:false` ⇒ the same auto deny bit `autoMode:false` writes (S-900 D2 — a mode's every refusal is an engine
+ * deny bit; the engine folds, announces and reports it on `wiring_manifest.permissionMode`).
  */
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
@@ -138,7 +148,7 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "webAdmin">): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
-    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;
+    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode/bypassPermissions;
      *  [ref]① 随批纠：此处是同一句降级声明的第二个写者，漏了 [ref] 加的 `autoMode`。真铸点同上）。 */
     resolveRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
     /**

package/dist/runtime-caps-resolver.js

@@ -27,12 +27,21 @@ function traceExecutionLaneDefault(form, ownLane, logger) {
     catch {
     }
 }
+const CENTER_ENGINE_CAP_KEYS = [
+    "allowWorkflows",
+    "forceDurableGate",
+    "allowFork",
+    "allowObservers",
+    "autoMode",
+    "allowAutoMode",
+    "allowBypassPermissions",
+    "allowMemoryOptOut",
+];
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
-    const autoMode = ent.autoMode;
     const badCap = (v) => v !== undefined && typeof v !== "boolean";
-    if (badCap(ent.allowWorkflows) || badCap(ent.forceDurableGate) || badCap(ent.allowFork) || badCap(ent.allowObservers) || badCap(autoMode) || badCap(ent.allowMemoryOptOut)) {
+    if (CENTER_ENGINE_CAP_KEYS.some((k) => badCap(ent[k]))) {
         throw new Error("runtimeCaps from center carries a non-boolean cap (contract breach — fail closed)");
     }
     const caps = {};
@@ -44,10 +53,14 @@ export function toCoreRuntimeCaps(ent) {
         caps.allowFork = ent.allowFork;
     if (typeof ent.allowObservers === "boolean")
         caps.allowObservers = ent.allowObservers;
-    if (typeof autoMode === "boolean")
-        caps.autoMode = autoMode;
+    if (ent.autoMode === false || ent.allowAutoMode === false)
+        caps.autoMode = false;
+    else if (ent.autoMode === true)
+        caps.autoMode = true;
     if (caps.autoMode === false)
         caps.autoModeDenySource = "org";
+    if (ent.allowBypassPermissions === false)
+        caps.bypassPermissions = false;
     if (typeof ent.allowMemoryOptOut === "boolean")
         caps.allowMemoryOptOut = ent.allowMemoryOptOut;
     return Object.keys(caps).length ? caps : undefined;
@@ -146,7 +159,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org", bypassPermissions: false }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
                 putCache(bin.cache, principal, entry);

package/dist/sandbox-pkg-source.d.ts

@@ -14,7 +14,16 @@
  *
  * The marker `SEMA_PKG_SOURCE` always rides along: the image's pkg-source.sh hook (pod-start / profile.d)
  * materializes the file-bound pieces from it; images without the hook simply ignore it.
+ *
+ * ## One law: no URL that rides into the model-visible sandbox env carries userinfo
+ * Everything this module derives lands in the env of every sandbox process — including the ones the model drives
+ * (`env`, `printenv`) — so `https://user:pass@mirror/…` among the `custom` addresses would hand the deployment's
+ * package-source credential to the model. {@link customPkgSourceFromEnv} is the ONE reader of the six addresses and the
+ * one place that judges them: the shared URL-shape judge (`httpUrlFlaws`, the same one MEMORY_EMBEDDER_ENDPOINT /
+ * A2A_SERVE_URL answer to) says no ⇒ it throws, startup refuses. Never stripped, never rewritten, never forwarded
+ * quietly. The request face has no package-source address key at all (deployment face only).
  */
+import { type HttpUrlFlaw } from "@sema-agent/settings-schema";
 /** Explicit URLs for `custom` (RFC B: 极端情况出口). Read from the service process env (operator-trusted). */
 export interface CustomPkgSource {
     aptMirror?: string;
@@ -29,6 +38,15 @@ export interface CustomPkgSource {
  * profile (unset = byte-identical sandbox — the B5 backward-compat contract).
  */
 export declare function derivePkgSourceEnv(profile: string | undefined, custom?: CustomPkgSource): Record<string, string>;
-/** Read the `custom` explicit-URL set from the service process env (operator-trusted deployment config). */
+/**
+ * The refusal sentence for one address (pure data): the shared judge's rule words + the value's origin only
+ * ({@link buildHttpUrlRefusal}), then why it matters here and the two ways out. No byte of the credential can reach it.
+ */
+export declare function buildCustomPkgSourceRefusal(envName: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
+/**
+ * Read the `custom` explicit-URL set from the service process env (operator-trusted deployment config) — the ONE reader and
+ * the ONE judge of those six addresses (see the module header). An address the shared judge refuses (userinfo, or a shape
+ * that is not a parseable http(s) URL) throws {@link buildCustomPkgSourceRefusal}; empty / unset = not set.
+ */
 export declare function customPkgSourceFromEnv(env?: NodeJS.ProcessEnv): CustomPkgSource;
 //# sourceMappingURL=sandbox-pkg-source.d.ts.map

package/dist/sandbox-pkg-source.js

@@ -1,3 +1,5 @@
+import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "./url-refusal.js";
 const GLOBAL_ENV = {
     PIP_INDEX_URL: "https://pypi.org/simple",
     UV_DEFAULT_INDEX: "https://pypi.org/simple",
@@ -43,14 +45,34 @@ export function derivePkgSourceEnv(profile, custom) {
             return { SEMA_PKG_SOURCE: profile };
     }
 }
+export function buildCustomPkgSourceRefusal(envName, raw, flaws) {
+    return (`${buildHttpUrlRefusal(envName, raw, flaws)} — with SANDBOX_PKG_SOURCE=custom this address is written verbatim into the environment of every sandbox ` +
+        `(e2b VM / k8s pod), where any process the model can run reads it back with \`env\`; an address that carries userinfo, or whose shape cannot be judged ` +
+        `credential-free (not http(s)://host[:port][/path], or containing a backslash — the URL standard reads it as "/", package managers do not), would hand ` +
+        `the deployment's package-source credential to the model, so the server refuses to start rather than forward or rewrite it. ` +
+        `Way out: (1) set ${envName} to the credential-free address and give the package manager its credential through its own channel — a token variable ` +
+        `named in the lane's name list (E2B_SANDBOX_ENV / K8S_SANDBOX_ENV; naming it accepts that every process in the sandbox, the model included, can read it) ` +
+        `or a credential file baked into the sandbox image; (2) if the source needs no authentication, drop the userinfo.`);
+}
 export function customPkgSourceFromEnv(env = process.env) {
-    return {
-        ...(env.SEMA_APT_MIRROR ? { aptMirror: env.SEMA_APT_MIRROR } : {}),
-        ...(env.SEMA_PIP_INDEX ? { pipIndex: env.SEMA_PIP_INDEX } : {}),
-        ...(env.SEMA_UV_INDEX ? { uvIndex: env.SEMA_UV_INDEX } : {}),
-        ...(env.SEMA_UV_PY_MIRROR ? { uvPyMirror: env.SEMA_UV_PY_MIRROR } : {}),
-        ...(env.SEMA_NPM_REGISTRY ? { npmRegistry: env.SEMA_NPM_REGISTRY } : {}),
-        ...(env.SEMA_NODE_MIRROR ? { nodeMirror: env.SEMA_NODE_MIRROR } : {}),
+    const addresses = {
+        aptMirror: ["SEMA_APT_MIRROR", env.SEMA_APT_MIRROR],
+        pipIndex: ["SEMA_PIP_INDEX", env.SEMA_PIP_INDEX],
+        uvIndex: ["SEMA_UV_INDEX", env.SEMA_UV_INDEX],
+        uvPyMirror: ["SEMA_UV_PY_MIRROR", env.SEMA_UV_PY_MIRROR],
+        npmRegistry: ["SEMA_NPM_REGISTRY", env.SEMA_NPM_REGISTRY],
+        nodeMirror: ["SEMA_NODE_MIRROR", env.SEMA_NODE_MIRROR],
     };
+    const out = {};
+    for (const field of Object.keys(addresses)) {
+        const [name, raw] = addresses[field];
+        if (!raw)
+            continue;
+        const flaws = raw.includes("\\") ? ["not-http-url"] : httpUrlFlaws(raw, ["userinfo"]);
+        if (flaws.length > 0)
+            throw new Error(buildCustomPkgSourceRefusal(name, raw, flaws));
+        out[field] = raw;
+    }
+    return out;
 }
 //# sourceMappingURL=sandbox-pkg-source.js.map