@sema-agent/server 7.132.0 → 7.133.0

package/dist/task-mcp.js

@@ -1,14 +1,11 @@
 import { mcpInjectionDroppedNotice, readMcpToolAxes, resolveComplianceDenies } from "@sema-agent/core";
-import { MCP_CONTENT_ORIGINS, describeNotStringArray, describeValueShape, isContentOriginWord, isStringArray, isUsableWireName, readMcpIdentityHeaders, } from "@sema-agent/settings-schema";
-import { describeBadContentOrigin, describeBadWireName } from "./caller-text-echo.js";
+import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, describeNotStringArray, describeValueShape, isContentOriginWord, isStringArray, isUsableWireName, readRequestMcpTransport, stripControlAndBidi, } from "@sema-agent/settings-schema";
 import { HttpError, createCodedHttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
-import { declaresMcpAssertionHeader, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
+import { describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
-import { readPlainStringRecord } from "./plain-string-record.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
@@ -27,62 +24,6 @@ function isRecord(v) {
 function isElicitationFlag(v) {
     return typeof v === "boolean";
 }
-const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
-function readRequestTransport(t) {
-    if (!t || typeof t !== "object")
-        return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
-    const tr = t;
-    const lost = [];
-    if (tr.kind === "stdio") {
-        if (typeof tr.command !== "string" || tr.command.length === 0)
-            return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
-        if (tr.args !== undefined && !isStringArray(tr.args))
-            lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
-        const env = readTransportRecord("transport.env", tr.env, lost);
-        return {
-            ok: true,
-            transport: {
-                kind: "stdio",
-                command: tr.command,
-                ...(isStringArray(tr.args) ? { args: tr.args } : {}),
-                ...(env !== undefined ? { env } : {}),
-            },
-            lost,
-        };
-    }
-    if (tr.kind === "http") {
-        if (typeof tr.url !== "string" || !/^https?:\/\//i.test(tr.url))
-            return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
-        const ids = readMcpIdentityHeaders(tr);
-        const headers = readTransportRecord("transport.headers", tr.headers, lost);
-        if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
-            lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
-        }
-        return {
-            ok: true,
-            transport: {
-                kind: "http",
-                url: tr.url,
-                ...(headers !== undefined ? { headers } : {}),
-                ...ids,
-            },
-            lost,
-        };
-    }
-    return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
-}
-function readTransportRecord(path, raw, lost) {
-    if (raw === undefined)
-        return undefined;
-    const read = readPlainStringRecord(raw);
-    if (!read.ok) {
-        lost.push({ path, reason: `must be a plain object of string values — ${read.member === undefined ? read.fault : `its member "${echoKeyName("", read.member)}" ${read.fault}`}` });
-        return undefined;
-    }
-    for (const m of read.stripped)
-        lost.push({ path: echoKeyName(`${path}.`, m.name), reason: m.fault });
-    return read.record;
-}
 const bad = (field) => ({ ok: false, field });
 const MALFORMED_NAME = "<malformed>";
 function declaredName(e) {
@@ -96,7 +37,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     const o = e;
     if (!isUsableWireName(o.name))
         return bad("name");
-    const read = readRequestTransport(o.transport);
+    const read = readRequestMcpTransport(o.transport);
     if (!read.ok)
         return bad(read.issue.path);
     const spec = { name: o.name, transport: read.transport };
@@ -114,7 +55,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
         const again = readMcpToolAxes(storedToolAxes.mcp(o.toolAxes));
         if (again.ok) {
             judged = again;
-            toolAxesReread = axes.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+            toolAxesReread = stripControlAndBidi(axes.problem);
         }
     }
     if (!judged.ok)
@@ -257,7 +198,7 @@ const ENTRY_KEY_JUDGES = {
         return read.ok ? undefined : { path: "toolFaces", reason: read.problem };
     },
     transport: (o) => {
-        const read = readRequestTransport(o.transport);
+        const read = readRequestMcpTransport(o.transport);
         return read.ok ? read.lost[0] : read.issue;
     },
 };
@@ -267,7 +208,7 @@ function entryFieldRefusal(entry, at, issue) {
     const server = echoKeyName("", declaredName(entry));
     return {
         errorCode: "request.field_invalid",
-        message: `${at}.${issue.path} (server "${server}") is not a usable declaration — ${issue.reason.replace(CONTROL_AND_BIDI_STRIP_RE, "")}. ${ENTRY_REFUSAL_TAIL}`,
+        message: `${at}.${issue.path} (server "${server}") is not a usable declaration — ${stripControlAndBidi(issue.reason)}. ${ENTRY_REFUSAL_TAIL}`,
     };
 }
 function requestEntryRefusal(entry, at) {
@@ -341,7 +282,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
     const closed = deploymentClosedMcpNames(baseline, reservedNames);
     const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
     for (const s of v.ok)
-        if (declaresMcpAssertionHeader(s) && !closed.has(s.name))
+        if (specWithholdsMcpAssertionHeader(s) && !closed.has(s.name))
             noteMcpAssertionHeaderNotSent(logger, s.name);
     const mounted = new Set(v.ok.filter((s) => !closed.has(s.name)).map((s) => s.name));
     for (const e of entries.slice(0, MAX_REQUEST_MCP_SERVERS)) {

package/dist/task-settings.d.ts

@@ -27,12 +27,12 @@
  *    `APPROVAL_REQUIRE` (an ask rule), `APPROVAL_NEVER_AUTO` (a person, mandated), `MANUAL_MODE_SHELL_GATE=always` (shell).
  *    A request-carried skill's `allowedTools` is the same member's twin (same grammar, same predicate, same admission judge
  *    `rule-entry-list.ts`). Pinned on the real assembly: `test/allow-layer-operator-knobs.test.ts`.
- *  - permissionMode(轴B #2 注释保鲜,1.254——[ref]/[ref] 后的真实现):`defaultMode` 收 core `PERMISSION_MODES` **全集**
- *    (default | acceptEdits | plan | auto | bypassPermissions | dontAsk),bypass/auto 被 HONOR 为 gate-shape 选择
- *    ——但深层不变量未变:bypass=「不加 ask 门」,恒不越部署基线(tightenTaskSpec deny-wins,基线 deny/
- *    ask 照压);精化语义见 :2xx 行内注释。旧头注的「NEVER honored/三模式白名单」是 pre-[ref] 拍照。
+ *  - permissionMode:`defaultMode` 收 core `PERMISSION_MODES` **全集**(default | acceptEdits | plan | auto | bypassPermissions | dontAsk),
+ *    生效词原样过境 `TaskSpec.permissionMode`,模式**做什么**只在引擎里答(core `modePolicyOf` / `arbitrateByMode`)。本模块的折叠
+ *    **不读**模式词:deny / ask 两张表在每一个词下编出同一只策略,部署基线照压(tightenTaskSpec deny-wins);bypass 放行的只是引擎
+ *    能放行的那几类问,部署 / 请求的 deny 与 ask 规则它一条都掀不掉。
  *
- * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy + §6.4 permissionMode derive MIRRORS
+ * 🔴 SYNC WITH sema-cli(壳仓)的 `src/sema/settings/seam.ts`: the permissions→toolPolicy compile MIRRORS
  * the shell's LOCAL-Runner resolver — both compose the SAME core primitives (`createAllowDenyPolicy` /
  * `combinePolicies` / `tightenTaskSpec`), so the deny-wins ENFORCEMENT is core-single-source. Only the COMPOSITION
  * is duplicated for the remote path; a proposed follow-up extracts it to `@sema-agent/sdk` for true
@@ -47,27 +47,29 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { type PathRuleBases, type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PermissionMode } from "@sema-agent/core";
+import { type PathRuleBases, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PermissionMode } from "@sema-agent/core";
+import { type EntryProblem } from "./entry-problems.js";
 import { type KeyClosureIssue } from "./request-key-closure.js";
 import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
 import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import { type EntryPermissionMode } from "./runtime-governance.js";
+import { type TightenOnlySeatValues } from "./tighten-only-seats.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
  * `?permissionMode=` 查询串三处同读)。本仓不持有第二份词表,也不持有「收 / 不收」的表态:判据 = core 的 `isPermissionMode`,型 = core 的
- * `PermissionMode`,wire 句子里的词表只从这里取词({@link PERMISSION_MODE_WORDS})。core 加一个词 ⇒ 请求面自动收它,它在派生腿上的去向由
- * {@link deriveSettingsPolicy} 的穷举 `switch` 逼出来(缺一臂 ⇒ 编译红);core 删 / 改名一个词 ⇒ 本文件里按名写出它的那一臂编译红。
+ * `PermissionMode`,wire 句子里的词表只从这里取词({@link PERMISSION_MODE_WORDS})。core 加一个词 ⇒ 请求面自动收它、原样过境,本仓没有
+ * 按词分的臂要补;core 删 / 改名一个词 ⇒ 本仓按名写出它的地方(`PLAN_APPROVE_PERMISSION_MODES_AFTER` 等)编译红。
  * 生效模式原样过境 `TaskSpec.permissionMode`(S-877):引擎自己解释模式 —— 含 `dontAsk`(CC 的「自动拒」档:凡是要问的一律由模式拒,零卡,
- * 门记录 `deniedBy:"mode"`),本仓不另写判。
+ * 门记录 `deniedBy:"mode"`)与 acceptEdits 的免问写域(引擎的写根:任务根 + `additionalDirectories` + 宣告的可写目录),本仓不另写判。
  */
 /** 请求面闭集的 wire 文案形(`"a" | "b" | …`,core 序)—— 三处 400(顶层 / bundle / 查询串)的句子从这里取词,不再各抄一份。 */
 export declare const PERMISSION_MODE_WORDS: string;
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends
  * the CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
- * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the mode only selects the CLIENT-derived
- * gate ({@link deriveSettingsPolicy}); it can never subtract from the deployment/operator policy (applyTaskSettings
- * folds via tightenTaskSpec, deny-wins). The honored set is core's `PERMISSION_MODES` in full — every word passes
+ * 🔴 TIGHTEN-ONLY vs the DEPLOYMENT baseline still holds for every value: the word rides verbatim into `TaskSpec.permissionMode`
+ * and only the engine interprets it; no mode subtracts from the deployment/operator policy or from the request's own
+ * deny / ask rules (applyTaskSettings folds them via tightenTaskSpec, deny-wins, under every word alike). The honored set is core's `PERMISSION_MODES` in full — every word passes
  * through verbatim (`dontAsk` included: folding the auto-deny mode to `default`, the asking mode, would turn a refusal
  * into a card). An UNKNOWN string coerces to `default` (fail-safe: the most-asking mode).
  * [ref]-②: fresh submits can no longer REACH the unknown-word arm — the HTTP gate 400s a non-member value
@@ -147,19 +149,13 @@ export declare function storedBodyPermissionMode(body: {
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
  *  future-proof). Awareness rides for free: core composes ORCHESTRATION_AWARENESS from thinking∈{xhigh,max}, no field. */
 export declare function effectiveThinking(reasoningEffort: unknown, ultracode: boolean): ThinkingLevel | undefined;
-/** R4: fold a top-level `body.permissionMode` onto the parsed settings as `permissions.defaultMode` (the top-level
- *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
- *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
-export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: PermissionMode): ParsedTaskSettings;
 /**
- * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
- * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处
- * 都没有 ⇒ `undefined` = **无表态**(调用点据此不写键,而不是替调用方选一个默认值)。
+ * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序:顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的
+ * `settings.permissions.defaultMode`;两处都没有 ⇒ `undefined` = **无表态**(调用点据此不写键,而不是替调用方选一个默认值;引擎把缺席读成 `default`)。
  *
- * 🔴 为什么必须是一只函数:同一个「生效模式」此前在 resolve-spec 里被算了两次(hooks 腿的
- * `permission_mode` 载荷、settings 折叠腿的 `withPermissionMode`),三审同点判定翻译表**不得**成为
- * 第三个算点 —— 三处各算各的,任何一次优先序修订都会让三面分家,而分家在这条轴上的形态是
- * 「壳发的 bundle bypass 在 A 面生效、在 B 面没生效」这种最难被外部发现的静默偏差。
+ * 🔴 为什么必须是一只函数:同一个「生效模式」此前在 resolve-spec 里被算过两次(hooks 腿的 `permission_mode` 载荷、settings 折叠腿),
+ * 两处各算各的,任何一次优先序修订都会让两面分家,而分家在这条轴上的形态是「壳发的 bundle bypass 在 A 面生效、在 B 面没生效」这种
+ * 最难被外部发现的静默偏差。settings 折叠今天不再读模式词,这只函数的读者是 spec 过境点、托管天花板与存储体读法。
  */
 export declare function effectivePermissionMode(body: {
     permissionMode?: unknown;
@@ -225,6 +221,10 @@ export interface ParsedTaskSettings {
     skillListingBudgetFraction?: number;
     /** 同族第二键:每条技能描述在清单里的字符帽(正整数;CC 默认 1536)。超出由引擎**截断**,不是拒。 */
     skillListingMaxDescChars?: number;
+    /** S-1351 —— 「只收紧」座位族(`tighten-only-seats.ts` 的四座:读拒模式 / 写保护名的加法 / 合规额外禁项 / 永不自动放行名单)的归一值,**一个键**而不是四个散字段:
+     *  wire 位置由座位表说(三座在 `settings` 顶层,`neverAuto` 在 `settings.permissions`),解析后与位置无关。空数组 ≡ 缺席(不铸键)。
+     *  去处:三座经 {@link applyTaskSettings} 落 core 任务层席;`neverAuto` 经 {@link deriveSettingsPolicy} 落请求叶策略。 */
+    tightenOnly?: TightenOnlySeatValues;
 }
 /** The result of parsing an untrusted `body.settings`: the applied subset + the names of present-but-deferred
  *  fields (so the caller can log/advertise them — no silent drop). `null` settings ⇒ `{ settings: undefined }`. */
@@ -285,13 +285,17 @@ export declare function settingsPermissionBucketIssue(perms: unknown): SettingsP
  *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。
  *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
  *
+ *  🔴 `readDenyPatterns` / `writeProtectedExtra` / `complianceAdditionalDenies` 与 `permissions.neverAuto`(S-1351)= **「只收紧」座位族**:消费点 = `tighten-only-seats.ts`
+ *  的座位表(位置、条目律、去处都由那张表说),读入在 {@link parseTaskSettings},投影在 {@link applyTaskSettings} / {@link deriveSettingsPolicy}。这四个键不是 CC settings 键
+ *  (sdk 的 `SemaSettings` 尚未声明 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 的「server 先于 sdk」登记表记着它们)。
+ *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
  *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 的 `TaskSpec` 透传。语义(预算怎么花、描述怎么裁、
  *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。 */
-export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
+export declare const TASK_SETTINGS_KEYS: readonly ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
-export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 /** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响
  *  文案,不影响判决。前三个的出处 = `@sema-agent/sdk` `SemaSettings` 尾注逐字点名的 deferred CC 键。
  *
@@ -354,53 +358,35 @@ export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSetting
  *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
  *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
+export declare function createWorkflowAskPolicy(isExempt?: WorkflowGateWiring["isExempt"]): ToolPolicy;
 /** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
- *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
- *  since [ref] — the sandbox lanes wire a gate of their own shape instead of no gate). */
+ *  fs-independent: one shape on every execution lane. */
 export interface WorkflowGateWiring {
-    /** The session "don't ask again" probe (approvalExemptionStore.has, canonical toolName key) — same store and
-     *  key space as the fs-write gate's probe; one remember="session" grant serves both. */
+    /** The session "don't ask again" probe (approvalExemptionStore.has, raw toolName key) — the same store and key space the
+     *  approval seat's standing grants read; one remember="session" grant serves them all. */
     isExempt?: (toolName: string) => boolean | Promise<boolean>;
 }
-/** [ref]/[ref]① — everything the mode-derived fs-write ask gate needs from the deployment, provided by
- *  `resolve-spec.ts`. Absent ⇒ no gate is derived (the pre-[ref] behavior).
- *
- *  WHY the `env` matters: core's `createFsWriteGatePolicy` canonicalizes every target/dir through the given `env`
- *  (real `exists`/`canonicalPath`/`readLink` fs access — read in dist, fs-write-gate-policy.js), so on a
- *  HOST-SEMANTICS lane (`REMOTE_EXEC` unset or "host") the env MUST be the fs the hand tools write.
+/**
+ * 请求的 deny / ask 两张表解析路径形规则用的**基**(`resolve-spec.ts` 每请求供)。只有这两件事:这条 task 的真根、执行环境的 home。
+ * 缺席 ⇒ 不声明(规则锚在装入这只策略的那条腿的真根,`~/` 形由 {@link rejectUnmatchableSettingsNames} 响亮拒)。
  *
- *  [ref]/[ref] — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) wire a gate TOO, but a different-shaped one: the
- *  tools run OFF this box and the per-task sandbox env is minted inside core (executionEnvFactory) AFTER spec
- *  build, so a worker-local env would adjudicate against the WRONG fs (a wrong ALLOW is worse than no gate — that
- *  is why [ref] left those lanes gate-less). They supply a `DeferredSandboxPathEnv`
- *  (`src/boot/deferred-sandbox-path-env.ts`) instead: a proxy that forwards the fs READ primitives to the task's
- *  REAL sandbox env at adjudication time (a per-session slot the factory decorator fills), keeping only
- *  `absolutePath` lexical so no relative path is resolved against the wrong base. Empty slot ⇒ fail-closed. */
+ * 修前本型还承运本仓自己的 acceptEdits cwd 域写门的四件(裁决 env / cwd / scratchpad 豁免域 / 会话豁免探针):acceptEdits 能免问写哪里
+ * 现在只由引擎的模式门答(写根 = 任务根 + `additionalDirectories` + 宣告的可写目录),本仓不再构造写门,那四件随之退役。
+ * 部署级旋钮(`SENSITIVE_WRITE_PATTERNS` 守卫集、`MANUAL_MODE_SHELL_GATE` 地板)早已不经本型:它们在治理层无条件施加
+ * (`runtime-governance.ts` `applyRuntimeGovernance`),client 表态掀不掉([ref] / [ref])。
+ */
 export interface FsWriteGateWiring {
-    /** The env the gate canonicalizes against — the worker host env on the host lane, the
-     *  `DeferredSandboxPathEnv` proxy over the task's real sandbox env on the sandbox lanes ([ref]). */
-    env: ExecutionEnv;
-    /** The task's working directory: the factory's `rootPath` (relative-path base) AND the acceptEdits accept domain.
-     *  ABSENT on the sandbox lanes ([ref]/[ref]): the sandbox cwd is the ENGINE's tracked cwd, not the env's own, so
-     *  neither spec time nor the env proxy can supply the right base — inventing one would mint a bogus auto-allow
-     *  domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths fail to resolve
-     *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
-     *  never-created sentinel dir (resolve-spec 修5). */
-    cwd?: string;
     /**
-     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基,与上面那个 `cwd` **刻意分成两个字段**。
+     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基(core `PathRuleBases.root`),**只在真任务根已知时**在场。
      *
-     * 两者在 host 腿上常常同值,但它们回答的不是同一个问题,而混用一个字段会让其中一个静默失效:
-     *  · `cwd` 是**写门**的基。它在「有 remoteExec 但这条 session 还没登记工作目录」时取的是一个
-     *    **永不创建的哨兵目录**(`resolve-spec` 的 `fs-write-gate-unrooted`)。对写门那是 fail-SAFE 的:
-     *    相对目标在哨兵下解析不出真身 ⇒ 落 ask。
-     *  · `taskRoot` 是**规则模式**的基(core `PathRuleBases.root`)。规则编译器按**词法**匹配,不问目录
-     *    存不存在 ⇒ 把哨兵递给它,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区
-     *    的 `<工作区>/src/secret.ts` 这类目标判 allow —— 一条运维亲手写下的收紧规则**静默失效**,方向与写门那条正相反。
+     * host 腿上「这条 session 还没登记工作目录」时,`resolve-spec` 的路径裁决 env 落在一个**永不创建的哨兵目录**上
+     * (`fs-write-gate-unrooted`,治理层守卫集的 cwd)。那对守卫是 fail-SAFE 的(相对目标在哨兵下解析不出真身);但规则编译器按**词法**匹配、
+     * 不问目录存不存在 ⇒ 把哨兵当根递进来,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区的
+     * `<工作区>/src/secret.ts` 判 allow —— 一条亲手写下的收紧规则**静默失效**。所以哨兵从不被声明成基。
      *
-     * ⇒ 本字段**只在真任务根已知时**在场。缺席 ⇒ 不声明根 ⇒ 需要该基的拼法(`Edit(src/**)` / `Edit(/etc/**)`)锚在**装入这只策略的那条腿**
-     * 的真根(core 7.46.0 #1383 车 B:锚装一次、在被装入处;`unsupported.path_base` 只剩「声明了一个用不了的基」)—— 哨兵从不被声明成基。
-     * 修前(core ≤7.45)缺席 ⇒ 整表拒(→ 422):沙箱车道上相对 / `/x` 形规则恒 422。绝对形(`//abs`)不需要基;`~/` 形见下一字段。
+     * 缺席 ⇒ 不声明根 ⇒ 需要该基的拼法(`Edit(src/**)` / `Edit(/etc/**)`)锚在**装入这只策略的那条腿**的真根(core 7.46.0 #1383 车 B:
+     * 锚装一次、在被装入处;`unsupported.path_base` 只剩「声明了一个用不了的基」)。修前(core ≤7.45)缺席 ⇒ 整表拒(→ 422):沙箱车道上
+     * 相对 / `/x` 形规则恒 422。绝对形(`//abs`)不需要基;`~/` 形见下一字段。
      */
     taskRoot?: string;
     /**
@@ -430,29 +416,20 @@ export interface FsWriteGateWiring {
      * 运维在**下单那一刻**就知道这条规则这条车道读不了,而不是等到跑起来每次都弹一张 ask。
      */
     taskHome?: string;
-    /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */
-    scratchpadDir?: string;
-    /** [ref]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),
-     *  called by core as `(canonicalToolName, canonicalPath)`. The host arm ignores the second argument (the key
-     *  comes from a real-fs canonicalize and the grant is deliberately name-keyed); the sandbox arm ([ref]) uses it
-     *  to confine the exemption to POSIX-absolute canonical keys — core's `canonicalizeTarget` short-circuits
-     *  backslash-UNC forms to `ok:true, key=raw` WITHOUT consulting the env, and an unconfined name-keyed grant
-     *  would turn those unresolvable forms into an allow (codex review 2026-08-05).
-     *  🔴 **坐标刷新(7.74.0 / core 7.17.0 [ref];结论不变,前提收窄了)**:那条短路现在**只在 `win` 家族上**
-     *  (`dist/tools/fs/safety.js` 的 `canonicalizeTarget`:`family === "win" && isUncSpelling(...)` 才折 UNC
-     *  并直接返回);在 `posix` 家族上,同一个反斜杠 UNC 拼法在更早一步的 `win32NamespaceScreen` 上就被
-     *  **拒**(`unc_on_posix_tree`),压根到不了短路。⇒ 今日部署形(posix 树)这条腿的暴露面比当年更小,
-     *  而本臂的 POSIX-absolute 收敛**继续是对的**:它挡的是「未经 env 解析的 key 拿到 name-keyed 放行」,
-     *  在两个家族上都成立,且方向仍是 fail-closed。不改实现。
-     *  The probe is consulted by the gate RIGHT BEFORE it would ask (after the exempt/accept dir layering — dist 亲读:true ⇒
-     *  allow with decisionReason "rule", a THROWN probe ⇒ not exempt = fail-closed to ask). Same canonical
-     *  toolName key space as the ask-policy layer's exemption probe — ONE grant serves both layers; the gate-level
-     *  check is what makes "allow all session" bite SAME-TURN for the parent and inherited child tasks (the ask
-     *  path is never re-entered). (codex M1 的边界注记:sensitive-path DENY 腿与本探针的「豁免越不过 deny」
-     *  保证仍成立——但那条腿已随 [ref] 搬到 governance 层,deny-wins 是 tightenTaskSpec 折叠给的,不再依赖
-     *  本 wiring 的组合点。) */
-    isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
 }
+/**
+ * 请求的 `settings.permissions.deny` / `ask` 有永远不生效的条目 ⇒ 拒点({@link rejectUnmatchableSettingsNames})抛的错:句子(`message`)与这一遍判下来的**全部**问题(`problems`,机读位的原料)。
+ * `resolveSpec` 的折叠口把它装成 422 体(句子照旧、码 {@link SETTINGS_RULE_REFUSAL_CODE}、体带 `field` + `detail.problems`);其余出口(收紧不得放宽)仍抛普通 `Error`。
+ */
+export declare class SettingsRuleRefusalError extends Error {
+    readonly problems: readonly EntryProblem[];
+    constructor(message: string, problems: readonly EntryProblem[]);
+}
+/**
+ * 请求设置里 deny / ask 规则拒的**码**:422 在折叠口上的状态派生粗码(`http/send.ts` 的 `httpErrorCode(422)`;`test/entry-problems.test.ts` 钉两者同值)。拒点铸 422 体、存体预判铸 409 的 `blockedBy`、
+ * 机读位每条问题的 `code` 三处读这一只常量,不各写一份字面量。
+ */
+export declare const SETTINGS_RULE_REFUSAL_CODE = "request.unprocessable";
 /**
  * deny / ask 两桶(core 规则编译器读的收紧表)的**问序,单表**:{@link rulePolicyBucketsRefusal} 的两段循环(名字层 + 文法 · `~/` 要 home)都迭代它 ——
  * 两桶都有坏条目时,拒点与存体预判点名同一个桶、说同一句。表里每个词同时是 core 规则的 `behavior`。
@@ -461,7 +438,8 @@ export declare const RULE_POLICY_BUCKETS: readonly ["ask", "deny"];
 export type RulePolicyBucket = (typeof RULE_POLICY_BUCKETS)[number];
 /**
  * deny / ask 两桶的**完整规则判**,唯一一只(拒点 {@link rejectUnmatchableSettingsNames} 与存体预判 `http/stored-body-replay.ts` 同调):
- *  ② 按 {@link RULE_POLICY_BUCKETS} 的序逐桶问 `unmatchableToolNamesRefusal`(名字层 + core 规则文法);③ 都过了,再逐桶判 `~/` 形要 home 的那一拒。第一个坏处答 `{ bucket, message }`。
+ *  ② 按 {@link RULE_POLICY_BUCKETS} 的序逐桶问 `judgeUnmatchableToolNames`(名字层 + core 规则文法);③ 再逐桶判 `~/` 形要 home 的那一拒。答 `{ bucket, message, problems }`:`bucket` 与 `message` 是**第一处**坏处的
+ *  (句子冻结,先撞上的那一条),`problems` 是**两段、两只桶判下来的全部**坏条目(机读位的原料,形的属主 `entry-problems.ts`)。
  * 入参:桶、{@link RulePolicyBases}。**home 同源**:拒点的 home 是 `resolve-spec.ts` 的 `laneHomeBase()` 经 `executionLaneHomeDir(config)` 算出的,预判传同一个函数对同一份部署配置算出的。
  * **声明给文法的基**只有拒点有(根 + home 的并集,执行车道才知道根):core 的规则文法对**没声明**的基不下判词(见 `config.ts` `uncompilableRuleGuidance`),所以预判什么也不声明、两腿逐字同句;
  * 预判不能把 home 当「半个基」声明给文法 —— core 的路径族只从根推,缺根时一个合法的 Windows 形 home 会按默认族被判 `unsupported.path_base`(V6-k)。
@@ -476,12 +454,35 @@ export interface RulePolicyBases {
 export declare function rulePolicyBucketsRefusal(permissions: Readonly<Partial<Record<RulePolicyBucket, readonly string[]>>>, bases: RulePolicyBases): {
     readonly bucket: RulePolicyBucket;
     readonly message: string;
+    readonly problems: readonly EntryProblem[];
 } | undefined;
 /** 请求的 settings 编不成生效的规则 / 有永远不生效的条目 ⇒ 422 的句首(三只桶同一个出口;`resolveSpec` 的拒点与存体重放预判的 409 句子同用这一个,不各写一份)。 */
 export declare const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
-export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
+/**
+ * Build the per-request permission ToolPolicy from the parsed settings: the two **rule lists** (`deny` / `ask`) through ONE compiler
+ * ({@link createRuleListPolicy} → core `createPermissionRulePolicy`) — a `deny` rule hard-blocks, an `ask` rule forces an approval
+ * gate, `deny` > `ask` on overlap. 两表的 **covering 语义同源**([ref]):底下是 core 的同一只 `namespacedRuleNameCovers`,本仓不持第二套 glob。
+ * The `allow` bucket is not here: a policy says deny / ask only (core 7.42.0); the list rides into `TaskSpec.allowedTools` at
+ * {@link applyTaskSettings}, the one write point.
+ *
+ * 🔴 **本函数不读模式词**:两张表在六个词与缺席下编出同一只策略(`test/settings-fold-mode-arms.test.ts` A2)。模式做什么只在引擎里答 ——
+ * 写门(`default` / `auto` / `dontAsk`:每次写先问;`acceptEdits`:写根内免问;`plan`:写与非只读调用以计划句问;`bypassPermissions`:不设门)
+ * 是引擎的模式门,`Workflow` 的问句腿在 `resolve-spec.ts` 按「这条 run 挂不挂得出 Workflow」装、由引擎的仲裁按模式处置({@link createWorkflowAskPolicy})。
+ * 修前这里按模式分四臂(acceptEdits 另铸一只 cwd 域写门、bypass / 缺席不装问句腿):本仓对模式的第二份解释,随之退役。
+ * Returns `{}` when there is no permission rule (nothing to project).
+ */
+export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, bases?: FsWriteGateWiring): {
     toolPolicy?: ToolPolicy;
 };
+/**
+ * 请求的 `settings.permissions.neverAuto` 有永远不生效的名字 ⇒ 拒因(句子 + 机读位),与 {@link rulePolicyBucketsRefusal} 同形 —— 拒点({@link deriveSettingsPolicy},422)与存体预判
+ * (`http/stored-body-replay.ts`)调这一只。判据与部署 `APPROVAL_NEVER_AUTO` 的 env 腿是**同一只**(`unmatchableToolNamesRefusal` 的名表消费者:退役名 / 无协议前缀的短名 / 缺段协议名 /
+ * 近似名 …),一条规则一种读法;机读位的 `field` = 座位在体内的坐标。无名字 / 全合法 ⇒ `undefined`。
+ */
+export declare function neverAutoNamesRefusal(names: readonly string[]): {
+    readonly message: string;
+    readonly problems: readonly EntryProblem[];
+} | undefined;
 /**
  * Apply a client's parsed per-request settings onto a base `TaskSpec`, TIGHTEN-ONLY, in a SINGLE {@link
  * tightenTaskSpec} pass (so the permission override composes deny-wins onto the baseline — TRAP #1). `tightenTaskSpec`
@@ -492,5 +493,5 @@ export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?
  *
  * Returns `base` untouched when the parsed settings project nothing onto the spec.
  */
-export declare function applyTaskSettings(base: TaskSpec, settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): TaskSpec;
+export declare function applyTaskSettings(base: TaskSpec, settings: ParsedTaskSettings, bases?: FsWriteGateWiring): TaskSpec;
 //# sourceMappingURL=task-settings.d.ts.map