@sema-agent/server 7.132.0 → 7.133.0

package/dist/task-settings.js

@@ -1,5 +1,6 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
-import { unmatchableToolNamesRefusal } from "./config.js";
+import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { judgeUnmatchableToolNames } from "./config.js";
+import { entryProblem } from "./entry-problems.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { limitRefusal } from "./limit-refusal.js";
@@ -9,6 +10,8 @@ import { parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
 import { entryPermissionMode } from "./runtime-governance.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
+import { createRequestNeverAutoPolicy } from "./approval.js";
+import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySpecSeats } from "./tighten-only-seats.js";
 export const PERMISSION_MODE_WORDS = PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function coercePermissionMode(raw) {
     const strict = coercePermissionModeStrict(raw);
@@ -48,10 +51,6 @@ export function effectiveThinking(reasoningEffort, ultracode) {
     const ultra = resolveReasoningProfile("ultra").thinking;
     return explicit && rankOf(explicit) > rankOf(ultra) ? explicit : ultra;
 }
-export function withPermissionMode(settings, mode) {
-    const base = settings ?? {};
-    return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
-}
 export function effectivePermissionMode(body, settings) {
     const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
     const kill = settings?.permissions?.disableAutoMode;
@@ -155,8 +154,8 @@ export function settingsPermissionBucketIssue(perms) {
 function acceptedRuleList(v) {
     return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
-export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch"];
-export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+export const TASK_SETTINGS_KEYS = ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
 const ACCEPTED_TOP = new Set(TASK_SETTINGS_KEYS);
@@ -195,6 +194,9 @@ export function taskSettingsKeyIssue(raw) {
 export function taskHooksHonored(config) {
     return config.requirePrincipal !== true;
 }
+function tightenOnlySeatDeferredName(name) {
+    return tightenOnlySeatField(name).replace(/^settings\./, "");
+}
 export function parseTaskSettings(raw, seats = {}) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
@@ -262,6 +264,11 @@ export function parseTaskSettings(raw, seats = {}) {
     const maxDesc = s.skillListingMaxDescChars;
     if (skillListingMaxDescOk(maxDesc))
         out.skillListingMaxDescChars = maxDesc;
+    const tightenSeats = readTightenOnlySeats(raw);
+    for (const name of tightenSeats.rejected)
+        deferred.push(tightenOnlySeatDeferredName(name));
+    if (Object.keys(tightenSeats.values).length > 0)
+        out.tightenOnly = tightenSeats.values;
     return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
 export function acceptAppendSystemPrompt(v, warn) {
@@ -280,7 +287,7 @@ export function acceptAppendSystemPrompt(v, warn) {
 const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
-function createWorkflowAskPolicy(isExempt) {
+export function createWorkflowAskPolicy(isExempt) {
     return {
         async check(req) {
             if (heldRuleName(req, isWorkflowName) === undefined)
@@ -302,17 +309,31 @@ function createWorkflowAskPolicy(isExempt) {
 function rejectUnmatchableSettingsNames(perms, pathBases) {
     const refused = rulePolicyBucketsRefusal(perms, { ...(pathBases !== undefined ? { declared: pathBases } : {}), ...(pathBases?.home !== undefined ? { home: pathBases.home } : {}) });
     if (refused !== undefined)
-        throw new Error(refused.message);
+        throw new SettingsRuleRefusalError(refused.message, refused.problems);
+}
+export class SettingsRuleRefusalError extends Error {
+    problems;
+    constructor(message, problems) {
+        super(message);
+        this.problems = problems;
+        this.name = "SettingsRuleRefusalError";
+    }
 }
+export const SETTINGS_RULE_REFUSAL_CODE = "request.unprocessable";
 export const RULE_POLICY_BUCKETS = ["ask", "deny"];
 export function rulePolicyBucketsRefusal(permissions, bases) {
+    let first;
+    const problems = [];
     for (const bucket of RULE_POLICY_BUCKETS) {
         const names = permissions[bucket];
         if (!names)
             continue;
-        const unmatchable = unmatchableToolNamesRefusal(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(bases.declared !== undefined ? { pathBases: bases.declared } : {}) });
-        if (unmatchable !== undefined)
-            return { bucket, message: unmatchable.message };
+        const judged = judgeUnmatchableToolNames(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(bases.declared !== undefined ? { pathBases: bases.declared } : {}) });
+        if (judged === undefined)
+            continue;
+        first ??= { bucket, message: judged.message };
+        for (const b of judged.bad)
+            problems.push(entryProblem(SETTINGS_RULE_REFUSAL_CODE, `settings.permissions.${bucket}`, b.name, b.reason));
     }
     if (bases.home === undefined) {
         for (const bucket of RULE_POLICY_BUCKETS) {
@@ -320,73 +341,60 @@ export function rulePolicyBucketsRefusal(permissions, bases) {
             for (const name of permissions[bucket] ?? []) {
                 const parsed = parseRuleText(name, bucket);
                 if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
-                    return {
+                    first ??= {
                         bucket,
                         message: `${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
                             `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
                             `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`,
                     };
+                    problems.push(entryProblem(SETTINGS_RULE_REFUSAL_CODE, `settings.${field}`, name, "home_unresolvable"));
                 }
             }
         }
     }
-    return undefined;
+    return first === undefined ? undefined : { ...first, problems };
 }
 export const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
-export function deriveSettingsPolicy(settings, gate, workflowGate) {
+export function deriveSettingsPolicy(settings, bases) {
     const perms = settings.permissions;
-    if (!perms)
+    const neverAuto = settings.tightenOnly?.neverAuto;
+    if (!perms && neverAuto === undefined)
         return {};
-    const { deny, ask, defaultMode } = perms;
-    const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
-        ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
-        : undefined;
-    rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (deny)
-        policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
-    if (ask)
-        policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
-    const fsWriteGate = (acceptCwd) => {
-        if (!gate)
-            return undefined;
-        const gatePolicy = createFsWriteGatePolicy({
-            env: gate.env,
-            ...(gate.cwd !== undefined ? { rootPath: gate.cwd } : {}),
-            ...(acceptCwd && gate.cwd !== undefined ? { acceptDirs: [gate.cwd] } : {}),
-            ...(gate.scratchpadDir ? { exemptDirs: [gate.scratchpadDir] } : {}),
-            ...(gate.isExempt ? { isExempt: gate.isExempt } : {}),
-            defaultWrite: "ask",
-        });
-        return gatePolicy;
-    };
-    const compose = (...extra) => {
-        const all = [...policies, ...extra.filter((p) => p !== undefined)];
-        return all.length === 0 ? undefined : all.length === 1 ? all[0] : combinePolicies(...all);
-    };
-    const basePolicy = compose();
-    switch (defaultMode) {
-        case "acceptEdits": {
-            const p = compose(fsWriteGate(true), createWorkflowAskPolicy(workflowGate?.isExempt));
-            return p ? { toolPolicy: p } : {};
-        }
-        case "default":
-        case "auto":
-        case "dontAsk":
-        case "plan": {
-            const p = compose(createWorkflowAskPolicy(workflowGate?.isExempt));
-            return p ? { toolPolicy: p } : {};
-        }
-        case "bypassPermissions":
-        case undefined:
-            return basePolicy ? { toolPolicy: basePolicy } : {};
+    if (perms) {
+        const { deny, ask } = perms;
+        const pathBases = bases?.taskRoot !== undefined || bases?.taskHome !== undefined
+            ? { ...(bases.taskRoot !== undefined ? { root: bases.taskRoot } : {}), ...(bases.taskHome !== undefined ? { home: bases.taskHome } : {}) }
+            : undefined;
+        rejectUnmatchableSettingsNames(perms, pathBases);
+        if (deny)
+            policies.push(createRuleListPolicy(deny, "deny", RULE_SOURCE_BY_BEHAVIOR.deny, pathBases));
+        if (ask)
+            policies.push(createRuleListPolicy(ask, "ask", RULE_SOURCE_BY_BEHAVIOR.ask, pathBases));
+    }
+    if (neverAuto !== undefined) {
+        const refused = neverAutoNamesRefusal(neverAuto);
+        if (refused !== undefined)
+            throw new SettingsRuleRefusalError(refused.message, refused.problems);
+        policies.push(createRequestNeverAutoPolicy(neverAuto, tightenOnlySeatField("neverAuto")));
     }
+    if (policies.length === 0)
+        return {};
+    return { toolPolicy: policies.length === 1 ? policies[0] : combinePolicies(...policies) };
+}
+export function neverAutoNamesRefusal(names) {
+    const field = tightenOnlySeatField("neverAuto");
+    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: "deny" });
+    if (judged === undefined)
+        return undefined;
+    return { message: judged.message, problems: judged.bad.map((b) => entryProblem(SETTINGS_RULE_REFUSAL_CODE, field, b.name, b.reason)) };
 }
-export function applyTaskSettings(base, settings, gate, workflowGate) {
-    const { toolPolicy } = deriveSettingsPolicy(settings, gate, workflowGate);
+export function applyTaskSettings(base, settings, bases) {
+    const { toolPolicy } = deriveSettingsPolicy(settings, bases);
+    const seatSpec = settings.tightenOnly !== undefined ? tightenOnlySpecSeats(settings.tightenOnly) : {};
     let next = base;
-    if (toolPolicy !== undefined)
-        next = tightenGoverned(next, { toolPolicy });
+    if (toolPolicy !== undefined || Object.keys(seatSpec).length > 0)
+        next = tightenGoverned(next, { ...(toolPolicy !== undefined ? { toolPolicy } : {}), ...seatSpec });
     const allow = settings.permissions?.allow;
     if (allow !== undefined)
         next = { ...next, allowedTools: allow };

package/dist/text-bidi.d.ts

@@ -1,7 +1,3 @@
-/** bidi ∪ C0/DEL —— **清洗**面用(见文件头注:清洗面比检测面宽是刻意的)。bidi 半场内插 core 的类,C0/DEL 半场是本仓清洗面自己的。 */
-export declare const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061C\\u200E\\u200F\\u202A-\\u202E\\u2066-\\u2069";
-/** 清洗用的全局正则(`String.replace` 会在返回前把 `lastIndex` 归零,故模块级常量可安全复用)。 */
-export declare const CONTROL_AND_BIDI_STRIP_RE: RegExp;
 /** 这串文本里**有没有** bidi 控制符(判官 = core 的 {@link carriesBidiControls})。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
 export declare function hasBidiControls(text: string): boolean;
 //# sourceMappingURL=text-bidi.d.ts.map

package/dist/text-bidi.js

@@ -1,6 +1,4 @@
-import { BIDI_CONTROL_CHARS, carriesBidiControls } from "@sema-agent/core";
-export const CONTROL_AND_BIDI_CHARS = `\\u0000-\\u001f\\u007f${BIDI_CONTROL_CHARS}`;
-export const CONTROL_AND_BIDI_STRIP_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`, "g");
+import { carriesBidiControls } from "@sema-agent/core";
 const WHOLE_TEXT_SCAN = { maxNodes: 1, maxChars: Number.MAX_SAFE_INTEGER };
 export function hasBidiControls(text) {
     return carriesBidiControls(text, WHOLE_TEXT_SCAN);

package/dist/tighten-only-seats.d.ts

@@ -0,0 +1,150 @@
+/**
+ * **请求面「只收紧」座位族** —— 团队仓库里只会收紧的四张列表,在 `settings` 面各有一个每请求座位:一张闭集座位表、一组受理判据、一个能力位。
+ *
+ *  | 座位(`settings.…`)                | 去处                                                                                          | 部署侧的表                          |
+ *  |-------------------------------------|-----------------------------------------------------------------------------------------------|-------------------------------------|
+ *  | `readDenyPatterns`                  | core 任务层席 `TaskSpec.readDenyPatterns`(只增不减)                                           | `READ_DENY_PATTERNS`                |
+ *  | `writeProtectedExtra`               | core 任务层席 `TaskSpec.writeProtectedAdditions`(只增不减)                                    | `WRITE_PROTECTED_EXTRA`             |
+ *  | `complianceAdditionalDenies`        | core 任务层席 `TaskSpec.complianceAdditionalDenies`(只增不减)                                 | `COMPLIANCE_ADDITIONAL_DENIES`      |
+ *  | `permissions.neverAuto`             | 本仓审批席的请求叶策略(命中的工具恒问真人;见 `approval.ts` `createRequestNeverAutoPolicy`)    | `APPROVAL_NEVER_AUTO`               |
+ *
+ * ## 律
+ *  · **取并在拥有部署表的那一层做一次**:三座的部署表在 core 的 `RunnerDeps`(`readDenyPatterns` / `writeProtectedPaths` / `compliancePostureResolver`),与任务层列表的并集由 core 在 prepare 取
+ *    (`CLAMP_SET` 的 addOnly 律:`[]` 不抹任何行、任务层只加不减);`neverAuto` 的部署表在本仓审批席,请求叶与基线名单经 `tightenGoverned` 的 deny-wins 折叠取并。
+ *    **本仓不在折叠之外手写第二份并集** —— 那是下游改上游席语义(并集规则一份在 core,哪天 core 改身份函数,本仓的副本会静默分岔)。
+ *  · **空数组 ≡ 缺席**(并集的单位元):读入时不铸键,spec 与不带这个座位的请求字节相同。
+ *  · **请求面没有放宽臂**:列表只能加行;送空、送别的行,部署的表一行不少。
+ *  · **条目律借引擎的判官**(同一批 env 腿读的那几只:`compileReadDeny` / `resolveWriteProtectedTable` / `COMPLIANCE_CAPABILITIES`),宿主不自造第二份校验语义;读拒条目的元素文法 env / 中心 / 请求三腿同读
+ *    `read-deny-entry.ts` 的那一只。受理面在 prepare 之前把坏形响亮拒掉(400),不让它变成 200 之后才失败的一跑。
+ *  · 受理判据一处({@link tightenOnlySeatIssue}):不是数组 / 超帽 / 坏项 ⇒ 400 `request.field_invalid` + 机读位(`field` / `reason` / `count`+`cap` | `index`),与 S-904 三桶同形。
+ *    fresh 受理口、`resolveSpec`(两腿)、存体重放预判三处调这一只。
+ *  · 座位表是闭集:加一座 = 加一行(`TIGHTEN_ONLY_SEAT_NAMES` 与表互为编译期穷举;`wire` 位置必须落在 `task-settings.ts` 的受理列里 —— 下面的编译期门)。
+ *
+ * 谁调:`task-settings.ts`(`parseTaskSettings` 读入 · `applyTaskSettings` 投影 · 键闭集门)· `http/admission.ts` / `boot/resolve-spec.ts` / `http/stored-body-replay.ts`(受理判据)·
+ * `http/routes/capabilities.ts`(能力位 `taskSettings.tightenOnlySeats`)· `request-key-closure.ts`(顶层同名键的拒句指路)。
+ */
+import { type ComplianceCapability, type ReadDenyEntry, type WriteProtectedEntry } from "@sema-agent/core";
+import type { GovernanceOverrides } from "./governance-overrides.js";
+import { type LimitFacts } from "./limit-refusal.js";
+/** 四座(表序;句子说「表序里第一座」)。 */
+export declare const TIGHTEN_ONLY_SEAT_NAMES: readonly ["neverAuto", "readDenyPatterns", "writeProtectedExtra", "complianceAdditionalDenies"];
+export type TightenOnlySeatName = (typeof TIGHTEN_ONLY_SEAT_NAMES)[number];
+/** 每座一个条目的类型(归一后的值;进 spec / 请求叶的就是它,不另投影)。 */
+interface SeatEntryTypes {
+    readonly neverAuto: string;
+    readonly readDenyPatterns: ReadDenyEntry;
+    readonly writeProtectedExtra: WriteProtectedEntry;
+    readonly complianceAdditionalDenies: ComplianceCapability;
+}
+/** 读入的产物:每座一份归一后的非空列表(缺席的座不在)。 */
+export type TightenOnlySeatValues = {
+    readonly [N in TightenOnlySeatName]?: readonly SeatEntryTypes[N][];
+};
+type SeatValuesDraft = {
+    -readonly [N in TightenOnlySeatName]?: readonly SeatEntryTypes[N][];
+};
+/** 三座落 core 任务层席时进 spec 的片段(键 = core 的 `TaskSpec` 席名)。 */
+export type TightenOnlySpecSeats = Pick<GovernanceOverrides, "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies">;
+/** 座位在 `settings` 里的位置:顶层键,或 `permissions` 下的一个成员。 */
+type SeatWire = readonly [key: string] | readonly [container: "permissions", key: string];
+declare const SEAT_WIRE: {
+    readonly neverAuto: readonly ["permissions", "neverAuto"];
+    readonly readDenyPatterns: readonly ["readDenyPatterns"];
+    readonly writeProtectedExtra: readonly ["writeProtectedExtra"];
+    readonly complianceAdditionalDenies: readonly ["complianceAdditionalDenies"];
+};
+/** 编译期门:每座的 wire 位置都在 `task-settings.ts` 的受理列里(座位表加一行而受理列没跟 ⇒ 这里红 —— 否则键闭集门会把新座 400 掉)。 */
+type SeatTopKeys = Extract<(typeof SEAT_WIRE)[TightenOnlySeatName], readonly [string]>[0];
+type SeatPermissionKeys = Extract<(typeof SEAT_WIRE)[TightenOnlySeatName], readonly ["permissions", string]>[1];
+/** 一个条目的读数:归一值,或接在坐标后面成句的原因(自带连接符)。 */
+type EntryReading<E> = {
+    readonly ok: true;
+    readonly value: E;
+} | {
+    readonly ok: false;
+    readonly after: string;
+};
+/**
+ * 一行座位。方法写成**方法签名**(参数双变):表是异质的,遍历时由 {@link eachSeat} 用同一个 `E` 把一行的读 / 放 / 投影三件事配回去。
+ *  · `grammar` —— 句子里说「这张表该装什么」;
+ *  · `readEntry` —— 一个条目的受理判(借引擎的判官);
+ *  · `get` / `put` —— 归一值在 {@link TightenOnlySeatValues} 里的位置(每行自己拼一次本座的键,类型检查);
+ *  · `sink` —— 去处:core 任务层席(`toSpec` 给出进 spec 的片段)或本仓审批席。
+ */
+interface SeatRow<E> {
+    readonly wire: SeatWire;
+    readonly grammar: string;
+    readEntry(entry: unknown): EntryReading<E>;
+    get(values: TightenOnlySeatValues): readonly E[] | undefined;
+    put(draft: SeatValuesDraft, list: readonly E[]): void;
+    /** 这一座的条数帽(超了响亮拒 `over_cap`,不截;先于逐条读,拒体有界)。 */
+    readonly maxEntries: number;
+    /** 整张列表的**成本预算**(可选;只给「引擎匹配代价随条目内容增长」的座):`measure` 数一张列表占多少预算,超 `cap` ⇒ 响亮拒(`over_cap` + `count` + `cap`),不截。 */
+    readonly budget?: {
+        measure(list: readonly E[]): number;
+        readonly cap: number;
+        readonly unit: string;
+    };
+    readonly sink: {
+        readonly kind: "core_task_seat";
+        toSpec(list: readonly E[]): TightenOnlySpecSeats;
+    } | {
+        readonly kind: "approval_seat";
+    };
+}
+/**
+ * 读拒模式的**成本单位 = 一颗 `*`**:引擎(core `compileSegmentPattern`)把每一颗 `*` 编成一个 `[^/]*`,相邻的星就是相邻的回溯点 ——
+ * 一段里 k 颗 `*` 对长度 n 的路径段是 n 的 k 次方级回溯(实测 16 颗连续的星对 17 字的段 ≈ 4 s,跑在事件循环上、任何计时器打不断)。
+ * 所以界按**调用方写下的每一颗**计,不按「连续的一串」计。整段 `**` / `id_rsa*` / `*.pem` / `*secret*` / `*_*_key` / `a**b` 都在内。
+ */
+export declare const MAX_READ_DENY_STARS_PER_SEGMENT = 2;
+/** 整张 `readDenyPatterns` 列表的 `*` 总预算:引擎每次判路径对每条模式、每个路径段各跑一遍,一段 2 颗星是段长的平方 —— 总量只界住「乘几遍」(128 颗时 64 条的表对万字段 ≈ 3.9 s)。
+ *  不是上界:16 颗的整表(8 条各 2 颗)对对手形的 4000 字段本机实测约 1 s、万字段约 5–6 s;段长的那一维只能在引擎里收(线性时间匹配或路径段长度上限,已向引擎请托)。 */
+export declare const MAX_READ_DENY_STARS_TOTAL = 16;
+/** 每座条数的缺省上限 —— 与 `settings.permissions` 三桶同一只帽(编译口的整表帽;超了响亮拒,不截)。读拒模式另有更紧的一只({@link MAX_READ_DENY_ENTRIES}),每座的帽写在座位表那一行。 */
+export declare const MAX_TIGHTEN_ONLY_SEAT_ENTRIES = 1000;
+/** 整张 `readDenyPatterns` 列表的条数帽:不带星的条目也是每段一遍匹配,条数本身就是成本(其余三座的帽是 {@link MAX_TIGHTEN_ONLY_SEAT_ENTRIES})。 */
+export declare const MAX_READ_DENY_ENTRIES = 32;
+/** 座位表(闭集;`{ [N in 座名]: SeatRow }` 双向穷举:少一座 / 多一座都是编译红)。 */
+export declare const TIGHTEN_ONLY_SEATS: {
+    readonly [N in TightenOnlySeatName]: SeatRow<SeatEntryTypes[N]>;
+};
+/** 一座在体内的坐标的**字面类型**(`settings.readDenyPatterns` | … | `settings.permissions.neverAuto`),从 {@link SEAT_WIRE} 派生,不手抄。 */
+export type TightenOnlySeatField = `settings.${SeatTopKeys}` | `settings.permissions.${SeatPermissionKeys}`;
+/** 一座在体内的坐标(`settings.readDenyPatterns` / `settings.permissions.neverAuto`)。 */
+export declare function tightenOnlySeatField(name: TightenOnlySeatName): TightenOnlySeatField;
+/** 拒体的机读位:撞帽 = {@link LimitFacts}(`over_cap` + `count` + `cap`),坏项 = `bad_entry`(+ 首个坏项的下标;整座不是数组时无下标)。 */
+export type TightenOnlySeatIssueFields = LimitFacts | {
+    readonly field: string;
+    readonly reason: "bad_entry";
+    readonly index?: number;
+};
+/** 一次裁决:是哪一座、wire 文案、机读位。 */
+export interface TightenOnlySeatIssue {
+    readonly seat: TightenOnlySeatName;
+    readonly message: string;
+    readonly fields: TightenOnlySeatIssueFields;
+}
+/**
+ * 四座的**唯一**受理判据(纯函数)。逐座按表序(整表判只有 {@link readSeat} 一只,本函数与 {@link readTightenOnlySeats} 共用):缺席 / `null` ⇒ 不判;不是数组 ⇒ `bad_entry`(无下标);
+ * 超帽 ⇒ `over_cap`(先于逐条读,拒体有界);首个坏条目 ⇒ `bad_entry` + 它的下标;成本预算超了 ⇒ `over_cap`(`count` = 占用,`cap` = 预算)。全合法 ⇒ `null`。空数组合法(单位元)。
+ * 句子出口剥控制与双向字符(引擎的原因句可能转载调用方的条目文字)。
+ */
+export declare function tightenOnlySeatIssue(settings: unknown): TightenOnlySeatIssue | null;
+/** 读入的结果:归一后的非空列表(空数组 ≡ 缺席,不铸键);判据说不合法的座**整座丢弃**并报名(`rejected`)—— 只有绕过两道入口的读者走得到,留痕由调用方记。 */
+export interface ReadTightenOnlySeats {
+    readonly values: TightenOnlySeatValues;
+    readonly rejected: readonly TightenOnlySeatName[];
+}
+/**
+ * 把一份**未验过**的 `settings` 读成四座的归一值(`parseTaskSettings` 的读入腿 —— RESUME 重放也走这里,所以宽容:不抛、坏座整座丢弃并报名)。
+ * 与 {@link tightenOnlySeatIssue} 共用 {@link readSeat}(同一只整表判):fresh 提交与续跑在更早处已被它响亮拒过,这里是宽容层。
+ */
+export declare function readTightenOnlySeats(settings: unknown): ReadTightenOnlySeats;
+/**
+ * 三座落 core 任务层席的 spec 片段(进 `tightenGoverned` 的 `TaskSpec` 席名 —— 与部署表取并由 core 的 addOnly 律在 prepare 做一次)。没有这三座的值 ⇒ `{}`。
+ * `neverAuto` 不在这里(它的去处是审批席的请求叶策略,见 `approval.ts` 的 `createRequestNeverAutoPolicy`)。
+ */
+export declare function tightenOnlySpecSeats(values: TightenOnlySeatValues): TightenOnlySpecSeats;
+export {};
+//# sourceMappingURL=tighten-only-seats.d.ts.map

package/dist/tighten-only-seats.js

@@ -0,0 +1,196 @@
+import { COMPLIANCE_CAPABILITIES, compileReadDeny, resolveWriteProtectedTable } from "@sema-agent/core";
+import { echoCallerText } from "./caller-text-echo.js";
+import { limitRefusal } from "./limit-refusal.js";
+import { MAX_PERMISSION_RULES_PER_LIST } from "./permission-rule-list.js";
+import { readReadDenyEntry } from "./read-deny-entry.js";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
+export const TIGHTEN_ONLY_SEAT_NAMES = ["neverAuto", "readDenyPatterns", "writeProtectedExtra", "complianceAdditionalDenies"];
+const SEAT_WIRE = {
+    neverAuto: ["permissions", "neverAuto"],
+    readDenyPatterns: ["readDenyPatterns"],
+    writeProtectedExtra: ["writeProtectedExtra"],
+    complianceAdditionalDenies: ["complianceAdditionalDenies"],
+};
+const CORE_REASON_ECHO_CHARS = 400;
+function coreReason(e) {
+    const text = e instanceof Error ? e.message : String(e);
+    return echoCallerText(text.replace(/^(?:readDenyPatterns \(additions\)|writeProtectedPaths): /, ""), { maxChars: CORE_REASON_ECHO_CHARS });
+}
+export const MAX_READ_DENY_STARS_PER_SEGMENT = 2;
+export const MAX_READ_DENY_STARS_TOTAL = 16;
+export const MAX_TIGHTEN_ONLY_SEAT_ENTRIES = MAX_PERMISSION_RULES_PER_LIST;
+export const MAX_READ_DENY_ENTRIES = 32;
+const starsIn = (text) => (text.match(/\*/g) ?? []).length;
+function maxStarsPerSegment(pattern) {
+    return pattern.split("/").reduce((max, segment) => Math.max(max, starsIn(segment)), 0);
+}
+function isComplianceCapability(entry) {
+    return COMPLIANCE_CAPABILITIES.includes(entry);
+}
+export const TIGHTEN_ONLY_SEATS = {
+    neverAuto: {
+        wire: SEAT_WIRE.neverAuto,
+        grammar: "non-empty tool-name strings",
+        readEntry: (entry) => (typeof entry === "string" && entry.length > 0 ? { ok: true, value: entry } : { ok: false, after: " is not a non-empty tool name string" }),
+        maxEntries: MAX_TIGHTEN_ONLY_SEAT_ENTRIES,
+        get: (values) => values.neverAuto,
+        put: (draft, list) => {
+            draft.neverAuto = list;
+        },
+        sink: { kind: "approval_seat" },
+    },
+    readDenyPatterns: {
+        wire: SEAT_WIRE.readDenyPatterns,
+        grammar: "read-deny patterns (a string, or an object { pattern, caseSensitive? })",
+        readEntry: (entry) => {
+            const read = readReadDenyEntry(entry);
+            if (!read.ok)
+                return { ok: false, after: read.after };
+            try {
+                compileReadDeny([read.entry]);
+            }
+            catch (e) {
+                return { ok: false, after: ` is refused by the engine: ${coreReason(e)}` };
+            }
+            const stars = maxStarsPerSegment(read.entry.pattern);
+            if (stars > MAX_READ_DENY_STARS_PER_SEGMENT) {
+                return { ok: false, after: ` has a path segment with ${stars} "*" wildcards — at most ${MAX_READ_DENY_STARS_PER_SEGMENT} per segment are accepted in a request, each "*" counted (the engine matches a segment by backtracking and the cost grows with each extra wildcard); merge them, or ask the operator to put the row in READ_DENY_PATTERNS` };
+            }
+            return { ok: true, value: read.entry };
+        },
+        maxEntries: MAX_READ_DENY_ENTRIES,
+        get: (values) => values.readDenyPatterns,
+        put: (draft, list) => {
+            draft.readDenyPatterns = list;
+        },
+        budget: { measure: (list) => list.reduce((sum, entry) => sum + starsIn(typeof entry === "string" ? entry : entry.pattern), 0), cap: MAX_READ_DENY_STARS_TOTAL, unit: `"*" wildcards` },
+        sink: { kind: "core_task_seat", toSpec: (list) => ({ readDenyPatterns: [...list] }) },
+    },
+    writeProtectedExtra: {
+        wire: SEAT_WIRE.writeProtectedExtra,
+        grammar: "write-protection names (a literal name string, or an object { name, kind })",
+        readEntry: (entry) => {
+            try {
+                const rows = resolveWriteProtectedTable([entry]);
+                const row = rows[0];
+                if (rows.length !== 1 || row === undefined)
+                    return { ok: false, after: " does not read as exactly one write-protection row" };
+                return { ok: true, value: row };
+            }
+            catch (e) {
+                return { ok: false, after: ` is refused by the engine: ${coreReason(e)}` };
+            }
+        },
+        maxEntries: MAX_TIGHTEN_ONLY_SEAT_ENTRIES,
+        get: (values) => values.writeProtectedExtra,
+        put: (draft, list) => {
+            draft.writeProtectedExtra = list;
+        },
+        sink: { kind: "core_task_seat", toSpec: (list) => ({ writeProtectedAdditions: [...list] }) },
+    },
+    complianceAdditionalDenies: {
+        wire: SEAT_WIRE.complianceAdditionalDenies,
+        grammar: `capability names (${COMPLIANCE_CAPABILITIES.join("|")})`,
+        readEntry: (entry) => isComplianceCapability(entry)
+            ? { ok: true, value: entry }
+            : { ok: false, after: ` is not one of ${COMPLIANCE_CAPABILITIES.join("|")}` },
+        maxEntries: MAX_TIGHTEN_ONLY_SEAT_ENTRIES,
+        get: (values) => values.complianceAdditionalDenies,
+        put: (draft, list) => {
+            draft.complianceAdditionalDenies = list;
+        },
+        sink: { kind: "core_task_seat", toSpec: (list) => ({ complianceAdditionalDenies: [...list] }) },
+    },
+};
+function eachSeat(visit) {
+    return TIGHTEN_ONLY_SEAT_NAMES.map((name) => visit(name, TIGHTEN_ONLY_SEATS[name]));
+}
+export function tightenOnlySeatField(name) {
+    const wire = SEAT_WIRE[name];
+    return wire.length === 1 ? `settings.${wire[0]}` : `settings.${wire[0]}.${wire[1]}`;
+}
+function rawListOf(settings, wire) {
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return undefined;
+    const top = settings[wire[0]];
+    if (wire.length === 1)
+        return top;
+    if (top === null || typeof top !== "object" || Array.isArray(top))
+        return undefined;
+    return top[wire[1]];
+}
+function readSeat(name, row, settings) {
+    const raw = rawListOf(settings, row.wire);
+    if (raw === undefined || raw === null)
+        return { kind: "absent" };
+    const field = tightenOnlySeatField(name);
+    const refuse = (message, fields) => ({ kind: "refused", seat: name, message: sanitized(message), fields });
+    if (!Array.isArray(raw)) {
+        return refuse(`${field} must be an array of ${row.grammar} — refused rather than ignored, because an ignored list reads as "in effect" to the caller`, { field, reason: "bad_entry" });
+    }
+    if (raw.length > row.maxEntries) {
+        const refusal = limitRefusal(field, "entries", raw.length, row.maxEntries, {
+            tail: "Refused rather than truncated: a truncated list silently drops the entries past the cap, and a dropped tightening is one that never happened. Merge entries into broader patterns or trim the list",
+        });
+        return refuse(refusal.message, refusal.facts);
+    }
+    const list = [];
+    for (let index = 0; index < raw.length; index++) {
+        const read = row.readEntry(raw[index]);
+        if (!read.ok) {
+            const after = read.after.replace(/\.$/, "");
+            return refuse(`${field}[${index}]${after} — every entry must be ${row.grammar}. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`, { field, reason: "bad_entry", index });
+        }
+        list.push(read.value);
+    }
+    const budget = row.budget;
+    if (budget !== undefined) {
+        const count = budget.measure(list);
+        if (count > budget.cap) {
+            return refuse(`${field} has ${count} ${budget.unit} in total — at most ${budget.cap} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the budget, and a dropped tightening is one that never happened. Merge entries into broader patterns or trim the list`, { field, reason: "over_cap", count, cap: budget.cap });
+        }
+    }
+    return { kind: "list", list };
+}
+export function tightenOnlySeatIssue(settings) {
+    for (const reading of eachSeat((name, row) => readSeat(name, row, settings))) {
+        if (reading.kind === "refused")
+            return { seat: reading.seat, message: reading.message, fields: reading.fields };
+    }
+    return null;
+}
+function sanitized(message) {
+    return stripControlAndBidi(message);
+}
+export function readTightenOnlySeats(settings) {
+    const draft = {};
+    const rejected = [];
+    eachSeat((name, row) => {
+        const reading = readSeat(name, row, settings);
+        if (reading.kind === "refused")
+            rejected.push(name);
+        else if (reading.kind === "list" && reading.list.length > 0)
+            row.put(draft, reading.list);
+    });
+    return { values: draft, rejected };
+}
+export function tightenOnlySpecSeats(values) {
+    const fragments = eachSeat((_name, row) => {
+        const list = row.get(values);
+        if (list === undefined || list.length === 0)
+            return undefined;
+        const sink = row.sink;
+        switch (sink.kind) {
+            case "core_task_seat":
+                return sink.toSpec(list);
+            case "approval_seat":
+                return undefined;
+            default: {
+                const unhandled = sink;
+                throw new Error(`tighten-only seat sink ${JSON.stringify(unhandled)} has no projection arm`);
+            }
+        }
+    });
+    return fragments.reduce((acc, fragment) => (fragment === undefined ? acc : { ...acc, ...fragment }), {});
+}
+//# sourceMappingURL=tighten-only-seats.js.map