@sema-agent/server 7.133.0 → 7.135.0

package/dist/task-settings.js

@@ -1,17 +1,19 @@
 import { combinePolicies, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { judgeUnmatchableToolNames } from "./config.js";
+import { NAME_TABLE_BEHAVIOR } from "./namespaced-rule-name.js";
 import { entryProblem } from "./entry-problems.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
-import { parseHooksConfig } from "./hooks/hook-runner.js";
+import { hooksCoordinate, parseHooksConfig } from "./hooks/hook-runner.js";
 import { heldRuleName } from "./tool-rule-names.js";
 import { entryPermissionMode } from "./runtime-governance.js";
 import { policyAskStandingAnswerFacts, standingAnswerDurablyRecordable } from "./tool-approval.js";
 import { createRequestNeverAutoPolicy } from "./approval.js";
 import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySpecSeats } from "./tighten-only-seats.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export const PERMISSION_MODE_WORDS = PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function coercePermissionMode(raw) {
     const strict = coercePermissionModeStrict(raw);
@@ -154,7 +156,7 @@ export function settingsPermissionBucketIssue(perms) {
 function acceptedRuleList(v) {
     return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
-export const TASK_SETTINGS_KEYS = ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export const TASK_SETTINGS_KEYS = ["approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
@@ -191,8 +193,36 @@ export function taskSettingsKeyIssue(raw) {
         unsupportedKeys: unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
+export function hooksKeyIssue(raw, config) {
+    const unknown = [];
+    const member = (node, key) => node !== null && typeof node === "object" && Object.hasOwn(node, key) ? node[key] : undefined;
+    const scan = (rawNode, carried, at) => {
+        if (rawNode === null || typeof rawNode !== "object" || Array.isArray(rawNode))
+            return;
+        for (const [key, value] of Object.entries(rawNode))
+            if (value !== undefined && !Object.hasOwn(carried, key))
+                unknown.push(hooksCoordinate([...at, key]));
+    };
+    for (const [event, groups] of Object.entries(config)) {
+        for (const [groupIndex, group] of (groups ?? []).entries()) {
+            const rawGroup = member(member(raw, event), groupIndex);
+            scan(rawGroup, group, ["hooks", event, groupIndex]);
+            for (const [entryIndex, entry] of group.hooks.entries())
+                scan(member(member(rawGroup, "hooks"), entryIndex), entry, ["hooks", event, groupIndex, "hooks", entryIndex]);
+        }
+    }
+    if (unknown.length === 0)
+        return null;
+    unknown.sort();
+    const label = "unknown (not read on that matcher group or hook entry by this server — a misspelling, a key of another entry type (plugin / args are read on command entries only), or a hook key this server does not run)";
+    return {
+        message: `settings.hooks: unrecognized key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ${keyClosureClause(unknown, label)}.`,
+        unknownKeys: unknown.slice(0, MAX_KEY_ECHO),
+        unsupportedKeys: [],
+    };
+}
 export function taskHooksHonored(config) {
-    return config.requirePrincipal !== true;
+    return !DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config);
 }
 function tightenOnlySeatDeferredName(name) {
     return tightenOnlySeatField(name).replace(/^settings\./, "");
@@ -384,7 +414,7 @@ export function deriveSettingsPolicy(settings, bases) {
 }
 export function neverAutoNamesRefusal(names) {
     const field = tightenOnlySeatField("neverAuto");
-    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: "deny" });
+    const judged = judgeUnmatchableToolNames(field.replace(/^settings\./, ""), names, { consumer: "tool-name-table", behavior: NAME_TABLE_BEHAVIOR });
     if (judged === undefined)
         return undefined;
     return { message: judged.message, problems: judged.bad.map((b) => entryProblem(SETTINGS_RULE_REFUSAL_CODE, field, b.name, b.reason)) };

package/dist/task-workflow.d.ts

@@ -1,27 +1,3 @@
-/**
- * Workflow super-set unlock — map the per-task `body.selfOrchestration` intent onto
- * `TaskSpec.selfOrchestration`, the gate that mounts core's LLM-authored `run_workflow` engine (the workflow.ts
- * agent/parallel/pipeline orchestrator). Same shape as the rank-1 roster gap: the engine (core run_workflow +
- * workflow.ts) is BUILT, but nothing mapped a body field to the per-task spec flag, so it was unreachable over HTTP
- * (capabilities advertised `workflows:true` but the LLM could never call run_workflow).
- *
- * Gating:
- *  - DEPLOYMENT: `selfOrchestrationEnabled` must be on (the workflowScriptRunner + stores are wired). Otherwise a set
- *    flag is a harmless no-op (core fail-closes run_workflow without the sandbox runner), so it's dropped for clarity.
- *  - MULTI-TENANT: honored ONLY when a per-principal entitlement RESOLVER is wired (`hasEntitlementResolver`). 🔴 core's
- *    `allowWorkflows` (RuntimeCaps) is TIGHTEN-ONLY — a resolver can only DENY; `undefined` = NO restriction, so the
- *    deployment capability governs. Therefore WITHOUT a resolver the engine would mount run_workflow UNGATED for every
- *    tenant. So we fail-closed here (defense-in-depth: a misconfigured multi-tenant deployment with no entitlement
- *    source must NOT leak the LLM-authored workflow engine). WITH a resolver, core enforces `allowWorkflows`
- *    per-principal (deny → fail-closed). Single-user (owns its own worker) honors directly. Three-gate: engine-can ∧
- *    center-may(allowWorkflows) ∧ shell-show.
- *
- * 🔴 [ref](2026-09-03):fail-closed 的**方向**从来是对的,错的是它**没人说**。多租户 + 无 entitlement 源
- * 的部署上,这条腿把 `body.selfOrchestration:true`(以及 `settings.ultracode` 展开出来的同一个意图)静默
- * 折成 `undefined`,而 `/v1/capabilities` 照报 `workflows:true` ⇒ 「壳显示支持、引擎按普通 run 跑」。修法
- * 是把部署级半场抽成下面的 {@link selfOrchestrationDenial}(能力位与准入**同一只**谓词),提交面在拒因
- * 在场时**响亮**拒(`routes` 的 501 `capability.self_orchestration_required`),不再静默折。
- */
 export declare function selfOrchestrationFromBody(body: {
     selfOrchestration?: unknown;
 }, config: SelfOrchestrationGateConfig, hasEntitlementResolver: boolean): true | undefined;

package/dist/task-workflow.js

@@ -1,3 +1,4 @@
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 export function selfOrchestrationFromBody(body, config, hasEntitlementResolver) {
     if (body.selfOrchestration !== true || config.selfOrchestrationEnabled !== true)
         return undefined;
@@ -15,7 +16,7 @@ export function enableForkFromBody(body, config, hasEntitlementResolver) {
         return false;
     if (body.enableFork === false)
         return false;
-    if (config.requirePrincipal !== true)
+    if (!DEPLOYMENT_SHAPE_PREDICATES.multiTenant.holds(config))
         return true;
     return hasEntitlementResolver;
 }

package/dist/terminal.d.ts

@@ -31,7 +31,7 @@ import { terminalProjection, type PausedCause, type TaskStatus, type TerminalCau
  */
 export declare function failureCodeOf(terminal: TerminalCause): string | undefined;
 /**
- * 本仓**对外机器码**的词法(S-548)。附录 A 那张表、core 的点名族(`limits.*` / `config.*` /
+ * 本仓**对外机器码**的词法([ref])。附录 A 那张表、core 的点名族(`limits.*` / `config.*` /
  * `resume_at.*` / `output.*` / brain 扁平码)、工具层自注册码 —— 全体成员都是这一形:**小写**的
  * `a-z0-9_`,用 `.` 分族。门 {@link OUTWARD_CODE_SHAPE} 在 `test/terminal-store-error-fold.test.ts`
  * 里对**目录里真有的每一个码**断言这条词法(判据由 catalog 机器派生,不是手抄的一张清单)。
@@ -40,7 +40,7 @@ export declare const OUTWARD_CODE_SHAPE: RegExp;
 /** 域外失败码的**唯一**落点(附录外的新码;原码进日志与 message,不丢)。 */
 export declare const STORE_ERROR_CODE = "internal.store_error";
 /**
- * 一个失败码要上 wire 之前的**归一**(S-548)。在词法内 ⇒ 原样;词法外 ⇒ {@link STORE_ERROR_CODE}。
+ * 一个失败码要上 wire 之前的**归一**([ref])。在词法内 ⇒ 原样;词法外 ⇒ {@link STORE_ERROR_CODE}。
  *
  * ── 病(test T-47,三库一致)────────────────────────────────────────────────────────────────────
  * 本仓的 SQL 店把**驱动原生错误**原样抛回引擎,而 core 的 `errorCodeOf` 沿 `err.code`/`cause` 链取
@@ -63,7 +63,7 @@ export declare function outwardFailureCode(code: string): string;
 /**
  * **一条结果离开引擎、进入本仓(可重放账本 / run 行 / wire)的唯一封口** —— 两件事,一个出口:
  *  ①摘掉**耐久恢复能力凭据**(`CheckpointToken`);②把**域外的失败码**折成本仓的 `internal.store_error`
- *  ({@link outwardFailureCode},S-548)。
+ *  ({@link outwardFailureCode},[ref])。
  *
  * 🔴 为什么两件事合在一只函数里而不是并列两只(7.92.2 改名 `stripResumeToken` → `sealResultForExit`):
  * 它们是**同一个出口上的同一件事** —— 「这条结果可以见人了吗」。并列两只 = 六个结算点各自要记得调两次,
@@ -92,12 +92,12 @@ export declare function sealResultForExit<T extends {
     terminal: TerminalCause;
 }>(result: T): T;
 /**
- * **投影出口的唯一属主**(S-548)—— core 的 `terminalProjection` + 对外码归一,一次。
+ * **投影出口的唯一属主**([ref])—— core 的 `terminalProjection` + 对外码归一,一次。
  *
  * `docs/ASSISTANT-WIRE-CONTRACT.md` §5.0 说清了终局有**两张脸**:①结果**本身**(`done.result` / 200 体 /
  * `GET /v1/runs/:id → result`,零投影)与②**五词投影**(run 行的 `status` / `error_code` 列、fleet 终态词、
  * 决策腿 200 体的三格平面词)。两张脸各有一个属主:①是 {@link sealResultForExit},②就是本函数。
- * **两个属主都折码**,否则同一次失败在两张脸上说两个不同的码 —— 而缺的那一张正是 S-548 修前仍在泄漏的
+ * **两个属主都折码**,否则同一次失败在两张脸上说两个不同的码 —— 而缺的那一张正是 [ref] 修前仍在泄漏的
  * 那条路(codex 对抗复审本轮 [medium],亲读证实:决策腿的 200 体从**未封口的** result 投影 `errorCode`,
  * 于是驱动原生码照旧上 wire,尽管同一段代码落库那份已经折过)。
  *

package/dist/tighten-only-seats.d.ts

@@ -16,7 +16,7 @@
  *  · **请求面没有放宽臂**:列表只能加行;送空、送别的行,部署的表一行不少。
  *  · **条目律借引擎的判官**(同一批 env 腿读的那几只:`compileReadDeny` / `resolveWriteProtectedTable` / `COMPLIANCE_CAPABILITIES`),宿主不自造第二份校验语义;读拒条目的元素文法 env / 中心 / 请求三腿同读
  *    `read-deny-entry.ts` 的那一只。受理面在 prepare 之前把坏形响亮拒掉(400),不让它变成 200 之后才失败的一跑。
- *  · 受理判据一处({@link tightenOnlySeatIssue}):不是数组 / 超帽 / 坏项 ⇒ 400 `request.field_invalid` + 机读位(`field` / `reason` / `count`+`cap` | `index`),与 S-904 三桶同形。
+ *  · 受理判据一处({@link tightenOnlySeatIssue}):不是数组 / 超帽 / 坏项 ⇒ 400 `request.field_invalid` + 机读位(`field` / `reason` / `count`+`cap` | `index`),与 [ref] 三桶同形。
  *    fresh 受理口、`resolveSpec`(两腿)、存体重放预判三处调这一只。
  *  · 座位表是闭集:加一座 = 加一行(`TIGHTEN_ONLY_SEAT_NAMES` 与表互为编译期穷举;`wire` 位置必须落在 `task-settings.ts` 的受理列里 —— 下面的编译期门)。
  *
@@ -93,13 +93,14 @@ interface SeatRow<E> {
     };
 }
 /**
- * 读拒模式的**成本单位 = 一颗 `*`**:引擎(core `compileSegmentPattern`)把每一颗 `*` 编成一个 `[^/]*`,相邻的星就是相邻的回溯点 ——
- * 一段里 k 颗 `*` 对长度 n 的路径段是 n 的 k 次方级回溯(实测 16 颗连续的星对 17 字的段 ≈ 4 s,跑在事件循环上、任何计时器打不断)。
- * 所以界按**调用方写下的每一颗**计,不按「连续的一串」计。整段 `**` / `id_rsa*` / `*.pem` / `*secret*` / `*_*_key` / `a**b` 都在内。
+ * 读拒模式的请求侧星号界:**一颗 `*` 算一颗**(调用方写下的每一颗都计,不按「连续的一串」计;整段 `**` / `id_rsa*` / `*.pem` / `*secret*` / `*_*_key` / `a**b` 都在内)。
+ *
+ * ⚠️ 这条界当初的理由(引擎把每一颗 `*` 编成一个 `[^/]*`,一段里 k 颗星对长度 n 的段是 n 的 k 次方级回溯)自引擎 7.55.0 起**不成立**:段匹配是 `*` glob,
+ * 没有从模式铸出来的表达式,代价至多是模式长度与段长的乘积、与星的个数和排布无关。所以界今天是**受理面的口径**(请求是不可信的写者),不再对应引擎里的某个成本 ——
+ * 拒句与契约都不再给「引擎回溯」这个理由。界本身退不退是放宽方向的另一件事,不在这里。
  */
 export declare const MAX_READ_DENY_STARS_PER_SEGMENT = 2;
-/** 整张 `readDenyPatterns` 列表的 `*` 总预算:引擎每次判路径对每条模式、每个路径段各跑一遍,一段 2 颗星是段长的平方 —— 总量只界住「乘几遍」(128 颗时 64 条的表对万字段 ≈ 3.9 s)。
- *  不是上界:16 颗的整表(8 条各 2 颗)对对手形的 4000 字段本机实测约 1 s、万字段约 5–6 s;段长的那一维只能在引擎里收(线性时间匹配或路径段长度上限,已向引擎请托)。 */
+/** 整张 `readDenyPatterns` 列表的 `*` 总预算(同一条受理口径,理由见 {@link MAX_READ_DENY_STARS_PER_SEGMENT}:星的个数不再对应引擎里的成本;条数与单条长度才是还在的两个成本维度)。 */
 export declare const MAX_READ_DENY_STARS_TOTAL = 16;
 /** 每座条数的缺省上限 —— 与 `settings.permissions` 三桶同一只帽(编译口的整表帽;超了响亮拒,不截)。读拒模式另有更紧的一只({@link MAX_READ_DENY_ENTRIES}),每座的帽写在座位表那一行。 */
 export declare const MAX_TIGHTEN_ONLY_SEAT_ENTRIES = 1000;

package/dist/tighten-only-seats.js

@@ -54,7 +54,7 @@ export const TIGHTEN_ONLY_SEATS = {
             }
             const stars = maxStarsPerSegment(read.entry.pattern);
             if (stars > MAX_READ_DENY_STARS_PER_SEGMENT) {
-                return { ok: false, after: ` has a path segment with ${stars} "*" wildcards — at most ${MAX_READ_DENY_STARS_PER_SEGMENT} per segment are accepted in a request, each "*" counted (the engine matches a segment by backtracking and the cost grows with each extra wildcard); merge them, or ask the operator to put the row in READ_DENY_PATTERNS` };
+                return { ok: false, after: ` has a path segment with ${stars} "*" wildcards — at most ${MAX_READ_DENY_STARS_PER_SEGMENT} per segment are accepted in a request, each "*" counted; merge them, or ask the operator to put the row in READ_DENY_PATTERNS` };
             }
             return { ok: true, value: read.entry };
         },