@sema-agent/server 7.140.0 → 7.141.0

package/dist/observability/run-terminal.js

@@ -3,7 +3,7 @@ import { redactSecrets } from "../trace/redact.js";
 import { isProviderEchoShape } from "@sema-agent/core";
 import { isModelTextLedgerEventType, isParkLedgerEventType } from "../trace/ledger-events.js";
 import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
-import { sealResultForExit } from "../terminal.js";
+import { mapPauseSeats, PAUSE_SEATS, sealResultForExit } from "../terminal.js";
 import { errorText } from "./err-text.js";
 import { recordFailOpen } from "./fail-open.js";
 import { toolEndMediaAsDescriptors } from "../trace/tool-output-media.js";
@@ -295,8 +295,11 @@ const PROVIDER_ECHO_SHAPERS = {
 }
 const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
 export const TREATED_RESULT_LEAVES = [
-    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t !== "verbatim").map(([k]) => k),
-    ...LEGACY_RESULT_LEAVES,
+    ...new Set([
+        ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t !== "verbatim").map(([k]) => k),
+        ...LEGACY_RESULT_LEAVES,
+        ...PAUSE_SEATS.map((seat) => seat.path[0]),
+    ]),
 ];
 export function redactTerminalResult(result) {
     if (result === undefined || result === null)
@@ -333,24 +336,8 @@ export function redactTerminalResult(result) {
             if (shaped !== detail)
                 nt = { ...cur, detail: shaped };
         }
-        const gateOf = (cause) => {
-            if (cause === null || typeof cause !== "object" || !("gate" in cause))
-                return undefined;
-            const g = cause.gate;
-            const ng = redactCheckpointGate(g);
-            return { gate: ng, changed: ng !== g };
-        };
         const base = nt ?? t;
-        if (t.kind === "paused") {
-            const g = gateOf(base);
-            if (g?.changed === true)
-                nt = { ...base, gate: g.gate };
-        }
-        else if (t.kind === "failed") {
-            const np = base.nestedPause;
-            const g = gateOf(np);
-            if (g?.changed === true)
-                nt = { ...base, nestedPause: { ...np, gate: g.gate } };
+        if (t.kind === "failed") {
             const cur = nt ?? base;
             const detail = cur.detail;
             const shaped = shapeTerminalFailureDetail(detail);
@@ -362,6 +349,17 @@ export function redactTerminalResult(result) {
             changed = true;
         }
     }
+    const gated = mapPauseSeats(out, (seat, keys) => {
+        if (!Object.hasOwn(seat, keys.gate))
+            return seat;
+        const g = seat[keys.gate];
+        const ng = redactCheckpointGate(g);
+        return ng === g ? seat : { ...seat, [keys.gate]: ng };
+    });
+    if (gated !== out) {
+        Object.assign(out, gated);
+        changed = true;
+    }
     if (r.remoteEnvFailures !== undefined) {
         out.remoteEnvFailures = Array.isArray(r.remoteEnvFailures)
             ? r.remoteEnvFailures.map((f) => (f && typeof f === "object" && typeof f.message === "string" ? { ...f, message: redactErrorMessage(f.message) } : f))
@@ -429,8 +427,8 @@ export function redactTerminalResult(result) {
     }
     return changed ? out : result;
 }
-export function sealRunRowResult(result) {
-    return result === null ? null : redactTerminalResult(sealResultForExit(result));
+export function sealRunRowResult(result, readSeat) {
+    return result === null ? null : redactTerminalResult(sealResultForExit(result, readSeat));
 }
 export function redactLedgerEventData(type, data) {
     if (data === null || typeof data !== "object" || Array.isArray(data))
@@ -439,7 +437,7 @@ export function redactLedgerEventData(type, data) {
         const result = data.result;
         if (result === null || typeof result !== "object")
             return data;
-        return { ...data, result: redactTerminalResult(result) };
+        return { ...data, result: sealRunRowResult(result) };
     }
     if (type === "failed") {
         const msg = data.errorMessage;
@@ -896,9 +894,10 @@ export function memoRedactedRead(seat, raw, redact) {
     }
     return out;
 }
-export function memoRedactTerminalResult(seat, result) {
-    if (result === undefined || result === null)
-        return result;
+export function memoRedactTerminalResult(seat, raw) {
+    if (raw === undefined || raw === null)
+        return raw;
+    const result = sealResultForExit(raw, seat);
     const r = result;
     if (TREATED_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;

package/dist/observability/secret-env-scrub.d.ts

@@ -31,9 +31,16 @@
  * git 腿是自由函数 / 闭包)。7.103.0 起各腿不再直接调本函数 —— 只经 `server-secret-env.ts` 的唯一组合 `hostSubprocessEnv`。
  * 装配层用 {@link installSecretEnvScrubRecorder} 把句柄接上,装配之前命中的次数不会丢(计数照常累加,
  * install 时一次性补进 metrics),披露行则在下一次命中时补发(未成功披露的 key 不进 `disclosed` 集)。
+ *
+ * ## 同族的第二件:自有凭据**值**没被引擎收下的点名({@link recordOwnCredentialValueNotWithheld})
+ * 起服第一步(三个进程入口在任何 logger 之前)把本进程自有凭据名与值交给引擎声明;引擎判「这不是一个凭据值」的那一个不扣、名照扣、不拒启,
+ * 需要一条运维看得见的行。它与上面的披露同一类东西(子进程 env 保护「没有按预期生效」的留痕),所以住同一个座:同一只 logger 句柄、同一条「装配之前不丢」纪律。
+ * 这一件的做法比披露行更简单:logger 已接上 ⇒ 走它;还没接上(起服第一步)⇒ **当拍**经一只进程默认的 JSON 行日志器(与进程入口自己建的日志器同一实现、同一行形)写 stderr ——
+ * 不缓冲、不补发:缓冲会在「接上 logger 之前就致命退出」的起服路径上把这一行吞掉(修前的裸 `console.warn` 当拍就出),而当拍写没有这一形。
+ * 判官只在引擎一处 —— 本座只转述引擎的拒句,不判。
  */
 import { type SecretEnvFinding } from "@sema-agent/core";
-import type { Logger } from "./logger.js";
+import { type Logger } from "./logger.js";
 import type { Metrics } from "./metrics.js";
 /**
  * 一个剥除现场的登记:`note` = 这条腿上泄漏意味着什么;`remedy` = 部署方能不能自己把某个被剥的键放回来。
@@ -92,6 +99,13 @@ interface Sink {
     logger?: Logger;
     metrics?: Metrics;
 }
+/** 自有凭据值没被引擎收下的一次点名(引擎的拒句从不回显值,本件也不带值)。 */
+export interface OwnCredentialValueRefusal {
+    /** 持有这个值的变量名。 */
+    readonly name: string;
+    /** 引擎拒这个值的原句(引擎是「什么不算凭据值」的唯一判官;本仓只转述)。 */
+    readonly reason: string;
+}
 /**
  * 记一次剥除。**总不抛** —— 观测本身绝不能变成故障(同 `recordFailOpen` / reapers 的判据)。
  * `findings` 为空(这一次没丢任何 key)时什么也不做:那不是事件,是常态。
@@ -99,6 +113,11 @@ interface Sink {
  * `allowed` = 这一次生效的点名放行名单([ref]),只在有出路的现场(`remedy` 在场)写进披露行;没有放行面的腿传 `[]`。
  */
 export declare function recordSecretEnvScrub(site: SecretEnvScrubSite, findings: readonly SecretEnvFinding[], allowed: readonly string[]): void;
+/**
+ * 记一次「自有凭据值没被引擎收下」(`declareServerWithheldEnv` 值臂,引擎拒句原文进 `reason`)。**总不抛**(观测绝不能变成故障)。
+ * 一条 `warn` 结构化行,**当拍**写:logger 已接上 ⇒ 走它;还没接上(起服第一步)⇒ 走进程默认的 JSON 行日志器(同一行形,stderr)。
+ */
+export declare function recordOwnCredentialValueNotWithheld(refusal: OwnCredentialValueRefusal): void;
 /** 装配层把 logger/metrics 接上(main.ts,与 `installFailOpenRecorder` 同一处)。装配前累计的次数在此补进 metrics。 */
 export declare function installSecretEnvScrubRecorder(deps: Sink): void;
 /** 已留驻的「现场×键」条数(测试/诊断读面)。恒 ≤ {@link DISCLOSED_CAP}。 */

package/dist/observability/secret-env-scrub.js

@@ -1,5 +1,6 @@
 import { summarizeRedactions } from "@sema-agent/core";
 import { describeAllowlistPostures } from "../env-name-allowlist-knobs.js";
+import { createLogger } from "./logger.js";
 export const SECRET_ENV_SCRUB_SITES = {
     "server.remote-env-host.spawn-env": {
         note: "模型可驱动的 host shell 继承 env(`inheritEnv` 三词任一,缺省 `\"scrub\"`;`\"all\"` 词下扣的只有本服务自己的凭据名)——这条腿上的一次泄漏等于把编排器的脑钥/仓库令牌交给模型选的命令",
@@ -43,6 +44,7 @@ const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped
 const DISCLOSED_CAP = 512;
 const SEP = "=";
 let sink = {};
+let preInstallLogger;
 let counts = new Map();
 let pushed = new Map();
 let disclosed = new Set();
@@ -101,6 +103,18 @@ export function recordSecretEnvScrub(site, findings, allowed) {
     catch {
     }
 }
+const OWN_CREDENTIAL_VALUE_NOT_WITHHELD = "own_credential_value_not_withheld";
+function emitValueRefusal(logger, r) {
+    logger.warn(OWN_CREDENTIAL_VALUE_NOT_WITHHELD, { name: r.name, reason: r.reason });
+}
+export function recordOwnCredentialValueNotWithheld(refusal) {
+    try {
+        const logger = sink.logger ?? (preInstallLogger ??= createLogger("warn"));
+        emitValueRefusal(logger, refusal);
+    }
+    catch {
+    }
+}
 export function installSecretEnvScrubRecorder(deps) {
     sink = { ...deps };
     deps.metrics?.counter(SCRUB_COUNTER, SCRUB_COUNTER_HELP);

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -18,8 +18,8 @@ export interface WorkflowCompletionInboxEntry {
      *  is the deployment's job). `runId` then holds the core task_id (disjoint id spaces). */
     kind?: "workflow_complete" | "task_notification";
     /** The per-kind extras as a JSON text — bounded + redacted AT ENQUEUE (the store carries only egress-safe bytes).
-     *  `task_notification`: {task_type, toolUseId?, result?, output_file?, …}. `workflow_complete`: at most `{"completionId": …}`
-     *  (see {@link buildWorkflowCompleteInboxEntry}; absent when the engine minted none). The SQL stores' existing `payload`
+     *  `task_notification`: {task_type, toolUseId?, result?, output_file?, …}. `workflow_complete`: at most `{"completionId": …, "diagnostics": …}`
+     *  (see {@link buildWorkflowCompleteInboxEntry}; each key absent when the engine minted none). The SQL stores' existing `payload`
      *  column carries it verbatim for both kinds — no DDL. */
     payload?: string;
 }
@@ -203,6 +203,8 @@ export declare class FileWorkflowCompletionInbox extends InMemoryWorkflowComplet
 /**
  * 一次 workflow 完成 → 入箱条目(`workflow_complete` 家族;启动期投递闭包的**唯一**构造点)。`summary` 在 core 的 notifier seam 上已脱敏 + 限长,这里原样入箱;
  * `completionId`(引擎铸,`WorkflowCompletionPayload` 上在场 iff 引擎给了)逐字落进 `payload` 列 —— 同一次完成的补投帧与 live 帧同一个相关 id,本服务零自铸。
+ * `diagnostics`(引擎铸的诊断教学文本,在场 iff 引擎给了)是自由文本:**这里**过出口座(`inbox-diagnostics-text` 行 —— 与 live `task_notification.diagnostics` 同一个脱敏 scope,
+ * 加一条界)再落 `payload` 列,drain 逐字带出;店里不放未洗的字节。
  */
 export declare function buildWorkflowCompleteInboxEntry(route: {
     sessionId: string;
@@ -212,6 +214,7 @@ export declare function buildWorkflowCompleteInboxEntry(route: {
     status: "completed" | "failed";
     summary: string;
     completionId?: string;
+    diagnostics?: string;
 }, enqueuedAt: number): WorkflowCompletionInboxEntry;
 /**
  * P1 ①② delivery half, TWO-PHASE since 1.80: read the session's pending completions, emit

package/dist/orchestration/workflow-completion-inbox.js

@@ -1,6 +1,7 @@
 import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
+import { seatText } from "../trace/exit-seat.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
 import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
@@ -273,12 +274,19 @@ function readEntryExtras(payload) {
     }
     return typeof extras === "object" && extras !== null && !Array.isArray(extras) ? extras : {};
 }
-function encodeWorkflowCompleteExtras(completionId) {
-    return completionId ? { payload: JSON.stringify({ completionId }) } : {};
+function encodeWorkflowCompleteExtras(extras) {
+    const body = {
+        ...(extras.completionId ? { completionId: extras.completionId } : {}),
+        ...(extras.diagnostics ? { diagnostics: extras.diagnostics } : {}),
+    };
+    return Object.keys(body).length > 0 ? { payload: JSON.stringify(body) } : {};
 }
 function workflowCompleteFrameExtras(payload) {
-    const id = readEntryExtras(payload).completionId;
-    return typeof id === "string" && id !== "" ? { completionId: id } : {};
+    const { completionId, diagnostics } = readEntryExtras(payload);
+    return {
+        ...(typeof completionId === "string" && completionId !== "" ? { completionId } : {}),
+        ...(typeof diagnostics === "string" && diagnostics !== "" ? { diagnostics } : {}),
+    };
 }
 export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
     return {
@@ -288,7 +296,7 @@ export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
         status: p.status,
         summary: p.summary,
         enqueuedAt,
-        ...encodeWorkflowCompleteExtras(p.completionId),
+        ...encodeWorkflowCompleteExtras({ completionId: p.completionId, diagnostics: p.diagnostics ? seatText("inbox-diagnostics-text", p.diagnostics) : undefined }),
     };
 }
 export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPrincipal, emit, diag) {

package/dist/orchestration/workflow-notify-journal.d.ts

@@ -6,8 +6,10 @@ import { type WorkflowAgentSessionIndex } from "./workflow-agent-session-index.j
  * core 给 `WorkflowCompletionNotifier.notify` 的入参加一个键 ⇒ 这里编译红(缺一行),逼人对「它上不上这条链」表态;core 删 / 改名一个键 ⇒ 同样红(多一行)。
  *  · `carry`:搬运到投递(journal 门 → 收件箱 → `workflow_complete` 帧 / 账本行)。`runId` / `status` / `summary` 必带;其余可选键引擎没给(或空串)⇒ 载荷上缺席。
  *    `completionId` = 引擎的一次完成的相关 id(fill-once,终态转换上铸):逐字、不脱敏、本服务零自铸。
- *  · `drop`:这条持久链只搬运一句受限摘要 + 路由键 —— `task_id` / `task_type` / `toolUseId` 是 live `task_notification` 帧的键(那条路径自带),`result` / `usage` /
- *    `diagnostics` 是完整结果 / 计量 / 诊断路由(终态轮询 `TaskOutput` / `WorkflowStatus` 读得到),不进补投帧。
+ *    `diagnostics` = 引擎在完成通知上铸的诊断教学文本(未完成 agent 的摘要行、完整记录的读取手柄、journal 坐标、续跑句):补投路径是它在原腿已不在(断线重连 / 重启)时唯一的去处,
+ *    所以搬运;它是自由文本,出门前在入箱处过出口座(见 `buildWorkflowCompleteInboxEntry`),载荷上仍是引擎值。**崩溃恢复臂不带**:`WorkflowRun` 行上没有这一位,本服务不编。
+ *  · `drop`:这条持久链只搬运一句受限摘要 + 诊断文本 + 路由键 —— `task_id` / `task_type` / `toolUseId` 是 live `task_notification` 帧的键(那条路径自带),`result` / `usage` 是完整结果 / 计量
+ *    (`WorkflowStatus` 读得到),不进补投帧。
  * 键名直呼 core 的入参型(型文本里就有 core 名)⇒ 读表的 literals 段收得到这些键。
  */
 export declare const WORKFLOW_NOTIFY_KEY_DISPOSITION: {
@@ -18,12 +20,12 @@ export declare const WORKFLOW_NOTIFY_KEY_DISPOSITION: {
     readonly principal: "carry";
     readonly originatingSessionId: "carry";
     readonly completionId: "carry";
+    readonly diagnostics: "carry";
     readonly task_id: "drop";
     readonly task_type: "drop";
     readonly toolUseId: "drop";
     readonly result: "drop";
     readonly usage: "drop";
-    readonly diagnostics: "drop";
 };
 type NotifyKeyDisposition = typeof WORKFLOW_NOTIFY_KEY_DISPOSITION;
 /** 处置表里 `carry` 的键。 */

package/dist/orchestration/workflow-notify-journal.js

@@ -13,12 +13,12 @@ export const WORKFLOW_NOTIFY_KEY_DISPOSITION = {
     principal: "carry",
     originatingSessionId: "carry",
     completionId: "carry",
+    diagnostics: "carry",
     task_id: "drop",
     task_type: "drop",
     toolUseId: "drop",
     result: "drop",
     usage: "drop",
-    diagnostics: "drop",
 };
 const SUMMARY_MAX = 500;
 export function recoverySummary(status, error) {
@@ -81,6 +81,7 @@ export class WorkflowNotifyGate {
                     ...(input.principal ? { principal: input.principal } : {}),
                     ...(input.originatingSessionId ? { originatingSessionId: input.originatingSessionId } : {}),
                     ...(input.completionId ? { completionId: input.completionId } : {}),
+                    ...(input.diagnostics ? { diagnostics: input.diagnostics } : {}),
                 }, input.scope ?? input.principal ?? "default");
             },
         };

package/dist/permission-mode-admission.d.ts

@@ -0,0 +1,68 @@
+/**
+ * **一个调用方交来的权限模式词,本部署收不收、收成什么** —— 唯一的受理判官(规则一处、三只属主各一处、序一处)。
+ *
+ * ## 一条规则,三只属主,本模块只排序
+ *  ① 本任务 settings 的 kill-switch 折叠(`task-settings.ts` `foldDisableAutoMode`:`disableAutoMode` 在 ⇒ `auto` 折 `default`);
+ *  ② 运维 `AUTONOMY` 的入口地板钳(`runtime-governance.ts` `entryPermissionMode` × `autonomyModeFloor`:`plan` 地板下比它松的词折成 `plan`);
+ *  ③ 托管姿态的写围栏拒(`hosted-posture.ts` `permissionModeWriteFaceRefusal`:开写面的词在托管形上 422 `request.host_posture_refused`)。
+ * ①② 是**入口一步**({@link entryStep}:改词、不拒),③ 是**托管一步**(只拒、不改词)。顺序承重的只有「② 在 ③ 之前」(地板把 bypass 钳成 plan 之后就不开写面,不拒);
+ * ① 只动 `auto`、③ 只看开写面的词,两者互不相交。
+ *
+ * ## 两口的调用形(同一组函数、同一个序;同一个词 × 同一份部署事实 × 同一份任务 settings ⇒ 同一个结果,钉 `test/run-permission-mode-admission.test.ts` 的两口表)
+ *  · 在飞 run 的切档口(`http/routes/run-permission-mode.ts`:`POST /v1/runs/:id/permission-mode` 的 `mode`,本任务 settings 读存储体)调整只判官 {@link admitPermissionModeWord}。
+ *  · 提交口(`POST /v1/tasks|/v1/tasks/stream|/v1/runs` 的词 = 顶层 `permissionMode` ?? bundle `settings.permissions.defaultMode`)把两步落在**上一版就在的两处**:
+ *    入口一步在受理门盖章({@link stampSubmissionEntryMode},`http/admission.ts`:值形门之后、装配之前 —— 首跑装配与 `buildCheckpointCtx` 读的都是盖过章的体);
+ *    托管一步是装配期那一处判(`boot/resolve-spec.ts`,对盖过章的词调同一只 ③;提交腿与续跑重放腿同经)。不把整只判官提前到受理门:那会让托管拒抢在
+ *    属主 / 会话 / 执行上下文与装配期其余值判之前答(拒序变了 —— 钉同一文件的拒序组)。续跑重放不再过 ②:地板是**入口**事实,热改只影响之后提交的任务。
+ *
+ * ## 为什么切档口必须经这只判官(而不是靠引擎的 deny 位)
+ * 引擎在根腿上只认两只模式拒位(`RuntimeCaps.bypassPermissions` / `RuntimeCaps.autoMode`,本仓由 center 与本地 kill-switch 写);上面三问
+ * 都不是引擎位 —— 根腿没有天花板座,托管姿态与任务 settings 都是逐提交的事实。切档口若不经这只判官,提交口在受理时拒过 / 折过的词
+ * 就能在 run 跑起来之后原样切进去。
+ *
+ * ## 答
+ *  · `refused` —— ③ 拒:状态 422、码 `request.host_posture_refused`、句子是属主的那一句;两口同码同句。
+ *  · `admitted` —— `requested`(调用方说的词,缺席 = 没说)、`admitted`(交给引擎的词)、`entry`(② 那一次求值的读数,盖章与地板通告只读它)、
+ *    `foldedBy`(本判官把词改了的那一站;没改 ⇒ 缺席。① ② 都改了 ⇒ `entry_floor`:落定的词是地板给的)。
+ */
+import type { PermissionMode } from "@sema-agent/core";
+import { type Autonomy, type EntryPermissionMode } from "./runtime-governance.js";
+import { HOST_POSTURE_REFUSED_CODE, type TaskWriteFaceInput } from "./hosted-posture.js";
+import { type ParsedTaskSettings } from "./task-settings.js";
+/** 本判官改词的站(闭集;wire 上切档回执的 `admission.foldedBy`)。引擎自己的折因词(`operator_deny` / `face_absent` / `inherited_ceiling`)在引擎回执里,不进这张表。 */
+export declare const PERMISSION_MODE_ADMISSION_FOLDS: readonly ["entry_floor", "disable_auto_mode"];
+export type PermissionModeAdmissionFold = (typeof PERMISSION_MODE_ADMISSION_FOLDS)[number];
+/** 判官读的事实:部署(活 config:`AUTONOMY` 地板 + 托管射程与天花板旋钮)与本任务的 settings(提交口 = 提交体的,切档口 = 存储体的)。 */
+export interface PermissionModeAdmissionFacts {
+    readonly deployment: TaskWriteFaceInput & {
+        readonly autonomy?: Autonomy | undefined;
+    };
+    readonly settings: ParsedTaskSettings | undefined;
+}
+export type PermissionModeAdmission = {
+    readonly kind: "refused";
+    readonly status: 422;
+    readonly code: typeof HOST_POSTURE_REFUSED_CODE;
+    readonly message: string;
+} | {
+    readonly kind: "admitted";
+    readonly requested: PermissionMode | undefined;
+    readonly admitted: PermissionMode | undefined;
+    readonly entry: EntryPermissionMode;
+    readonly foldedBy?: PermissionModeAdmissionFold;
+};
+/** 整只判官(入口一步 → 托管一步)—— 在飞 run 的切档口调它。 */
+export declare function admitPermissionModeWord(word: PermissionMode | undefined, facts: PermissionModeAdmissionFacts): PermissionModeAdmission;
+/**
+ * 提交口的入口一步(`http/admission.ts` 唯一调用;直调装配腿的测试夹具也调它 —— 少了这一步的体是部署上到不了的体):
+ * 体上的词(顶层 `permissionMode` ?? bundle `settings.permissions.defaultMode`)过 {@link entryStep},本任务的 settings = 体上那一份;
+ * 入口词盖进体(`task-settings.ts` `stampEntryPermissionMode`:地板在场时写顶层 `permissionMode`,缺席原物)。不拒 —— 托管一步在装配期判(见顶注「两口的调用形」)。
+ */
+export declare function stampSubmissionEntryMode<B extends {
+    permissionMode?: unknown;
+    settings?: unknown;
+}>(body: B, deployment: PermissionModeAdmissionFacts["deployment"]): {
+    readonly body: B;
+    readonly entry: EntryPermissionMode;
+};
+//# sourceMappingURL=permission-mode-admission.d.ts.map

package/dist/permission-mode-admission.js

@@ -0,0 +1,23 @@
+import { autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
+import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal } from "./hosted-posture.js";
+import { foldDisableAutoMode, parseTaskSettings, requestedPermissionMode, stampEntryPermissionMode } from "./task-settings.js";
+export const PERMISSION_MODE_ADMISSION_FOLDS = ["entry_floor", "disable_auto_mode"];
+function entryStep(word, facts) {
+    const folded = foldDisableAutoMode(word, facts.settings);
+    const entry = entryPermissionMode(folded, autonomyModeFloor(facts.deployment.autonomy));
+    const foldedBy = entry.clamped ? "entry_floor" : folded !== word ? "disable_auto_mode" : undefined;
+    return { entry, ...(foldedBy !== undefined ? { foldedBy } : {}) };
+}
+export function admitPermissionModeWord(word, facts) {
+    const { entry, foldedBy } = entryStep(word, facts);
+    const why = permissionModeWriteFaceRefusal(entry.effective, facts.deployment);
+    if (why !== undefined)
+        return { kind: "refused", status: 422, code: HOST_POSTURE_REFUSED_CODE, message: why };
+    return { kind: "admitted", requested: word, admitted: entry.effective, entry, ...(foldedBy !== undefined ? { foldedBy } : {}) };
+}
+export function stampSubmissionEntryMode(body, deployment) {
+    const settings = parseTaskSettings(body.settings).settings;
+    const { entry } = entryStep(requestedPermissionMode(body, settings), { deployment, settings });
+    return { body: stampEntryPermissionMode(body, entry), entry };
+}
+//# sourceMappingURL=permission-mode-admission.js.map

package/dist/permission-rule-list.d.ts

@@ -1,6 +1,6 @@
 /**
  * **规则表的唯一编译口** —— 一张工具名规则表(`ask` / `deny` 之一)编成一只 `ToolPolicy`。读者:请求腿的 `settings.permissions.{ask,deny}`
- * 两桶(`task-settings.ts` 的 `deriveSettingsPolicy`)。
+ * 两桶(`task-settings.ts` 的 `deriveSettingsPolicy`,每桶按根至多编两集,见文件尾 {@link ruleRootOf})。设置层条目的形与层 → 根表也住这里(文件尾一节)。
  *
  * 🔴 core 7.42.0 起策略只说 deny / ask:allow 规则有且只有引擎 allow 层的两个席位 —— 请求的 `settings.permissions.allow` 整份投
  * `TaskSpec.allowedTools`(`task-settings.ts` 的 `applyTaskSettings`),运维的 `APPROVAL_GRANT` 投 `RunnerDeps.allowedTools`
@@ -9,6 +9,7 @@
  * 为什么住在一只叶模块里(不留在 `task-settings.ts`):本模块只 import core 与契约包 settings-schema(纯叶),读者引它不成环。
  */
 import { type PathRuleBases, type PermissionRule, type PermissionRulePolicyOptions, type ToolPolicy } from "@sema-agent/core";
+import { type SettingsSource } from "@sema-agent/settings-schema";
 /** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的 deny / ask 两桶判形)读的也是这一个名字:core 的缺省帽是 256,
  *  不对齐的话第 257 条起编译当场抛,等于服务端自己收下的东西自己反悔。 */
 export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
@@ -21,13 +22,13 @@ export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
  * 交一只名册解析器会多出一种读法:目录没有的名字成 `unsupported.tool_unknown` —— 本仓自铸的工具(`repo_read_file(path:…)`)上一条编得出、真判的规则会在受理口被拒。
  */
 export declare function buildRuleListJudgeOptions(pathBases: PathRuleBases | undefined): Pick<PermissionRulePolicyOptions, "caps" | "pathBases">;
-/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (`ask` tightens to an approval gate;
+/** A name-keyed rule-list ToolPolicy: a tool named by `rules` gets `behavior` (`ask` tightens to an approval gate;
  *  `deny` hard-blocks); every other tool is out of scope (`defaultAction: "allow"` = this policy has no opinion about
  *  anything it does not name — core 7.42.0: it states nothing and clears nothing). Composed deny-wins with the rest of
  *  the fold, so both only ever tighten.
  *
- *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`)。它盖进每条规则(core 的 deny / ask
- *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句也点名它;只是出处,
+ *  `source` = 这条规则**写在哪**(请求腿 `settings.permissions.<桶>`,带层条目再加层:`settings.permissions.ask, layer userSettings`)。它盖进每条规则(core 的 deny / ask
+ *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句点名桶;只是出处,
  *  不带任何优先级(层序在各自的折叠里)。
  *
  * 🔴 [ref] / core [ref] —— 本函数曾是 `new Set(askNames).has(req.toolName)` 的**逐字**比对,那是
@@ -74,6 +75,54 @@ export declare function buildRuleListJudgeOptions(pathBases: PathRuleBases | und
  *     排除在外),dist 亲读在案。审计归因改由 `matchedAskRule` + `source` 承担,后者比前者强:它还让 core 的 auto-mode 分类器
  *     **拒绝**替人清掉这条 ask(「运维写下的『每次问我』不是分类器的犹豫」),方向是收紧。
  */
-/** `behavior` = 这张表的态度 —— 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 加 / 减一种态度,这里与它同步、读者 tsc 上见到)。 */
-export declare function createRuleListPolicy(names: readonly string[], behavior: PermissionRule["behavior"], source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+/** `behavior` = 这张表的态度 —— 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 加 / 减一种态度,这里与它同步、读者 tsc 上见到)。
+ *  `rules` = 这一集的规则,**每条自带出处**({@link SourcedRule}:请求自己写的纯串 = 桶坐标;带层条目 = 桶坐标 + 层,{@link ruleSourceOf});
+ *  `table` = 这一集出自哪只桶(只进编不出时的兜底句;逐条坐标由先跑的受理判 `rulePolicyBucketsRefusal` 给)。 */
+export declare function createRuleListPolicy(rules: readonly SourcedRule[], behavior: PermissionRule["behavior"], table: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+/**
+ * deny / ask 桶的一个条目:**纯串** = 请求自己写的规则(今天的形,读在任务根);**带层条目** `{ rule, layer }` = 端从某个设置层读来的规则,`layer` 是
+ * 契约包 `SETTINGS_SOURCES` 的来源词(= 参照实现的设置来源词)。层只决定这条规则的 `/` 读在哪个根({@link layerRuleRoot}),**不决定准入档**
+ * (准入只由凭据推,`http/caller-trust.ts`):调用方自报任何层,挪动的只是它自己那条收紧读在哪,与它自己写 `//abs` 等价。
+ *
+ * 为什么是「条目带层」而不是一只新键:本版之前的每一个读者(回滚、滚动发布中的旧副本)对一只没见过的键是**静默忽略**(续跑重放走宽容层),
+ * 带层的收紧会整批消失;对一个不是串的条目则在桶门上 `bad_entry` —— 新提交 400、续跑 409,响亮拒。条数帽也因此仍是「一桶一张表」。
+ */
+export type RuleListEntry = string | LayeredRule;
+/** 带层条目(恰两键;受理判 {@link ruleListEntryOk})。 */
+export interface LayeredRule {
+    readonly rule: string;
+    readonly layer: SettingsSource;
+}
+/** 一条进编译口的规则与它的出处串(core 规则行逐条带 `source`,问 / 拒句点名它)。 */
+export interface SourcedRule {
+    readonly rule: string;
+    readonly source: string;
+}
+/** 一个条目合不合 deny / ask 桶的条目律:非空串;或恰 `rule`(非空串)+ `layer`(`SETTINGS_SOURCES` 里的词)两键的纯对象。别的形一律不合(多键、空串、未知层、数组、原型对象)。 */
+export declare function ruleListEntryOk(x: unknown): x is RuleListEntry;
+/** 条目的规则原文(纯串即它自己)。 */
+export declare function ruleTextOf(entry: RuleListEntry): string;
+/** 条目进编译口的出处串:纯串 = 桶坐标(今天的字面);带层 = 桶坐标 + 层(`settings.permissions.deny, layer userSettings`)。 */
+export declare function ruleSourceOf(table: string, entry: RuleListEntry): string;
+/** 规则的 `/` 读在哪个根(闭集,也是一桶里各集的编译序与判序):`task` = 任务根;`configuration` = 执行环境的配置根(`execution-config-root.ts`)。 */
+export declare const RULE_ROOTS: readonly ["task", "configuration"];
+export type RuleRoot = (typeof RULE_ROOTS)[number];
+/**
+ * 一个设置层的 `/` 读在哪个根 —— 参照实现(CC 2.1.309)的表照录(`cli309.js:258818` `zBt` → `:252700` `D8o` / `swn`:user 层 ⇒ 配置目录 `Le()`〔`:251921`〕;
+ * project / local / policy ⇒ 工作目录;flag ⇒ flag 文件的目录,内联 ⇒ 工作目录)。本服务的两处取舍:`flagSettings` 读任务根(flag 文件的目录是端那台机的事实,本服务手里没有;
+ * 要固定位置写 `//abs`);`foreignProjectSettings`(仓库里写给别的工具的项目文件)与项目层同根。契约包加一个来源词 ⇒ 这里编译红。
+ */
+export declare function layerRuleRoot(layer: SettingsSource): RuleRoot;
+/**
+ * 一个条目编进哪一集:**只有 `/` 随层变** —— 带层条目的层根是配置根 ∧ 这条规则要 `root`(core 的必需基分类 `ruleBasesNeeded`)⇒ `configuration`;
+ * 其余一律 `task`(纯串、别的层、`~/` / 相对形、`//abs` 与 subpath 这类分类为空的规则 —— 后者在 Windows 族上仍随声明的根选盘,必须留在今天那一集)。
+ * 文法读不出的串 ⇒ `task`(受理判在前面就拒它,这里不另说一句)。
+ *
+ * 为什么按根分集、不按层分集:共根各层给出逐字相同的锚,合一集判决不变;而一只声明了 `root` 却没声明 `cwd` 的集把相对形读在声明的根上(core
+ * `policyAnchors`)—— 「一层一集」在任务根读不出的腿(未登记工作目录的 host 腿、每一条沙箱腿)上会把 user 层的相对规则读到配置根下。配置根那一集只装要
+ * `root` 的规则,`cwd` 永远不被问。
+ */
+export declare function ruleRootOf(entry: RuleListEntry, behavior: PermissionRule["behavior"]): RuleRoot;
+/** 一桶的条目按根分集(受理判与编译读同一只:判的就是要编的那一集);集内保持原序。 */
+export declare function ruleSetsOf(entries: readonly RuleListEntry[], behavior: PermissionRule["behavior"]): Readonly<Record<RuleRoot, readonly RuleListEntry[]>>;
 //# sourceMappingURL=permission-rule-list.d.ts.map

package/dist/permission-rule-list.js

@@ -1,5 +1,5 @@
-import { createPermissionRulePolicy } from "@sema-agent/core";
-import { stripControlAndBidi } from "@sema-agent/settings-schema";
+import { createPermissionRulePolicy, parseRuleText, ruleBasesNeeded } from "@sema-agent/core";
+import { SETTINGS_SOURCES, stripControlAndBidi } from "@sema-agent/settings-schema";
 export const MAX_PERMISSION_RULES_PER_LIST = 1_000;
 export function buildRuleListJudgeOptions(pathBases) {
     return {
@@ -7,13 +7,60 @@ export function buildRuleListJudgeOptions(pathBases) {
         ...(pathBases !== undefined ? { pathBases } : {}),
     };
 }
-export function createRuleListPolicy(names, behavior, source, pathBases) {
+export function createRuleListPolicy(rules, behavior, table, pathBases) {
     try {
-        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source })), { defaultAction: "allow", ...buildRuleListJudgeOptions(pathBases) });
+        return createPermissionRulePolicy(rules.map(({ rule, source }) => ({ rule, behavior, source })), { defaultAction: "allow", ...buildRuleListJudgeOptions(pathBases) });
     }
     catch (e) {
         const coreMsg = stripControlAndBidi(e instanceof Error ? e.message : String(e));
-        throw new Error(`${source.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+        throw new Error(`${table.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
+const SETTINGS_SOURCE_SET = new Set(SETTINGS_SOURCES);
+export function ruleListEntryOk(x) {
+    if (typeof x === "string")
+        return x.length > 0;
+    if (x === null || typeof x !== "object" || Array.isArray(x) || Object.getPrototypeOf(x) !== Object.prototype)
+        return false;
+    const keys = Object.keys(x);
+    if (keys.length !== 2 || !Object.hasOwn(x, "rule") || !Object.hasOwn(x, "layer"))
+        return false;
+    const { rule, layer } = x;
+    return typeof rule === "string" && rule.length > 0 && typeof layer === "string" && SETTINGS_SOURCE_SET.has(layer);
+}
+export function ruleTextOf(entry) {
+    return typeof entry === "string" ? entry : entry.rule;
+}
+export function ruleSourceOf(table, entry) {
+    return typeof entry === "string" ? table : `${table}, layer ${entry.layer}`;
+}
+export const RULE_ROOTS = ["task", "configuration"];
+export function layerRuleRoot(layer) {
+    switch (layer) {
+        case "userSettings":
+            return "configuration";
+        case "projectSettings":
+        case "localSettings":
+        case "flagSettings":
+        case "policySettings":
+        case "foreignProjectSettings":
+            return "task";
+        default: {
+            const unhandled = layer;
+            return unhandled;
+        }
+    }
+}
+export function ruleRootOf(entry, behavior) {
+    if (typeof entry === "string" || layerRuleRoot(entry.layer) === "task")
+        return "task";
+    const parsed = parseRuleText(entry.rule, behavior);
+    return "rule" in parsed && ruleBasesNeeded(parsed.rule).includes("root") ? "configuration" : "task";
+}
+export function ruleSetsOf(entries, behavior) {
+    const sets = { task: [], configuration: [] };
+    for (const entry of entries)
+        sets[ruleRootOf(entry, behavior)].push(entry);
+    return sets;
+}
 //# sourceMappingURL=permission-rule-list.js.map

package/dist/plugins/caching-session-store.d.ts

@@ -142,6 +142,12 @@ export declare class CachingSessionStore implements SessionStore {
      * 只读快照而非 getter:声明是店的构造期常量(会变的声明本身就是缺陷)。
      */
     readonly placements?: SessionStore["placements"];
+    /**
+     * 内层店的**会话耐久声明**(core `SessionStore.durability`,说的是未 placed 的会话)转发 —— 与 {@link retention} / {@link placements} 同一族教训:
+     * 生产默认把真店包进本类,core 的接线清单(`wiring_manifest.session.store`)与停驻自检读的就是包装层;不转发 = 一只声明了 `durable` 的店在默认部署上
+     * 读成 `process_local`(core 对缺席的 fail-closed 读法),没有任何一处报错。只读快照;缺席则不设。
+     */
+    readonly durability?: SessionStore["durability"];
     /** [ref]:placed 分区的两只读面(reap 分区腿 / 准入探针)——同款转发理由:reaper 与准入判据拿到的
      *  是包装层,不转发 = 分区腿静默不可用、暖命中的 claim 关门静默失效。缺席则不设(诚实降级)。 */
     readonly listPlaced?: (kind: "subagent", opts?: {

package/dist/plugins/caching-session-store.js

@@ -33,6 +33,7 @@ export class CachingSessionStore {
     replaceEntries;
     retention;
     placements;
+    durability;
     listPlaced;
     placementOf;
     constructor(inner, opts) {
@@ -43,6 +44,8 @@ export class CachingSessionStore {
         const declared = inner.retention;
         if (declared !== undefined)
             this.retention = declared;
+        if (inner.durability !== undefined)
+            this.durability = inner.durability;
         if (inner.placements !== undefined)
             this.placements = inner.placements;
         if (typeof inner.listPlaced === "function")