@sema-agent/server 7.140.0 → 7.142.0

package/dist/observability/secret-env-scrub.js

@@ -1,5 +1,6 @@
 import { summarizeRedactions } from "@sema-agent/core";
 import { describeAllowlistPostures } from "../env-name-allowlist-knobs.js";
+import { createLogger } from "./logger.js";
 export const SECRET_ENV_SCRUB_SITES = {
     "server.remote-env-host.spawn-env": {
         note: "模型可驱动的 host shell 继承 env(`inheritEnv` 三词任一,缺省 `\"scrub\"`;`\"all\"` 词下扣的只有本服务自己的凭据名)——这条腿上的一次泄漏等于把编排器的脑钥/仓库令牌交给模型选的命令",
@@ -43,6 +44,7 @@ const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped
 const DISCLOSED_CAP = 512;
 const SEP = "=";
 let sink = {};
+let preInstallLogger;
 let counts = new Map();
 let pushed = new Map();
 let disclosed = new Set();
@@ -101,6 +103,18 @@ export function recordSecretEnvScrub(site, findings, allowed) {
     catch {
     }
 }
+const OWN_CREDENTIAL_VALUE_NOT_WITHHELD = "own_credential_value_not_withheld";
+function emitValueRefusal(logger, r) {
+    logger.warn(OWN_CREDENTIAL_VALUE_NOT_WITHHELD, { name: r.name, reason: r.reason });
+}
+export function recordOwnCredentialValueNotWithheld(refusal) {
+    try {
+        const logger = sink.logger ?? (preInstallLogger ??= createLogger("warn"));
+        emitValueRefusal(logger, refusal);
+    }
+    catch {
+    }
+}
 export function installSecretEnvScrubRecorder(deps) {
     sink = { ...deps };
     deps.metrics?.counter(SCRUB_COUNTER, SCRUB_COUNTER_HELP);

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -18,8 +18,8 @@ export interface WorkflowCompletionInboxEntry {
      *  is the deployment's job). `runId` then holds the core task_id (disjoint id spaces). */
     kind?: "workflow_complete" | "task_notification";
     /** The per-kind extras as a JSON text — bounded + redacted AT ENQUEUE (the store carries only egress-safe bytes).
-     *  `task_notification`: {task_type, toolUseId?, result?, output_file?, …}. `workflow_complete`: at most `{"completionId": …}`
-     *  (see {@link buildWorkflowCompleteInboxEntry}; absent when the engine minted none). The SQL stores' existing `payload`
+     *  `task_notification`: {task_type, toolUseId?, result?, output_file?, …}. `workflow_complete`: at most `{"completionId": …, "diagnostics": …}`
+     *  (see {@link buildWorkflowCompleteInboxEntry}; each key absent when the engine minted none). The SQL stores' existing `payload`
      *  column carries it verbatim for both kinds — no DDL. */
     payload?: string;
 }
@@ -203,6 +203,8 @@ export declare class FileWorkflowCompletionInbox extends InMemoryWorkflowComplet
 /**
  * 一次 workflow 完成 → 入箱条目(`workflow_complete` 家族;启动期投递闭包的**唯一**构造点)。`summary` 在 core 的 notifier seam 上已脱敏 + 限长,这里原样入箱;
  * `completionId`(引擎铸,`WorkflowCompletionPayload` 上在场 iff 引擎给了)逐字落进 `payload` 列 —— 同一次完成的补投帧与 live 帧同一个相关 id,本服务零自铸。
+ * `diagnostics`(引擎铸的诊断教学文本,在场 iff 引擎给了)是自由文本:**这里**过出口座(`inbox-diagnostics-text` 行 —— 与 live `task_notification.diagnostics` 同一个脱敏 scope,
+ * 加一条界)再落 `payload` 列,drain 逐字带出;店里不放未洗的字节。
  */
 export declare function buildWorkflowCompleteInboxEntry(route: {
     sessionId: string;
@@ -212,6 +214,7 @@ export declare function buildWorkflowCompleteInboxEntry(route: {
     status: "completed" | "failed";
     summary: string;
     completionId?: string;
+    diagnostics?: string;
 }, enqueuedAt: number): WorkflowCompletionInboxEntry;
 /**
  * P1 ①② delivery half, TWO-PHASE since 1.80: read the session's pending completions, emit

package/dist/orchestration/workflow-completion-inbox.js

@@ -1,6 +1,7 @@
 import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
+import { seatText } from "../trace/exit-seat.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
 import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
@@ -273,12 +274,19 @@ function readEntryExtras(payload) {
     }
     return typeof extras === "object" && extras !== null && !Array.isArray(extras) ? extras : {};
 }
-function encodeWorkflowCompleteExtras(completionId) {
-    return completionId ? { payload: JSON.stringify({ completionId }) } : {};
+function encodeWorkflowCompleteExtras(extras) {
+    const body = {
+        ...(extras.completionId ? { completionId: extras.completionId } : {}),
+        ...(extras.diagnostics ? { diagnostics: extras.diagnostics } : {}),
+    };
+    return Object.keys(body).length > 0 ? { payload: JSON.stringify(body) } : {};
 }
 function workflowCompleteFrameExtras(payload) {
-    const id = readEntryExtras(payload).completionId;
-    return typeof id === "string" && id !== "" ? { completionId: id } : {};
+    const { completionId, diagnostics } = readEntryExtras(payload);
+    return {
+        ...(typeof completionId === "string" && completionId !== "" ? { completionId } : {}),
+        ...(typeof diagnostics === "string" && diagnostics !== "" ? { diagnostics } : {}),
+    };
 }
 export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
     return {
@@ -288,7 +296,7 @@ export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
         status: p.status,
         summary: p.summary,
         enqueuedAt,
-        ...encodeWorkflowCompleteExtras(p.completionId),
+        ...encodeWorkflowCompleteExtras({ completionId: p.completionId, diagnostics: p.diagnostics ? seatText("inbox-diagnostics-text", p.diagnostics) : undefined }),
     };
 }
 export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPrincipal, emit, diag) {

package/dist/orchestration/workflow-notify-journal.d.ts

@@ -6,8 +6,10 @@ import { type WorkflowAgentSessionIndex } from "./workflow-agent-session-index.j
  * core 给 `WorkflowCompletionNotifier.notify` 的入参加一个键 ⇒ 这里编译红(缺一行),逼人对「它上不上这条链」表态;core 删 / 改名一个键 ⇒ 同样红(多一行)。
  *  · `carry`:搬运到投递(journal 门 → 收件箱 → `workflow_complete` 帧 / 账本行)。`runId` / `status` / `summary` 必带;其余可选键引擎没给(或空串)⇒ 载荷上缺席。
  *    `completionId` = 引擎的一次完成的相关 id(fill-once,终态转换上铸):逐字、不脱敏、本服务零自铸。
- *  · `drop`:这条持久链只搬运一句受限摘要 + 路由键 —— `task_id` / `task_type` / `toolUseId` 是 live `task_notification` 帧的键(那条路径自带),`result` / `usage` /
- *    `diagnostics` 是完整结果 / 计量 / 诊断路由(终态轮询 `TaskOutput` / `WorkflowStatus` 读得到),不进补投帧。
+ *    `diagnostics` = 引擎在完成通知上铸的诊断教学文本(未完成 agent 的摘要行、完整记录的读取手柄、journal 坐标、续跑句):补投路径是它在原腿已不在(断线重连 / 重启)时唯一的去处,
+ *    所以搬运;它是自由文本,出门前在入箱处过出口座(见 `buildWorkflowCompleteInboxEntry`),载荷上仍是引擎值。**崩溃恢复臂不带**:`WorkflowRun` 行上没有这一位,本服务不编。
+ *  · `drop`:这条持久链只搬运一句受限摘要 + 诊断文本 + 路由键 —— `task_id` / `task_type` / `toolUseId` 是 live `task_notification` 帧的键(那条路径自带),`result` / `usage` 是完整结果 / 计量
+ *    (`WorkflowStatus` 读得到),不进补投帧。
  * 键名直呼 core 的入参型(型文本里就有 core 名)⇒ 读表的 literals 段收得到这些键。
  */
 export declare const WORKFLOW_NOTIFY_KEY_DISPOSITION: {
@@ -18,12 +20,12 @@ export declare const WORKFLOW_NOTIFY_KEY_DISPOSITION: {
     readonly principal: "carry";
     readonly originatingSessionId: "carry";
     readonly completionId: "carry";
+    readonly diagnostics: "carry";
     readonly task_id: "drop";
     readonly task_type: "drop";
     readonly toolUseId: "drop";
     readonly result: "drop";
     readonly usage: "drop";
-    readonly diagnostics: "drop";
 };
 type NotifyKeyDisposition = typeof WORKFLOW_NOTIFY_KEY_DISPOSITION;
 /** 处置表里 `carry` 的键。 */

package/dist/orchestration/workflow-notify-journal.js

@@ -13,12 +13,12 @@ export const WORKFLOW_NOTIFY_KEY_DISPOSITION = {
     principal: "carry",
     originatingSessionId: "carry",
     completionId: "carry",
+    diagnostics: "carry",
     task_id: "drop",
     task_type: "drop",
     toolUseId: "drop",
     result: "drop",
     usage: "drop",
-    diagnostics: "drop",
 };
 const SUMMARY_MAX = 500;
 export function recoverySummary(status, error) {
@@ -81,6 +81,7 @@ export class WorkflowNotifyGate {
                     ...(input.principal ? { principal: input.principal } : {}),
                     ...(input.originatingSessionId ? { originatingSessionId: input.originatingSessionId } : {}),
                     ...(input.completionId ? { completionId: input.completionId } : {}),
+                    ...(input.diagnostics ? { diagnostics: input.diagnostics } : {}),
                 }, input.scope ?? input.principal ?? "default");
             },
         };

package/dist/permission-mode-admission.d.ts

@@ -0,0 +1,68 @@
+/**
+ * **一个调用方交来的权限模式词,本部署收不收、收成什么** —— 唯一的受理判官(规则一处、三只属主各一处、序一处)。
+ *
+ * ## 一条规则,三只属主,本模块只排序
+ *  ① 本任务 settings 的 kill-switch 折叠(`task-settings.ts` `foldDisableAutoMode`:`disableAutoMode` 在 ⇒ `auto` 折 `default`);
+ *  ② 运维 `AUTONOMY` 的入口地板钳(`runtime-governance.ts` `entryPermissionMode` × `autonomyModeFloor`:`plan` 地板下比它松的词折成 `plan`);
+ *  ③ 托管姿态的写围栏拒(`hosted-posture.ts` `permissionModeWriteFaceRefusal`:开写面的词在托管形上 422 `request.host_posture_refused`)。
+ * ①② 是**入口一步**({@link entryStep}:改词、不拒),③ 是**托管一步**(只拒、不改词)。顺序承重的只有「② 在 ③ 之前」(地板把 bypass 钳成 plan 之后就不开写面,不拒);
+ * ① 只动 `auto`、③ 只看开写面的词,两者互不相交。
+ *
+ * ## 两口的调用形(同一组函数、同一个序;同一个词 × 同一份部署事实 × 同一份任务 settings ⇒ 同一个结果,钉 `test/run-permission-mode-admission.test.ts` 的两口表)
+ *  · 在飞 run 的切档口(`http/routes/run-permission-mode.ts`:`POST /v1/runs/:id/permission-mode` 的 `mode`,本任务 settings 读存储体)调整只判官 {@link admitPermissionModeWord}。
+ *  · 提交口(`POST /v1/tasks|/v1/tasks/stream|/v1/runs` 的词 = 顶层 `permissionMode` ?? bundle `settings.permissions.defaultMode`)把两步落在**上一版就在的两处**:
+ *    入口一步在受理门盖章({@link stampSubmissionEntryMode},`http/admission.ts`:值形门之后、装配之前 —— 首跑装配与 `buildCheckpointCtx` 读的都是盖过章的体);
+ *    托管一步是装配期那一处判(`boot/resolve-spec.ts`,对盖过章的词调同一只 ③;提交腿与续跑重放腿同经)。不把整只判官提前到受理门:那会让托管拒抢在
+ *    属主 / 会话 / 执行上下文与装配期其余值判之前答(拒序变了 —— 钉同一文件的拒序组)。续跑重放不再过 ②:地板是**入口**事实,热改只影响之后提交的任务。
+ *
+ * ## 为什么切档口必须经这只判官(而不是靠引擎的 deny 位)
+ * 引擎在根腿上只认两只模式拒位(`RuntimeCaps.bypassPermissions` / `RuntimeCaps.autoMode`,本仓由 center 与本地 kill-switch 写);上面三问
+ * 都不是引擎位 —— 根腿没有天花板座,托管姿态与任务 settings 都是逐提交的事实。切档口若不经这只判官,提交口在受理时拒过 / 折过的词
+ * 就能在 run 跑起来之后原样切进去。
+ *
+ * ## 答
+ *  · `refused` —— ③ 拒:状态 422、码 `request.host_posture_refused`、句子是属主的那一句;两口同码同句。
+ *  · `admitted` —— `requested`(调用方说的词,缺席 = 没说)、`admitted`(交给引擎的词)、`entry`(② 那一次求值的读数,盖章与地板通告只读它)、
+ *    `foldedBy`(本判官把词改了的那一站;没改 ⇒ 缺席。① ② 都改了 ⇒ `entry_floor`:落定的词是地板给的)。
+ */
+import type { PermissionMode } from "@sema-agent/core";
+import { type Autonomy, type EntryPermissionMode } from "./runtime-governance.js";
+import { HOST_POSTURE_REFUSED_CODE, type TaskWriteFaceInput } from "./hosted-posture.js";
+import { type ParsedTaskSettings } from "./task-settings.js";
+/** 本判官改词的站(闭集;wire 上切档回执的 `admission.foldedBy`)。引擎自己的折因词(`operator_deny` / `face_absent` / `inherited_ceiling`)在引擎回执里,不进这张表。 */
+export declare const PERMISSION_MODE_ADMISSION_FOLDS: readonly ["entry_floor", "disable_auto_mode"];
+export type PermissionModeAdmissionFold = (typeof PERMISSION_MODE_ADMISSION_FOLDS)[number];
+/** 判官读的事实:部署(活 config:`AUTONOMY` 地板 + 托管射程与天花板旋钮)与本任务的 settings(提交口 = 提交体的,切档口 = 存储体的)。 */
+export interface PermissionModeAdmissionFacts {
+    readonly deployment: TaskWriteFaceInput & {
+        readonly autonomy?: Autonomy | undefined;
+    };
+    readonly settings: ParsedTaskSettings | undefined;
+}
+export type PermissionModeAdmission = {
+    readonly kind: "refused";
+    readonly status: 422;
+    readonly code: typeof HOST_POSTURE_REFUSED_CODE;
+    readonly message: string;
+} | {
+    readonly kind: "admitted";
+    readonly requested: PermissionMode | undefined;
+    readonly admitted: PermissionMode | undefined;
+    readonly entry: EntryPermissionMode;
+    readonly foldedBy?: PermissionModeAdmissionFold;
+};
+/** 整只判官(入口一步 → 托管一步)—— 在飞 run 的切档口调它。 */
+export declare function admitPermissionModeWord(word: PermissionMode | undefined, facts: PermissionModeAdmissionFacts): PermissionModeAdmission;
+/**
+ * 提交口的入口一步(`http/admission.ts` 唯一调用;直调装配腿的测试夹具也调它 —— 少了这一步的体是部署上到不了的体):
+ * 体上的词(顶层 `permissionMode` ?? bundle `settings.permissions.defaultMode`)过 {@link entryStep},本任务的 settings = 体上那一份;
+ * 入口词盖进体(`task-settings.ts` `stampEntryPermissionMode`:地板在场时写顶层 `permissionMode`,缺席原物)。不拒 —— 托管一步在装配期判(见顶注「两口的调用形」)。
+ */
+export declare function stampSubmissionEntryMode<B extends {
+    permissionMode?: unknown;
+    settings?: unknown;
+}>(body: B, deployment: PermissionModeAdmissionFacts["deployment"]): {
+    readonly body: B;
+    readonly entry: EntryPermissionMode;
+};
+//# sourceMappingURL=permission-mode-admission.d.ts.map

package/dist/permission-mode-admission.js

@@ -0,0 +1,23 @@
+import { autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
+import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal } from "./hosted-posture.js";
+import { foldDisableAutoMode, parseTaskSettings, requestedPermissionMode, stampEntryPermissionMode } from "./task-settings.js";
+export const PERMISSION_MODE_ADMISSION_FOLDS = ["entry_floor", "disable_auto_mode"];
+function entryStep(word, facts) {
+    const folded = foldDisableAutoMode(word, facts.settings);
+    const entry = entryPermissionMode(folded, autonomyModeFloor(facts.deployment.autonomy));
+    const foldedBy = entry.clamped ? "entry_floor" : folded !== word ? "disable_auto_mode" : undefined;
+    return { entry, ...(foldedBy !== undefined ? { foldedBy } : {}) };
+}
+export function admitPermissionModeWord(word, facts) {
+    const { entry, foldedBy } = entryStep(word, facts);
+    const why = permissionModeWriteFaceRefusal(entry.effective, facts.deployment);
+    if (why !== undefined)
+        return { kind: "refused", status: 422, code: HOST_POSTURE_REFUSED_CODE, message: why };
+    return { kind: "admitted", requested: word, admitted: entry.effective, entry, ...(foldedBy !== undefined ? { foldedBy } : {}) };
+}
+export function stampSubmissionEntryMode(body, deployment) {
+    const settings = parseTaskSettings(body.settings).settings;
+    const { entry } = entryStep(requestedPermissionMode(body, settings), { deployment, settings });
+    return { body: stampEntryPermissionMode(body, entry), entry };
+}
+//# sourceMappingURL=permission-mode-admission.js.map

package/dist/permission-rule-list.d.ts

@@ -1,6 +1,6 @@
 /**
  * **规则表的唯一编译口** —— 一张工具名规则表(`ask` / `deny` 之一)编成一只 `ToolPolicy`。读者:请求腿的 `settings.permissions.{ask,deny}`
- * 两桶(`task-settings.ts` 的 `deriveSettingsPolicy`)。
+ * 两桶(`task-settings.ts` 的 `deriveSettingsPolicy`,每桶按根至多编两集,见文件尾 {@link ruleRootOf})。设置层条目的形与层 → 根表也住这里(文件尾一节)。
  *
  * 🔴 core 7.42.0 起策略只说 deny / ask:allow 规则有且只有引擎 allow 层的两个席位 —— 请求的 `settings.permissions.allow` 整份投
  * `TaskSpec.allowedTools`(`task-settings.ts` 的 `applyTaskSettings`),运维的 `APPROVAL_GRANT` 投 `RunnerDeps.allowedTools`
@@ -9,6 +9,7 @@
  * 为什么住在一只叶模块里(不留在 `task-settings.ts`):本模块只 import core 与契约包 settings-schema(纯叶),读者引它不成环。
  */
 import { type PathRuleBases, type PermissionRule, type PermissionRulePolicyOptions, type ToolPolicy } from "@sema-agent/core";
+import { type SettingsSource } from "@sema-agent/settings-schema";
 /** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的 deny / ask 两桶判形)读的也是这一个名字:core 的缺省帽是 256,
  *  不对齐的话第 257 条起编译当场抛,等于服务端自己收下的东西自己反悔。 */
 export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
@@ -21,13 +22,13 @@ export declare const MAX_PERMISSION_RULES_PER_LIST = 1000;
  * 交一只名册解析器会多出一种读法:目录没有的名字成 `unsupported.tool_unknown` —— 本仓自铸的工具(`repo_read_file(path:…)`)上一条编得出、真判的规则会在受理口被拒。
  */
 export declare function buildRuleListJudgeOptions(pathBases: PathRuleBases | undefined): Pick<PermissionRulePolicyOptions, "caps" | "pathBases">;
-/** A name-keyed rule-list ToolPolicy: a tool named by `names` gets `behavior` (`ask` tightens to an approval gate;
+/** A name-keyed rule-list ToolPolicy: a tool named by `rules` gets `behavior` (`ask` tightens to an approval gate;
  *  `deny` hard-blocks); every other tool is out of scope (`defaultAction: "allow"` = this policy has no opinion about
  *  anything it does not name — core 7.42.0: it states nothing and clears nothing). Composed deny-wins with the rest of
  *  the fold, so both only ever tighten.
  *
- *  `source` = 这张表**写在哪**(请求腿 `settings.permissions.<桶>`)。它盖进每条规则(core 的 deny / ask
- *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句也点名它;只是出处,
+ *  `source` = 这条规则**写在哪**(请求腿 `settings.permissions.<桶>`,带层条目再加层:`settings.permissions.ask, layer userSettings`)。它盖进每条规则(core 的 deny / ask
+ *  句里点名它:`flagged by permission rule "mcp__figma__*" (settings.permissions.ask)`),编不出来时的错误句点名桶;只是出处,
  *  不带任何优先级(层序在各自的折叠里)。
  *
  * 🔴 [ref] / core [ref] —— 本函数曾是 `new Set(askNames).has(req.toolName)` 的**逐字**比对,那是
@@ -74,6 +75,54 @@ export declare function buildRuleListJudgeOptions(pathBases: PathRuleBases | und
  *     排除在外),dist 亲读在案。审计归因改由 `matchedAskRule` + `source` 承担,后者比前者强:它还让 core 的 auto-mode 分类器
  *     **拒绝**替人清掉这条 ask(「运维写下的『每次问我』不是分类器的犹豫」),方向是收紧。
  */
-/** `behavior` = 这张表的态度 —— 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 加 / 减一种态度,这里与它同步、读者 tsc 上见到)。 */
-export declare function createRuleListPolicy(names: readonly string[], behavior: PermissionRule["behavior"], source: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+/** `behavior` = 这张表的态度 —— 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 加 / 减一种态度,这里与它同步、读者 tsc 上见到)。
+ *  `rules` = 这一集的规则,**每条自带出处**({@link SourcedRule}:请求自己写的纯串 = 桶坐标;带层条目 = 桶坐标 + 层,{@link ruleSourceOf});
+ *  `table` = 这一集出自哪只桶(只进编不出时的兜底句;逐条坐标由先跑的受理判 `rulePolicyBucketsRefusal` 给)。 */
+export declare function createRuleListPolicy(rules: readonly SourcedRule[], behavior: PermissionRule["behavior"], table: string, pathBases: PathRuleBases | undefined): ToolPolicy;
+/**
+ * deny / ask 桶的一个条目:**纯串** = 请求自己写的规则(今天的形,读在任务根);**带层条目** `{ rule, layer }` = 端从某个设置层读来的规则,`layer` 是
+ * 契约包 `SETTINGS_SOURCES` 的来源词(= 参照实现的设置来源词)。层只决定这条规则的 `/` 读在哪个根({@link layerRuleRoot}),**不决定准入档**
+ * (准入只由凭据推,`http/caller-trust.ts`):调用方自报任何层,挪动的只是它自己那条收紧读在哪,与它自己写 `//abs` 等价。
+ *
+ * 为什么是「条目带层」而不是一只新键:本版之前的每一个读者(回滚、滚动发布中的旧副本)对一只没见过的键是**静默忽略**(续跑重放走宽容层),
+ * 带层的收紧会整批消失;对一个不是串的条目则在桶门上 `bad_entry` —— 新提交 400、续跑 409,响亮拒。条数帽也因此仍是「一桶一张表」。
+ */
+export type RuleListEntry = string | LayeredRule;
+/** 带层条目(恰两键;受理判 {@link ruleListEntryOk})。 */
+export interface LayeredRule {
+    readonly rule: string;
+    readonly layer: SettingsSource;
+}
+/** 一条进编译口的规则与它的出处串(core 规则行逐条带 `source`,问 / 拒句点名它)。 */
+export interface SourcedRule {
+    readonly rule: string;
+    readonly source: string;
+}
+/** 一个条目合不合 deny / ask 桶的条目律:非空串;或恰 `rule`(非空串)+ `layer`(`SETTINGS_SOURCES` 里的词)两键的纯对象。别的形一律不合(多键、空串、未知层、数组、原型对象)。 */
+export declare function ruleListEntryOk(x: unknown): x is RuleListEntry;
+/** 条目的规则原文(纯串即它自己)。 */
+export declare function ruleTextOf(entry: RuleListEntry): string;
+/** 条目进编译口的出处串:纯串 = 桶坐标(今天的字面);带层 = 桶坐标 + 层(`settings.permissions.deny, layer userSettings`)。 */
+export declare function ruleSourceOf(table: string, entry: RuleListEntry): string;
+/** 规则的 `/` 读在哪个根(闭集,也是一桶里各集的编译序与判序):`task` = 任务根;`configuration` = 执行环境的配置根(`execution-config-root.ts`)。 */
+export declare const RULE_ROOTS: readonly ["task", "configuration"];
+export type RuleRoot = (typeof RULE_ROOTS)[number];
+/**
+ * 一个设置层的 `/` 读在哪个根 —— 参照实现(CC 2.1.309)的表照录(`cli309.js:258818` `zBt` → `:252700` `D8o` / `swn`:user 层 ⇒ 配置目录 `Le()`〔`:251921`〕;
+ * project / local / policy ⇒ 工作目录;flag ⇒ flag 文件的目录,内联 ⇒ 工作目录)。本服务的两处取舍:`flagSettings` 读任务根(flag 文件的目录是端那台机的事实,本服务手里没有;
+ * 要固定位置写 `//abs`);`foreignProjectSettings`(仓库里写给别的工具的项目文件)与项目层同根。契约包加一个来源词 ⇒ 这里编译红。
+ */
+export declare function layerRuleRoot(layer: SettingsSource): RuleRoot;
+/**
+ * 一个条目编进哪一集:**只有 `/` 随层变** —— 带层条目的层根是配置根 ∧ 这条规则要 `root`(core 的必需基分类 `ruleBasesNeeded`)⇒ `configuration`;
+ * 其余一律 `task`(纯串、别的层、`~/` / 相对形、`//abs` 与 subpath 这类分类为空的规则 —— 后者在 Windows 族上仍随声明的根选盘,必须留在今天那一集)。
+ * 文法读不出的串 ⇒ `task`(受理判在前面就拒它,这里不另说一句)。
+ *
+ * 为什么按根分集、不按层分集:共根各层给出逐字相同的锚,合一集判决不变;而一只声明了 `root` 却没声明 `cwd` 的集把相对形读在声明的根上(core
+ * `policyAnchors`)—— 「一层一集」在任务根读不出的腿(未登记工作目录的 host 腿、每一条沙箱腿)上会把 user 层的相对规则读到配置根下。配置根那一集只装要
+ * `root` 的规则,`cwd` 永远不被问。
+ */
+export declare function ruleRootOf(entry: RuleListEntry, behavior: PermissionRule["behavior"]): RuleRoot;
+/** 一桶的条目按根分集(受理判与编译读同一只:判的就是要编的那一集);集内保持原序。 */
+export declare function ruleSetsOf(entries: readonly RuleListEntry[], behavior: PermissionRule["behavior"]): Readonly<Record<RuleRoot, readonly RuleListEntry[]>>;
 //# sourceMappingURL=permission-rule-list.d.ts.map

package/dist/permission-rule-list.js

@@ -1,5 +1,5 @@
-import { createPermissionRulePolicy } from "@sema-agent/core";
-import { stripControlAndBidi } from "@sema-agent/settings-schema";
+import { createPermissionRulePolicy, parseRuleText, ruleBasesNeeded } from "@sema-agent/core";
+import { SETTINGS_SOURCES, stripControlAndBidi } from "@sema-agent/settings-schema";
 export const MAX_PERMISSION_RULES_PER_LIST = 1_000;
 export function buildRuleListJudgeOptions(pathBases) {
     return {
@@ -7,13 +7,60 @@ export function buildRuleListJudgeOptions(pathBases) {
         ...(pathBases !== undefined ? { pathBases } : {}),
     };
 }
-export function createRuleListPolicy(names, behavior, source, pathBases) {
+export function createRuleListPolicy(rules, behavior, table, pathBases) {
     try {
-        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source })), { defaultAction: "allow", ...buildRuleListJudgeOptions(pathBases) });
+        return createPermissionRulePolicy(rules.map(({ rule, source }) => ({ rule, behavior, source })), { defaultAction: "allow", ...buildRuleListJudgeOptions(pathBases) });
     }
     catch (e) {
         const coreMsg = stripControlAndBidi(e instanceof Error ? e.message : String(e));
-        throw new Error(`${source.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+        throw new Error(`${table.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
+const SETTINGS_SOURCE_SET = new Set(SETTINGS_SOURCES);
+export function ruleListEntryOk(x) {
+    if (typeof x === "string")
+        return x.length > 0;
+    if (x === null || typeof x !== "object" || Array.isArray(x) || Object.getPrototypeOf(x) !== Object.prototype)
+        return false;
+    const keys = Object.keys(x);
+    if (keys.length !== 2 || !Object.hasOwn(x, "rule") || !Object.hasOwn(x, "layer"))
+        return false;
+    const { rule, layer } = x;
+    return typeof rule === "string" && rule.length > 0 && typeof layer === "string" && SETTINGS_SOURCE_SET.has(layer);
+}
+export function ruleTextOf(entry) {
+    return typeof entry === "string" ? entry : entry.rule;
+}
+export function ruleSourceOf(table, entry) {
+    return typeof entry === "string" ? table : `${table}, layer ${entry.layer}`;
+}
+export const RULE_ROOTS = ["task", "configuration"];
+export function layerRuleRoot(layer) {
+    switch (layer) {
+        case "userSettings":
+            return "configuration";
+        case "projectSettings":
+        case "localSettings":
+        case "flagSettings":
+        case "policySettings":
+        case "foreignProjectSettings":
+            return "task";
+        default: {
+            const unhandled = layer;
+            return unhandled;
+        }
+    }
+}
+export function ruleRootOf(entry, behavior) {
+    if (typeof entry === "string" || layerRuleRoot(entry.layer) === "task")
+        return "task";
+    const parsed = parseRuleText(entry.rule, behavior);
+    return "rule" in parsed && ruleBasesNeeded(parsed.rule).includes("root") ? "configuration" : "task";
+}
+export function ruleSetsOf(entries, behavior) {
+    const sets = { task: [], configuration: [] };
+    for (const entry of entries)
+        sets[ruleRootOf(entry, behavior)].push(entry);
+    return sets;
+}
 //# sourceMappingURL=permission-rule-list.js.map

package/dist/plugins/approval-ask-store-file.d.ts

@@ -126,6 +126,10 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     private replayRejectedCount;
     /** 重放期被丢弃的坏行数(撕尾不计:那是本格式存在的理由,由 {@link corruptQuarantinePath} 单独说)。 */
     private corruptLineCount;
+    /** 本次启动重放到的 v1 信封记录数(随 M34;{@link upgradeJournalEnvelope} 的读数)。 */
+    private journalV1Records;
+    /** 盘上还有 v1 信封记录(随 M34):重放到 v1 记录时置位,任何一次压实(整本重写成 v2)清位 —— 已被压实过的账本不再为升级重写第二次。 */
+    private journalV1OnDisk;
     /** 本次启动隔离出去的原件路径(无坏字节 ⇒ `undefined`)。 */
     readonly corruptQuarantinePath: string | undefined;
     /**
@@ -179,8 +183,8 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
      * 🔴 [ref] —— **出域的一次决议不落账本**。作用域的属主维(`owner`,判据 {@link askRowCarriesOwner})不在记录上:行此刻不带着门判过的那位属主
      * ⇒ 内核上这一笔必输、零写(读钟也在判定之后,不开账本窗)⇒ 没有要重放的东西,直调内核拿它的输者答案(与留存两动词「空的一次不落」同一条先例)。
      * 判定、落账、内核调用都在同一个同步前缀里,其间行不可能换属主。于是**落了账的每一条决议都在域内**,重放按行自己的属主喂属主维
-     * ({@link FileApprovalAskStore.replayOp})—— 记录形一个字节不变:升级前写下的账本、升级后写下的账本、降级回老版本时老读者读新账本,三者同读,
-     * 零迁移、零双读。
+     * ({@link FileApprovalAskStore.replayOp})—— 决议记录的形一个字节不变(没有属主格):升级前写下的决议记录与升级后写下的同读,零迁移、零双读
+     * (整本账的信封号另算 —— 见顶注「信封版本」)。
      */
     decideAsk(askId: string, batchId: string, owner: string | null, decision: DecideAskInput): Promise<DecideResult>;
     claimTerminal(askId: string, batchId: string, intent: AskTerminalClaimIntent, opts?: AskTerminalClaimOpts): Promise<AskTerminalClaimOutcome>;
@@ -208,14 +212,20 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
         corruptLines: number;
         records: number;
     };
-    /** 释放追加 fd(`LocalBackend.close` → 优雅重启重开)。不包 try/catch 的理由同
-     *  {@link FileApprovalNonceStore.dispose}:core 的 `AppendLog.close()` 自己就是全函数。 */
+    /**
+     * 问行成因两列的 local 腿(一次性迁移 M34,窗口见 `plugins/one-time-migrations.ts` 登记表;`LocalBackend.runOneTimeMigrations` 调):本次启动重放到的 v1 信封记录
+     * 已由读侧半场按意义译进内存({@link translateJournalV1Record}),这里**一次压实**把整本账重写成 v2 快照(压实 = 既有整本原子重写)。返回 v1 记录数;没有 ⇒ 零写、0。
+     * 本次启动里账本已被别的压实整本重写过(撕尾 / 坏行收拢、M32 的车道回填)⇒ 盘上已无 v1,不再重写,读数照报。
+     */
+    upgradeJournalEnvelope(): number;
     /**
      * 执行放置切换 ④b 的 local 腿(一次性迁移登记表 M32;`LocalBackend.runOneTimeMigrations` 在任何读者之前调):升级前写下的问(日志 `ensureAsk` 记录行 /
      * 压实快照行没有 `executionLane`)记成本部署车道表的唯一项,然后**一次压实**把整本账重写成带车道的快照(压实 = 既有整本原子重写)。
      * 没有缺车道的行 ⇒ 零写。车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸),一个字节没写。
      */
     backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (pending: number) => never): number;
+    /** 释放追加 fd(`LocalBackend.close` → 优雅重启重开)。不包 try/catch 的理由同
+     *  {@link FileApprovalNonceStore.dispose}:core 的 `AppendLog.close()` 自己就是全函数。 */
     dispose(): void;
 }
 export {};

package/dist/plugins/approval-ask-store-file.js

@@ -30,6 +30,29 @@ const JOURNAL_OP_WORDS = new Set(JOURNAL_OPS);
 export const JOURNAL_OP_TABLE_GATE = true;
 const JOURNAL_V1_CLAIM_INTENTS = ["expire", "cancel"];
 const JOURNAL_V1_CLAIM_INTENT_WORDS = new Set(JOURNAL_V1_CLAIM_INTENTS);
+const JOURNAL_ENVELOPE = 2;
+const JOURNAL_V1_ENVELOPE = 1;
+const V1_ENDING_STATES = new Set(["VOID", "DENIED"]);
+const V1_TRIGGER_STATES = new Set(["PARKING", "PARKED"]);
+function translateJournalV1Record(raw, refuse) {
+    const rec = raw;
+    if (rec.k === "ask" && rec.row !== null && typeof rec.row === "object") {
+        const { deniedReason, ...row } = rec.row;
+        const cause = typeof deniedReason === "string" ? deniedReason : null;
+        if (cause !== null && row.state === "STREAM_PENDING") {
+            refuse(`an envelope-1 snapshot row in STREAM_PENDING carries the single cause field ${JSON.stringify(cause)} — no released server wrote that shape and it has no two-column reading`);
+        }
+        return { ...raw, row: { ...row, endingCause: V1_ENDING_STATES.has(row.state) ? cause : null, parkTrigger: V1_TRIGGER_STATES.has(row.state) ? cause : null } };
+    }
+    if (rec.k === "op" && (rec.op === "transitionAsk" || rec.op === "resolveProvisional") && rec.patch !== null && typeof rec.patch === "object" && "deniedReason" in rec.patch) {
+        const { deniedReason, ...patch } = rec.patch;
+        if (!V1_ENDING_STATES.has(rec.to) || (typeof deniedReason !== "string" && deniedReason !== null)) {
+            refuse(`an envelope-1 ${String(rec.op)} record sets the single cause field on a transition to ${JSON.stringify(rec.to)} with ${JSON.stringify(deniedReason)} — no released server wrote that shape and it has no two-column reading`);
+        }
+        return { ...raw, patch: { ...patch, endingCause: deniedReason } };
+    }
+    return raw;
+}
 const ASK_JOURNAL_SHAPE = {
     what: "approval-ask journal record",
     read: (record) => record,
@@ -57,6 +80,8 @@ export class FileApprovalAskStore {
     pinnedNow = null;
     replayRejectedCount = 0;
     corruptLineCount = 0;
+    journalV1Records = 0;
+    journalV1OnDisk = false;
     corruptQuarantinePath;
     constructor(root) {
         const dir = join(root, APPROVAL_ASK_DIR);
@@ -95,7 +120,7 @@ export class FileApprovalAskStore {
     }
     write(call, run) {
         const t = Date.now();
-        const record = { v: 1, k: "op", t, ...call };
+        const record = { v: JOURNAL_ENVELOPE, k: "op", t, ...call };
         const encoded = encodeStoreJsonPayload(`${call.op} call`, record);
         this.logFor().append(encoded, true);
         this.records += 1;
@@ -125,22 +150,29 @@ export class FileApprovalAskStore {
     }
     compact(snapshot = this.core.exportRows()) {
         const lines = [
-            ...snapshot.batches.map((row) => `${JSON.stringify({ v: 1, k: "batch", row })}\n`),
-            ...snapshot.asks.map((row) => `${JSON.stringify({ v: 1, k: "ask", row })}\n`),
+            ...snapshot.batches.map((row) => `${JSON.stringify({ v: JOURNAL_ENVELOPE, k: "batch", row })}\n`),
+            ...snapshot.asks.map((row) => `${JSON.stringify({ v: JOURNAL_ENVELOPE, k: "ask", row })}\n`),
         ];
         this.log?.closeForSwap();
         atomicWriteFile(this.tmpDir, this.path, lines.join(""));
+        this.journalV1OnDisk = false;
         this.records = lines.length;
     }
-    replayRecord(raw) {
-        const probe = raw;
+    replayRecord(disk) {
+        const head = disk;
         const refuse = (why) => {
             throw new StoreBootRefusalError(`FileApprovalAskStore: approval ask journal ${this.path} carries a record this build cannot replay — ${why} ` +
-                `(v=${JSON.stringify(probe.v)} k=${JSON.stringify(probe.k)} op=${JSON.stringify(probe.op)}). ` +
+                `(v=${JSON.stringify(head.v)} k=${JSON.stringify(head.k)} op=${JSON.stringify(head.op)}). ` +
                 "Replaying only the records it understands would resurrect decided asks or drop a human's approval. " +
                 "Run the server version that wrote this journal, or move the file aside (every approval on it is abandoned) to continue.");
         };
-        if (probe.v !== 1)
+        if (head.v === JOURNAL_V1_ENVELOPE) {
+            this.journalV1Records += 1;
+            this.journalV1OnDisk = true;
+        }
+        const raw = head.v === JOURNAL_V1_ENVELOPE ? translateJournalV1Record(disk, refuse) : disk;
+        const probe = raw;
+        if (probe.v !== JOURNAL_ENVELOPE && probe.v !== JOURNAL_V1_ENVELOPE)
             refuse("unknown envelope version");
         if (probe.k === "ask" || probe.k === "batch") {
             const row = probe.row;
@@ -296,6 +328,15 @@ export class FileApprovalAskStore {
     replayStats() {
         return { rejected: this.replayRejectedCount, corruptLines: this.corruptLineCount, records: this.records };
     }
+    upgradeJournalEnvelope() {
+        const upgraded = this.journalV1Records;
+        if (upgraded === 0)
+            return 0;
+        if (this.journalV1OnDisk)
+            this.compact();
+        this.journalV1Records = 0;
+        return upgraded;
+    }
     backfillExecutionLanes(lanes, refuse) {
         const pending = this.core.exportRows().asks.filter((r) => !isExecutionLane(String(r.executionLane ?? ""))).length;
         if (pending === 0)

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -101,7 +101,8 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
      * 单调性论证)。
      */
     claimTerminal(askId: string, batchId: string, intent: AskTerminalClaimIntent, opts?: AskTerminalClaimOpts): Promise<AskTerminalClaimOutcome>;
-    /** `cause`(可选)= 转 park 的触发成因,赢下 PARKING 的同一步落进 `deniedReason`(SQL twin 同一条 UPDATE 的镜像;接口上的 `expireAsk` 不带它,只有 `claimTerminal(expire, { cause })` 带)。 */
+    /** `cause`(可选)= 转 park 的触发成因,赢下 PARKING 的同一步落进 `parkTrigger`(SQL twin 同一条 UPDATE 的镜像;接口上的 `expireAsk` 不带它,只有 `claimTerminal(expire, { cause })` 带)——
+     *  `parkTrigger` 的唯一写点:此后的转移(补丁里没有这一键)不再碰它。 */
     expireAsk(askId: string, batchId: string, cause?: AskTerminalClaimOpts["cause"]): Promise<ExpireResult>;
     bindBatch(batchId: string, askId: string, gate: BindGateInput): Promise<BindResult>;
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;