@sema-agent/server 7.147.0 → 7.149.0

package/dist/request-form.js

@@ -0,0 +1,72 @@
+import { effectivePermissionMode, parseTaskSettings } from "./task-settings.js";
+import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal, taskInheritEnvRefusal } from "./hosted-posture.js";
+import { HttpError, createCodedHttpError, verifiedSubject } from "./security.js";
+import { inheritEnvFacts } from "./request-value-closure.js";
+import { inertToolListEntryOf } from "./rule-entry-list.js";
+import { ruleTablesRefusalWithoutTaskRoot } from "./http/stored-body-replay.js";
+import { assertRequestMcpEntries } from "./task-mcp.js";
+import { assertRequestA2aEntries, snapshotRequestA2a } from "./task-a2a.js";
+import { assertRequestImages } from "./request-images.js";
+import { partsOf } from "./owner-brands.js";
+export function scenarioRequestedBy(headerScenario, bodyScenario) {
+    if (headerScenario === undefined)
+        return bodyScenario;
+    if (bodyScenario !== undefined && bodyScenario !== headerScenario) {
+        throw createCodedHttpError(400, "scenario_conflict", `the request body names scenario ${JSON.stringify(String(bodyScenario))} but the x-agent-scenario header names ${JSON.stringify(headerScenario)} — send one scenario (the header alone selects both the partition and the scenario)`);
+    }
+    return headerScenario;
+}
+export function assertInheritEnvServed(body, config) {
+    if (body.inheritEnv !== "all")
+        return;
+    const lane = config.remoteExec.provider;
+    if (lane !== "host") {
+        throw new HttpError(400, `inheritEnv:"all" applies to the host lane only (this deployment runs ${lane}) — only the host lane builds the model-driven shell's environment from this machine's own, so the declaration has no effect here; omit it (or send "scrub", the default, which every lane accepts)`, { code: "request.field_invalid", extra: inheritEnvFacts("lane_not_host") });
+    }
+    const why = taskInheritEnvRefusal(config);
+    if (why !== undefined)
+        throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+}
+export function assertToolListsReadable(body, sides) {
+    const inert = inertToolListEntryOf(body, sides);
+    if (inert !== undefined)
+        throw new HttpError(400, inert.message, { code: inert.code, ...(inert.extra !== undefined ? { extra: { ...inert.extra } } : {}) });
+}
+export function assertAttachmentIdsShape(raw) {
+    if (raw === undefined)
+        return;
+    if (!Array.isArray(raw) || !raw.every((x) => typeof x === "string" && x.length > 0 && x.length <= 64)) {
+        throw new HttpError(400, "`attachmentIds` must be an array of attachment ids (strings)");
+    }
+    if (raw.length > 16)
+        throw new HttpError(400, "`attachmentIds` exceeds the per-task limit (16)");
+}
+export function assertWriteFaceAdmitted(mode, config) {
+    const why = permissionModeWriteFaceRefusal(mode, config);
+    if (why !== undefined)
+        throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
+}
+export function assertImageProfileLane(profile, config) {
+    if (profile !== undefined && config.remoteExec.provider !== "k8s") {
+        throw createCodedHttpError(501, "capability.k8s_lane_required", "sandboxImageProfile is only supported on the k8s sandbox backend");
+    }
+}
+export function bodyImageProfileOf(body) {
+    return typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 ? body.sandboxImageProfile : undefined;
+}
+export function assertRequestFormBeforeMint(body, req, config) {
+    const subject = verifiedSubject(req, config);
+    assertRequestMcpEntries(body.mcpServers);
+    assertInheritEnvServed(body, config);
+    assertToolListsReadable(body);
+    assertRequestA2aEntries(snapshotRequestA2a(body.a2aPeers, { reread: false }));
+    assertRequestImages(body.images);
+    scenarioRequestedBy(subject === undefined ? undefined : partsOf(subject).scenario, body.scenario);
+    assertAttachmentIdsShape(body.attachmentIds);
+    assertWriteFaceAdmitted(effectivePermissionMode(body, parseTaskSettings(body.settings).settings), config);
+    const ruleTables = ruleTablesRefusalWithoutTaskRoot(body, config);
+    if (ruleTables !== undefined)
+        throw new HttpError(422, ruleTables.message, { code: ruleTables.code, ...(ruleTables.extra !== undefined ? { extra: { ...ruleTables.extra } } : {}) });
+    assertImageProfileLane(bodyImageProfileOf(body), config);
+}
+//# sourceMappingURL=request-form.js.map

package/dist/request-image-urls.d.ts

@@ -1,6 +1,12 @@
-import { type UrlCredentialRefusal } from "./url-credential-refusal.js";
+import { type UrlCredentialFacts, type UrlCredentialRefusal } from "./url-credential-refusal.js";
+/** 本座的拒:URL 凭据座的整句 + 机读位,机读位另带 `index`(条目在 `images` 里的下标)—— 与 `request-declaration-refusal.ts` 骨架上条目级拒的 `index` 同一个键、同一个意思,一份 `images` 的所有条目级拒同形。 */
+export interface ImageUrlRefusal extends UrlCredentialRefusal {
+    readonly facts: UrlCredentialFacts & {
+        readonly index: number;
+    };
+}
 /** 请求体 `images` 的 URL 座:任一条目的串值 `url` 带凭据 ⇒ 拒(整句 + 机读位),列表序第一处即答;没有 ⇒ `undefined`。`images` 不是数组 / 缺席 ⇒ `undefined`(形归受理口别的门)。 */
-export declare function requestImageUrlRefusal(images: unknown): UrlCredentialRefusal | undefined;
+export declare function requestImageUrlRefusal(images: unknown): ImageUrlRefusal | undefined;
 /** fresh 提交腿的 `images` URL 门:{@link requestImageUrlRefusal} 有答案 ⇒ 同步 400(码 / 句 / 机读位原样)。 */
 export declare function assertRequestImageUrls(bodyImages: unknown): void;
 //# sourceMappingURL=request-image-urls.d.ts.map

package/dist/request-image-urls.js

@@ -15,7 +15,8 @@ export function requestImageUrlRefusal(images) {
         if (found === undefined)
             continue;
         const at = `images[${i}]`;
-        return buildRequestUrlCredentialRefusal(`${at}.url`, found, inlineImageExit(at));
+        const refusal = buildRequestUrlCredentialRefusal(`${at}.url`, found, inlineImageExit(at));
+        return { message: refusal.message, facts: { ...refusal.facts, index: i } };
     }
     return undefined;
 }

package/dist/request-images.d.ts

@@ -0,0 +1,20 @@
+import { type DeclarationRefusal } from "./request-declaration-refusal.js";
+/** 一次提交最多带几张图(条数帽;受理口的 `413 request.payload_too_large` 与本座骨架的撞帽拒读这一个数)。 */
+export declare const MAX_IMAGES_PER_REQUEST = 20;
+/** 内联字节臂的受理键(书写序即判序)。两道编译格对引擎的 `ImageInput`:引擎长出 / 退役一个键而本表没跟 ⇒ 红。 */
+export declare const IMAGE_INLINE_KEYS: readonly ["data", "mimeType"];
+/** URL 臂的受理键。同上两道编译格。 */
+export declare const IMAGE_URL_KEYS: readonly ["url"];
+/** 请求体 `images`「这份声明能不能原样交给引擎」的回答者(骨架同形):`undefined` = 能(或缺席 / `null` = 没带图)。 */
+export declare function requestImagesRefusal(images: unknown): DeclarationRefusal | undefined;
+/**
+ * fresh 提交腿的 `images` 门(`boot/resolve-spec.ts`):先形(骨架的拒,码 / 句 / `unknownKeys` / 机读位原样),后 URL 凭据座({@link assertRequestImageUrls})。
+ * 形坏的 `images` 走不到凭据座 —— 凭据座读的是形已判过的条目。
+ */
+export declare function assertRequestImages(bodyImages: unknown): void;
+/**
+ * 一条图片的内联字节(`data` 是串才有;条目不是对象 / 没有 `data` / 不是串 ⇒ `undefined`)。受理口的内联字节帽读它,**不自己摸条目**:帽排在形判之前,条目可能是 `null`。
+ * 条目形坏不是帽的事 —— 形判在后头答。
+ */
+export declare function inlineImageData(image: unknown): string | undefined;
+//# sourceMappingURL=request-images.d.ts.map

package/dist/request-images.js

@@ -0,0 +1,59 @@
+import { describeValueShape } from "@sema-agent/settings-schema";
+import { assertRequestImageUrls } from "./request-image-urls.js";
+import { MAX_KEY_ECHO, keyClosureClause, scanKeyNames } from "./request-key-closure.js";
+import { judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal } from "./request-declaration-refusal.js";
+export const MAX_IMAGES_PER_REQUEST = 20;
+export const IMAGE_INLINE_KEYS = ["data", "mimeType"];
+export const IMAGE_URL_KEYS = ["url"];
+const IMAGES_SEAT = {
+    list: "images",
+    cap: MAX_IMAGES_PER_REQUEST,
+    identify: () => "",
+    entryTail: "The request is refused rather than handing the engine an image it cannot read: an image that silently did not apply would leave the model answering without what you attached. " +
+        "Fix the entry (an image is either { data, mimeType } or { url }).",
+    declaration: "an image entry",
+    declarations: "image entries",
+};
+function mustBeString(key, what) {
+    return (entry) => (typeof entry[key] === "string" ? undefined : { path: key, reason: `must be a string (${what}) — got ${describeValueShape(entry[key])}` });
+}
+const INLINE_KEY_JUDGES = {
+    data: mustBeString("data", "the base64-encoded image bytes"),
+    mimeType: mustBeString("mimeType", 'an image MIME type such as "image/png"'),
+};
+const URL_KEY_JUDGES = {
+    url: mustBeString("url", "the URL the engine fetches the image from"),
+};
+const INLINE_KEY_SET = new Set(IMAGE_INLINE_KEYS);
+const URL_KEY_SET = new Set(IMAGE_URL_KEYS);
+const NO_TOLERATED_KEYS = new Set();
+function imageEntryRefusal(entry, at) {
+    const urlArm = "url" in entry;
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyNames(Object.keys(entry), `${at}.`, urlArm ? URL_KEY_SET : INLINE_KEY_SET, NO_TOLERATED_KEYS, buckets);
+    if (buckets.unknown.length > 0) {
+        const unknownKeys = buckets.unknown.sort();
+        return {
+            errorCode: "request.body_shape",
+            message: `body: unrecognized key(s) on an image entry — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
+                `${keyClosureClause(unknownKeys, `unknown (not a key of the ${urlArm ? "url" : "inline-bytes"} form — check the spelling; an image is either { data, mimeType } or { url }, never both)`)}. ` +
+                `Accepted: ${[...(urlArm ? IMAGE_URL_KEYS : IMAGE_INLINE_KEYS)].join(",")}`,
+            unknownKeys: unknownKeys.slice(0, MAX_KEY_ECHO),
+        };
+    }
+    return urlArm ? judgeDeclarationKeys(IMAGES_SEAT, entry, at, IMAGE_URL_KEYS, URL_KEY_JUDGES) : judgeDeclarationKeys(IMAGES_SEAT, entry, at, IMAGE_INLINE_KEYS, INLINE_KEY_JUDGES);
+}
+export function requestImagesRefusal(images) {
+    return requestDeclarationRefusal(IMAGES_SEAT, images, imageEntryRefusal);
+}
+export function assertRequestImages(bodyImages) {
+    throwDeclarationRefusal(requestImagesRefusal(bodyImages));
+    assertRequestImageUrls(bodyImages);
+}
+export function inlineImageData(image) {
+    if (image === null || typeof image !== "object")
+        return undefined;
+    const data = image.data;
+    return typeof data === "string" ? data : undefined;
+}
+//# sourceMappingURL=request-images.js.map

package/dist/request-key-closure.d.ts

@@ -46,7 +46,6 @@ export type NamedKeysOf<T> = {
 export declare function taskBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
 declare const RUN_STEER_BODY_KEYS: readonly ["mode", "priority", "text"];
 declare const CONTENT_STEER_BODY_KEYS: readonly ["content"];
-declare const INTERRUPT_STEER_BODY_KEYS: readonly ["text"];
 /** `POST /v1/runs/:id/steer` 的体形(键 = 受理集,值形由路由逐键判)。 */
 export type RunSteerBody = {
     readonly [K in (typeof RUN_STEER_BODY_KEYS)[number]]?: unknown;
@@ -55,14 +54,14 @@ export type RunSteerBody = {
 export type ContentSteerBody = {
     readonly [K in (typeof CONTENT_STEER_BODY_KEYS)[number]]?: unknown;
 };
-/** `POST /v1/runs/:id/interrupt` 带 text 形的体形。 */
-export type InterruptSteerBody = {
-    readonly [K in (typeof INTERRUPT_STEER_BODY_KEYS)[number]]?: unknown;
-};
-/** 送话口的体形(闭集;词外是编译错)。`interrupt` = `POST /v1/runs/:id/interrupt` 整扇门(bare 与带 `text` 两形同一张受理集)。 */
-export type SteerBodyForm = "run" | "content" | "interrupt";
+/** 送话口的体形(闭集;词外是编译错)。 */
+export type SteerBodyForm = "run" | "content";
 /** 送话口的顶层键裁决(各形同一只;`form` 选受理集)。 */
 export declare function steerBodyKeyIssue(raw: unknown, form: SteerBodyForm): KeyClosureIssue | null;
+/** halt 门的拒句(定长;对每一种非空体同一句)。 */
+export declare const HALT_BODY_REFUSAL: string;
+/** halt 门的体判:空体(`undefined` / `null` / 零键对象)⇒ `null`;其余 ⇒ 拒体(键全进 `unknownKeys`,封顶同 {@link MAX_KEY_ECHO})。 */
+export declare function haltBodyIssue(raw: unknown): KeyClosureIssue | null;
 declare const PRINCIPAL_INBOX_BODY_KEYS: readonly ["to", "content", "urgent"];
 /** 受理口的体形(键 = 受理集,值形由路由逐键判)。 */
 export type PrincipalInboxBody = {

package/dist/request-key-closure.js

@@ -68,11 +68,9 @@ export function taskBodyKeyIssue(raw) {
 }
 const RUN_STEER_BODY_KEYS = ["mode", "priority", "text"];
 const CONTENT_STEER_BODY_KEYS = ["content"];
-const INTERRUPT_STEER_BODY_KEYS = ["text"];
 const STEER_DOORS = {
     run: { accepted: new Set(RUN_STEER_BODY_KEYS), door: "a steer-request" },
     content: { accepted: new Set(CONTENT_STEER_BODY_KEYS), door: "a steer-request" },
-    interrupt: { accepted: new Set(INTERRUPT_STEER_BODY_KEYS), door: "an interrupt-request" },
 };
 const STEER_UNSUPPORTED = {
     keys: new Set([...UNSUPPORTED_BODY_KEYS, ...OBJECTIVE_ONLY_BODY_KEYS]),
@@ -81,6 +79,21 @@ const STEER_UNSUPPORTED = {
 export function steerBodyKeyIssue(raw, form) {
     return closedBodyKeyIssue(raw, STEER_DOORS[form].accepted, STEER_UNSUPPORTED, STEER_DOORS[form].door);
 }
+export const HALT_BODY_REFUSAL = "body must be empty (no body, {} or null): this door is halt — it cuts the in-flight turn and stops the run at that boundary — and takes no fields; " +
+    'to send the run a message, POST /v1/runs/:id/steer with priority:"now" (it cuts the in-flight turn first, then the run continues with that message)';
+const NO_FIELDS = new Set();
+export function haltBodyIssue(raw) {
+    if (raw === null || raw === undefined)
+        return null;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return { message: HALT_BODY_REFUSAL, unknownKeys: [], unsupportedKeys: [] };
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(raw, "", NO_FIELDS, NO_FIELDS, buckets);
+    if (buckets.unknown.length === 0)
+        return null;
+    buckets.unknown.sort();
+    return { message: HALT_BODY_REFUSAL, unknownKeys: buckets.unknown.slice(0, MAX_KEY_ECHO), unsupportedKeys: [] };
+}
 const PRINCIPAL_INBOX_BODY_KEYS = ["to", "content", "urgent"];
 const PRINCIPAL_INBOX_UNSUPPORTED = { keys: new Set(), label: "unsupported" };
 export function principalInboxBodyKeyIssue(raw) {

package/dist/resource-suspend.d.ts

@@ -5,28 +5,19 @@
  * task opts in, a budget/turns/walltime limit OR a scheduler preempt durably SUSPENDS the task (resumable via
  * `POST /v1/assistant/tasks/:id/resume`) instead of FAILING; absent ⇒ a limit still FAILS.
  *
- * 🔴 EXCLUDE cascade tasks. Core runs a cascade through `runCascade`, which maps a rung's durable suspend to a FAILED
- * result carrying the pause (`errorCode: "unexpected.suspended"`, 内层 status "needs_review" 时铸 `"unexpected.needs_review"`,
- * 停驻因由在 `terminal.nestedPause` —— 真源是 core `agents/suspend-guard.js` 的 `mapNestedSuspend`;`suspended.*` 三码是 bg
- * 子代/委派报告面的词,不落在这条 TaskResult 腿上). A rung's pause lands on the rung's own engine-minted session, which the
- * host-boundary judge (`atHostBoundary`, src/terminal.ts) leaves terminal: the service would `setTerminal(failed)` while core
- * had already minted a pending `resource_limit` checkpoint + suspended the remote VM — ORPHANING both (the run row is
- * terminal, so nothing resumes them). A resource-limit hit on a cascade task must FAIL CLEANLY (no suspend).
- * (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended VM + checkpoint on every
- * cascade task that hits a resource limit.) The arm is the judge's session cell seen from the opt-in side: the day the engine
- * lets a rung's pause land on a session the host's resume chain reaches (core [ref]), the judge's answer flips and this arm goes.
- * Every other task — a verify task included — opts in alike. A verify task's implementation leg and fix rounds run on the
- * run's own session, so the judge lifts their pause into a park of the run row (resumable through
- * `POST /v1/assistant/tasks/:id/resume`); the verifier's own leg is built by the engine without an opt-in, so a limit there
- * still fails that leg.
+ * Every task opts in alike — plain, verify and cascade. A limit hit inside a composition comes back to the host as a nested
+ * pause (`failed.nestedPause`, core `mapNestedSuspend`), which the host-boundary judge (`atHostBoundary`, src/terminal.ts) lifts
+ * into a park of the run row: the card is filed under the run's session (`checkpoint.host_session_id` — a verify task's
+ * implementation leg and fix rounds run on that session; a cascade rung's card records its composition leg, whose host
+ * session is the run's), so `POST /v1/assistant/tasks/:id/resume` finds it from the run and continues it through the same
+ * composition entry the run was submitted with (`resumeWithVerification` / `resumeCascade`). The verifier's own leg is built by
+ * the engine without an opt-in, so a limit there still fails that leg.
  */
 export declare function resourceSuspendOptIn(opts: {
     /** `RESOURCE_SUSPEND=true` (the worker-level switch). */
     enabled: boolean;
     /** `RESOURCE_SUSPEND_TTL_SEC` — 0 ⇒ core default (30d) by omitting `ttlMs`. */
     ttlSec: number;
-    /** This task requested the cascade ladder (`body.cascade === true`). */
-    isCascade: boolean;
     /** Multi-tenant isolation key — the SAME key durableApproval uses (the principal; "_" when auth is off). */
     scope: string;
     /** [ref] S-3:`RESOURCE_SUSPEND_TOTAL_TOKENS`(跨片 token 总额)。0/缺省 ⇒ 不铸键。 */

package/dist/resource-suspend.js

@@ -1,5 +1,5 @@
 export function resourceSuspendOptIn(opts) {
-    if (!opts.enabled || opts.isCascade)
+    if (!opts.enabled)
         return undefined;
     return {
         scope: opts.scope,

package/dist/retired-name-host-notice.d.ts

@@ -0,0 +1,21 @@
+/**
+ * core 7.66.0 [ref]([ref] 加注 1 ③)—— 请求体 `settings.permissions.neverAuto`(只有本服务读的限制表:命中的工具恒问真人;引擎不读这张表,
+ * 它编成的策略不带名单投影,引擎的名字审计看不到)上**退役且无后继**的工具名:这一行不拒、原样留着,**读这张表的本服务说那一句** ——
+ * 用户面通告 `config.legacy_tool_name`,句子与 detail 是**引擎的账**(`retiredToolNameAccount`,`detail.layer` = `host_table`,每条 `source` = 这张表的体内坐标),
+ * 本服务只在 `detail` 上加归属键 `sessionId`(core 的话:the host mints its own notice … with `sessionId` added to `detail`)。本文件是这一形的**唯一**铸点。
+ *
+ * ## 判据与句子都不在本仓
+ * 哪几行算(退役且无后继、名册里没有它的另一种大小写)= 引擎的账({@link retiredLeftOutAccount},唯一读法);句子 = 账的 `message`,逐字;
+ * 有后继的改名、无前缀短名、铸不出的对端段不在账里,照旧 422(`task-settings.ts` 的 `neverAutoNamesRefusal`,同一只判官)。
+ *
+ * ## 投递 / 去重
+ * 调用点 = `boot/resolve-spec.ts` 里请求设置编成策略之后(那张表在这一刻被读);经装配期通告口(`opts.onNotice`)收进这一腿的待投通告,
+ * 与请求腿 MCP 丢弃一族同一条投递路(白名单 / 归属 / 消毒 / 隔离一个不绕;`detail.entries[].entry` 走规则文本脱敏表 `RULE_TEXT_DETAIL_FIELDS`)。
+ * 去重单位 = **每次装配一条**(引擎自己的表是 once per audited layer per prepared task,同一个单位)。会话 id 缺席 ⇒ 不铸(无处可投,宁缺不串)。
+ * 铸者:码在 core 码册里的铸者行是 `"engine"`(引擎自己的三张表铸它);本仓这一铸是 core [ref] 为宿主自有表开的同码同句同形(铸者宿主),
+ * 铸者表一行表达不了「引擎 + 宿主」两铸,见本版收车档未闭环。
+ */
+import type { EngineNotice } from "@sema-agent/core";
+/** 一次装配读到的 `neverAuto` 表 → 至多一条通告(读法见文件头)。表的 `field` = `ask`(这张表要的是「问真人」,core 的推荐形)。 */
+export declare function buildNeverAutoRetiredNotice(names: readonly string[] | undefined, sessionId: string | undefined): EngineNotice | undefined;
+//# sourceMappingURL=retired-name-host-notice.d.ts.map

package/dist/retired-name-host-notice.js

@@ -0,0 +1,12 @@
+import { retiredLeftOutAccount } from "./namespaced-rule-name.js";
+import { tightenOnlySeatField } from "./tighten-only-seats.js";
+const LEGACY_TOOL_NAME = "config.legacy_tool_name";
+export function buildNeverAutoRetiredNotice(names, sessionId) {
+    if (names === undefined || names.length === 0 || sessionId === undefined || sessionId.length === 0)
+        return undefined;
+    const account = retiredLeftOutAccount("ask", tightenOnlySeatField("neverAuto"), names);
+    if (account === undefined)
+        return undefined;
+    return { code: LEGACY_TOOL_NAME, message: account.message, detail: { ...account.detail, sessionId } };
+}
+//# sourceMappingURL=retired-name-host-notice.js.map

package/dist/rule-entry-list.d.ts

@@ -17,7 +17,7 @@
  *     **名册只有一张**({@link TOOL_NAME_ROSTER}:引擎目录 ∪ 本仓自铸的工具名),每一处读条目名的地方都传它 —— 请求体的规则表(`settings.permissions.*`)、技能清单、选择器清单、
  *     运维 / 中心的审批名单读同一份,没有「这一处空名册、那一处带名册」的两种读法。
  *     **读成空的哪些原因词是拒面,按方向定**:**限制侧**(读成空 = 静默放行:技能 `disallowedTools`、`excludeTools` / 子代 `denyTools`、`settings.permissions.deny` / `ask`、运维 / 中心的审批名单)四类全拒 ——
- *     近似名 · 退役名 · 文法读不出 · 不带内容形的工具带内容;**放行侧**(读成空 = 想放的什么也没放:`settings.permissions.allow`、根 / 子代 `allowTools`、技能 `allowedTools`)**只拒近似名**
+ *     近似名 · 退役名 · 文法读不出 · 不带内容形的工具带内容(退役名里**无后继**的那一种除外:引擎保留并通告 `config.legacy_tool_name`,判据 = 引擎的账,core 7.65.0 [ref] / 7.66.0 [ref] / [ref]);**放行侧**(读成空 = 想放的什么也没放:`settings.permissions.allow`、根 / 子代 `allowTools`、技能 `allowedTools`)**只拒近似名**
  *     ({@link allowSideReadsAsNothing}):近似名现名唯一、确定是笔误;退役名 / 内容形 / 文法读不出 / 协议名对端段通配照 7.130.0 受理、交引擎既有通告(其中选择器清单 `allowTools` 里**有后继**的退役名〔`Task` ⇒ `Agent`、`bash` ⇒ `Bash`〕core 7.52.0 起由引擎开跑前拒,不在本仓拒面;规则表上的退役名引擎照旧告运维 ——
  *     壳转投的 CC 用户 settings 里这些极常见,尤其内容形里的 `$VAR`(`Bash(echo $HOME)`)读成 `grammar`,拒了 = 每次提交 400)。运维的 `APPROVAL_GRANT` 是运维自己的配置:任何读成空都拒启(写错了当场改)。
  *     技能拒侧那一拒与引擎 [ref](core 7.43.0:那只技能不激活)是同一件事的两处 —— 7.118.0 重估过、本版**不退**:本仓的续跑腿把引擎的
@@ -29,7 +29,7 @@
  *     选择器读一条条目 = 引擎 `judgeToolNameList` 的读法({@link selectorEntryName}):先取工具名那一段再只判名字(限制侧 `Tool(content)` ⇒ 整只工具,内容里写什么都不读;放行侧内容形引擎告「什么也不授」,受理口不拒);
  *     `*` 在放行侧是「本层不设名单」、在限制侧是整名 glob(引擎文法 5,7.137.0 起;此前读成空、受理口拒);限制侧整个协议的名字 `mcp__*` / `mcp__*__*` / `a2a__*` 合法 —— 那是引擎条目读法的读数(core 7.55.0 [ref]:
  *     `compileAllowList(…, "deny", 名册)` 把它们读成这一协议的每一只工具),本仓不另写豁免。
- *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `detail.problems`,{@link inertToolListEntryOf} 铸);
+ *  ⑤ **机读位**:拒体的码与句子是第一处命中的清单的(句子冻结),体另带这一遍判下来的**全部**读成空的条目(`entry-problems.ts` 的 `problems`,在拒体根上;{@link inertToolListEntryOf} 铸);
  *     放行侧选择器清单里受理口没拒、却什么也不放的条目随受理应答的 `warnings` 交回({@link allowSelectorWarningsOf})—— 两处读同一次条目读法({@link selectorReadings}),不另判。
  */
 import type { TightenOnlySeatField } from "./tighten-only-seats.js";

package/dist/rule-entry-list.js

@@ -1,7 +1,7 @@
 import { PROTOCOL_TABLE, compileAllowList, parsePermissionRule } from "@sema-agent/core";
 import { displayListEntry } from "./list-entry-display.js";
 import { limitRefusal } from "./limit-refusal.js";
-import { TOOL_NAME_ROSTER } from "./namespaced-rule-name.js";
+import { TOOL_NAME_ROSTER, isRetiredLeftOut } from "./namespaced-rule-name.js";
 import { NOT_IN_ROSTER, entryProblem, entryProblemsFacts } from "./entry-problems.js";
 import { layeredRuleOk } from "./permission-rule-list.js";
 export const ruleEntryListShapeOk = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
@@ -107,9 +107,8 @@ function requestAllowRuleInertEntriesOf(list) {
 }
 function inertEntriesOfList(list, layer) {
     const face = TOOL_LIST_FACES[layer];
-    if (face.kind === "selector")
-        return selectorInertEntriesOf(list, face.side);
-    return face.side === "deny" ? inertRuleEntriesOf(list, "deny") : requestAllowRuleInertEntriesOf(list);
+    const inert = face.kind === "selector" ? selectorInertEntriesOf(list, face.side) : face.side === "deny" ? inertRuleEntriesOf(list, "deny") : requestAllowRuleInertEntriesOf(list);
+    return face.side === "deny" ? inert.filter((i) => !isRetiredLeftOut(i.entry)) : inert;
 }
 function* toolListsOf(body) {
     const skills = body["skills"];

package/dist/rule-issue-reading.d.ts

@@ -0,0 +1,58 @@
+/**
+ * **本仓怎样读 core 规则编译器的拒句** —— 一只判官({@link deploymentRuleRefusal})、一张受众表({@link RULE_ISSUE_AUDIENCE})。
+ *
+ * core 的每条规则拒句({@link PermissionRuleIssue})分两层说话:
+ *  · `message`(与 `code` / `rule`)写给**写规则的人** —— 这一条错在哪、该怎么改;
+ *  · `libraryOption` 写给**宿主程序** —— 这条拒句涉及的库坐标:编译调用的构造选项(`primaryFieldGeneric: "allow-lexical"`、`caps.*`、`pathBases.*`、`defaultAction`、`ruleFaces`)、
+ *    允许表的座位(`TaskSpec.allowedTools` / `RunnerDeps.allowedTools`)、MCP 服务器声明里的 `toolAxes`。
+ * core 的契约(`PermissionRuleIssue.libraryOption`)逐字:**句子从不点名那一位**;暴露这些坐标的宿主自己渲染它,别的宿主只给句子。
+ *
+ * 本仓是「别的宿主」,读法只有一条:**部署面的句子 = `code` + core 的句,`libraryOption` 不渲染**。理由分两种,都是读码得来的:
+ *  · 坐标是本仓装配编译调用时自己选 / 自己推的(`caps` / `pathBases`,见 `buildRuleListJudgeOptions`;`primaryFieldGeneric` 本仓零设点)—— 写规则的人没有旋钮,渲染它 = 一条够不着的出路;
+ *  · 坐标在部署上有够得着的面(请求的 / 运维的允许表、MCP 服务器声明里的 `toolAxes`)—— core 的句子已经用人的话说了那个面(「the request's allow list, or the deployment's」、「declared per tool in the MCP server's spec」),
+ *    再渲染库的拼写(`TaskSpec.allowedTools`)只是把库的字段名摆到给人看的句子里。
+ *
+ * ── 怎么保证只有一条读法 ─────────────────────────────────────────────────────────────────────
+ *  · {@link RULE_ISSUE_AUDIENCE} 给拒句的**每一位**定受众,`satisfies Record<keyof PermissionRuleIssue, …>`:core 多一位 / 少一位 ⇒ 这里 tsc 红,先决定那一位面向谁,
+ *    不会悄悄落成「没人读它」或「谁都渲染它」。返回型 {@link PersonFacingRuleIssue} 由这张表**推出来**(每一位面向人的位都必填,可选位也一样),判官里逐位挑,多挑 / 漏挑一位 ⇒ tsc 红。
+ *  · 判官**不在运行期扫句子**:那是对 core 句子的第二套判。core 把库坐标写回句子里,是 core 契约的回归 —— 由 `test/rule-issue-reading.test.ts` 的 pickup 钉在提货时红
+ *    (真 core 规则编译器铸得出的每一种坐标各一格;坐标名单是类型联合上的穷尽表,core 多一种坐标 ⇒ 那张表 tsc 红)。
+ *  · 读拒句的口只有 `config.ts` 的预判口 `uncompilableRuleGuidance` 一个(名表 / 规则表的各条受理腿 —— env 审批名单、中心下发的审批名单、请求体 `settings.permissions.deny` / `ask`、
+ *    存体重放 —— 都经它);源码钉保证 `validatePermissionRules` 与 `libraryOption` 不在别处出现。编译口 `createRuleListPolicy` 只转 core 抛出的整句(`[码] 规则: 句`,同样只有面向人的位)。
+ *
+ * 范围(如实):本模块只管**规则编译器的拒句**。core 的其它出路话(无头审批的 `headlessApprovalRemedy` 句子与 `remedies`、`delegation.ask_unresolvable` 通告)是别的契约、别的读法
+ * —— core 把那句子标为面向用户、`remedies` 标为宿主自选渲染的数据 —— 不在这条读法里。
+ */
+import type { PermissionRuleIssue } from "@sema-agent/core";
+/** 拒句的一位写给谁:`person` = 写规则的人(部署者 / 请求方);`library` = 宿主程序(本仓不渲染)。 */
+type Audience = "person" | "library";
+/**
+ * core 拒句每一位的受众 —— **穷尽表**(`satisfies Record<keyof PermissionRuleIssue, …>`:缺一位 / 多一位 tsc 红)。
+ * `rule` 是写规则的人自己写下的文本(本仓点名条目时用自己手里的那一份,不读这一位),但它面向人,所以标 `person`。
+ */
+export declare const RULE_ISSUE_AUDIENCE: {
+    readonly rule: "person";
+    readonly code: "person";
+    readonly message: "person";
+    readonly libraryOption: "library";
+};
+type FieldsFor<A extends Audience> = {
+    [K in keyof typeof RULE_ISSUE_AUDIENCE]: (typeof RULE_ISSUE_AUDIENCE)[K] extends A ? K : never;
+}[keyof typeof RULE_ISSUE_AUDIENCE];
+/**
+ * 拒句里面向人的那几位(型由 {@link RULE_ISSUE_AUDIENCE} 推出)。刻意不用 `Pick`:`Pick` 保留可选性,core 加一个**可选**位并标 `person` 时,漏挑它不报错;
+ * 这里的映射型不跟随原型的可选标记,每一位面向人的位都必填(值型仍是 core 的,可选位的值可以是 `undefined`)。
+ */
+export type PersonFacingRuleIssue = {
+    readonly [K in FieldsFor<"person">]: PermissionRuleIssue[K];
+};
+/**
+ * core 的规则文法判「这一条编不出来」时,本仓交给部署面的一句话:`<码> — core's rule grammar cannot compile this entry: <core 的句>`。
+ * 码与句逐字是 core 的;`libraryOption` 不进句子、也不进出口(出口只有 `code` / `guidance`)。
+ */
+export declare function deploymentRuleRefusal(issue: PermissionRuleIssue): {
+    readonly code: string;
+    readonly guidance: string;
+};
+export {};
+//# sourceMappingURL=rule-issue-reading.d.ts.map

package/dist/rule-issue-reading.js

@@ -0,0 +1,14 @@
+export const RULE_ISSUE_AUDIENCE = {
+    rule: "person",
+    code: "person",
+    message: "person",
+    libraryOption: "library",
+};
+function personFacing(issue) {
+    return { rule: issue.rule, code: issue.code, message: issue.message };
+}
+export function deploymentRuleRefusal(issue) {
+    const { code, message } = personFacing(issue);
+    return { code, guidance: `${code} — core's rule grammar cannot compile this entry: ${message}` };
+}
+//# sourceMappingURL=rule-issue-reading.js.map

package/dist/rules-consent.d.ts

@@ -551,8 +551,8 @@ export type DurableRuleScope = Exclude<RuleScope, {
  *  🔴 **收不收只有一只判据:core 的 `isValidDurableScope`**(引擎 7.46.0 起 project root 必须是完整绝对路径:`/…`、`X:\…` /
  *  `X:/…`、`\\host\…`)。四个 wire 入口(`/v1/rules` 写 / 撤 / 列举过滤、local-import 的行)都经这里;cc-import 的层 root 调同一只
  *  谓词(`http/routes/rules.ts`)。修前这里手抄了一份「root 非空」:`project:myproj` 本仓收、引擎写臂拒(写口答 503「再发一次」——
- *  客户端会无限重试)、引擎读侧丢(撤销口删不动),一条规则在两侧是两种命运。存量的那种行由一次性迁移 M11 删
- *  (`plugins/one-time-migrations.ts` 登记表)。 */
+ *  客户端会无限重试)、引擎读侧丢(撤销口删不动),一条规则在两侧是两种命运。存量的那种行(7.119.x 及更早收下的)不再被起服删除 ——
+ *  引擎读侧继续丢它并告知(`permission.rule_row_dropped`),出路是运维在库里删那一行。 */
 export declare function parseRuleScope(text: string): DurableRuleScope | undefined;
 /** 引擎不收的 scope 的**唯一一句**拒句:写 / 撤 / 列举过滤三个路由口、local-import 的成员拒因 `scope_unreadable` 都出站这一只
  *  (各口的码照旧各自的),不在读点各抄一份。cc-import 预览的层 root 判据是同一只(`isValidDurableScope`),但那份体里没有 scope 字段,
@@ -682,11 +682,13 @@ export type RuleWritten =
     stillLive: Exclude<RemovalLiveness, "yes">;
     row?: undefined;
 }
-/** 裁定性不收(内容判据 / 方向判据)。`detail` 是给人看的那一半,`reason` 是给客户端分流的那一半。 */
+/** 裁定性不收(内容判据 / 方向判据)。`detail` 是给人看的那一半(进拒句),`reason` 是给客户端分流的那一半;
+ *  `canonical` 只在「写入原样不是店会存的拼写」那一臂:店会存的规范拼写原串,调用方原样重发即可(机读位,不必从句子里抠)。 */
  | {
     status: "rejected";
     reason: LocalImportRefusalCode;
     detail: string;
+    canonical?: string;
 }
 /** 终态写失败。`detail` 是给人看的那一半;`committed`({@link RuleWriteCommitted},core 的两词闭集)是
  *  给机器分流的那一半 —— 它回答的是**调用方下一步该做什么**。

package/dist/rules-consent.js

@@ -872,6 +872,7 @@ export function createRuleConsentLane(stores, opts) {
                     reason: "rule_rejected",
                     detail: `this rule text is not the spelling the store would hold: send ${JSON.stringify(written.rule.rule)} instead ` +
                         `— a rule written under one spelling and held under another cannot be listed or revoked by the bytes you sent`,
+                    canonical: written.rule.rule,
                 };
             }
             const row = {

package/dist/run-acceptance.d.ts

@@ -33,7 +33,7 @@
  * ## 受理之后 / 之前
  *  · 受理 ⇒ 有交付的那一份时标题器起一次(会话没有标题时它才真去生成;判据在标题器里,本文件不重复)。
  *  · 没受理就收场(零工作的拒、受理前取消 / 拦截)⇒ 标题器不起:被拒的输入不花一次模型调用,也不被送去起名。
- *    这次提交在提交门铸下的会话行照旧留下(无标题、零消息),与此前同 —— 「提交没让引擎受理就收场」的会话去留是另一件事,不在本文件。
+ *    这只闩也是提交出口(`submission-exit.ts`)判「这次提交铸下的会话留不留」的第一读:闩上 ⇒ 留;没上 ⇒ 出口按它自己的律判({@link RunAcceptance.accepted})。
  *
  * ## 谁喂它
  * 三条提交腿(同步 / 流式 / durable)各在两处喂同一只:持流的那一形把每一帧交给 {@link RunAcceptance.observe}(并等它交回的那一拍 —— 有补写时
@@ -92,6 +92,8 @@ export interface RunAcceptance {
     onDelivered(face: DeliveryFace, fill: (objective: string) => Promise<void>): void;
     /** 持活流的腿开流时挂上它的写口(一次提交至多一条活流;重挂以最后一次为准)。不挂 = 本次提交没有可写的流,标题写成的帧丢弃。 */
     attachStream(sink: RunStreamSink): void;
+    /** 闩此刻上没上(引擎受理过这次提交)。提交出口的唯一读法;只读,不改闩。 */
+    readonly accepted: boolean;
 }
 export declare function createRunAcceptance(deps: RunAcceptanceDeps, input: RunAcceptanceInput): RunAcceptance;
 //# sourceMappingURL=run-acceptance.d.ts.map

package/dist/run-acceptance.js

@@ -67,6 +67,9 @@ export function createRunAcceptance(deps, input) {
         attachStream(sink) {
             stream = sink;
         },
+        get accepted() {
+            return accepted;
+        },
     };
 }
 //# sourceMappingURL=run-acceptance.js.map

package/dist/run-cancel-card.d.ts

@@ -0,0 +1,28 @@
+/**
+ * **取消动词在一条 run 的会话上会结算的那一张卡 —— 找法的唯一属主**(怎么结算它是 `card-settle-stored-scope.ts` 全仓共用的那一只)。两个读者同读这里,没有第二份:
+ *  · `POST /v1/runs/:id/cancel` 的停驻取消腿找卡(`routes/runs.ts` 的 `cancelSuspended`);
+ *  · 判坏的停驻卡的出路投影(`resume-legs.ts` 的 `rowWayOutOf`:`cancel_run` 当且仅当取消动词会结算**这一张**)。
+ *
+ * ## 规则一条:取消只读店的列,不读行体
+ * 取消要的两样 —— 这条 run 在等哪一张卡、它是不是活 run 的门 —— 都是列上的事实:找卡读归属 / 门型列(`findPendingTokenBySession` 的 run 绑定)。
+ * 行体怎么坏(读不成检查点、属主格丢了或与列不一致、整格 `{}`)都不改变取消落不落得下。属主门是路由层的 run 行属主复核(`admitRunById`),不在这里。
+ *
+ * ## 为什么出路投影问同一问
+ * 投影若另按载入的行体判「取消落不落得下」,就是同一件事的第二个读者(行体坏得越厉害,它越说不出出路,而取消恰在那时最需要被指出来)。
+ * 所以投影问取消动词自己那一问:有 run 店、那条会话上的 run 停着、取消动词找到的恰是这一张卡({@link cancelSettlesCard})。
+ */
+import type { CheckpointToken } from "@sema-agent/core";
+import type { CheckpointStoreFull, RunStore } from "./plugins/store-backend.js";
+/** 取消动词在 `runSessionId` 这条 run 的会话上会结算的那一张卡;没有 ⇒ `null`。 */
+export declare function runCancelCardOf(cs: Pick<CheckpointStoreFull, "findPendingTokenBySession">, runSessionId: string): Promise<CheckpointToken | null>;
+/** 取消动词要问的 run 行的两口:这条会话上持着认领的 run、它的行。 */
+export type CancelRunReader = Pick<RunStore, "getActiveTaskId" | "getRun">;
+/**
+ * 取消动词会不会结算 `token` 这一张 —— 出路投影问的就是这一问,三个条件都是取消口自己的:
+ *  · 有耐久 run 店(没有 ⇒ 取消口恒 `501 capability.run_store_required`,谈不上结算);
+ *  · 这张卡归属的 run 会话上持着认领的那条 run **停着**(`suspended` / `needs_review`):取消口只对停着的 run 走结算卡那一腿 ——
+ *    终局的 run 是空操作(卡不动),在跑的 run 只挂取消旗(卡不动);归属说不出 —— M49 回填前的老行 —— 也找不到 run;
+ *  · 取消动词在那条会话上找到的恰是这一张({@link runCancelCardOf};终局后的纯 park 排除在外)。
+ */
+export declare function cancelSettlesCard(cs: Pick<CheckpointStoreFull, "hostSessionOfCard" | "findPendingTokenBySession">, runs: CancelRunReader | undefined, token: CheckpointToken): Promise<boolean>;
+//# sourceMappingURL=run-cancel-card.d.ts.map

package/dist/run-cancel-card.js

@@ -0,0 +1,19 @@
+import { LIVE_RUN_GATE_KINDS } from "./plugins/checkpoint-store-face.js";
+import { isParkedRunStatus } from "./plugins/store-contracts.js";
+const RUN_CANCEL_CARD = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
+export function runCancelCardOf(cs, runSessionId) {
+    return cs.findPendingTokenBySession(runSessionId, undefined, RUN_CANCEL_CARD);
+}
+export async function cancelSettlesCard(cs, runs, token) {
+    if (runs === undefined)
+        return false;
+    const host = await cs.hostSessionOfCard(token);
+    if (typeof host !== "string")
+        return false;
+    const holder = await runs.getActiveTaskId(host);
+    if (holder === undefined)
+        return false;
+    const run = await runs.getRun(holder);
+    return run !== undefined && isParkedRunStatus(run.status) && (await runCancelCardOf(cs, host)) === token;
+}
+//# sourceMappingURL=run-cancel-card.js.map

package/dist/run-cancel-context.d.ts

@@ -68,13 +68,23 @@ export declare const CANCELLED_CODE = "cancelled";
  * `cause` 是**必填**:本函数是 server 铸取消终局的唯一出口,而每一次取消都有一个发起者 ⇒ 「本仓铸的取消终局上恒有
  * `abortCause`」由签名保证,不靠调用方记得。它走与补码、补快照**同一条**空座闸 —— 引擎给的终局不是无码的 failed
  * (与中止赛跑跑完了 / 引擎自带码)⇒ 整只原样返回,成因也不挂(那条终局不是这次中止的结果,挂上就是「完成了却带着取消便签」)。
+ *
+ * ## 停驻中的取消:这条 run 已经说过的那一格随终局走(`parkedResult`)
+ * park 中直接终局化的取消(`POST /v1/runs/:id/cancel` 的停驻臂)没有引擎终局可补标,合成形是这条 run 的终局 —— 但这条 run 不是没跑过:它停驻时那条结果
+ * (出口封口过、落在行上)已经带着 run 级的那一格 **读拒字节地板不守**(`readDenyFloor`,属主 `read-deny-floor-notice.ts`:准备期定下,停驻之前就已在 run 事件流上说过)。
+ * 合成形照抄行上那一格:同一句、同一个来源(行),不按取消这一拍的进程重判 —— 取消可以落在另一只副本上、或重启之后,进程内的记录不在那里;店的写口过出口封口时
+ * 那一格已在 ⇒ 原样(封口「已挂即原样」)。引擎给了终局的形不读它(那条终局自己带 `runId`,封口按它接)。
  */
 export declare function mintCancelledResult<R extends PersistedTaskResult>(args: CancelMintArgs & {
     engineResult: R;
+    parkedResult?: undefined;
 }): R;
 export declare function mintCancelledResult(args: CancelMintArgs & {
     engineResult?: undefined;
+    parkedResult?: ParkedLegResult;
 }): PersistedTaskResult;
+/** 停驻臂交来的那条行上的结果(停驻时出口封口过的;行可以没有结果 ⇒ `null`)。合成形只读它 run 级的那一格。 */
+export type ParkedLegResult = Pick<PersistedTaskResult, "readDenyFloor"> | null;
 /**
  * 被取消的续跑腿、且这张卡被本服务 expire 之后,终局上的那句话 —— **全仓单源**([ref])。
  *

package/dist/run-cancel-context.js

@@ -34,6 +34,7 @@ export function mintCancelledResult(args) {
         stats: { turns: 0, tokens: 0, usageMissing: true },
         ...(ctx ? { cancelContext: ctx } : {}),
         abortCause: args.cause,
+        ...(args.parkedResult?.readDenyFloor !== undefined ? { readDenyFloor: args.parkedResult.readDenyFloor } : {}),
     };
 }
 export const CARD_SETTLED_BY_CANCEL_MESSAGE = "Cancelled — the approved action never started, and the cancel settled this approval: it cannot be resumed (start a new run to continue)";