@sema-agent/server 7.3.0 → 7.5.0

package/dist/question.js

@@ -15,29 +15,39 @@
  * (the HTTP boundary) and REDACTS secrets from the model-authored QUESTION text before it is persisted/streamed (the
  * same redact-at-write contract as elicitation's `message`/tool outputs — the question is shown to a human, never
  * re-fed to a model, so no `delimitUntrusted` is needed on it). Deployment responsibilities core delegates: THROTTLE
- * (bound concurrency/total/ttl per run — an over-eager agent could flood the human) and no-live-human FALLBACK (a leg
- * with no stream returns the headless "no answer" default so the model proceeds instead of hanging).
+ * (bound concurrency/total/ttl per run — an over-eager agent could flood the human).
+ *
+ * 🔴 VERDICT vs LANDING are separate jobs (#166 裁1). This coordinator is the deployment's HONEST reporter of one fact:
+ * "no human answered this". Every arm with no real human answer — no run context, the run aborted, the throttle window
+ * is spent, the question cannot be presented, the TTL expired (incl. the run-exit sweep) — returns core's
+ * `{kind:"unavailable"}`. It NEVER synthesizes an empty answer set: an empty `{answers:[]}` reads to core as "a human
+ * was here and picked nothing", which on a durable deployment consumes the pending approval and hands the model a
+ * fabricated human verdict instead of parking the question where an operator can still answer it. Choosing the landing
+ * is CORE's job: a durable leg parks a checkpoint (operator answers later via decide), a non-durable leg continues with
+ * the `declined_unavailable` synthetic-continuation card (the model is told nobody is reachable and proceeds on its own
+ * judgment — a run with no human still never hangs). Only a REAL human answer returns a {@link QuestionAnswer}.
  *
  * ROUTING mirrors elicitation: `onQuestion` lives on the SINGLETON runner's `RunnerDeps` (the request carries no taskId),
  * so the run leg establishes a per-run AsyncLocalStorage context (taskId throttle key, owner respond-gate, `emit`
- * closure). `node:async_hooks` propagates it through every await; no context ⇒ headless default (never a hang).
+ * closure). `node:async_hooks` propagates it through every await; no context ⇒ unavailable (never a hang).
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7 } from "@sema-agent/core";
 import { redactDeep } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 /** Size bound on the model-authored questions payload before it is persisted to the durable log + streamed (parity
  *  with elicitation's MAX_ELICIT_* — an over-large questions blob amplifies into the socket/log). Over the cap ⇒ the
- *  questions are dropped and the ask headless-defaults (a question the human can't see can't be answered). */
+ *  questions are dropped and the ask reports unavailable (a question the human can't see can't be answered). */
 const MAX_QUESTIONS_BYTES = 16384;
 export const DEFAULT_QUESTION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
     ttlMs: 5 * 60_000,
 };
-/** The headless "no live human answered" result — an EMPTY answer set (no question got a selection). core's
- *  AskUserQuestion tool renders this to the model as "no option selected" so it proceeds with its own judgment instead
- *  of hanging (parity with the `onQuestion===undefined` headless default — a run with no human never blocks). */
-const NO_HUMAN = { answers: [] };
+/** The honest "nobody answered this" outcome. Frozen + shared: it is pure data core reads through
+ *  `classifyQuestionOutcome`, and it must never be confused with an empty ANSWER (which claims a human chose nothing
+ *  and, on a durable leg, spends the approval that park would have preserved). */
+const UNAVAILABLE = Object.freeze({ kind: "unavailable" });
 /** Validate the respond body = core's {@link QuestionAnswer}. `selected`/`note` are OPAQUE passthrough (core fences
  *  them: `selected ⊆ options`, `note` untrusted-fenced) — we validate only the outer SHAPE (answers[] of {header,
  *  selected:string[], note?}), never the option semantics. */
@@ -65,7 +75,7 @@ export function parseQuestionResponse(body) {
 }
 /** redactDeep + size-bound the UNTRUSTED model-authored questions before they are persisted/streamed (a question's
  *  free-text — question/header/option label+description — can echo a secret from the model's context). Over the byte
- *  cap OR unserializable ⇒ undefined (drop; the ask headless-defaults). */
+ *  cap OR unserializable ⇒ undefined (drop; the ask reports unavailable). */
 function boundQuestions(questions) {
     const redacted = redactDeep(questions);
     try {
@@ -81,7 +91,7 @@ function boundQuestions(questions) {
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present
  * (passed into `RunnerDeps.onQuestion` + the respond route) ONLY when `ASK_QUESTION_ENABLED` — absent ⇒ core mounts the
- * AskUserQuestion tool with the headless default (a run never hangs; the model just can't get a live answer).
+ * AskUserQuestion tool with no seam at all (`seam_absent` continuation; the model just can't get a live answer).
  */
 export class QuestionCoordinator {
     als = new AsyncLocalStorage();
@@ -92,7 +102,7 @@ export class QuestionCoordinator {
         this.throttle = throttle;
     }
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → headless default) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
     runWithContext(ctx, fn) {
         return this.als.run(ctx, async () => {
             try {
@@ -101,31 +111,34 @@ export class QuestionCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle(NO_HUMAN, "unanswered");
+                        p.settle(UNAVAILABLE, "unanswered");
                 }
                 this.counters.delete(ctx.taskId);
             }
         });
     }
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved answer is what
-     *  the model sees. Headless default (`NO_HUMAN`) in every case with no live human, so the run never hangs. Arrow
-     *  property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
+     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
+     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
+     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
     question = async (req, signal) => {
         const ctx = this.als.getStore();
         // No run context (a leg not wrapped by runWithContext — synchronous /v1/tasks, verify/cascade, or a leader sub-task
-        // with no live stream) ⇒ headless default. Sub-tasks run in the parent's ALS frame → a child's question inherits the
+        // with no live stream) ⇒ nobody to ask. Sub-tasks run in the parent's ALS frame → a child's question inherits the
         // top-level run's ctx (one human, one stream, one throttle budget), same as elicitation.
         if (!ctx)
-            return NO_HUMAN;
+            return UNAVAILABLE;
+        // Aborted (call signal or the run's own): whatever comes back has no consumer, so claiming a human answered is a lie.
         if (signal?.aborted || ctx.abortSignal?.aborted)
-            return NO_HUMAN;
-        // THROTTLE (service's job — core imposes none): bound concurrency + total. Breach ⇒ headless default.
+            return UNAVAILABLE;
+        // THROTTLE (service's job — core imposes none): bound concurrency + total. Breach ⇒ unavailable, never a denial and
+        // never a fabricated answer — a spent window is a "not now", which is exactly what park/continue is for.
         const rc = this.countersFor(ctx.taskId);
         if (rc.inflight >= this.throttle.maxConcurrentPerRun || rc.total >= this.throttle.maxTotalPerRun)
-            return NO_HUMAN;
+            return UNAVAILABLE;
         const questions = boundQuestions(req.questions);
         if (!questions)
-            return NO_HUMAN; // over-cap / unserializable → can't show it → headless
+            return UNAVAILABLE; // over-cap / unserializable → can't show it → nobody can answer it
         const id = uuidv7();
         rc.inflight += 1; // reserve the concurrency slot; total charged only on a successful emit
         let done = false;
@@ -147,8 +160,10 @@ export class QuestionCoordinator {
             resolveAnswer(a);
         };
         let lastOutcome = "unanswered";
-        const onAbort = () => settle(NO_HUMAN, "unanswered");
-        timer = setTimeout(() => settle(NO_HUMAN, "unanswered"), this.throttle.ttlMs);
+        const onAbort = () => settle(UNAVAILABLE, "unanswered");
+        // TTL: the human walked away. Release as unavailable — core decides whether that parks (durable, operator can still
+        // answer) or continues (non-durable); holding core past the window is not one of the choices.
+        timer = setTimeout(() => settle(UNAVAILABLE, "unanswered"), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -156,20 +171,53 @@ export class QuestionCoordinator {
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
         // Emit the OPEN frame AWAITED so its durable append is ORDERED ahead of the answer/completion/terminal appends (a
         // fire-and-forget append can commit out of seq order and be skipped by the monotonic events-tail cursor). A FAILED
-        // emit headless-defaults (nobody can answer) and must NOT burn the per-run total.
-        try {
-            await ctx.emit({ type: "question", questionId: id, questions, serverNowMs: Date.now() });
+        // emit settles unavailable (nobody can answer a frame that never arrived) and must NOT burn the per-run total.
+        // 🔴 RACED against the settlement (codex 复审 R2-high): a STALLED delivery (a durable append that never settles, a
+        // half-open socket) is a third shape next to ok/threw, and a bare `await ctx.emit` on it outlives TTL *and* abort —
+        // settle would resolve `answerP` while this frame is still parked on the emit, so `question()` never returns, core's
+        // callTool never unblocks and the leg cannot even reach its own cleanup. "The window always releases" has to hold
+        // for the stalled shape too, so the await ends at whichever comes first. Ordering is unchanged on the normal path
+        // (the settlement is still pending there, so the emit is still fully awaited).
+        // The loser of the race keeps its own handlers — an emit that rejects AFTER the race must not surface as an
+        // unhandled rejection.
+        const emitted = (async () => ctx.emit({ type: "question", questionId: id, questions, serverNowMs: Date.now() }))()
+            .then(() => "ok", () => "failed");
+        const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
+        if (delivery === "ok") {
             rc.total += 1;
         }
-        catch {
-            settle(NO_HUMAN, "unanswered");
+        else if (delivery === "failed") {
+            // #157(codex 复审 MEDIUM,2026-08-07):投递失败 ⇒ 人在环这道门被**一次故障**跳过,模型自己往下判。
+            // 「绝不把 run 挂死」是刻意的产品姿态,所以方向不改;但它是 P-DEBT 不是合法兜底——债要在遥测里显形。
+            // #166 后本臂结算成 unavailable(而非空答):留痕语义不变(一次投递故障仍可能让人在环被跳过——非
+            // durable 形 core 合成续跑),durable 形则改由 core park,债的方向与本记账口径一致。
+            recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
+            settle(UNAVAILABLE, "unanswered");
         }
+        // delivery==="stalled":窗已由 TTL/abort/清扫结算,这一问就此让位;账在下面那个迟到臂里补(投递还没
+        // 判出成败,现在既不能计费也不能记债)。
         const answer = await answerP;
         // Completion breadcrumb (dialog dismiss) — FIRE-AND-FORGET so a slow durable append can never delay returning the
-        // answer to core. Best-effort + ordering-uncritical (the shell already has the answer via respond).
-        void Promise.resolve()
-            .then(() => ctx.emit({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() }))
-            .catch(() => undefined);
+        // answer to core. Best-effort (the shell already has the answer via respond), but CHAINED BEHIND the open frame and
+        // BRANCHED on how that frame ended (codex 复审 R3):
+        //  · 送达(含**迟到**送达)⇒ 人真看见了这张卡:补烧总量额度(否则「反复悬挂再落地」是一条绕过刷屏帽的
+        //    路子),再发消卡帧把它消解掉;
+        //  · 投递失败(含**迟到**失败)⇒ 没有卡可消解,发消卡帧只会在流里留一条无主帧;此时补记那条 P-DEBT
+        //    留痕(同步臂已经记过的不会重复:那条腿的 delivery 不是 stalled)。
+        void emitted
+            .then((result) => {
+            if (result === "failed") {
+                if (delivery === "stalled")
+                    recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
+                return undefined;
+            }
+            if (delivery === "stalled")
+                rc.total += 1;
+            return ctx.emit({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() });
+        })
+            // #157:F 类兜底(丢的是收尾渲染,不是答案)——合法,但必须留痕,否则"面包屑成片消失"只能靠
+            // 用户报"对话框不消解"发现。
+            .catch(() => recordFailOpen("server.question.complete-breadcrumb-dropped", `question=${id}`));
         return answer;
     };
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
@@ -197,9 +245,10 @@ export class QuestionCoordinator {
      *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
      *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
      *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow(挂满 ttl 后以空答喂模型),而 park 才是它该走的腿。
+     *  只判 ALS 会把一条谁也收不到的问题判成 allow——挂满 ttl 后以 unavailable 结算,非 durable 形 core
+     *  就此合成续跑,活人再没机会答;而 park 才是它该走的腿。
      *  谓词缺席 ⇒ 恒可达(后台腿的 durable events tail 语义)。谓词本身抛错按不可达处理:判决面
-     *  fail-closed 到 park(park 可由运维补答,空答不可回收)。 */
+     *  fail-closed 到 park(park 可由运维补答,续跑掉的问题不可回收)。 */
     hasLiveContext() {
         const ctx = this.als.getStore();
         if (ctx === undefined)

package/dist/runs.d.ts

@@ -80,6 +80,14 @@ export declare function taskHandleStop(registry: typeof defaultTaskRegistry, han
     content: string;
     details: unknown;
 }>;
+/**
+ * Attribute this signal's abort as a USER stop for the owner's task-scoped children.
+ *
+ * 🔴 已经 abort 的信号在这里**立刻**记账,不是静默无操作(#168 件3 的配套)。调用点在 #168 件3 之后
+ * 一律挪到了「run 认领成功之后」—— 认领是一次 await,断连完全可能落在它之前。`addEventListener` 对一个
+ * 已 fire 的信号永不回调,那样一次真实的人为断连会被吞成「无归因」(子代 settle 时记成 system)。
+ * 语义上这两种时序是同一件事:本请求赢下了这条 session,而这条 session 的连接是被人断掉的。
+ */
 export declare function markChildrenStoppedByUserOnAbort(signal: AbortSignal, taskId: string, principal: string | null | undefined): void;
 /**
  * A session CAS conflict is swallowed by core into a failed `TaskResult` (it is not thrown from

package/dist/runs.js

@@ -111,15 +111,28 @@ export async function taskHandleStop(registry, handle, access, agentStore) {
     registry.markStopSource(handle, "user");
     return registry.stopTask(handle, access);
 }
+/**
+ * Attribute this signal's abort as a USER stop for the owner's task-scoped children.
+ *
+ * 🔴 已经 abort 的信号在这里**立刻**记账,不是静默无操作(#168 件3 的配套)。调用点在 #168 件3 之后
+ * 一律挪到了「run 认领成功之后」—— 认领是一次 await,断连完全可能落在它之前。`addEventListener` 对一个
+ * 已 fire 的信号永不回调,那样一次真实的人为断连会被吞成「无归因」(子代 settle 时记成 system)。
+ * 语义上这两种时序是同一件事:本请求赢下了这条 session,而这条 session 的连接是被人断掉的。
+ */
 export function markChildrenStoppedByUserOnAbort(signal, taskId, principal) {
-    signal.addEventListener("abort", () => {
+    const mark = () => {
         try {
             defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope: principal ?? "default" }, "user", { skipSessionScoped: true });
         }
         catch {
             /* attribution is advisory — the cancel itself must never fail on it */
         }
-    }, { once: true });
+    };
+    if (signal.aborted) {
+        mark();
+        return;
+    }
+    signal.addEventListener("abort", mark, { once: true });
 }
 /**
  * A session CAS conflict is swallowed by core into a failed `TaskResult` (it is not thrown from

package/dist/runtime-governance.d.ts

@@ -24,6 +24,7 @@
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
 import { type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** A per-command governance rule (registry `runtime.commandPolicy[]`). */
 export type CommandRule = {
     command: string;
@@ -106,10 +107,27 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
  * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
  * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
+ *
+ * #177([2951] issue #29,**邻仓 test AI 的 46 格真机矩阵**实证——不是本仓的钉,别到本仓文件里数 46;
+ * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
+ * `SENSITIVE_WRITE_PATTERNS` 是 #153 那次搬家漏下的兄弟旋钮——同一个病灶原样复发在 sensitive-path
+ * DENY 腿上(唯一合成点在 deriveSettingsPolicy 的 fsWriteGate 闭包,bypassPermissions/键缺席/settings
+ * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathPolicy`
+ * 从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
+ * `action:"allow"`(**不是**「无意见」这种第三态:core 的 ToolPolicy 没有弃权值。它在
+ * `combinePolicies` 的 deny/ask 优先折叠里不构成一票,所以在**折叠语境**下等价于弃权;若日后有人把
+ * 这条策略单独当成唯一 policy 用,那个 allow 就是真放行——别照抄这句话去别的语境)。于是对 bypass
+ * 只挡守卫段、不给普通目标加 ask 门([820] 表第四行「bypass=不加门非开门」保持逐字)。策略在这里
+ * 只组合不构造:裁决 env 的 lane 分形(host 真 fs / 沙箱 deferred 代理)是 resolve-spec 的属主知识,
+ * governance 层不重复它。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;
     commandPolicy?: CommandRule[];
     manualModeShellGate?: "always" | "classify";
+    sensitivePathPolicy?: ToolPolicy;
+    /** [2942]/[2943] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
+     *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
+    askMarks?: GovernanceAskMarks;
 }): TaskSpec;
 //# sourceMappingURL=runtime-governance.d.ts.map

package/dist/runtime-governance.js

@@ -24,6 +24,7 @@
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
 import { combinePolicies, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
+import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 /** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
  *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 RB-476:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
  *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
@@ -178,7 +179,14 @@ export function compileCommandPolicy(rules) {
         policies.push(createCoarseCommandNamePolicy({ allow, deny, defaultAction: "ask" }));
     }
     else {
-        // Blocklist mode: only `deny` blocks; per-command `ask` via the ask-list; unlisted pass through.
+        // Blocklist mode: only `deny` blocks; per-command `ask` via the ask-list; an unlisted **simple** command
+        // passes through.
+        // ⚠️ #184([3038]/[3047] 双探针实证):「unlisted pass through」只对**单纯命令**成立。带 shell 运算符的
+        // 复合命令(`a && b`、管道、`;`)`parseLeadingCommandName` 判 reject,而 `createCoarseCommandNamePolicy`
+        // 的 `defaultAction` **缺省就是 `"ask"`**(core tool-policy.js:`opts.defaultAction ?? "ask"`)—— 于是它们
+        // 在 deny 门上折 **ask**,不是放行(无 command 串的调用同理)。这与 allowlist 模式那句「fall to
+        // defaultAction」是同一个兜底,只是这里没显式传参所以容易读漏。上方 docblock 的「Un-parseable bypass
+        // commands fail toward `ask` in both the deny gate and the ask-list」说的就是这一条。零行为码改动。
         // (NOTE: never pass `allow: []` to the coarse helper — an empty array is truthy there and would turn it
         //  into an allowlist that asks on EVERYTHING. Omit allow entirely instead.)
         if (deny.length > 0)
@@ -211,6 +219,56 @@ export function autonomyOverrides(autonomy) {
             return {};
     }
 }
+/**
+ * [2942]/[2943] `governanceForced` 的**写侧** —— 把内层策略(治理层自己合成的那些)产的 `ask` 记进标记表。
+ *
+ * 决议本身**逐字透传**:本包装器只观察,不改 action / message / updatedInput / decisionReason,也不吞异常
+ * (内层抛就照抛,fail-closed 的属主仍是内层)。同步内层保持同步返回(不无谓地把一条同步策略异步化)。
+ *
+ * 为什么标在这一层而不是让 `decisionReason` 上 wire:core 的 ask 铸造点不透传 `PermissionResult`
+ * (侦察结论逐字见 `governance-ask-marks.ts` 顶注),这条缝在当前 core 上根本不存在。
+ */
+function createGovernanceAskMarkingPolicy(inner, marksOf) {
+    // 🔴 codex 交叉复审 round2 [medium](验真):**如实覆写**,不是只加不减 —— core 的
+    // `recheckApprovedEdit` 拿同一个 `toolCallId` 重跑策略链(人编辑 args 之后),「原始 args 治理层要问 /
+    // 编辑后治理层放行、由别的策略提第二问」会让第二张卡挂陈旧治理标。理由全文见 GovernanceAskMarks.setMarked。
+    const note = (d, req) => {
+        // 表在**裁决那一刻**解析(不是构造时):策略闭包铸于 resolveSpec,真正的作用域要到 run 腿跑起来才在。
+        marksOf()?.setMarked(req.toolCallId, d.action === "ask");
+        return d;
+    };
+    return {
+        check(req, signal) {
+            const decision = inner.check(req, signal);
+            return decision instanceof Promise ? decision.then((d) => note(d, req)) : note(decision, req);
+        },
+    };
+}
+/**
+ * [2942]/[2943] shellGate 腿的写侧 —— **纯观察器**(恒 `allow` = `combinePolicies` 折叠里的弃权,见
+ * `applyRuntimeGovernance` 顶注对 sensitivePathPolicy 那段 allow 语义的同款说明)。
+ *
+ * 只在治理层把 shellGate 抬到 **`"always"`** 时装:该档下 core 对**每一次** shell 调用都要人批
+ * (`prepare-task.js` 把 Bash/Monitor 的 irreversibility tier 置 `"always"`),所以「这是一次 shell 调用」
+ * 与「这只 ask 是治理层门出来的」等价——推断是紧的,零错标。
+ *
+ * 🔴 `"classify"` 档**故意不装**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能来自分类器
+ * (治理),也可能来自 `APPROVAL_REQUIRE` 这类别的门(非治理),在 `AskRequest` 上无从分辨。按本信号
+ * 「只做正向断言」的语义,分不清就**让键缺席**,不去猜(`governance-ask-marks.ts` 语义 1)。
+ */
+function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS) {
+    const shellTools = new Set(tools);
+    return {
+        check(req) {
+            // 只对 shell 工具**置位**,非 shell 一格不碰(那格的属主是上面的 ask 观察器)。本策略在合成里
+            // 恒排在 ask 观察器**之后**(见 applyRuntimeGovernance 的 combinePolicies 顺序):`always` 档下
+            // 每一次 shell 调用都被治理层门住,所以它对 shell 那一格的裁定压过「治理策略这次没产 ask」。
+            if (shellTools.has(req.toolName))
+                marksOf()?.setMarked(req.toolCallId, true);
+            return { action: "allow" };
+        },
+    };
+}
 /** core `tighten-task-spec` 的 SHELL_GATE_RANK 镜像(单一属主:#153 搬家后本文件是 server 侧唯一副本;
  *  task-settings 的旧副本随 settings 折叠臂一并拆除)。tightenTaskSpec 的契约是「override 自身必须收紧」
  *  而非「取两者较严」——低于 base 的 override 直接 throw,所以施加前要按 rank 只升不降。 */
@@ -229,12 +287,34 @@ const SHELL_GATE_RANK = { off: 0, classify: 1, always: 2 };
  * ⇒ 旋钮静默失效(clay 实机 Monitor 案「门根本没铸」);bypassPermissions 一句话掀掉部署闸;非 host lane
  * fsWriteGate wiring 不建 ⇒ 沙箱 lane 全失效。governance 层与 autonomy 同拍施加后三者全闭。rank 合成:
  * autonomy 派生值与旋钮取大(ask→"always" 压过 "classify"),再对 base 只升不降(防 tightenTaskSpec throw)。
+ *
+ * #177([2951] issue #29,**邻仓 test AI 的 46 格真机矩阵**实证——不是本仓的钉,别到本仓文件里数 46;
+ * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
+ * `SENSITIVE_WRITE_PATTERNS` 是 #153 那次搬家漏下的兄弟旋钮——同一个病灶原样复发在 sensitive-path
+ * DENY 腿上(唯一合成点在 deriveSettingsPolicy 的 fsWriteGate 闭包,bypassPermissions/键缺席/settings
+ * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathPolicy`
+ * 从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
+ * `action:"allow"`(**不是**「无意见」这种第三态:core 的 ToolPolicy 没有弃权值。它在
+ * `combinePolicies` 的 deny/ask 优先折叠里不构成一票,所以在**折叠语境**下等价于弃权;若日后有人把
+ * 这条策略单独当成唯一 policy 用,那个 allow 就是真放行——别照抄这句话去别的语境)。于是对 bypass
+ * 只挡守卫段、不给普通目标加 ask 门([820] 表第四行「bypass=不加门非开门」保持逐字)。策略在这里
+ * 只组合不构造:裁决 env 的 lane 分形(host 真 fs / 沙箱 deferred 代理)是 resolve-spec 的属主知识,
+ * governance 层不重复它。
  */
 export function applyRuntimeGovernance(base, governance) {
+    // 显式注入(测试/将来的多实例形)优先;否则**每次裁决时**取当前 run 腿的 ALS 表(顶注「作用域」段)。
+    const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
     const coarse = compileCommandPolicy(governance.commandPolicy);
-    if (coarse)
-        overrides.toolPolicy = coarse;
+    const governancePolicies = [coarse, governance.sensitivePathPolicy].filter((p) => p !== undefined);
+    // [2942]/[2943]:治理层自己产的 `ask` 打标 —— 包在**合成之后**,于是 commandPolicy 的两模式
+    // (allowlist 的 defaultAction:"ask" / blocklist 的 ask-list)与 sensitivePathPolicy 走同一个铸点,
+    // 不会漏掉将来加进这个数组的第四条腿。
+    const governancePolicy = governancePolicies.length > 0
+        ? createGovernanceAskMarkingPolicy(governancePolicies.length === 1 ? governancePolicies[0] : combinePolicies(...governancePolicies), marksOf)
+        : undefined;
+    if (governancePolicy !== undefined)
+        overrides.toolPolicy = governancePolicy;
     if (governance.manualModeShellGate !== undefined) {
         const candidate = overrides.shellGate !== undefined && SHELL_GATE_RANK[overrides.shellGate] >= SHELL_GATE_RANK[governance.manualModeShellGate]
             ? overrides.shellGate
@@ -249,6 +329,13 @@ export function applyRuntimeGovernance(base, governance) {
         else
             delete overrides.shellGate;
     }
+    // [2942]/[2943] shellGate 腿:治理层**自己**把门抬到 `"always"` 时,挂上纯观察器给 shell 调用打标
+    // (理由与 `"classify"` 为何不装,见 createGovernanceShellGateMarkPolicy 顶注)。判据取
+    // `overrides.shellGate` 而不是有效档 —— base 已经更严时上面那支会 `delete`,那时门不是治理层给的。
+    if (overrides.shellGate === "always") {
+        const shellObserver = createGovernanceShellGateMarkPolicy(marksOf);
+        overrides.toolPolicy = governancePolicy === undefined ? shellObserver : combinePolicies(governancePolicy, shellObserver);
+    }
     if (overrides.toolPolicy === undefined && overrides.handsReadOnly === undefined && overrides.shellGate === undefined) {
         return base; // nothing to govern → avoid a needless tightenTaskSpec pass
     }

package/dist/task-settings.d.ts

@@ -149,7 +149,7 @@ export declare function providerDropsAppend(provider: PromptProvider | undefined
 export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void, packDropsAppend?: boolean): string | undefined;
 /** [1248]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
  *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
- *  since #156 — the sandbox lanes now wire a lexical-path gate instead of no gate). */
+ *  since #156 — the sandbox lanes wire a gate of their own shape instead of no gate). */
 export interface WorkflowGateWiring {
     /** The session "don't ask again" probe (approvalExemptionStore.has, canonical toolName key) — same store and
      *  key space as the fs-write gate's probe; one remember="session" grant serves both. */
@@ -162,22 +162,23 @@ export interface WorkflowGateWiring {
  *  (real `exists`/`canonicalPath`/`readLink` fs access — read in dist, fs-write-gate-policy.js), so on a
  *  HOST-SEMANTICS lane (`REMOTE_EXEC` unset or "host") the env MUST be the fs the hand tools write.
  *
- *  #156 — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) now wire a gate TOO, but a different-shaped one: the
+ *  #156/#165 — the sandbox lanes (e2b/k8s/ssh/adb/local-docker) wire a gate TOO, but a different-shaped one: the
  *  tools run OFF this box and the per-task sandbox env is minted inside core (executionEnvFactory) AFTER spec
  *  build, so a worker-local env would adjudicate against the WRONG fs (a wrong ALLOW is worse than no gate — that
- *  is why [816] left those lanes gate-less). The transitional shape instead supplies a `LexicalPathExecutionEnv`
- *  (`src/boot/lexical-path-env.ts`): NO fs is consulted at all, absolute paths are judged by lexical
- *  normalization and everything else fails closed to `ask`. Its residual surface (symlink form) and the endgame
- *  seam (core [2751] read-only env face on HookToolContext) are documented on that module. */
+ *  is why [816] left those lanes gate-less). They supply a `DeferredSandboxPathEnv`
+ *  (`src/boot/deferred-sandbox-path-env.ts`) instead: a proxy that forwards the fs READ primitives to the task's
+ *  REAL sandbox env at adjudication time (a per-session slot the factory decorator fills), keeping only
+ *  `absolutePath` lexical so no relative path is resolved against the wrong base. Empty slot ⇒ fail-closed. */
 export interface FsWriteGateWiring {
-    /** The env the gate canonicalizes against — the worker host env on the host lane, the fs-less
-     *  `LexicalPathExecutionEnv` on the sandbox lanes (#156). */
+    /** The env the gate canonicalizes against — the worker host env on the host lane, the
+     *  `DeferredSandboxPathEnv` proxy over the task's real sandbox env on the sandbox lanes (#165). */
     env: ExecutionEnv;
     /** The task's working directory: the factory's `rootPath` (relative-path base) AND the acceptEdits accept domain.
-     *  ABSENT on the sandbox lanes (#156): the sandbox cwd is not knowable at spec time and inventing one would mint
-     *  a bogus auto-allow domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths
-     *  fail to resolve (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the
-     *  host lane's never-created sentinel dir (resolve-spec 修5). */
+     *  ABSENT on the sandbox lanes (#156/#165): the sandbox cwd is the ENGINE's tracked cwd, not the env's own, so
+     *  neither spec time nor the env proxy can supply the right base — inventing one would mint a bogus auto-allow
+     *  domain. With it absent the gate gets no `rootPath` and no `acceptDirs`, so relative paths fail to resolve
+     *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
+     *  never-created sentinel dir (resolve-spec 修5). */
     cwd?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [820]③) — writes there are always auto-allowed. */
     scratchpadDir?: string;
@@ -191,16 +192,10 @@ export interface FsWriteGateWiring {
      *  allow with decisionReason "rule", a THROWN probe ⇒ not exempt = fail-closed to ask). Same canonical
      *  toolName key space as the ask-policy layer's exemption probe — ONE grant serves both layers; the gate-level
      *  check is what makes "allow all session" bite SAME-TURN for the parent and inherited child tasks (the ask
-     *  path is never re-entered). (codex M1 的边界注记已闭合:core 1.295 起本仓在 gate 腿上组合
-     *  createSensitivePathPolicy —— 见 `sensitivePatterns`,deny 在 combinePolicies 折叠里恒胜,豁免/acceptDirs
-     *  越不过它。) */
+     *  path is never re-entered). (codex M1 的边界注记:sensitive-path DENY 腿与本探针的「豁免越不过 deny」
+     *  保证仍成立——但那条腿已随 #177 搬到 governance 层,deny-wins 是 tightenTaskSpec 折叠给的,不再依赖
+     *  本 wiring 的组合点。) */
     isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
-    /** ③ (core 1.295): the sensitive-path write DENY set composed onto the fs-write gate leg —
-     *  `createSensitivePathPolicy({env, patterns, rootPath: cwd})`, deny-wins in the SAME combinePolicies fold, so a
-     *  session exemption (isExempt) or an acceptEdits auto-allow can never cross it (the 1.199-batch documented gap,
-     *  now closed). Source = config `SENSITIVE_WRITE_PATTERNS` (unset ⇒ core RECOMMENDED_SENSITIVE_PATTERNS; the
-     *  set curation is core's — the server passes through). Absent/empty ⇒ no sensitive policy (pre-1.295 shape). */
-    sensitivePatterns?: string[];
 }
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;

package/dist/task-settings.js

@@ -35,8 +35,8 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createSensitivePathPolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
-import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
+import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
@@ -367,9 +367,12 @@ function createWorkflowPlanDenyPolicy() {
  * silent on this leg. Throwing here surfaces as a 422 at the HTTP boundary (resolve-spec already wraps every
  * throw out of `applyTaskSettings`), i.e. the same fail-loud posture the other two legs have.
  *
- * `allow` is deliberately NOT judged: it is a WHITELIST — a name that matches nothing leaves the allowlist
- * effectively empty, so every tool falls to "not in the allowlist" and is DENIED. That fails closed and is
- * immediately visible to the caller, which is a different (and acceptable) failure mode from a silent hole.
+ * `allow` is deliberately NOT judged by the GENERAL arm: it is a WHITELIST — a name that matches nothing leaves
+ * the allowlist effectively empty, so every tool falls to "not in the allowlist" and is DENIED. That fails closed
+ * and is immediately visible to the caller, which is a different (and acceptable) failure mode from a silent hole.
+ * The ONE exception is the CC-rule-form arm ({@link findCcRuleFormNames}, #186): `allow: ["Bash(ps:*)"]` is the
+ * shape a CC user writes to get FEWER prompts and it silently costs them Bash entirely — a spelling-family error,
+ * not a typo, so it is refused on all three lists. See the config.ts docblock for the two knobs it points at.
  */
 function rejectUnmatchableSettingsNames(perms) {
     for (const [field, names] of [["permissions.ask", perms.ask], ["permissions.deny", perms.deny]]) {
@@ -379,6 +382,11 @@ function rejectUnmatchableSettingsNames(perms) {
         if (bad.length > 0)
             throw new Error(formatUnmatchableToolNames(field, bad));
     }
+    if (perms.allow) {
+        const bad = findCcRuleFormNames(perms.allow);
+        if (bad.length > 0)
+            throw new Error(formatUnmatchableToolNames("permissions.allow", bad));
+    }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
@@ -395,20 +403,17 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
         policies.push(createAskListPolicy(ask));
     // The mode-derived fs-write ask gate (core 1.290 factory — real shape read in dist: {env, rootPath?, acceptDirs?,
     // exemptDirs?, defaultWrite}, gates Write/Edit/NotebookEdit, exempt→accept→default layering, canonicalize inside
-    // the given env, only ever allow/ask). undefined without wiring (see FsWriteGateWiring). #156: the sandbox lanes
-    // supply wiring too — same factory, a lexical (fs-less) env and no cwd; the shape difference lives entirely in
-    // what `resolve-spec.ts` puts in the wiring, not in a second code path here.
-    // ③ (core 1.295): the sensitive-path DENY policy (patterns from the wiring — config SENSITIVE_WRITE_PATTERNS,
-    // default = core's RECOMMENDED set) composes into the SAME fold, deny-wins — core semantics deny/"safety", so
-    // neither the gate's own allow legs (exemptDirs/acceptDirs/isExempt session exemption) nor a settings allow can
-    // cross it (the 1.199-batch gap: an exempted tool could write .git/hooks — closed here). Same env/rootPath as
-    // the gate (the fs the hands really write; symlink canonicalization inside the policy, dist-read).
+    // the given env, only ever allow/ask). undefined without wiring (see FsWriteGateWiring). #156/#165: the sandbox
+    // lanes supply wiring too — same factory, a deferred real-env proxy and no cwd; the shape difference lives
+    // entirely in what `resolve-spec.ts` puts in the wiring, not in a second code path here.
+    // (③ sensitive-path DENY 已随 #177 搬 governance 层——见 FsWriteGateWiring 尾注。deny-wins 由
+    //  tightenTaskSpec 折叠保证:豁免/acceptDirs/settings allow 仍然越不过部署 DENY 基线。)
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;
-        // #156: `cwd` is optional (absent on the sandbox lanes). Omitting `rootPath` makes core leave a relative
-        // target relative → its lexical env cannot resolve it → ask; omitting `acceptDirs` means acceptEdits mints
-        // no auto-allow domain at all. Both are the intended fail-safe, NOT a degraded copy of the host arm.
+        // #156/#165: `cwd` is optional (absent on the sandbox lanes). Omitting `rootPath` makes core leave a relative
+        // target relative → the sandbox proxy's lexical `absolutePath` refuses it → ask; omitting `acceptDirs` means
+        // acceptEdits mints no auto-allow domain at all. Both are the intended fail-safe, NOT a degraded host arm.
         const gatePolicy = createFsWriteGatePolicy({
             env: gate.env,
             ...(gate.cwd !== undefined ? { rootPath: gate.cwd } : {}),
@@ -422,9 +427,7 @@ export function deriveSettingsPolicy(settings, gate, workflowGate) {
         // NotebookEdit 时 notebook_path 恒先(诱饵 file_path 失效),其余工具 file_path 先(反向诱饵也封);均 dist
         // 亲读。回归锚保留在 test/task-settings.test.ts(NotebookEdit deny + 双向诱饵),现在锁的是 core 行为经
         // 我方折叠——core 若回退,锚变红。
-        return gate.sensitivePatterns && gate.sensitivePatterns.length > 0
-            ? combinePolicies(createSensitivePathPolicy({ env: gate.env, patterns: gate.sensitivePatterns, ...(gate.cwd !== undefined ? { rootPath: gate.cwd } : {}) }), gatePolicy)
-            : gatePolicy;
+        return gatePolicy;
     };
     const compose = (...extra) => {
         const all = [...policies, ...extra.filter((p) => p !== undefined)];