@sema-agent/server 7.55.0 → 7.57.0

package/dist/approval-card.js

@@ -1,38 +1,97 @@
 import { z } from "zod";
 import { ASK_EVIDENCE_ABSENCE_VALUES, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+import { PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS } from "./permission-rule-vocab.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
 export const MAX_RULE_OFFERS = 4;
 export const MAX_RULE_OFFER_BATCH_MEMBERS = 8;
-const SegmentRuleSuggestionSchema = z
-    .object({
-    rule: z.string().max(MAX_RULE_TEXT_CHARS),
-    match: z.enum(["exact", "prefix"]),
-    command: z.string().max(MAX_RULE_TEXT_CHARS),
-    segment: z.string().max(MAX_RULE_TEXT_CHARS),
-})
-    .strict();
+export const MAX_UNCOVERED_DETAIL_ROWS = 32;
+const RuleMatchSchema = z.enum(PERSISTED_RULE_MATCHES);
+const UncoveredReasonSchema = z.enum(UNCOVERED_SEGMENT_REASONS);
+const RuleOfferBatchMemberSchema = z.union([
+    z
+        .object({
+        kind: z.literal("command"),
+        rule: z.string().max(MAX_RULE_TEXT_CHARS),
+        match: RuleMatchSchema,
+        command: z.string().max(MAX_RULE_TEXT_CHARS),
+        segment: z.string().max(MAX_RULE_TEXT_CHARS),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("directoryRead"),
+        rule: z.string().max(MAX_RULE_TEXT_CHARS),
+        directory: z.string().max(MAX_RULE_TEXT_CHARS),
+        segment: z.string().max(MAX_RULE_TEXT_CHARS),
+    })
+        .strict(),
+]);
+const UncoveredSegmentDetailSchema = z.object({ segment: z.string().max(MAX_RULE_TEXT_CHARS), reason: UncoveredReasonSchema }).strict();
+const UncoveredSegmentDetailRawSchema = z.object({ segment: z.string(), reason: UncoveredReasonSchema }).strip();
 export const RuleOfferSchema = z.union([
-    z.object({ kind: z.literal("single"), rule: z.string().max(MAX_RULE_TEXT_CHARS), match: z.enum(["exact", "prefix"]), command: z.string().max(MAX_RULE_TEXT_CHARS) }).strict(),
+    z.object({ kind: z.literal("single"), rule: z.string().max(MAX_RULE_TEXT_CHARS), match: RuleMatchSchema, command: z.string().max(MAX_RULE_TEXT_CHARS) }).strict(),
     z
         .object({
         kind: z.literal("batch"),
-        rules: z.array(SegmentRuleSuggestionSchema).min(1).max(MAX_RULE_OFFER_BATCH_MEMBERS),
+        rules: z.array(RuleOfferBatchMemberSchema).min(1).max(MAX_RULE_OFFER_BATCH_MEMBERS),
         uncoveredSegments: z.number().int().nonnegative().safe(),
+        uncoveredDetail: z.array(UncoveredSegmentDetailSchema).max(MAX_UNCOVERED_DETAIL_ROWS).optional(),
     })
         .strict(),
 ]);
 export const RuleOfferRawSchema = z.union([
-    z.object({ kind: z.literal("single"), rule: z.string(), match: z.enum(["exact", "prefix"]), command: z.string() }).strip(),
+    z.object({ kind: z.literal("single"), rule: z.string(), match: RuleMatchSchema, command: z.string() }).strip(),
     z
         .object({
         kind: z.literal("batch"),
-        rules: z.array(z.object({ rule: z.string(), match: z.enum(["exact", "prefix"]), command: z.string(), segment: z.string() }).strip()).min(1),
+        rules: z
+            .array(z.union([
+            z.object({ kind: z.literal("command"), rule: z.string(), match: RuleMatchSchema, command: z.string(), segment: z.string() }).strip(),
+            z.object({ kind: z.literal("directoryRead"), rule: z.string(), directory: z.string(), segment: z.string() }).strip(),
+        ]))
+            .min(1),
         uncoveredSegments: z.number().int().nonnegative().safe(),
+        uncoveredDetail: z.array(UncoveredSegmentDetailRawSchema).optional(),
     })
         .strip(),
 ]);
+export function screenUncoveredDetailSeat(item) {
+    if (typeof item !== "object" || item === null)
+        return item;
+    const candidate = item;
+    if (candidate.kind !== "batch" || !("uncoveredDetail" in candidate) || candidate.uncoveredDetail === undefined)
+        return item;
+    const rows = candidate.uncoveredDetail;
+    const wellFormed = Array.isArray(rows) &&
+        rows.length <= MAX_UNCOVERED_DETAIL_ROWS &&
+        rows.length === candidate.uncoveredSegments &&
+        rows.every((r) => UncoveredSegmentDetailRawSchema.safeParse(r).success);
+    if (wellFormed)
+        return item;
+    recordFailOpen("server.rule-offers.uncovered-detail-dropped", Array.isArray(rows) ? `rows=${rows.length} count=${String(candidate.uncoveredSegments)}` : `seat is ${typeof rows}`);
+    const { uncoveredDetail: _dropped, ...rest } = candidate;
+    return rest;
+}
+export function backfillLegacyBatchMemberKind(item) {
+    if (typeof item !== "object" || item === null)
+        return item;
+    const candidate = item;
+    if (candidate.kind !== "batch" || !Array.isArray(candidate.rules))
+        return item;
+    const isLegacy = (m) => typeof m === "object" &&
+        m !== null &&
+        !("kind" in m) &&
+        typeof m.rule === "string" &&
+        typeof m.match === "string" &&
+        typeof m.command === "string" &&
+        typeof m.segment === "string";
+    if (!candidate.rules.some(isLegacy))
+        return item;
+    return { ...candidate, rules: candidate.rules.map((m) => (isLegacy(m) ? { kind: "command", ...m } : m)) };
+}
 export function copyRuleOffer(o) {
     switch (o.kind) {
         case "single":
@@ -40,8 +99,18 @@ export function copyRuleOffer(o) {
         case "batch":
             return {
                 kind: "batch",
-                rules: o.rules.map((r) => ({ rule: r.rule, match: r.match, command: r.command, segment: r.segment })),
+                rules: o.rules.map((r) => {
+                    switch (r.kind) {
+                        case "command":
+                            return { kind: "command", rule: r.rule, match: r.match, command: r.command, segment: r.segment };
+                        case "directoryRead":
+                            return { kind: "directoryRead", rule: r.rule, directory: r.directory, segment: r.segment };
+                        default:
+                            throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                    }
+                }),
                 uncoveredSegments: o.uncoveredSegments,
+                ...(o.uncoveredDetail !== undefined ? { uncoveredDetail: o.uncoveredDetail.map((d) => ({ segment: d.segment, reason: d.reason })) } : {}),
             };
         default:
             throw new Error(`unknown rule-offer kind: ${JSON.stringify(o)}`);

package/dist/approval-content-kind.d.ts

@@ -0,0 +1,22 @@
+/**
+ * [ref]([ref]② core 点名 → [ref] 认领):`contentKind` 投影键的**单一词属主**(server 侧)。
+ *
+ * core 在 `summarizeCheckpoint`(dist/core/checkpoint-store.js)对 tool_approval 门铸
+ * `contentKind: "content_ask"`,判据一行:`tool.toolName === ASK_USER_QUESTION_TOOL_NAME`
+ * (常量声明 = core `dist/core/ask-question.d.ts:14`,值 `"AskUserQuestion"`;该常量**未从 core 包根
+ * 导出**(index.d.ts 零命中,exports map 无深路径口)⇒ 本仓落一份同字节常量,不做深路径导入)。
+ * 三条 server 投影面(SQL `listPending` 列读 / LOCAL `listPending` blob 读 / live `listLivePending`)
+ * 全部经 {@link contentKindOf} 派生,恒与 core 的 summarize 面同词 —— 词漂移由 parity 钉看住
+ * (`test/local-checkpoint-store.test.ts` [ref] parity 格:core `summarizeCheckpoint` 对 AskUserQuestion
+ * checkpoint 的铸值必须逐字等于本函数的答案)。
+ *
+ * 🔴 与 `hasBidiControls` 的「server 不重算」纪律**不冲突**:那一位是有界扫描的结果(重算可分家),
+ * 而 contentKind 是行上 core 铸的 `toolName` 的**全函数**(一行确定性判)——派生 ≠ 重扫。
+ * 🔴 OMIT 契约与同族键一致(`boundCallId`/`gateKind`/`hasBidiControls` 的 [ref]② 纪律):
+ * `"content_ask"` 或**缺席**,恒不铸 `null`/`false`;缺席 = 不是内容问句门(普通工具门 / 非工具 park /
+ * toolName 缺席的存量行)。展示/分诊/渲染分型用,永不参与 resume / gate / CAS。
+ */
+export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+/** 三读面共用的派生:AskUserQuestion 工具门 ⇒ `"content_ask"`;其余(含 null/缺席)⇒ undefined(键缺席)。 */
+export declare function contentKindOf(toolName: string | null | undefined): "content_ask" | undefined;
+//# sourceMappingURL=approval-content-kind.d.ts.map

package/dist/approval-content-kind.js

@@ -0,0 +1,5 @@
+export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export function contentKindOf(toolName) {
+    return toolName === ASK_USER_QUESTION_TOOL_NAME ? "content_ask" : undefined;
+}
+//# sourceMappingURL=approval-content-kind.js.map

package/dist/approval.d.ts

@@ -36,6 +36,37 @@ export declare function assertGateIntentServiceable(config: {
     approvalNeverAuto: readonly string[];
     durableApproval: boolean;
 }, checkpointStorePresent: boolean): void;
+/**
+ * [ref] 件⑩ —— **center 的 `forceDurableGate` 在无 checkpoint 店的部署上会静默 inert**,补一条 boot 披露。
+ *
+ * 事实链(core 7.2.0 亲读):`RuntimeCaps.forceDurableGate:true` 让引擎**合成**一个
+ * `durableApproval{scope: principal}`(`dist/core/types.d.ts:5279-5283`),好让 policy 的 `ask` 挂到
+ * durable wire 上。但「挂得上去」的前提是这台 worker 真有 checkpoint 店 —— 而本仓的构造条件逐字是
+ * `backend?.checkpoint && config.durableApproval`(main.ts)。`DURABLE_APPROVAL` 关 ⇒ 店缺席 ⇒ 合成出来
+ * 的那把锁**没有锁孔**:core 侧退化成非 durable 的 ask 链,center 那条「fleet-wide interactive runs gate」
+ * 的授权在这台机器上**一个字节都没兑现**,且两侧都不出声(core 侧归 core 的 C-22)。
+ *
+ * 为什么是 warn 不是拒启:`forceDurableGate` 是 **per-principal** 的授权,boot 期没有 principal,判不出
+ * 「今天真的会有人被下发」——能判的只有「这台机器的下发口开着(有 entitlement 源)而承接面关着」。
+ * 拿一个**可能**的下发去挡死一台本来跑得好好的 worker,是本条诊断带来的新故障,不是它治的病
+ * (与 `noticeAutoCompactAboveWindow` 的同一条取舍)。所以:响亮一行,不拒启。
+ *
+ * 为什么在 **boot** 判而不是 resolve 时判:两个入参都是**部署级**的(entitlement 源在不在、durable 门开
+ * 不开),per-principal 的那一半改变不了结论;放 resolve 里就得自己造去重,而 boot 天然只跑一次。
+ *
+ * 纯函数(返回一行或 undefined,不自己写日志)= 红先测得动;调用点在 main.ts 的
+ * {@link assertGateIntentServiceable} 之后(同一段门装配)。
+ */
+export declare function buildForceDurableGateInertNotice(input: {
+    /** center per-principal entitlement 源在不在(`centerEntitlementSourceWired` 的结果 —— 判据单源在那里)。 */
+    entitlementSourceWired: boolean;
+    /** 本进程真建出 checkpoint 店了吗(= `backend?.checkpoint && DURABLE_APPROVAL`)。 */
+    checkpointStorePresent: boolean;
+    durableApproval: boolean;
+}): {
+    event: string;
+    fields: Record<string, unknown>;
+} | undefined;
 /**
  * Durable approval policy (core 1.67 / [ref]): returns three-state **`ask`** for gated tools instead of
  * polling. With `TaskSpec.durableApproval` set + a `checkpointStore` on the Runner, core turns that `ask` into

package/dist/approval.js

@@ -13,6 +13,24 @@ export function assertGateIntentServiceable(config, checkpointStorePresent) {
     }
     throw new Error("DURABLE_APPROVAL=true but no checkpoint store is available — the configured DB backend has no checkpoint face (or no backend is configured). Wire a MySQL-protocol/PostgreSQL/file backend, or unset DURABLE_APPROVAL.");
 }
+export function buildForceDurableGateInertNotice(input) {
+    if (!input.entitlementSourceWired || input.checkpointStorePresent)
+        return undefined;
+    return {
+        event: "center_force_durable_gate_inert",
+        fields: {
+            durableApproval: input.durableApproval,
+            note: "this deployment resolves per-principal entitlements from config-center, but it has NO checkpoint store " +
+                (input.durableApproval
+                    ? "(DURABLE_APPROVAL=true, yet the configured backend exposes no checkpoint face)"
+                    : "(DURABLE_APPROVAL is off)") +
+                " — a center-issued RuntimeCaps.forceDurableGate=true will be INERT here: the engine synthesizes a " +
+                "durableApproval scope, but with no store to suspend into, gated asks fall back to the non-durable chain " +
+                "and the fleet-wide interactive-runs mandate is NOT enforced on this worker. Set DURABLE_APPROVAL=true with " +
+                "a backend that has a checkpoint face (MySQL-protocol / PostgreSQL / file), or stop issuing forceDurableGate for these principals.",
+        },
+    };
+}
 function createNameSetMatcher(names) {
     const exact = new Set(names);
     const covering = names.filter(isNamespacedCoveringRuleName);

package/dist/auto-mode-face.d.ts

@@ -0,0 +1,111 @@
+import { type Model, type ModelRoles, type RuntimeCaps } from "@sema-agent/core";
+import type { SettingsPermissionMode } from "./task-settings.js";
+/**
+ * 分类器**配置**的模型路由 —— 直接复用 core 的 `resolveTaskModel({ modelRole: "classifier" })`(prepare-task 武装时
+ * 走的同一函数:role 回落链 `classifier → summarize → default`,且 `{select}` 形 RoleSpec 按目录选型)。
+ * codex r4 [medium] 验真后改:首版按名字级自算,遇 center 下发的 `{select:{tier}}` 形会错落到 summarize/default,
+ * 对 `sema doctor permissions` 报另一个模型。答的是「配置了什么」;运行期 `derivedRouteFallsBack` 的回落不在射程
+ * (那是 core 状态座的事)。什么都解不出 ⇒ `{id:undefined, fault}`(core 的拒句当数据交出,读面不写 model 键):
+ * 本面是纯披露、不是执法——读面 500 掉整张能力表比少一个 model 键更伤。
+ */
+export declare function classifierRouteFor(deps: {
+    models?: Record<string, Model>;
+    roles?: ModelRoles;
+}): ClassifierRoute;
+/** `classifierRouteFor` 的答:解出 ⇒ `{id}`;解不出 ⇒ `{id:undefined, fault}`(core 的拒句原文,不吞)。 */
+export type ClassifierRoute = {
+    readonly id: string;
+    readonly fault?: undefined;
+} | {
+    readonly id: undefined;
+    readonly fault: string;
+};
+/** core [ref] seam ⑤ 的未武装原因闭集(六词,[ref] 加 settings_denied;顺序 = 判序)。 */
+export declare const AUTO_MODE_UNARMED_REASONS: readonly ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
+export type AutoModeUnarmedReason = (typeof AUTO_MODE_UNARMED_REASONS)[number];
+/** 锁步表:词表与语义一一对应(加员/删员任一侧不同步 = tsc 红)。语义只供文档/测试,不上 wire。 */
+export declare const AUTO_MODE_UNARMED_REASON_SEMANTICS: {
+    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\";座缺席)——只属意图武装式,旧式 core 不读模式";
+    readonly deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器);旧式 core 下另含「无 center 源 = 零授予路径」";
+    readonly org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项;旧式 core 下另含「center 在场但未授予」";
+    readonly local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false";
+    readonly settings_denied: "settings 层 permissions.disableAutoMode 取 disable 或 true(两套已发布拼写同义;用户/managed 层 kill-switch)把本 run 折成非 auto —— capabilities 查询串不带 settings,本词由 run 级面产([6128] PM 裁定第六员)";
+    readonly resolver_fault: "per-principal caps resolver 抛错/答非记录(core 同形全拒:autoMode:false + onError phase config)";
+};
+/**
+ * 安装包探针:**这台机器上装的 core 用哪套武装极性**。
+ *
+ * 判据([ref] 改,原先用「854b202b 同批的运行时导出 `mailboxCrossProcessMountVerdict`」作代理 —— 那是 385 片2a 的
+ * mailbox 面,与 auto 武装**语义无关**,只是恰好同一个 dist;core 若把 [ref] 单独发一个补丁版,代理就答错):
+ *
+ *  · **主判(语义精确)= [ref] 自己的座**:武装点 `dist/core/runner/prepare-task.js` 里是否出现 `autoModeRequested`。
+ *    亲验(2026-09-03,`git grep autoModeRequested` 两 ref 对拍):v7.2.0 全树**零**处提及,854b202b 起 prepare-task
+ *    有 8 处 —— 单调、且探的就是「武装点读不读意图座」这件事本身。dist 未 mangle(属性名从不被 tsc/esbuild 改名),
+ *    d.ts 不参与判断(类型面运行期探不到,读 js 才是「引擎真这么跑」)。
+ *  · **佐证(只在主判为 false 时读)= 同批到货的运行时导出** `mailboxCrossProcessMountVerdict`(包内随发的
+ *    `node_modules/@sema-agent/core/test/export-surface.snapshot.json`(core 包内随发),core `files` 字段含它 —— 消费账本门 A 的同一真源)。
+ *    - 座缺席 ∧ 标记缺席 ⇒ 就是 npm 7.2.0 那一档 ⇒ `false`(旧式臂,兼容形);
+ *    - 座缺席 ∧ 标记**在场** ⇒ **矛盾**:dist 已是 854b202b 之后,而武装点不再提这个座名(core 重构/换文件)
+ *      ⇒ 判据失效,**抛**(不猜。静默回落旧式臂正是「854 之后的部署悄悄退回 org 授予极性」那一形)。
+ *    - 座在场 ⇒ `true`,不看佐证([ref] 单发的补丁版合法)。
+ *
+ * 🔴 不用 `import * as core`(消费账本门禁命名空间导入:每个消费名必须可按名对账);两个文件都经主入口 resolve
+ * 定位(package `exports` 映射不暴露这些子路径)。**任何读不到 = 抛**,由 boot 装配点承接成拒启(见
+ * {@link coreArmsAutoOnIntent})。
+ *
+ * @param distDir 测试注入的假 `dist/` 根;生产不传(从安装的 core 主入口解)。
+ */
+export declare function coreArmsAutoOnIntentProbe(distDir?: string): boolean;
+/**
+ * {@link coreArmsAutoOnIntentProbe} 的**惰性记忆化**访问器 —— 生产装配点(`main.ts` 的 `autoModeFace` 组装,
+ * 早于 `server.listen`)调一次,探针抛就是**boot 期响亮拒启**并带指路。
+ *
+ * 🔴 为什么必须惰性([ref]):此前是模块顶层 `const … = coreArmsAutoOnIntentProbe()`,而 `main.ts` 顶部 import 本模块
+ * ⇒ 探针在 **import 期**求值,读不到快照就在任何日志器/诊断存在之前把整台 server 抛死(一个 npm 安装瑕疵 =
+ * 一台起不来且没有遗言的机器)。惰性之后,同一条失败落在 boot 装配点,遗言完整、退出码照旧。
+ */
+export declare function coreArmsAutoOnIntent(): boolean;
+/** 装配面交给读面的四件事实(`main.ts` 从 runnerDeps / 合成后的 caps resolver / 到货位取,读面不自算)。 */
+export interface AutoModeFaceDeps {
+    /** `RunnerDeps.autoMode !== undefined`——**读**装配点那一位,不写字面 true(与 parked-revive 的
+     *  `autoModeSeatMounted` 同一纪律:席位哪天改成有条件挂载,这里不能静默错供)。 */
+    readonly seatMounted: boolean;
+    /** {@link coreArmsAutoOnIntent}(生产装配递探针访问器;测试可递 true 走正控)。false ⇒ `deployment_incapable`。 */
+    readonly engineArmsOnIntent: boolean;
+    /** 合成后的 per-principal caps resolver(= 递给 `RunnerDeps.runtimeCapsResolver` 的同一只:center 客户端
+     *  → observer env 基线 → memory grant → 本地 auto deny,单一属主 boot/runtime-caps.ts)。缺席 = 无任何
+     *  per-principal 源(无 center、无本地 deny)⇒ caps undefined ⇒ 三态之「缺席=不阻」。 */
+    readonly resolveCaps?: ((principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>) | undefined;
+    /** 分类器**配置**的模型路由(server 侧按 core 的 role 回落序 `classifier → summarize → default` 从
+     *  `config.roles` 读到的 catalog 名)。这是「配置了什么」,不是「这次真用了什么」——core 的
+     *  `derivedRouteFallsBack` 可能在运行期回落到主模型;真值候 core 状态座。
+     *  🔴 codex r3 [medium]:是 **getter** 不是快照——config-center 会原地热更新 `config.roles`(Runner 每任务从活引用
+     *  重解),boot 期铸的字符串会在热切换后永久陈旧;生产装配递的 getter 调 `classifierRouteFor({ models: config.models, roles: config.roles })` 并把 fault 记 debug。 */
+    readonly classifierModel?: (() => string | undefined) | undefined;
+}
+export type AutoModeVerdict = {
+    readonly armed: true;
+    readonly model?: string;
+    readonly fault?: undefined;
+} | {
+    readonly armed: false;
+    readonly reason: AutoModeUnarmedReason;
+    readonly model?: string; /** 仅 resolver_fault 臂:错误原文(不上 wire,路由记 warn)。 */
+    readonly fault?: string;
+};
+/**
+ * 三项合取的 server 侧裁决。`requestedMode` 缺席 = 按 auto 意图答(「若请求会不会武装」);`principal` =
+ * 调用方经门验证的身份(匿名 ⇒ undefined ⇒ center 客户端答 undefined,本地 deny 层照样罩)。
+ *
+ * 🔴 resolver 抛错**不吞**:合成腿的每一层都自带 fail-closed/缺席臂(center 客户端 catch-all、grant 腿 onFault),
+ * 走到这里还在抛 = 装配缺陷,读面 500 比一句编出来的 reason 诚实。
+ */
+export declare function judgeAutoModeArming(face: AutoModeFaceDeps | undefined, input: {
+    readonly requestedMode: SettingsPermissionMode | undefined;
+    readonly principal: string | undefined;
+    readonly entitlementSource: boolean;
+    /** 本地 `PERMISSIONS_DISABLE_AUTO_MODE`(= catalog/settings 键 `permissions.disableAutoMode`)是否置 true —— caps false 时分词
+     *  `local_denied` / `org_denied`(seam ⑤;两者对壳的指路不同:改本机 env vs 找组织)。 */
+    readonly localDeny: boolean;
+}): Promise<AutoModeVerdict>;
+//# sourceMappingURL=auto-mode-face.d.ts.map

package/dist/auto-mode-face.js

@@ -0,0 +1,99 @@
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+import { resolveTaskModel } from "@sema-agent/core";
+export function classifierRouteFor(deps) {
+    try {
+        return { id: resolveTaskModel({ modelRole: "classifier" }, deps).model.id };
+    }
+    catch (err) {
+        return { id: undefined, fault: err instanceof Error ? err.message : String(err) };
+    }
+}
+export const AUTO_MODE_UNARMED_REASONS = ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
+export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
+    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\";座缺席)——只属意图武装式,旧式 core 不读模式",
+    deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器);旧式 core 下另含「无 center 源 = 零授予路径」",
+    org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项;旧式 core 下另含「center 在场但未授予」",
+    local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false",
+    settings_denied: "settings 层 permissions.disableAutoMode 取 disable 或 true(两套已发布拼写同义;用户/managed 层 kill-switch)把本 run 折成非 auto —— capabilities 查询串不带 settings,本词由 run 级面产([6128] PM 裁定第六员)",
+    resolver_fault: "per-principal caps resolver 抛错/答非记录(core 同形全拒:autoMode:false + onError phase config)",
+};
+function armingProbeFailure(what) {
+    return new Error(`auto-mode arming probe cannot decide (${what}). This probe answers ONE question — does the INSTALLED @sema-agent/core arm ` +
+        `auto mode from the task's INTENT seat (core #521: spec.autoModeRequested ∧ seat ∧ caps !== false), or from the older ` +
+        `"org grants it" polarity (runtimeCaps.autoMode === true ∧ seat)? The two polarities are OPPOSITE on the permission axis, ` +
+        `so guessing would silently put this deployment on the wrong one — either arming runs the org never granted, or reporting ` +
+        `"not armed" at /v1/capabilities while the engine really is arming (#157: no silent fail-open on the permission axis). ` +
+        `Refusing to start instead. Fix: reinstall the engine (rm -rf node_modules && npm ci) so the package ships its full dist, ` +
+        `or — if core moved/renamed the arming site — update the probe in src/auto-mode-face.ts to read the new one.`);
+}
+export function coreArmsAutoOnIntentProbe(distDir) {
+    const dist = distDir ?? dirname(createRequire(import.meta.url).resolve("@sema-agent/core"));
+    const armingSite = join(dist, "core", "runner", "prepare-task.js");
+    let armingSrc;
+    try {
+        armingSrc = readFileSync(armingSite, "utf8");
+    }
+    catch (err) {
+        throw armingProbeFailure(`the engine's arming site is unreadable at ${armingSite}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (armingSrc.includes(CORE_AUTO_MODE_INTENT_SEAT))
+        return true;
+    const snapPath = join(dist, "..", "test", "export-surface.snapshot.json");
+    let snap;
+    try {
+        const parsed = ExportSurfaceSnapshotSchema.safeParse(JSON.parse(readFileSync(snapPath, "utf8")));
+        if (!parsed.success)
+            throw new Error(`export-surface snapshot shape mismatch: ${parsed.error.issues.map((i) => i.path.join(".") + ":" + i.message).join("; ")}`);
+        snap = parsed.data;
+    }
+    catch (err) {
+        throw armingProbeFailure(`the arming seat is absent from ${armingSite} and the corroborating export-surface snapshot is unreadable at ${snapPath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!snap.exports || typeof snap.exports !== "object")
+        throw armingProbeFailure(`core export-surface snapshot malformed at ${snapPath}`);
+    if (typeof snap.exports.mailboxCrossProcessMountVerdict === "string") {
+        throw armingProbeFailure(`contradiction — the installed core's export surface is at/after the batch that shipped #521, but its arming site ` +
+            `(${armingSite}) never names \`${CORE_AUTO_MODE_INTENT_SEAT}\`, so the engine either moved the arming site or renamed the seat`);
+    }
+    return false;
+}
+const CORE_AUTO_MODE_INTENT_SEAT = "autoModeRequested";
+let armsOnIntentMemo;
+const ExportSurfaceSnapshotSchema = z.object({ exports: z.record(z.string(), z.string()).optional() }).passthrough();
+export function coreArmsAutoOnIntent() {
+    if (armsOnIntentMemo === undefined)
+        armsOnIntentMemo = coreArmsAutoOnIntentProbe();
+    return armsOnIntentMemo;
+}
+export async function judgeAutoModeArming(face, input) {
+    const route = face?.seatMounted ? face.classifierModel?.() : undefined;
+    const model = route !== undefined ? { model: route } : {};
+    if (face?.engineArmsOnIntent && input.requestedMode !== undefined && input.requestedMode !== "auto")
+        return { armed: false, reason: "mode_not_auto", ...model };
+    if (face === undefined || !face.seatMounted)
+        return { armed: false, reason: "deployment_incapable" };
+    let caps;
+    try {
+        caps = face.resolveCaps !== undefined ? await face.resolveCaps(input.principal) : undefined;
+    }
+    catch (err) {
+        return { armed: false, reason: "resolver_fault", ...model, fault: err instanceof Error ? err.message : String(err) };
+    }
+    const deniedWord = input.localDeny ? "local_denied" : "org_denied";
+    if (face.engineArmsOnIntent) {
+        if (caps?.autoMode === false)
+            return { armed: false, reason: deniedWord, ...model };
+        return { armed: true, ...model };
+    }
+    if (caps?.autoMode === true)
+        return { armed: true, ...model };
+    if (caps?.autoMode === false)
+        return { armed: false, reason: deniedWord, ...model };
+    if (!input.entitlementSource)
+        return { armed: false, reason: "deployment_incapable", ...model };
+    return { armed: false, reason: "org_denied", ...model };
+}
+//# sourceMappingURL=auto-mode-face.js.map

package/dist/bench/s1/arms.js

@@ -1,4 +1,4 @@
-import { leafBudgetFields } from "./runner-ctx.js";
+import { leafBudgetFields, s1DebugGit } from "./runner-ctx.js";
 import {} from "./tasks.js";
 import { decideApproval, decidePlan } from "./reviewer.js";
 import { oracleTrulyCorrect, pickOracleVerdicts, armTag, S1_SCHEMA_VERSION, S1_CORE_VERSION, } from "./row.js";
@@ -164,7 +164,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
             vr = await deps.runWithVerification(implSpec);
         }
         catch (e) {
-            if (process.env.S1_DEBUG_GIT)
+            if (s1DebugGit())
                 console.error("[S1 SOLO infra throw]", e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
@@ -176,7 +176,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
                 finishedAt: ctx.clock.now(),
             });
         }
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error("[S1 SOLO vr.status]", vr.status, "| stats:", JSON.stringify(vr.stats)?.slice(0, 200));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         return assembleRow({
@@ -210,7 +210,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
             }
         }
         catch (e) {
-            if (process.env.S1_DEBUG_GIT)
+            if (s1DebugGit())
                 console.error(`[S1 SUP infra throw driver=${trap.supDriver}]`, e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
@@ -222,7 +222,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
                 finishedAt: ctx.clock.now(),
             });
         }
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error(`[S1 SUP vr.status driver=${trap.supDriver}]`, vr.status, "| repairTerminal:", repairTerminal, "| verdict:", vr.verification?.verdict, "| unverifiedReason:", vr.verification?.unverifiedReason, "| checkpointGate:", JSON.stringify(vr.checkpointGate), "| error:", vr.error, "| stats:", JSON.stringify(vr.stats)?.slice(0, 180));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         const runStatus = classifyRunStatus({ status: vr.status, repairTerminal });

package/dist/bench/s1/live-deps.js

@@ -7,7 +7,7 @@ import { createDurableAskPolicy } from "../../approval.js";
 import { createLeaderRunner } from "../../leader/wire.js";
 import { runOracle as runStandaloneOracle } from "./oracle.js";
 import { makeRepairOracle } from "./repair-oracle-adapter.js";
-import { assertDistinctEnvs } from "./runner-ctx.js";
+import { assertDistinctEnvs, s1DebugGit } from "./runner-ctx.js";
 const W = "/home/user";
 const REPO = `${W}/repo`;
 const BASE_REF = "s1-base";
@@ -112,7 +112,7 @@ async function transferWorkerTreeToGrader(worker, grader) {
     const ext = await sh(grader)(`set -e; test -s /tmp/s1-wt.tar; rm -rf ${REPO}; mkdir -p ${REPO}; tar -xf /tmp/s1-wt.tar -C ${REPO}; echo "EXTRACTED=$(ls -A ${REPO} | wc -l)"`);
     if (ext.code !== 0 || !ext.out.includes("EXTRACTED="))
         throw new Error(`s1 grader tar extract failed: ${ext.out.slice(-400)}`);
-    if (process.env.S1_DEBUG_GIT)
+    if (s1DebugGit())
         console.error(`[S1_DEBUG_TAR] head=${head.slice(0, 8)} base=${base.slice(0, 8)} tarBytes=${buf.length} ${ext.out.slice(-60)}`);
     return { head, base };
 }
@@ -141,7 +141,7 @@ async function importBundleBinaryToGrader(grader, tarBuffer, shas) {
     const ext = await sh(grader)(`set -e; test -s /tmp/s1-wt.tar; rm -rf ${REPO}; mkdir -p ${REPO}; tar -xf /tmp/s1-wt.tar -C ${REPO}; echo "EXTRACTED=$(ls -A ${REPO} | wc -l)"`);
     if (ext.code !== 0 || !ext.out.includes("EXTRACTED="))
         throw new Error(`s1 grader tar extract failed: ${ext.out.slice(-400)}`);
-    if (process.env.S1_DEBUG_GIT)
+    if (s1DebugGit())
         console.error(`[S1_DEBUG_TAR team] head=${shas.head.slice(0, 8)} base=${shas.base.slice(0, 8)} ${ext.out.slice(-60)}`);
     return shas;
 }
@@ -196,7 +196,7 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
             state.shas = await transferWorkerTreeToGrader(worker, grader);
         const task = { ...oracleTaskFromTrap(trap), ...(state.shas ? { deliveredShas: state.shas } : {}) };
         const v = await runStandaloneOracle(grader, graderTransport(grader), worker, task);
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error(`[S1_DEBUG_ORACLE ${trap.id}] delivered=${v.delivered} tests=${v.hiddenTestsGreen} build=${v.buildPassed} inv=${v.invariantsOk} | raw=`, JSON.stringify(v.raw)?.slice(0, 700));
         return v;
     };
@@ -250,27 +250,27 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
                         execFileSync("git", ["clone", "-q", "--branch", branch, remoteUrl, cloneDir], { stdio: ["ignore", "ignore", "pipe"] });
                     }
                     catch (e1) {
-                        if (process.env.S1_DEBUG_GIT)
+                        if (s1DebugGit())
                             console.error(`[S1_DEBUG_IMPORT] cp clone --branch ${branch} failed: ${e1.stderr?.toString().slice(-200)}; retrying default`);
                         execFileSync("git", ["clone", "-q", remoteUrl, cloneDir], { stdio: ["ignore", "ignore", "pipe"] });
                     }
                     const baseHash = execFileSync("git", ["-C", cloneDir, "rev-list", "--max-parents=0", "HEAD"]).toString().trim().split("\n").pop().trim();
                     const head = execFileSync("git", ["-C", cloneDir, "rev-parse", "HEAD"]).toString().trim();
                     if (!/^[0-9a-f]{40}$/.test(baseHash) || head === baseHash) {
-                        if (process.env.S1_DEBUG_GIT)
+                        if (s1DebugGit())
                             console.error(`[S1_DEBUG_IMPORT] cp integrated tree not delivered: head=${head} base=${baseHash}`);
                         return false;
                     }
                     const bundlePath = join(tmp, "team.bundle");
                     execFileSync("git", ["-C", cloneDir, "archive", "--format=tar", "-o", bundlePath, "HEAD"], { stdio: ["ignore", "ignore", "pipe"] });
                     const buffer = readFileSync(bundlePath);
-                    if (process.env.S1_DEBUG_GIT)
+                    if (s1DebugGit())
                         console.error(`[S1_DEBUG_IMPORT] cp integrated head=${head} base=${baseHash} tar bytes=${buffer.length}`);
                     state.teamBundle = { buffer, head, base: baseHash };
                     return true;
                 }
                 catch (e) {
-                    if (process.env.S1_DEBUG_GIT)
+                    if (s1DebugGit())
                         console.error(`[S1_DEBUG_IMPORT] control-plane THREW:`, e instanceof Error ? e.message : String(e));
                     return false;
                 }
@@ -361,7 +361,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     process.env.LEADER_CONFLICT_ROUNDS = process.env.LEADER_CONFLICT_ROUNDS ?? "2";
     const run = createLeaderRunner({
         brain, models, roles, pricing, e2bApiKey: rt.e2bApiKey, workspace: W,
-        ...(process.env.S1_DEBUG_GIT ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
+        ...(s1DebugGit() ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
     });
     const teamSeedWrite = (trap.seedFiles ?? [])
         .map((f) => {
@@ -415,13 +415,13 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
         });
     }
     catch (e) {
-        if (process.env.S1_DEBUG_GIT)
+        if (s1DebugGit())
             console.error(`[S1_DEBUG_LEADER ${trap.id}] run() THREW:`, e instanceof Error ? (e.stack ?? e.message) : String(e));
         killDaemon();
         rmSync(baseDir, { recursive: true, force: true });
         return { ok: false, reports: [], infraFailed: true };
     }
-    if (process.env.S1_DEBUG_GIT)
+    if (s1DebugGit())
         console.error(`[S1_DEBUG_LEADER ${trap.id}] ok=${res.ok} error=${JSON.stringify(res.error)} cancelled=${res.cancelled} merge=${JSON.stringify(res.merge)} repairTerminal=${res.repairTerminal} reports=${(res.reports ?? []).length} reportsDetail=${JSON.stringify((res.reports ?? []).map((r) => ({ w: r.workerId, ok: r.ok, err: r.error })))?.slice(0, 400)}`);
     let imported = false;
     const merged = res.merge?.ok === true;

package/dist/bench/s1/run-firm.js

@@ -7,6 +7,7 @@ import { makeBenchClock } from "./runner-ctx.js";
 import { buildS1Report, S1_SCHEMA_VERSION, S1_CORE_VERSION } from "./row.js";
 import { armTag } from "./row.js";
 import { buildLiveDeps, liveRuntimeConfigFromEnv } from "./live-deps.js";
+import { setS1DebugGit } from "./runner-ctx.js";
 export function enumerateCells(seeds, filter = {}) {
     const cells = [];
     const source = filter.only ? ALL_TRAPS : FIRM_TRAPS;
@@ -184,6 +185,7 @@ function parseArgs(argv) {
     const cellTimeoutMs = positiveIntArg(get("cell-timeout-ms"), 15 * 60_000, "--cell-timeout-ms");
     return {
         dryRun: argv.includes("--dry-run"),
+        debugGit: argv.includes("--debug-git"),
         seeds,
         cellTimeoutMs,
         ledgerPath: get("ledger") ?? path.resolve(`./s1-out/${runId}.ledger.jsonl`),
@@ -234,6 +236,7 @@ function dryRunMockFactory() {
 }
 export async function main(argv = process.argv.slice(2)) {
     const args = parseArgs(argv);
+    setS1DebugGit(args.debugGit);
     const liveRuntime = liveRuntimeConfigFromEnv();
     if (!args.dryRun && !liveRuntime) {
         console.error("[s1 run-firm] LIVE path refused: E2B_API_KEY + DEEPSEEK_API_KEY are required (the brain gateway). " +

package/dist/bench/s1/runner-ctx.d.ts

@@ -17,6 +17,10 @@
  * + the clock; a deterministic shape test exercises it with a MOCK runner (no real agents, no keys).
  */
 import type { ExecutionEnv } from "@sema-agent/core";
+/** 由 bench 入口(`run-firm.ts` 的 `--debug-git`)翻开;不调 = 关。 */
+export declare function setS1DebugGit(on: boolean): void;
+/** tar/import/oracle/leader 四族 stderr 追踪开着没有(读侧单点)。 */
+export declare function s1DebugGit(): boolean;
 /**
  * The budget block the budget-match guard compares. NOT a s1.v1 RawRow field (the contract carries no budget) —
  * it is a PRODUCER-side fairness descriptor (one per emitted cell). `teamWorkerBudgetSumUsd` is the bigger-pie

package/dist/bench/s1/runner-ctx.js

@@ -1,3 +1,10 @@
+let debugGit = false;
+export function setS1DebugGit(on) {
+    debugGit = on;
+}
+export function s1DebugGit() {
+    return debugGit;
+}
 export function budgetDescriptor(budget, arm, teamWorkerBudgetSumUsd) {
     return {
         modelId: budget.modelId,