@sema-agent/server 7.55.0 → 7.57.0

package/dist/config-types.d.ts

@@ -145,16 +145,36 @@ export interface A2aServeConfig {
  *  the default base ref) live here so image-api injects only VETTED, server-fixed values into the build.sh argv —
  *  operator free-text never reaches the runner. */
 /** [ref] 车3([ref] 流内审批协议)的配置面。总开关默认 **true**(clay 裁 2026-08-08,[ref] 翻真验证后;
- *  树上已生效,发布线落在 7.4.0 之后的下一个发布);四个从属旋钮只在开关为真时生效
+ *  树上已生效,发布线落在 7.4.0 之后的下一个发布);从属旋钮**除 `windowMs` 外**只在开关为真时生效
+ *  ([ref]:`STREAM_ASK_WINDOW_MS` 是活卡窗长,与协议上不上场解耦 —— 逐条辖域见各字段域注)
  *  (语义与「谁需要 / 谁被伤 / 什么补偿」三问见 `ServiceConfigFlat.streamApproval` 的注)。 */
 export interface StreamApprovalConfig {
     /** 协议总开关。`STREAM_APPROVAL_ENABLED`,默认 **true**(clay 裁 2026-08-08,[ref] 翻真验证后;7.5.0 起)。显式 false ⇒ 全链逐字 7.3.0 前行为(唯一干净还原键)。
      *  翻真要等回决端点(车4)与对账收敛器(车5)到位——在此之前是个不完整协议(有卡无正规回决口、
      *  有 PARKING 无收敛器、跨副本回决无唤醒路径)。 */
     enabled: boolean;
-    /** 开关为真时作为 `ToolApprovalCoordinator` 的 `ttlMs`([ref] §3.3 的「配置窗默认」)。
-     *  `STREAM_ASK_WINDOW_MS`,默认 **300000**(同裁与 sync 腿既有 5min 活卡窗对齐)。`0` = 运维显式关窗 ⇒ 恒 park(§3.3 窗=0 语义)。
-     *  开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)。 */
+    /** `ToolApprovalCoordinator` 的 `ttlMs` —— **一只活卡等人多久**([ref] §3.3 的「配置窗默认」)。
+     *  `STREAM_ASK_WINDOW_MS`,默认 **300000**(同裁与 sync 腿既有 5min 活卡窗对齐)。
+     *
+     *  🔴 **辖域([ref] 起):无条件** —— 本值在**每一条**呈活卡的腿上生效,与流内协议上不上场无关
+     *  (`DB_BACKEND=local` / 无 park 设施 / `STREAM_APPROVAL_ENABLED=false` 的部署同样按它计窗)。
+     *  旧文「开关为假 ⇒ 本值不参与,窗保持既有 `DEFAULT_APPROVAL_TTL_MS`(5min)」是**已修的病**,不是
+     *  设计:那让一根部署级旋钮的生效与否挂在装配在场性上,运维配了它、没有任何一行说它没生效
+     *  (clay 令:部署级旋钮禁挂在场性派生腿)。缺省值与那个常量同为 300000 ⇒ **没配过这根 env 的部署
+     *  字节不变**;协议上不上场改变的是**持久层与协议帧**(ask 行 / 重放 / 迟到赎回),不是窗长。
+     *
+     *  `0` = 运维显式关窗 ⇒ **不发任何审批卡**,每只受门 ask 在铸造时刻直接走 `unattendedAskOutcome()`
+     *  (§3.3 窗=0 语义;[ref] 起两条车道同义 —— 此前 `0` 在协议不上场的腿上被静默读成「5min 活卡」)。
+     *  该形有 park 设施 ⇒ 全落 durable park(经 `POST /v1/approvals/:sessionId/decide` 兑现);无 park 设施
+     *  或 `UNATTENDED_APPROVAL_POLICY=deny` ⇒ core fail-closed 拒 = **受门工具全关**,故 boot 期有一行
+     *  `stream_ask_window_zero` 点名(`boot/coordinators.ts`)。
+     *  **坏值拒启两侧**([ref]):负值(`-1` 此前静默落成「立即到期」并白发一张没人赢得了的卡)与
+     *  **超过 Node 定时器上界 `2147483647`(2^31−1 ms ≈ 24.8 天)的值**(codex r1-[high]:`setTimeout` 把更大的
+     *  delay 静默折成 1ms ⇒ 想调长反而立即到期;跨旋钮门只管 `窗 + adhoc宽限 < orphanTtl`,而 orphanTtl 域上界
+     *  90 天,所以 30 天的窗此前合法通过)—— 两侧都点名拒启,不夹取。
+     *
+     *  窗到期的**去向**不由本键决定(`UNATTENDED_APPROVAL_POLICY` + park 设施在场性决定),本键只决定
+     *  「等多久」。悬挂 ask(零活流铸造,[ref] 案A)走的是 `unreachedTtlMs`,不是本键。 */
     windowMs: number;
     /** 开流重放(§5)每次最多投几张未决卡——**读面**的帽,超出只投最新的并记一次 warn,开流不失败。
      *  `STREAM_APPROVAL_REPLAY_MAX`,默认 **50**。 */
@@ -512,10 +532,12 @@ export interface ServiceConfigFlat {
      *  `open` 的故障极性**相反**,一个被静默折成缺省的拼写错误会让合规部署在故障窗里放行留存必需用户的 opt-out。
      *  core 侧 `prepareConfigDoors` 另有同判门(`config.memory_capture_policy`),两道同向不冲突。
      *
-     *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。本批唯一源 = SQL 后端上的
-     *  `memory_optout_grant` 表(S-2;center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema
-     *  的独立小件,到货前不算源)。governed 而无源 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
+     *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。源**两条**(析取,[ref] 起):
+     *  SQL 后端上的 `memory_optout_grant` 表(S-2),或非 dry-run 的 config center 发 `EntitlementRuntimeCaps.allowMemoryOptOut`
+     *  (settings-schema 1.4.0 到货)。两源皆无 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
      *  `boot/runtime-caps.ts` 的 `assertMemoryCapturePolicyWirable` 在启动期拒启(与 consolidation 阀门 D1 同姿态)。
+     *  ⚠️ [ref]:center 那一臂只证「源在场」,不证 center 会**发**这个可选键 —— center-only 的部署起动后仍可能次次拒,
+     *  两处 warn 把它响亮化(`memory_capture_governed_center_only_source` / `memory_capture_governed_verdict_absent`)。
      *
      *  ⚠️ **部署席 ONLY**:TaskSpec 无同名键;不冻进 checkpoint(resume 腿跟当前部署配置走,core 成文)。
      *  运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.capturePolicy`(`null`=本部署未设)。 */
@@ -1270,6 +1292,13 @@ export interface ServiceConfigFlat {
      *  other value (incl. `"off"`) is treated as unset — this knob has no "off" value to opt BACK OUT with once a
      *  session's baseline already tightened elsewhere (tightenTaskSpec would reject that as a loosen anyway). */
     manualModeShellGate?: "always" | "classify";
+    /** [ref] ③(黑板 [ref]/[ref],core [ref] 合修)—— CC `permissions.disableAutoMode` 的本地镜像
+     *  (`PERMISSIONS_DISABLE_AUTO_MODE`,布尔词表旋钮,opt-in 缺省 false):本部署对**每个** principal 把
+     *  `RuntimeCaps.autoMode` 折成 `false` = org deny 位(core [ref] 三态谓词 `runtimeCaps?.autoMode !== false`
+     *  的拒臂)。**tighten-only**:center 授予 `true` 翻不回;未设 = 不动 caps(无 center 的部署 caps 仍缺席 ⇒
+     *  「缺席=不阻」⇒ 壳发 `permissionMode:"auto"` 即武装)。词表外的值 boot 拒启(安全轴旋钮不许静默回默认)。
+     *  合成点 = `boot/runtime-caps.ts` 最外层(applyLocalAutoModeDeny);读面 = `/v1/capabilities.permissionModeAuto`。 */
+    permissionsDisableAutoMode: boolean;
     /** [ref]④ defer face (EXPERIMENTAL, default OFF): mark the default scenario's LONG-TAIL first-party tools
      *  (today = SelectEnvironment only) `defer:true` (core tool-disclosure: the model sees a placeholder until it
      *  ToolSearch-loads the schema). Assessment says the win is marginal for us (spec.tools total ≈4.2k tokens, of
@@ -1400,8 +1429,10 @@ export interface ServiceConfigFlat {
      *  `DEFAULT_APPROVAL_TTL_MS` 对齐——「开协议」不再顺带把窗砍短)。⚠️ 版本坐标:翻转**已在树上生效**,
      *  发布线上落在 7.4.0 之后的下一个发布,所以一台自报 7.4.0 的**已发布** worker 仍是 OFF,别只按
      *  `/health` 的版本号推默认。显式 `STREAM_APPROVAL_ENABLED=false` 是**唯一干净还原键** ⇒ 全链逐字回到
-     *  翻转前行为:不发 `approval_request` 帧、不落 `approval_ask` 行、不起收敛器腿、窗 = 既有
-     *  `DEFAULT_APPROVAL_TTL_MS`(5min)、`askStore` 不注入协调器。
+     *  翻转前行为:不发 `approval_request` 帧、不落 `approval_ask` 行、不起收敛器腿、`askStore` 不注入
+     *  协调器。⚠️ **窗不在这份还原清单里了([ref])**:`STREAM_ASK_WINDOW_MS` 自此在关协议的部署上照样
+     *  生效(缺省 300000 == `DEFAULT_APPROVAL_TTL_MS` ⇒ 没配过它的部署仍然字节不变),理由见
+     *  `StreamApprovalConfig.windowMs` 的辖域段。
      *
      *  **旋钮为什么存在(2026-08-08 翻转前的成文前提,已被上面的裁定取代,留作沿革)**:那一版默认 false +
      *  60s 窗,三问记的是那个世界——
@@ -1597,7 +1628,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate" | "permissionsDisableAutoMode">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.d.ts

@@ -169,6 +169,27 @@ export declare const hostExecSpoolEnabled: () => boolean;
  *  a loud CONFIG_NOTICES line ("removed-1m"); the center lane's roster culture is explicit declaration.
  *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
+/**
+ * [ref] 件⑤ —— 思考档两键的**闭集词表**与拒启判据(`MODEL_DEFAULT_THINKING` / `MODEL_REASONING_EFFORT_LEVELS`)。
+ *
+ * 改前两键都走 `isThinkingLevel(...)` **过滤**:拼错的词被**静默丢掉**,而两根旋钮的失败方向恰好都是
+ * 「把运维的意图反向执行」——
+ *  · `MODEL_DEFAULT_THINKING=hight` ⇒ `defaultThinking` 不铸键 ⇒ 全部任务回落到「无模型级默认档」,
+ *    运维以为整台机器抬到了 high;
+ *  · `MODEL_REASONING_EFFORT_LEVELS=med,high` ⇒ 只剩 `["high"]`;写成 `med` 一个词则整键落空、
+ *    `compat` 不铸 ⇒ 回落 core 的保守梯(`minimal|low|medium|high`),`xhigh`/`max` 被 clamp 下来。
+ *    运维配这根旋钮的**全部用途**就是告诉引擎「本端点吃得下更高档」,静默落空 = 高档永远上不去。
+ * 两条都是 `MODEL_DEGRADE_ON` / `TASK_TIMEOUT_SEC` 那条族律的同形([ref] A 档:坏值拒启,不静默折默认),
+ * 所以改成 boot 响亮拒 —— 与 `MODEL_DEGRADE_ON` 的 `parseDegradeOn` 逐字同款(点名坏词 + 列合法词)。
+ *
+ * 词表用 `Record<ThinkingLevel, true>` 铸 = 与 llm-core 锁步:上游加一档而这里不补 ⇒ **编译红**
+ * (`MODEL_DEGRADE_ON` 的 `Set<DegradeReason>` 同款纪律);目录行的 `enumValues` 由本表派生,
+ * 「文档写五档、代码收六档」那种分叉在类型层就不可能发生。
+ */
+type ModelThinkingLevel = NonNullable<Model["defaultThinking"]>;
+/** 六档闭集(有序:低→高,取自上表的书写序),目录行 `enumValues` 与两条拒因文案的单一真源。
+ *  (`CATALOG_RESTART_SLICES = Object.keys(RESTART_SLICE_SET)` 同款派生式。) */
+export declare const THINKING_LEVELS: readonly ModelThinkingLevel[];
 /**
  * 一条工具名**永不匹配任何现役工具**的三种拼法,及其修正指引。审批/权限名单是 server 侧 ToolPolicy 的
  * RAW 逐字比对(canonicalToolName 折叠面已随 core 5.0.0 [ref] 退役),所以写错的名字不会报错、只会静默

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -521,7 +521,8 @@ function noticeAutoCompactAboveWindow(slot, envName, m) {
             model: m.id,
             value: String(act),
             contextWindow: String(window),
-            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window, so a value above the physical window means autocompaction effectively never fires and the destructive context guard truncates history instead (the opposite of what this knob is for). The value is applied as configured (not clamped, not rejected); lower it below the window — CC's own shape is window-33000.`,
+            clampedTo: String(window),
+            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window and CLAMPS it to the physical window (resolveTriggerWindow), so this knob is a NO-OP here: the trigger geometry falls back to ${window} and core mints one config.autocompact_window_clamped notice per prepare. server neither clamps nor rejects the value (clamping is core's, at the read site); lower it below the window to make the knob do something — CC's own shape is window-33000.`,
         },
     });
 }
@@ -637,8 +638,8 @@ function parseModelDomain() {
         return "gateway";
     })();
     const extraBody = buildExtraBody();
-    const thinkingDefault = (() => { const v = process.env.MODEL_DEFAULT_THINKING; return v && isThinkingLevel(v) && v !== "off" ? v : undefined; })();
-    const effortLevels = (process.env.MODEL_REASONING_EFFORT_LEVELS ?? "").split(",").map((s) => s.trim()).filter((s) => isThinkingLevel(s) && s !== "off");
+    const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
+    const effortLevels = parseReasoningEffortLevels(csv("MODEL_REASONING_EFFORT_LEVELS"));
     const model = {
         id: modelId,
         name: modelId,
@@ -777,6 +778,32 @@ function parseModelDomain() {
             : undefined,
     };
 }
+const THINKING_LEVEL_TABLE = { minimal: true, low: true, medium: true, high: true, xhigh: true, max: true };
+export const THINKING_LEVELS = Object.keys(THINKING_LEVEL_TABLE);
+const isThinkingTier = (w) => THINKING_LEVELS.includes(w);
+function parseDefaultThinking(raw) {
+    const v = raw?.trim();
+    if (v === undefined || v === "")
+        return undefined;
+    if (v === "off")
+        return undefined;
+    if (!isThinkingTier(v)) {
+        throw new Error(`env MODEL_DEFAULT_THINKING="${v}" is not a thinking tier — valid: ${THINKING_LEVELS.join(" | ")} | off ` +
+            `("off" = no model-level default). A typo used to be dropped SILENTLY, leaving the deployment on no default at all (#210 A 档).`);
+    }
+    return v;
+}
+function parseReasoningEffortLevels(words) {
+    if (words.length === 0)
+        return [];
+    const bad = words.filter((w) => !isThinkingTier(w));
+    if (bad.length > 0) {
+        throw new Error(`env MODEL_REASONING_EFFORT_LEVELS has unknown tier(s): ${bad.join(", ")} (valid: ${THINKING_LEVELS.join(" | ")})` +
+            `${bad.includes("off") ? ' — "off" belongs to MODEL_DEFAULT_THINKING (no model-level default), it is not an effort tier an endpoint can accept' : ""}. ` +
+            `Bad words used to be dropped SILENTLY, narrowing the declared ladder without a word (#210 A 档).`);
+    }
+    return words.filter(isThinkingTier);
+}
 const DEGRADE_ON_WORDS = new Set(["breaker_open", "rate_limit", "budget", "server_error", "last_resort"]);
 function parseDegradeOn(words) {
     if (words.length === 0)
@@ -853,6 +880,7 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
 function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
@@ -866,6 +894,12 @@ function streamApprovalConfig(gates) {
         orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
         unreachedTtlMs: numEnvBounded("UNREACHED_ASK_TTL_MS", String(60 * 60 * 1000), 60_000, 24 * 60 * 60 * 1000),
     };
+    if (cfg.windowMs < 0) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} must not be negative — 0 means "close the window" (every gated ask goes straight to the unattended outcome and NO approval card is emitted), any positive value is the live-card window in ms. A negative value used to emit a card nobody could ever win.`);
+    }
+    if (cfg.windowMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} exceeds the Node timer ceiling ${MAX_TIMER_DELAY_MS} (2^31-1 ms ≈ 24.8 days) — setTimeout SILENTLY collapses a larger delay to 1ms, so the window you meant to lengthen would expire immediately and every gated ask would take the unattended route on the next tick. Pick a window at or below the ceiling (and remember STREAM_ASK_WINDOW_MS + STREAM_APPROVAL_ADHOC_GRACE_MS must stay strictly below STREAM_APPROVAL_ORPHAN_TTL_MS).`);
+    }
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
@@ -945,6 +979,7 @@ function parseApprovalDomain(ctx) {
                 `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Classify" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
+        permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
         mcpElicitation: {
             enabled: boolEnv("MCP_ELICITATION_ENABLED", false),
             throttle: {
@@ -1757,7 +1792,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "manualModeShellGate",
+    "sensitiveWritePatterns", "manualModeShellGate", "permissionsDisableAutoMode",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/http/route-ctx.d.ts

@@ -47,6 +47,24 @@ export interface RouteHelpers {
     rateLimited(req: IncomingMessage, res: ServerResponse): boolean;
     quotaExceeded(req: IncomingMessage, res: ServerResponse): boolean;
     leaseDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    /**
+     * 🔴 **[ref]:按**付费**方(不是请求方)判的成本配额准入 —— {@link quotaExceeded} 的孪生。**
+     *
+     * `quotaExceeded` 键在 `gatedPrincipal(req)` = 谁点的按钮;本门键在**这笔钱记谁的账**。两者在自助
+     * 场景恒相等,在「显式 operator 代别人动手」的场景不等 —— 那正是配额上限被绕过的那一支。
+     * 参数 `owner` 由调用点从**已属主校验过的那一行**取(run 行的 `owner` / checkpoint 的 scope),
+     * 本门不自己推身份(推得出来就说明调用点还有第二个身份源,那才是病)。
+     * `undefined`(匿名/开放行)⇒ 无付费方 ⇒ 不 gated,与 `quotaExceeded` 的成文语义同判。
+     * 拒 = 429 + `Retry-After`,码/文案/extras 与 `quotaExceeded` 逐字同一套。
+     * 位序纪律:**必须排在本路由的 owner 门之后**(反枚举 —— 否则 429 会变成「这行存在且它属主超顶了」
+     * 的谕示);且排在真正驱动模型之前。
+     */
+    ownerQuotaDenied(res: ServerResponse, owner: string | undefined): boolean;
+    /** 🔴 **[ref]:{@link ownerQuotaDenied} 的 lease 孪生 —— 按**付费**方判的 fleet-lease 准入。**
+     *  `leaseDenied` 键在请求方;本门键在付费方(`driveResumeLeg` 的 `fleetLease.admit(卡属主)` 早就是这个
+     *  语义,本位把它交给路由域)。两门在自助场景恒同答,在「operator 代别人动手」时不同 —— 那正是
+     *  「拿自己的额度去烧别人的账」的那一支。同样必须排在 owner 门之后、驱动之前。 */
+    ownerLeaseDenied(res: ServerResponse, owner: string | undefined): Promise<boolean>;
     /** [ref]-T1:治理窗 pre-admission(异步 202 车道的唯一 429 出路;key 公式与 core 单源)。 */
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
@@ -79,6 +97,17 @@ export interface RouteRequestState {
     streamDetached: boolean;
     /** 凭证派生的调用方系统身份(`source`)。handle() 的鉴权门是**唯一**赋值点,域模块只读。 */
     source: string | null;
+    /**
+     * [ref] 件2(cli [ref] sema-bug4 (c)):本请求驱动的那条 run 的**终局**(`completed` / `failed` /
+     * `suspended` / …)与结构化失败码。`handle()` 的 `request` 日志行读它 —— 让「端点 200 ≠ 模型成功」
+     * 这条歧义消失(取证:模型 connect timeout 的那一刻,日志里唯一的行是 `request status:200`)。
+     *
+     * 赋值点在 `routes/tasks.ts`(`/v1/tasks` 与 `/v1/tasks/stream` 两腿的终局到手处);拿不到 run 结果
+     * (受理即拒 / 幂等重放 / 非任务端点)⇒ **键缺席**,绝不写 null —— 缺席 = 「这条请求没驱动 run」,
+     * 与「run 结果不明」是两句话,而 `null` 会把两者压成一个形。
+     */
+    runStatus?: string;
+    runErrorCode?: string;
 }
 /** B4①(命名化):`prepareSpec` 的返回形(tasks.ts/runs.ts 两域共同消费的属性面)——原为 6 成员内联匿名对象。
  *  命名后好处不只是过 B4 门:两个消费域现在都能对同一个符号做 `import type` 标注,而不是各自重推断结构。 */
@@ -141,6 +170,52 @@ export interface DriveResumeArgs {
      *  **唯一不设此位的**是内部 D-D SLA deny-sweep:它没有在等响应的人,提前受理对它零收益,而且那条
      *  循环靠 `await` 串行给每 tick 的重活限流(见其调用处的登记注)。 */
     acceptEarly?: boolean;
+    /**
+     * 🔴 **[ref](codex 交叉复审 r2-[medium] 验真后修):这条腿是**调用方发起**的吗?**
+     *
+     * `true` = 有人在 HTTP 上点了按钮(resume / plan_review / wake / decide / 赎回席)⇒ 吃按**付费方**
+     * (卡属主)判的成本配额准入(`ownerCostQuotaDenied`)。缺席/`false` = **部署自己的结算腿**
+     * (内部 D-D SLA deny-sweep)⇒ **不吃**那道门。
+     *
+     * 为什么系统腿必须豁免(亲核后改的判据,首版曾一并拦下 sweep):sweep 的活是把过了 SLA 的卡**结算掉**
+     * (graceful deny → 行收敛 → 释放 `task_active` claim)。拦住它并不能省钱,只会让超顶租户的卡**挂着**
+     * —— 而挂多久的兜底**比首版注释里写的差得多**:`checkpoint-store-sql.ts` 的 `reapExpired` 在
+     * **deadline 分支**上逐字排除了 `APPROVAL_GATE_KINDS`(`gate_kind NOT IN (…) OR tool_name='AskUserQuestion'`),
+     * 所以一张过期的 human / irreversible_ask 卡根本不走那条腿;真正兜住它的只有绝对 backstop
+     * `terminal_at_ms`(`TERMINAL_BACKSTOP_MS` 默认 **30 天**)。于是「拦 sweep」= 把一个由
+     * `APPROVAL_TIMEOUT_SEC` 界定的 SLA 换成「等成本窗滚过(`COST_QUOTA_WINDOW_SEC` 默认 24h)、最坏等 30 天」,
+     * 并且整段时间攥着会话 claim。**方向也自洽**:deny 是**停下**这条 run 的动作,为了省钱而拒绝执行「停」
+     * 与 preempt 路由早就成文的那句同一条(「否则超顶租户连自己的花费都停不下来」)。
+     *
+     * 判别子取 `req` 的在场与否 —— 这在 `resumeCheckpoint` 里**已经是**「系统腿 vs 调用方腿」的既有判据
+     * (绑定强制、parked 分流两处都写着 `req !== undefined` 与「内部 D-D SLA deny-sweep(req 缺席)豁免」),
+     * 本位只是把同一条判据显式化成一个有名字的位,而不是让下游去猜。
+     * ⚠️ **射程覆盖两道门**:紧邻的 fleet-lease 准入(`ownerFleetLeaseDenied`)读**同一位** —— [ref] 件⑤②
+     * (codex r3-[high])把它一并改吃了 `callerInitiated`,理由与三问逐字同 cost 半场。
+     * 🔴 本句是 [ref] R4 改写的(2026-09-03,7.57.0 发车前合并重扫 wf_1abaaa9a):此处原文写着「紧邻的
+     * fleet-lease 准入**没有**这条豁免(对 sweep 一视同仁),本批不动它,分歧已登记为遗留」—— 那是**同一批
+     * 件⑤② 落地之前**的话,件⑤② 修好后这条 JSDoc 没跟着改,于是注释与代码正相反(亲读
+     * `server.ts` 的 `ownerFleetLeaseDenied` 消费点:两处都是 `args.callerInitiated === true` /
+     * `req !== undefined`)。两道门在这一位上**无分歧**,[ref] 上也没有这一项。
+     */
+    callerInitiated?: boolean;
+    /**
+     * 🔴 **[ref] codex 对抗复审 r1-F3 [medium](验真后修):本次请求的属主 lease 准入**已经做过了**。**
+     *
+     * `resumeCheckpoint` 在 parked 子代赎回分流**之前**先判一次属主 lease([ref] R3:那条腿提前 `return`,
+     * 结构上够不到 `driveResumeLeg` 的同一道门)。分流**未命中**时请求落回 legacy 腿,于是同一条请求、
+     * 同一个付费方会向 center 协商**两次**。cost 半场可以「过两次门」(本地同步、纯读);lease 半场**不行**:
+     * `FleetLeaseManager.admit` 的五条 fail-open 路径(center 不可达 / 5xx / 超时 / 401-403 / 畸形响应)
+     * 一律**不写缓存态**(亲读 `fleet-lease.ts` 的 `issueOrRenewInner`),而 single-flight 只合并**并发**调用 ——
+     * 两道门是串行的 ⇒ 半开 center 下一个请求连吃两次 `LEASE_FETCH_TIMEOUT_MS`,持续故障时整条 legacy
+     * resume 车道把控制面负载翻倍。
+     *
+     * 所以由上游把「已受理」这个事实传下来,`driveResumeLeg` 据此跳过重复协商。**安全性**:两处的键是
+     * **同一个表达式**(`decodeCheckpointScope(cp.scope)`,上游门与下游 `auth.principal` 同源),射程条件也
+     * 同一条(`req !== undefined` ⇔ `callerInitiated`)⇒ 跳过的是一次**逐字相同**的判定,不是一道门。
+     * 缺席/`false` ⇒ 照常自己判(其余三条驱动腿与 sweep 一字不变)。
+     */
+    ownerLeaseAdmitted?: boolean;
 }
 /** 提交/续跑「腿」= 跨域共享的**有状态**长流程(不像 {@link RouteHelpers} 那样只依赖 deps/config:它们要写
  *  run log、发 fleet 帧、走 markResuming CAS、驱动模型)。A9 上批的停点就在这里——tasks/runs 两域共用
@@ -198,10 +273,16 @@ export interface RouteLegs {
         status: number;
         body: object;
     }>;
-    /** assistant 抢占腿的复位(gate-kind 守卫 + 驱动)。 */
+    /** assistant 抢占腿的复位(gate-kind 守卫 + 行级属主复核 + 驱动)。 */
     resumePreempted(sessionId: string, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/resume` 腿传 `true`。 */
-    acceptEarly?: boolean): Promise<{
+    acceptEarly?: boolean, 
+    /** [ref]②([ref]):调用方已验身份的裁定 —— 腿内在被真正载入的 checkpoint 行上重跑属主判
+     *  ([ref] R3 同形;缺席 = 匿名 dev 部署,不咬)。 */
+    decider?: {
+        principal?: string;
+        explicitOperator: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;
@@ -221,7 +302,13 @@ export interface RouteLegs {
         principalPresent?: boolean;
     }, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
-    acceptEarly?: boolean): Promise<{
+    acceptEarly?: boolean, 
+    /** [ref]②([ref]):调用方已验身份的裁定(直连门 = HMAC 验出的 principal)—— 腿内行级属主复核
+     *  ([ref] R3 同形;缺席 = 匿名 dev 部署,不咬)。 */
+    decider?: {
+        principal?: string;
+        explicitOperator: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/routes/a2a-serve.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
+import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal-log.js";
 import { A2A_TASK_STATES } from "@sema-agent/core";
-import { isParkedRunStatus } from "../../plugins/store-contracts.js";
+import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError } from "../send.js";
@@ -80,10 +81,11 @@ function statusTextForRun(run, state) {
         return "this task is suspended awaiting an approval decision on the serving deployment; it resumes once that decision is made";
     if (run.result?.result)
         return run.result.result;
+    const memo = (seat, raw) => (isTerminalRunStatus(run.status) ? memoRedactedRead(`a2a.${seat}`, raw, (v) => redactErrorMessage(v) ?? "") : (redactErrorMessage(raw) ?? ""));
     if (run.error)
-        return run.error;
+        return memo("error", run.error);
     if (run.result?.errorMessage)
-        return run.result.errorMessage;
+        return memo("errorMessage", run.result.errorMessage);
     return undefined;
 }
 function taskFromRun(run, stale) {

package/dist/http/routes/approvals-assistant.js

@@ -107,6 +107,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 : (principal ?? "__none__");
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
+                serverNowMs: Date.now(),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
             });
@@ -299,7 +300,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const out = await resumePreempted(run.sessionId, req, true);
+            const out = await resumePreempted(run.sessionId, req, true, { principal, explicitOperator });
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
@@ -365,7 +366,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true);
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, { taskId, principalPresent: principal !== undefined }, true, { principal: deciderPrincipal, explicitOperator });
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
@@ -520,9 +521,20 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
 const APPROVALS_STREAM_POLL_MS = 3000;
 function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
-    if (rd === null || rd === undefined || typeof rd.shadowedRule !== "string")
+    if (rd === null || rd === undefined)
         return row;
-    return { ...row, riskDescriptor: { ...rd, shadowedRule: redactSecrets(rd.shadowedRule) } };
+    const shadowedRule = typeof rd.shadowedRule === "string" ? redactSecrets(rd.shadowedRule) : undefined;
+    const summary = typeof rd.summary === "string" ? redactSecrets(rd.summary) : undefined;
+    if (shadowedRule === undefined && summary === undefined)
+        return row;
+    return {
+        ...row,
+        riskDescriptor: {
+            ...rd,
+            ...(shadowedRule !== undefined ? { shadowedRule } : {}),
+            ...(summary !== undefined ? { summary } : {}),
+        },
+    };
 }
 function projectPendingForWire(row, governance) {
     const redacted = redactPendingDisclosures(row);
@@ -553,19 +565,20 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
         }
         const cur = new Map(pending.map((p) => [keyOf(p), p]));
         const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
+        const pendingFrame = (k) => JSON.stringify({ type: "pending", ...cur.get(k), serverNowMs: Date.now() });
         if (first) {
-            for (const frame of curFrames.values())
-                res.write(`event: pending\ndata: ${frame}\n\n`);
+            for (const k of curFrames.keys())
+                res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
         else {
             for (const [k, frame] of curFrames)
                 if (prevFrames.get(k) !== frame)
-                    res.write(`event: pending\ndata: ${frame}\n\n`);
+                    res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
             for (const [k, p] of prev)
                 if (!cur.has(k))
-                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`);
+                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: Date.now() })}\n\n`);
         }
         prev = cur;
         prevFrames = curFrames;

package/dist/http/routes/capabilities.js

@@ -9,8 +9,10 @@ import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
-import { workflowModelAllowlistFor } from "../../task-workflow.js";
+import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
+import { judgeAutoModeArming } from "../../auto-mode-face.js";
+import { coercePermissionModeStrict } from "../../task-settings.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
@@ -43,6 +45,18 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
         return;
     }
     if (req.method === "GET" && url === "/v1/capabilities") {
+        const workflowsEngineCan = deps.workflowsCapable ?? Boolean(deps.workflowRunStore);
+        const workflowsDenial = selfOrchestrationDenial({ selfOrchestrationEnabled: deps.config.selfOrchestrationEnabled, requirePrincipal: deps.config.requirePrincipal }, centerEntitlementSourceWired(deps.config));
+        const requestedModeRaw = new URL(req.url ?? "", "http://x").searchParams.get("permissionMode");
+        const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
+        if (requestedModeRaw !== null && requestedMode === undefined) {
+            sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+            return;
+        }
+        const entitlementSource = centerEntitlementSourceWired(deps.config);
+        const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), entitlementSource, localDeny: deps.config.permissionsDisableAutoMode });
+        if (autoModeFault !== undefined)
+            deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
         sendJson(res, 200, {
             ...deps.capabilities,
             asyncRuns: Boolean(deps.runStore),
@@ -92,8 +106,10 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             modeShellGateTranslation: true,
             permissionModeAuto: {
                 accepted: true,
-                classifierSeat: true,
-                entitlementSource: centerEntitlementSourceWired(deps.config),
+                classifierSeat: deps.autoModeFace?.seatMounted === true,
+                entitlementSource,
+                intentArming: deps.autoModeFace?.engineArmsOnIntent === true,
+                ...autoMode,
             },
             readFace: deps.config.readFace ?? null,
             appendSystemPrompt: true,
@@ -141,8 +157,9 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
             s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
             sendUserFileLedger: Boolean(deps.sendFileLedger),
-            workflows: deps.workflowsCapable ?? Boolean(deps.workflowRunStore),
+            workflows: workflowsEngineCan && workflowsDenial === null,
             workflowsList: Boolean(deps.workflowRunStore),
+            workflowsGate: { engineCan: workflowsEngineCan, denial: workflowsDenial },
             workflowModels: (() => {
                 const allow = deps.workflowModelAllowlist
                     ?? workflowModelAllowlistFor({

package/dist/http/routes/leader.js

@@ -7,7 +7,7 @@ export async function handleLeader(req, res, url, ctx) {
 }
 async function handleLeaderBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
     if (deps.leaderEndpoint) {
         const isLeaderPost = req.method === "POST" && url === "/v1/leader";
         const isLeaderGet = req.method === "GET" && /^\/v1\/leader\/[^/]+$/.test(url);
@@ -18,7 +18,7 @@ async function handleLeaderBody(req, res, url, ctx, miss) {
             }
             const requester = gatedPrincipal(req, deps.config) ?? null;
             if (isLeaderPost) {
-                if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
+                if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
                     return;
                 let body;
                 try {

package/dist/http/routes/memory-origin.d.ts

@@ -99,7 +99,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
         detail?: string | undefined;
         eventId: string;
         at: number;
-        to: "failed" | "done";
+        to: "done" | "failed";
         requestId: string;
     }[];
     custodyBytes: number;
@@ -107,7 +107,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "pending" | "failed" | "done";
+    status: "pending" | "done" | "failed";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/http/routes/rules.js

@@ -6,6 +6,7 @@ import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, seri
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
 import { MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
+import { PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -45,8 +46,8 @@ const LocalImportRowSchema = z
     .object({
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
-    tool: z.literal("Bash"),
-    match: z.enum(["exact", "prefix"]),
+    tool: z.enum(PERSISTED_RULE_TOOLS),
+    match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
 })

package/dist/http/routes/runs.d.ts

@@ -1,17 +1,3 @@
-/**
- * [ref] A9 域模块 —— 异步 run 面与它的全部动词。
- *
- * 路由:`POST /v1/runs`(异步提交)· `GET /v1/runs/:id[/events]`(轮询 / 可恢复 SSE)· 运行期动词
- * `cancel` / `steer` / `compact` / `detach` · 子代理面 `subagents/:target/{steer,resume,output,stream}` ·
- * 通用任务句柄 `tasks/:handle/{output,stop}` · 三条 HITL 应答口 `elicitations|questions|tool-approvals/:id/respond`。
- *
- * 两段搬运:提交+run 级动词一段,子代理/任务句柄/HITL 应答一段——它们在 `handle()` 里原本被 SVC-5 的
- * workflow steer 隔开,拆分保持各自位置(本文件里的先后只是同域归并)。`POST /v1/runs` 与 tasks 域共用
- * `ctx.legs.prepareSpec`(同一条读体/校验/建 spec 的前段)。
- *
- * 可变状态全部来自跨域 registry(`idemCache` 幂等、`inflightRuns`/`preemptableRuns` 中止句柄、
- * `cancelledViaVerb` first-writer-wins 判别、`steerableRuns` 活流句柄、`wakeParkMints` park 铸造闩)。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import type { RouteCtx, PreparedTaskSubmission } from "../route-ctx.js";