@sema-agent/server 7.65.0 → 7.67.0

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, parseRuleText } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -13,6 +13,7 @@ import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
+import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
@@ -321,6 +322,15 @@ export function configKnobTable() {
 function registerKnob(rec) {
     CONFIG_KNOBS.set(rec.name, rec);
 }
+function postureSourceOfKnob(name) {
+    const source = CONFIG_KNOBS.get(name)?.source;
+    return source === "env" ? "env" : source === "posture" ? "posture" : "engine-default";
+}
+function postureSourceOfNumEnv(raw, singleUserTurnkey) {
+    if (raw !== undefined && raw !== "")
+        return "env";
+    return singleUserTurnkey ? "posture" : "engine-default";
+}
 const BOOL_TRUE_WORDS = new Set(["true", "1", "yes", "on"]);
 const BOOL_FALSE_WORDS = new Set(["false", "0", "no", "off"]);
 function parseBoolWord(name, raw) {
@@ -918,49 +928,48 @@ function ccRuleFormGuidance(name) {
         `to decide per COMMAND use \`runtime.commandPolicy\` ({command, decision} — bare argv[0] names); ` +
         `to put every shell call behind an approval use MANUAL_MODE_SHELL_GATE=always`);
 }
-export function findCcRuleFormNames(names) {
-    const out = [];
-    for (const name of names) {
-        const guidance = ccRuleFormGuidance(name);
-        if (guidance !== undefined)
-            out.push({ name, guidance });
-    }
-    return out;
-}
-function uncompilableRuleGuidance(name) {
-    const issues = validatePermissionRules([{ rule: name, behavior: "deny" }]);
+function uncompilableRuleGuidance(name, behavior, pathBases) {
+    const issues = validatePermissionRules([{ rule: name, behavior }], pathBases !== undefined ? { pathBases } : undefined);
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
+    const ccGuidance = issue.code === "unsupported.bash_prefix" || issue.code === "unsupported.file_glob" ? ccRuleFormGuidance(name) : undefined;
+    if (ccGuidance !== undefined)
+        return ccGuidance;
     return (`${issue.code} — core's rule grammar cannot compile this name (${issue.message}), so a table keyed by it matches nothing. ` +
         `Tool names carry no backslashes and are far shorter than the 512-character rule cap; check the spelling, and use ` +
         `mcp__<server>__* / a2a__<peer>__* for "every tool on that peer"`);
 }
-export function findUnmatchableToolNames(names) {
+export function findUnmatchableToolNames(names, opts) {
     const out = [];
     for (const name of names) {
-        const ccGuidance = ccRuleFormGuidance(name);
-        if (ccGuidance !== undefined) {
-            out.push({ name, guidance: ccGuidance });
-            continue;
+        if (opts.consumer === "tool-name-table") {
+            const ccGuidance = ccRuleFormGuidance(name);
+            if (ccGuidance !== undefined) {
+                out.push({ name, guidance: ccGuidance });
+                continue;
+            }
         }
+        if (opts.behavior === "allow")
+            continue;
         const retired = RETIRED_TOOL_NAMES.get(name);
         if (retired !== undefined) {
             out.push({ name, guidance: retired });
             continue;
         }
-        const uncompilable = uncompilableRuleGuidance(name);
+        const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
+        const subject = opts.consumer === "tool-name-table" ? name : (() => { const parsed = parseRuleText(name, opts.behavior); return "rule" in parsed ? parsed.rule.tool : name; })();
         if (uncompilable !== undefined) {
             out.push({ name, guidance: uncompilable });
             continue;
         }
-        const ns = protocolOf(name);
+        const ns = protocolOf(subject);
         if (ns === undefined) {
-            if (name.includes("__"))
+            if (subject.includes("__"))
                 out.push({ name, guidance: `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentToolName(name)}`).join(" or ")}` });
             continue;
         }
-        if (ns.parse(name) === undefined) {
+        if (ns.parse(subject) === undefined) {
             out.push({ name, guidance: `incomplete ${ns.id} name — the live form is ${ns.prefix}<server>__<tool>, or ${ns.prefix}<server>__* to cover every tool on that server` });
         }
     }
@@ -974,7 +983,7 @@ const MAX_TIMER_DELAY_MS = 2_147_483_647;
 function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
-        windowMs: numEnv("STREAM_ASK_WINDOW_MS", "300000"),
+        windowMs: numEnv("STREAM_ASK_WINDOW_MS", gates.windowMsSource === "posture" ? "86400000" : "300000"),
         replayMax: numEnv("STREAM_APPROVAL_REPLAY_MAX", "50"),
         admitMaxPerTask: numEnv("STREAM_APPROVAL_ADMIT_MAX_PER_TASK", "32"),
         admitMaxPerOwner: numEnv("STREAM_APPROVAL_ADMIT_MAX_PER_OWNER", "256"),
@@ -990,6 +999,10 @@ function streamApprovalConfig(gates) {
     if (cfg.windowMs > MAX_TIMER_DELAY_MS) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} exceeds the Node timer ceiling ${MAX_TIMER_DELAY_MS} (2^31-1 ms ≈ 24.8 days) — setTimeout SILENTLY collapses a larger delay to 1ms, so the window you meant to lengthen would expire immediately and every gated ask would take the unattended route on the next tick. Pick a window at or below the ceiling (and remember STREAM_ASK_WINDOW_MS + STREAM_APPROVAL_ADHOC_GRACE_MS must stay strictly below STREAM_APPROVAL_ORPHAN_TTL_MS).`);
     }
+    if (gates.windowMsSource === "posture" && cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
+        gates.onPostureYield?.({ windowMs: cfg.windowMs, adhocGraceMs: cfg.adhocGraceMs, orphanTtlMs: cfg.orphanTtlMs });
+        cfg.windowMs = 300_000;
+    }
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
@@ -1014,14 +1027,25 @@ function unattendedApprovalPolicyEnv() {
         `Refusing to boot rather than treating a misspelled value as "unset": that runs the deployment on a policy the operator did not choose, with no trace anywhere`);
 }
 function parseApprovalDomain(ctx) {
-    const { postureOn } = ctx;
+    const { postureOn, singleUserTurnkey, infraReady } = ctx;
     const unattendedPolicy = unattendedApprovalPolicyEnv();
+    const streamAskWindowMsSource = postureSourceOfNumEnv(process.env.STREAM_ASK_WINDOW_MS, singleUserTurnkey);
     const toolApprovalEnabled = postureOn("TOOL_APPROVAL_ENABLED");
+    let streamAskWindowMsEffectiveSource = streamAskWindowMsSource;
+    const streamApproval = streamApprovalConfig({
+        unattendedPolicy,
+        toolApprovalEnabled,
+        windowMsSource: streamAskWindowMsSource,
+        onPostureYield: (facts) => {
+            streamAskWindowMsEffectiveSource = "engine-default";
+            process.stderr.write(`[config] stream_ask_window_posture_yielded: the single-user posture default STREAM_ASK_WINDOW_MS=${facts.windowMs} would violate the explicit STREAM_APPROVAL_ORPHAN_TTL_MS=${facts.orphanTtlMs} (window + ADHOC_GRACE ${facts.adhocGraceMs} must be strictly less) — falling back to 300000; set STREAM_ASK_WINDOW_MS explicitly to choose\n`);
+        },
+    });
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
-    const durableApproval = boolEnv("DURABLE_APPROVAL", false);
+    const durableApproval = postureOn("DURABLE_APPROVAL", infraReady);
     const rejectUnmatchableToolNames = (envName, names) => {
-        const bad = findUnmatchableToolNames(names);
+        const bad = findUnmatchableToolNames(names, { consumer: "tool-name-table", behavior: "deny" });
         if (bad.length > 0)
             throw new Error(formatUnmatchableToolNames(envName, bad));
         return names;
@@ -1092,7 +1116,9 @@ function parseApprovalDomain(ctx) {
         permissionRulesEnabled: boolEnv("PERMISSION_RULES_ENABLED", true),
         permissionRulesEnabledExplicit: parseBoolWord("PERMISSION_RULES_ENABLED", process.env["PERMISSION_RULES_ENABLED"]) !== undefined,
         streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
-        streamApproval: streamApprovalConfig({ unattendedPolicy, toolApprovalEnabled }),
+        streamApproval,
+        streamAskWindowMsSource: streamAskWindowMsEffectiveSource,
+        durableApprovalSource: postureSourceOfKnob("DURABLE_APPROVAL"),
         unattendedApprovalPolicy: unattendedPolicy,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
@@ -1659,6 +1685,7 @@ function parseOrchestrationDomain(ctx) {
             ? { sandboxPkgSource: pkgSourceEnv() }
             : {}),
         sessionAutoTitle: boolEnv("SESSION_AUTO_TITLE", true),
+        sessionAutoTitleSource: postureSourceOfKnob("SESSION_AUTO_TITLE"),
         selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true),
         envFactsEnabled: boolEnv("SANDBOX_ENV_FACTS", true),
         toolDeferLongtail: boolEnv("TOOL_DEFER_LONGTAIL", false),
@@ -1885,7 +1912,7 @@ const MODEL_PLANE_GROUP_KEYS = [
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
-    "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
+    "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
     "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
@@ -1907,7 +1934,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
-    "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
+    "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
     "imageBakes", "readFace", "readFaceSource", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
@@ -1968,12 +1995,13 @@ export function loadConfig() {
     const postureOn = (name, infraReady = true) => {
         const explicit = parseBoolWord(name, process.env[name]);
         const value = explicit ?? (singleUserTurnkey && infraReady);
-        registerKnob({ name, polarity: "posture", value, source: explicit === undefined ? "posture" : "env" });
+        registerKnob({ name, polarity: "posture", value, source: explicit !== undefined ? "env" : singleUserTurnkey ? "posture" : "default" });
         return value;
     };
     const store = parseStoreDomain({ requirePrincipal });
     const modelPlane = parseModelDomain();
-    const approval = parseApprovalDomain({ postureOn });
+    const durableStoreReady = store.dbBackend !== "memory";
+    const approval = parseApprovalDomain({ postureOn, singleUserTurnkey, infraReady: durableStoreReady });
     const memory = parseMemoryDomain({ requirePrincipal });
     const auth = parseAuthDomain({ requirePrincipal });
     const orchestration = parseOrchestrationDomain({ postureOn, singleUserTurnkey });

package/dist/deployment-governance.d.ts

@@ -55,6 +55,14 @@ export interface PathAdjudication {
     readonly env: ExecutionEnv;
     /** 相对路径基准(core 的 `rootPath`)。缺席 ⇒ 相对形在真身那层判不了,补词法臂(见下)。 */
     readonly cwd?: string;
+    /** 🔴 S-177:**真任务根**(权限规则模式的基)。与上面那个 `cwd` 分开:后者在 host 腿的无 session-cwd
+     *  形上是一个永不创建的哨兵目录 —— 对写门 fail-safe,对规则 fail-open。理由逐字见
+     *  `task-settings.ts` 的 `FsWriteGateWiring.taskRoot`。缺席 ⇒ 需要基的规则拼法被 core 整表拒(fail-loud)。 */
+    readonly taskRoot?: string;
+    /** 🔴 S-177 / codex r2:**执行环境的 home**(`~/…` 形规则的基)。只在引擎与执行同机时在场 ——
+     *  远端车道上 server 的 home 是另一个用户的目录,回落它 = 规则静默失效。逐字见
+     *  `task-settings.ts` 的 `FsWriteGateWiring.taskHome`。 */
+    readonly taskHome?: string;
 }
 /** [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门的活体面探针(QuestionCoordinator 的切面)。 */
 export interface LiveQuestionFace {

package/dist/http/routes/approvals-assistant.js

@@ -1,4 +1,6 @@
+import { screenedGate } from "../../trace/project.js";
 import { personDecision } from "../../host-decision.js";
+import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -71,6 +73,21 @@ async function decideIdempotentReplay(cs, args) {
         if (row.payloadFp === null || row.payloadFp !== requestFp)
             return undefined;
     }
+    const executionOutcome = (() => {
+        const records = rows.map((r) => r.executionOutcome);
+        const first = records[0];
+        if (first === null || first === undefined)
+            return undefined;
+        for (const r of records) {
+            if (r === null)
+                return undefined;
+            if (!sameExecutionRecord(r, first)) {
+                warn("decide_replay_execution_outcome_divergent", { sessionId, rows: rows.length });
+                return undefined;
+            }
+        }
+        return screenedGate(first);
+    })();
     return {
         status: 200,
         body: {
@@ -78,6 +95,7 @@ async function decideIdempotentReplay(cs, args) {
             idempotent: true,
             decision,
             bindingEnforced: true,
+            ...(executionOutcome !== undefined ? { executionOutcome } : {}),
         },
     };
 }

package/dist/http/routes/diagnostics.d.ts

@@ -1,3 +1,15 @@
+/**
+ * [ref] 件二+件三 —— **装配自证**域:启动期静态自检(拒启判据)与 operator 诊断读面
+ * (`GET /v1/diagnostics/wiring`)。
+ *
+ * 🔴 两件为什么同住一个模块:它们回答的是同一个问题(「这台 worker 到底接了什么线」),只是一个在 boot
+ * 用它拒绝启动、一个在运行期把它读给 operator。分成两处 = 拒启用的判据与诊断报的读数会各自演化,而
+ * 「拒启说没矛盾、诊断页显示矛盾」正是本设计要消灭的那类装配谎言。故 boot 半场是本文件导出的**纯函数**
+ * (可单测、无 I/O),路由半场只是它的读口。
+ *
+ * 分层:本模块不值 import `server.ts`(那条边会闭合运行时装载环),对它只有 `import type`。
+ */
+import { type PostureKnobReading, type PostureSource } from "../../posture-source.js";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { WiringManifest } from "@sema-agent/core";
 import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../tool-approval.js";
@@ -7,10 +19,17 @@ import type { RouteCtx } from "../route-ctx.js";
 export type StreamApprovalGateReading = "active" | Extract<StreamApprovalGate, {
     active: false;
 }>["reason"];
-/** server 自己的装配谓词读数(core 的静态半场之外的那一半:本仓在这台 worker 上做出的判断)。 */
+/** server 自己的装配谓词读数(core 的静态半场之外的那一半:本仓在这台 worker 上做出的判断)。
+ *
+ *  🔴 S-178:三个 **posture 家族**旋钮改报 `{value, source, note}`(与 S-167 的 `readFace` 同一张四词表、
+ *  同一只 note 函数)。裸布尔答不出裁定的补偿项要求的那句话 —— 单机形升级后 `durableApproval` 缺席即
+ *  ON、审批窗缺席即 24h,运维必须在一个读面上看得见「这是 posture 派生的」以及「怎么钉回」。
+ *  `streamApproval` 那一格是**门读数**(另一根轴:这条腿现在通不通),不是旋钮,故形不变。 */
 export interface ServerWiringGates {
     streamApproval: StreamApprovalGateReading;
-    durableApproval: boolean;
+    durableApproval: PostureKnobReading<boolean>;
+    streamAskWindowMs: PostureKnobReading<number>;
+    sessionAutoTitle: PostureKnobReading<boolean>;
     checkpointStore: boolean;
 }
 /** `buildServerWiringGates` 的入参 = 三个谓词各自的**真输入**(不接受已算好的布尔:那样这里读到的就
@@ -23,6 +42,12 @@ export interface ServerWiringGateInput {
     /** 在场性即事实;本面不取实例,故 `unknown` 足够(取窄型会把整棵 store 类型树拖进诊断域)。 */
     checkpointStore: unknown;
     durableApproval: boolean;
+    /** S-178:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
+    durableApprovalSource: PostureSource;
+    streamAskWindowMs: number;
+    streamAskWindowMsSource: PostureSource;
+    sessionAutoTitle: boolean;
+    sessionAutoTitleSource: PostureSource;
 }
 /** 纯数据产物(`build*`):三个门的当前读数。`streamApproval` 走**单一谓词**
  *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个

package/dist/http/routes/diagnostics.js

@@ -1,3 +1,4 @@
+import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
@@ -11,7 +12,21 @@ export function buildServerWiringGates(input) {
     });
     return {
         streamApproval: gate.active ? "active" : gate.reason,
-        durableApproval: input.durableApproval,
+        durableApproval: buildPostureKnobReading(input.durableApproval, {
+            knob: "DURABLE_APPROVAL",
+            source: input.durableApprovalSource,
+            postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set) composed with a durable store being present: park/resume and the /v1/approvals routes are on by default — set DURABLE_APPROVAL=false to pin them off",
+        }),
+        streamAskWindowMs: buildPostureKnobReading(input.streamAskWindowMs, {
+            knob: "STREAM_ASK_WINDOW_MS",
+            source: input.streamAskWindowMsSource,
+            postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): an approval card waits 24h instead of 5 minutes, so stepping away does not settle the run unattended — set STREAM_ASK_WINDOW_MS to pin your own window",
+        }),
+        sessionAutoTitle: buildPostureKnobReading(input.sessionAutoTitle, {
+            knob: "SESSION_AUTO_TITLE",
+            source: input.sessionAutoTitleSource,
+            postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
+        }),
         checkpointStore: input.checkpointStore !== undefined,
     };
 }
@@ -100,6 +115,11 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
                 backend: deps.backend,
                 checkpointStore: deps.checkpointStore,
                 durableApproval: deps.config.durableApproval === true,
+                durableApprovalSource: deps.config.durableApprovalSource,
+                streamAskWindowMs: deps.config.streamApproval?.windowMs ?? 0,
+                streamAskWindowMsSource: deps.config.streamAskWindowMsSource,
+                sessionAutoTitle: deps.config.sessionAutoTitle === true,
+                sessionAutoTitleSource: deps.config.sessionAutoTitleSource,
             }),
         });
         return;

package/dist/http/routes/rules.js

@@ -5,8 +5,8 @@ import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
-import { PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS } from "../../permission-rule-vocab.js";
+import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
+import { PERSISTED_RULE_MATCHES, isPersistedRuleTool } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -46,7 +46,8 @@ const LocalImportRowSchema = z
     .object({
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
-    tool: z.enum(PERSISTED_RULE_TOOLS),
+    behavior: z.enum(RULE_BEHAVIORS),
+    tool: z.string().min(1).max(190).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
     match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
@@ -58,16 +59,18 @@ const LocalImportPrepareBodySchema = z.object({ rows: z.array(LocalImportRowSche
 const LocalImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
 const RuleRevokeBodySchema = z
     .object({
+    behavior: z.enum(RULE_BEHAVIORS),
     rule: z.string().min(1).max(1024),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
     principal: z.string().min(1).max(190).optional(),
 })
     .strict();
+const RULES_CURSOR_FORMAT = 2;
 const RulesCursorSchema = z
-    .object({ rev: z.number().int().nonnegative().safe(), principal: z.string(), scope: z.string(), after: z.string() })
+    .object({ v: z.literal(RULES_CURSOR_FORMAT), rev: z.number().int().nonnegative().safe(), principal: z.string(), scope: z.string(), after: z.string() })
     .strict();
 function encodeRulesCursor(c) {
-    return Buffer.from(JSON.stringify(c)).toString("base64url");
+    return Buffer.from(JSON.stringify({ v: RULES_CURSOR_FORMAT, ...c })).toString("base64url");
 }
 function decodeRulesCursor(raw) {
     try {
@@ -78,7 +81,7 @@ function decodeRulesCursor(raw) {
         return { ok: false, why: err instanceof Error ? err.message : String(err) };
     }
 }
-const rowKey = (r) => `${r.scope}\u0000${r.rule}`;
+const rowKey = (r) => `${r.scope}\u0000${r.rule}\u0000${r.behavior}`;
 export async function handleRules(req, res, url, ctx) {
     const miss = { fell: false };
     await handleRulesBody(req, res, url, ctx, miss);
@@ -132,7 +135,7 @@ async function handleRulesBody(req, res, url, ctx, miss) {
     if (isLocalPrepare) {
         const parsed = LocalImportPrepareBodySchema.safeParse(rawBody);
         if (!parsed.success) {
-            sendError(res, 400, "request.body_shape", "body must be {rows:[{rule,scope,tool,match,command,adds}]}");
+            sendError(res, 400, "request.body_shape", "body must be {rows:[{behavior,rule,scope,tool,match,command,adds}]}");
             return;
         }
         const prepared = await lane.prepareLocalImport(principal, parsed.data.rows);
@@ -241,7 +244,9 @@ async function handleRuleList(req, res, caller, lane, operatorPrincipals) {
         sendError(res, 400, "request.query_invalid", "the rules cursor was minted at a different revision — restart the listing", { rev: listing.rev });
         return;
     }
-    const matching = listing.rows.filter((r) => (filterKey === "" || r.scope === filterKey) && (cursor === undefined || rowKey(r) > cursor.after));
+    const matching = listing.rows
+        .filter((r) => (filterKey === "" || r.scope === filterKey) && (cursor === undefined || rowKey(r) > cursor.after))
+        .sort((x, y) => (rowKey(x) < rowKey(y) ? -1 : rowKey(x) > rowKey(y) ? 1 : 0));
     const page = matching.slice(0, limit);
     const last = page[page.length - 1];
     const nextCursor = matching.length > limit && last !== undefined
@@ -252,7 +257,7 @@ async function handleRuleList(req, res, caller, lane, operatorPrincipals) {
 async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals) {
     const parsed = RuleRevokeBodySchema.safeParse(rawBody);
     if (!parsed.success) {
-        sendError(res, 400, "request.body_shape", "body must be {rule, scope} with an optional principal");
+        sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
         return;
     }
     const scope = parseRuleScope(parsed.data.scope);
@@ -265,7 +270,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
         sendError(res, 403, "auth.operator_only", "revoking another principal's rules is an operator-only action");
         return;
     }
-    const outcome = await lane.removeRule({ principal: target.principal, rule: parsed.data.rule, scope });
+    const outcome = await lane.removeRule({ principal: target.principal, behavior: parsed.data.behavior, rule: parsed.data.rule, scope });
     switch (outcome.status) {
         case "removed":
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });

package/dist/http/routes/tasks.js

@@ -12,7 +12,7 @@ import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../..
 import { buildCancelContext } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -231,20 +231,15 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 let ledgerSink;
                 let ledgerTerminal = false;
-                if (detachOnDisconnect && durableTaskId && deps.runStore) {
-                    const rs = deps.runStore;
-                    const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
-                    usageKey = durableTaskId;
-                    if (usageKey)
-                        deps.modelUsage?.register(usageKey);
-                }
                 if (deps.checkpointStore && prepared.spec.sessionId) {
                     await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
                 }
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
+                    usageKey = tid;
+                    deps.modelUsage?.register(tid);
                     const owner = principal ?? null;
                     const abortFromVerb = () => {
                         cancelledViaVerb.add(tid);
@@ -484,6 +479,11 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                             : wiringManifestEventData(ev)),
                                     });
                                 }
+                                else if (ev.type === "tool_roster_delta") {
+                                    const rosterDelta = toolRosterDeltaEventData(ev);
+                                    if (rosterDelta !== undefined)
+                                        sseData(res, { type: "tool_roster_delta", ...rosterDelta });
+                                }
                                 else if (ev.type === "human_input") {
                                     sseData(res, { type: "human_input", ...humanInputEventData(ev) });
                                 }

package/dist/http/server.js

@@ -115,6 +115,7 @@ export function validateUserSkills(skills) {
     }
     return null;
 }
+const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 const MAX_BODY = 8 * 1024 * 1024;
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
@@ -125,7 +126,7 @@ function mentionableNames(config, catalog) {
 }
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
-    return code === "resume.env_failed" || code === "resume.tool_unavailable";
+    return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
 }
 function nestedParkStatusOf(r) {
     const paused = nestedPauseOf(r.terminal);
@@ -323,6 +324,7 @@ export function createHttpServer(rawDeps) {
                 ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
                 configHash,
                 pid: process.pid,
+                startedAt: PROCESS_STARTED_AT_MS,
                 port: deps.config.port,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
@@ -2434,6 +2436,7 @@ const WORKER_SWAP_REDEEMABLE = {
     env_factory_missing: true,
     governed_unwired: true,
     origin_missing: true,
+    ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
     read_face_damaged: false,

package/dist/mcp-tool-faces.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `McpServerSpec.toolFaces` —— MCP 工具的**面覆盖层**(core 7.8.0 [ref] §1.1/§2.7;声明面
+ * settings-schema 1.9.0)。一条规则、三条腿共用(请求腿 `task-mcp.ts normalizeServer` / center 腿
+ * `config-center/skills-mcp.ts resolveMcpServers` / 本地 config.d 腿 `config-provider.ts` 只做承载),
+ * 与 {@link import("./mcp-source-label.js").readMcpSourceLabel} 同一个「判据单点、三腿一致」的形。
+ *
+ * ## 分工(为什么本层**不**复述 core 的那张表)
+ * 覆盖层的**语义**校验属 core 的摄入侧,而且只有它做得了:`pathTarget.param` 是不是这只工具**物化后
+ * schema** 的顶层属性、审批卡要的键在不在、`ruleFace` 指的是不是标量键 —— 三件都要看远端 server 真发
+ * 回来的 schema,本层手里根本没有。core 的处置也已经定死:不合 ⇒ **这只工具在这条腿上不挂**,并通告
+ * 一次 `config.tool_face_invalid`(亲读 `dist/core/runner/tool-face-overlay.js` 的 `return undefined` 臂 ——
+ * 该文件 d.ts 头注里那句「the tool mounts BARE」是**过期**的,以实现为准)。
+ *
+ * 本层因此只做 core 的校验器**假定成立**的那一件事:**JSON 结构合不合 TS 型**。理由是硬的 —— core 的
+ * `toolFaceProblem` 是按 TS 型写的,`renderHints.summaryParams` 是个字符串时它会 `.find is not a function`
+ * 地把 prepare 整条炸掉,`ruleFace.params` 是个数字时 `for...of` 直接抛。原样透传一份任意 JSON 不是
+ * 「解析透明」,是把类型错误变成运行期崩溃。
+ *
+ * 闭词(`family` / `pathTarget.access` / `renderHints.approvalCard`)判据**取自 core 的导出常量**
+ * (`TOOL_FAMILIES` / `TOOL_PATH_ACCESSES` / `TOOL_APPROVAL_CARDS`),本仓一个词都不枚举 —— 与
+ * `MCP_DELIVERY_VERDICTS` 的消费姿势同款:词表单一属主在 core,抄一遍就是抄了一张会漂的表。
+ *
+ * ## 坏形的方向:**整条 server 不进**(fail-closed)
+ * 🔴 这一条被 codex 对抗复审 r1 的 [high] **翻正过一次**,把翻正的理由留在这里,因为它是本模块最容易
+ * 想错的一格:初版按 `contentOrigin` 的先例判「丢声明、留 server + 留痕」,而那条先例管的是**放宽**键
+ * (丢它 ⇒ 回落到过度标记 = fail-closed 的那一侧)。`toolFaces` 是**收窄**声明:它声明的 `pathTarget`
+ * 正是敏感路径策略、写围栏、编辑跟踪读的那一格 —— 丢掉它,那只工具就**无面挂载**,运维声明的保护
+ * 静默失效。codex 实测(同一只 MCP 写工具、同一个 `/work/.env` 目标,仅把 `renderHints.summaryParams`
+ * 从数组写成字符串):`createSensitivePathPolicy` 从 deny 变成 allow。一条 warn 补偿不了这个方向。
+ *
+ * 所以判据回到本仓对**收窄键**已经成文的那一条(`task-mcp.ts` 的 `allowTools`,[ref] / [ref] codex F1):
+ * **一个键在场就必须合法,否则这条 server 整条不进**。三问逐条:
+ *  ① 谁需要 —— 在部署侧给 MCP 工具声明写围栏 / 审批卡 / 显示名的运维;
+ *  ② 谁受伤 —— 覆盖层写错的那台 server:它**整条**不挂(请求腿进 `dropped` 并点名上报,center 腿跳过
+ *     该条、兄弟 server 照挂)。代价是真的(少一套工具),但它**响亮且立刻**;反方向的代价是一条
+ *     **静默失效的安全声明**,而后者按 [ref] 不许存在于安全轴上;
+ *  ③ 拿什么补偿 —— 报出来的名字本身:请求腿 `mcp_injection_dropped{dropped:[name]}`、center 腿
+ *     `sema_registry_mcp_tool_faces_invalid{server,problem,note}` 一条点名 warn(`problem` 里带工具名与哪一段不合;运维照着改那一行即可)。
+ * 每只工具的面是**整只**判(core 明写 "applied whole or not at all");而**任一只**判不出形 ⇒ 整条 server
+ * 不进 —— 「留下好的那几只」同样是让坏的那一只无面挂载,与整张丢没有区别。
+ */
+import { type McpServerSpec } from "@sema-agent/core";
+type ToolFaces = NonNullable<McpServerSpec["toolFaces"]>;
+/**
+ * 一条 server 条目的 `toolFaces` 判形结果:
+ *  · `{ ok: true, faces }` —— 合形(`faces` 缺席 = 这台 server 没有覆盖层,或声明了一个**空**覆盖层:
+ *    两者对 core 同义,都不铸键);
+ *  · `{ ok: false, problem }` —— 判不出形,**整条 server 不进**(方向与理由见模块头注),`problem` 是
+ *    给运维的一句点名(只带工具名与哪一段不合,不带面的值)。
+ */
+export type McpToolFacesRead = {
+    ok: true;
+    faces?: ToolFaces;
+} | {
+    ok: false;
+    problem: string;
+};
+/**
+ * 从任一腿的原始条目里读出 `toolFaces` —— **三条腿共用的唯一判据点**。
+ * 缺席 ⇒ 合形无覆盖层;整只不是对象 / **任一只**工具的面判不出形 ⇒ `ok:false`(调用方整条 server 不收)。
+ */
+export declare function readMcpToolFaces(v: unknown): McpToolFacesRead;
+export {};
+//# sourceMappingURL=mcp-tool-faces.d.ts.map