@sema-agent/server 7.66.0 → 7.67.0

package/dist/rules-consent.d.ts

@@ -1,4 +1,4 @@
-import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedAllowRule, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
+import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
 /**
@@ -20,10 +20,7 @@ export interface RuleConsentRecordStores {
             principal: string;
             approvalId: string;
             purpose: RuleTicketPurpose;
-            candidates: ReadonlyArray<{
-                rule: string;
-                scope: RuleScope;
-            }>;
+            candidates: ReadonlyArray<RuleCandidate>;
             ttlMs: number;
         }): Promise<RuleImportTicket>;
         /** 一次**认领**(不是「已完成」)。语义与「认领之后怎么办」见 {@link RuleConsentStores.tickets.release}。
@@ -144,9 +141,12 @@ export declare const MAX_LOCAL_IMPORT_BYTES: number;
  *    救回来",而不是等下一次 prepare。运维旋钮暂不开(没有部署形要求它可调)。
  */
 export declare const LOCAL_IMPORT_CLAIM_LEASE_MS = 60000;
-/** 一条规则的 wire 身份键(规则文本 + {@link serializeRuleScope} 的判别式串)。两个面(预览 / 兑付回执)
- *  用**同一把键**,客户端拿它把两张表 join 起来。 */
+/** 一条规则的 wire 身份键(**态** + 规则文本 + {@link serializeRuleScope} 的判别式串)。两个面
+ *  (预览 / 兑付回执)用**同一把键**,客户端拿它把两张表 join 起来。
+ *  🔴 `behavior` 自 7.67.0 起是这把键的一格(core 7.9.0 [ref]:规则的身份是三元组)—— 少了它,同文本
+ *  同作用域的 deny 与 allow 两行会被本口判成 `duplicate_row`,而它们是两条不同的规则。 */
 export interface LocalImportRuleKey {
+    behavior: RuleBehavior;
     rule: string;
     scope: string;
 }
@@ -502,14 +502,18 @@ export declare function parseRuleScope(text: string): DurableRuleScope | undefin
  *  `adds` **如实上 wire**、不折叠成单值:同一条规则可以被批准过多次(不同 dot、不同来源、不同时刻),
  *  折成「一个 addedAt」会让「这条规则是我导入的还是我点过卡的」在治理面上不可分。 */
 export interface PersistedRuleWireRow {
+    /** core 7.9.0([ref])—— 这一行是哪一态的规则(`deny` / `ask` / `allow`)。**身份的一格**:
+     *  规则的身份是 (behavior, text, scope) 三元组,同文本不同态是两条不同的行(core `sameRuleIdentity`),
+     *  所以它既在列举面上,也在**导入/撤销的输入面**上必填 —— 少了它,一次撤销会瞄准同文本的另一态。 */
+    behavior: PersistedRule["behavior"];
     rule: string;
     /** {@link serializeRuleScope} 的判别式串。 */
     scope: string;
-    tool: PersistedAllowRule["tool"];
-    match: PersistedAllowRule["match"];
+    tool: PersistedRule["tool"];
+    match: PersistedRule["match"];
     /** 去规范化的命令(core 的匹配器信的就是它 + `match`,不是重新解析 `rule`)。 */
     command: string;
-    adds: PersistedAllowRule["adds"];
+    adds: PersistedRule["adds"];
     /** [ref](core 7.5.0):这一行来自哪个源。**由 `scope` 派生**(`global`⟺`user`、`project`⟺
      *  `project`、`session`⟺`session`),不是行上另存的第二个字节 —— core 的 `ruleSourceOf` 是整条映射。
      *  今天本部署只接 durable 一格分区 ⇒ 值域实为 `user | project`。
@@ -600,6 +604,7 @@ export interface RuleConsentLane {
      */
     removeRule(input: {
         principal: RuleBucketRef;
+        behavior: RuleBehavior;
         rule: string;
         scope: RuleScope;
     }): Promise<RemoveResult>;

package/dist/rules-consent.js

@@ -4,7 +4,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
 import { MAX_CWD_CHARS } from "./task-cwd.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, parseAllowRuleText, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -18,7 +18,7 @@ const LocalImportOutcomeSchema = z
     .object({
     members: z.array(z
         .object({
-        key: z.object({ rule: z.string().min(1), scope: z.string().min(1) }).strict(),
+        key: z.object({ behavior: z.preprocess((v) => readRowBehavior(v) ?? v, z.enum(RULE_BEHAVIORS)), rule: z.string().min(1), scope: z.string().min(1) }).strict(),
         outcome: z.enum(["persisted", "no-op", "refused", "indeterminate"]),
         reason: z.enum(["store_refused", "walk_failed"]).optional(),
         detail: z.string().optional(),
@@ -83,6 +83,7 @@ function isSupportedRuleMatch(match) {
         case "wildcard":
             return true;
         case "subpath":
+        case "path":
             return false;
         default: {
             const unknown = match;
@@ -177,13 +178,25 @@ function screenLocalImportRow(row) {
                     `${derived.tool}/${derived.match}/${JSON.stringify(derived.command)} but the row says ${String(row.tool)}/${String(row.match)}/${JSON.stringify(row.command)}`,
             };
         }
-        return { rule: derived.rule, scope };
+        if (derived.behavior !== row.behavior) {
+            return { reason: "row_inconsistent", detail: `this row says behavior ${JSON.stringify(String(row.behavior))} but the parser resolved ${JSON.stringify(derived.behavior)}` };
+        }
+        return { behavior: derived.behavior, rule: derived.rule, scope };
     };
-    const written = parseAllowRuleText(row.rule);
+    const written = parseRuleText(row.rule, row.behavior);
     if ("reject" in written)
         return { reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
-    if (written.rule.tool === "Read")
+    if (ruleToolGrammarOf(written.rule.tool) !== "command")
+        return consistent(written.rule);
+    if (written.rule.behavior !== "allow") {
+        if (!ruleReachesProgramRun(written.rule, row.command)) {
+            return {
+                reason: "row_inconsistent",
+                detail: `this tightening rule does not speak about the command it names: ${JSON.stringify(written.rule.rule)} vs ${JSON.stringify(row.command)}`,
+            };
+        }
         return consistent(written.rule);
+    }
     const pre = precheckCardRuleText(row.rule, row.command);
     if (pre === undefined) {
         return { reason: "rule_uncheckable", detail: "the rule text gate could not be asked about this row (its command is absent or not a string) — the row itself is malformed" };
@@ -199,22 +212,29 @@ function buildLocalImportLayers(candidates) {
     const byRoot = new Map();
     for (const c of candidates) {
         const key = c.scope.kind === "global" ? "" : c.scope.root;
-        const bucket = byRoot.get(key);
-        if (bucket === undefined)
-            byRoot.set(key, [c.rule]);
-        else
-            bucket.push(c.rule);
+        let bucket = byRoot.get(key);
+        if (bucket === undefined) {
+            bucket = { deny: [], ask: [], allow: [] };
+            byRoot.set(key, bucket);
+        }
+        bucket[c.behavior].push(c.rule);
     }
-    return [...byRoot].map(([root, rules]) => ({
+    return [...byRoot].map(([root, lists]) => ({
         layer: root === "" ? "userSettings" : "projectSettings",
         path: root === "" ? LOCAL_IMPORT_LAYER_PATH : `${LOCAL_IMPORT_LAYER_PATH}:${root}`,
         root: root === "" ? "/" : root,
-        readFile: async () => JSON.stringify({ permissions: { allow: rules } }),
+        readFile: async () => JSON.stringify({
+            permissions: {
+                ...(lists.deny.length > 0 ? { deny: lists.deny } : {}),
+                ...(lists.ask.length > 0 ? { ask: lists.ask } : {}),
+                ...(lists.allow.length > 0 ? { allow: lists.allow } : {}),
+            },
+        }),
     }));
 }
 function buildLocalImportMembers(members) {
     return members.map((m) => {
-        const key = { rule: m.rule, scope: serializeRuleScope(m.scope) };
+        const key = { behavior: m.behavior, rule: m.rule, scope: serializeRuleScope(m.scope) };
         switch (m.status) {
             case "persisted":
                 return { key, outcome: "persisted" };
@@ -312,7 +332,7 @@ export function createRuleConsentLane(stores, opts) {
                 if (minted === undefined) {
                     return { ok: false, reason: "confirm-refused", detail: "the edited confirmation landed without a minted candidate — nothing to redeem" };
                 }
-                const canonical = parseAllowRuleText(minted.rule);
+                const canonical = parseRuleText(minted.rule, "allow");
                 if ("reject" in canonical) {
                     return { ok: false, reason: "edit-rejected", detail: `the canonical spelling the engine minted does not re-parse: ${canonical.reject.message}` };
                 }
@@ -444,11 +464,11 @@ export function createRuleConsentLane(stores, opts) {
             for (const row of rows) {
                 const screened = screenLocalImportRow(row);
                 if ("reason" in screened) {
-                    members.push({ key: { rule: row.rule, scope: row.scope }, admitted: false, reason: screened.reason, detail: screened.detail });
+                    members.push({ key: { behavior: row.behavior, rule: row.rule, scope: row.scope }, admitted: false, reason: screened.reason, detail: screened.detail });
                     continue;
                 }
-                const key = { rule: screened.rule, scope: serializeRuleScope(screened.scope) };
-                const dedupKey = `${key.scope}${LOCAL_IMPORT_KEY_SEP}${key.rule}`;
+                const key = { behavior: screened.behavior, rule: screened.rule, scope: serializeRuleScope(screened.scope) };
+                const dedupKey = `${key.behavior}${LOCAL_IMPORT_KEY_SEP}${key.scope}${LOCAL_IMPORT_KEY_SEP}${key.rule}`;
                 if (seen.has(dedupKey)) {
                     members.push({ key, admitted: false, reason: "duplicate_row", detail: "this (rule, scope) appears earlier in the same batch — the engine would fold the two silently, so it is reported here instead" });
                     continue;
@@ -460,12 +480,12 @@ export function createRuleConsentLane(stores, opts) {
             if (admitted.length === 0)
                 return { ok: true, preview: { members } };
             const { preview, approvalId } = await prepareCcImport({ layers: buildLocalImportLayers(admitted), principal, deps });
-            const engineKeys = new Set(preview.candidates.map((c) => `${serializeRuleScope(c.scope)}${LOCAL_IMPORT_KEY_SEP}${c.rule}`));
+            const engineKeys = new Set(preview.candidates.map((c) => `${c.behavior}${LOCAL_IMPORT_KEY_SEP}${serializeRuleScope(c.scope)}${LOCAL_IMPORT_KEY_SEP}${c.rule}`));
             for (let i = 0; i < members.length; i++) {
                 const m = members[i];
                 if (m === undefined || !m.admitted)
                     continue;
-                if (engineKeys.has(`${m.key.scope}${LOCAL_IMPORT_KEY_SEP}${m.key.rule}`))
+                if (engineKeys.has(`${m.key.behavior}${LOCAL_IMPORT_KEY_SEP}${m.key.scope}${LOCAL_IMPORT_KEY_SEP}${m.key.rule}`))
                     continue;
                 const why = preview.skipped.find((s) => s.rule === m.key.rule)?.reason ?? "the engine's import gate did not take it, and said nothing about it";
                 localImportLogger.warn("local_import_row_admitted_but_not_importable", {
@@ -683,12 +703,12 @@ export function createRuleConsentLane(stores, opts) {
         },
         async listRules(bucket) {
             const view = await effectiveOrThrow(storeForBucket(stores.provider, bucket));
-            const rows = view.rules.map((r) => ({ rule: r.rule, scope: serializeRuleScope(r.scope), tool: r.tool, match: r.match, command: r.command, adds: r.adds, source: r.source, status: r.status }));
+            const rows = view.rules.map((r) => ({ behavior: r.behavior, rule: r.rule, scope: serializeRuleScope(r.scope), tool: r.tool, match: r.match, command: r.command, adds: r.adds, source: r.source, status: r.status }));
             rows.sort((a, b) => (a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0));
             return { rows, rev: view.rev };
         },
         async removeRule(input) {
-            return await removePersistedRule({ rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });
+            return await removePersistedRule({ behavior: input.behavior, rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });
         },
     };
 }

package/dist/session-titler.js

@@ -1,10 +1,10 @@
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 export const TITLE_MAX_CHARS = 80;
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
 const FAIL_CAUSE_KEY_CHARS = 80;
-const FAIL_CAUSE_CAP = 100;
 const SEEN_CAP = 10_000;
 export function sanitizeTitle(raw) {
     const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
@@ -22,18 +22,9 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const warnedCauses = new Set();
     const logFailure = (sessionId, error) => {
-        const cause = error.slice(0, FAIL_CAUSE_KEY_CHARS);
-        const meta = { sessionId, error: error.slice(0, 200) };
-        if (warnedCauses.has(cause)) {
-            deps.logger?.debug?.("session_title_failed", meta);
-            return;
-        }
-        if (warnedCauses.size >= FAIL_CAUSE_CAP)
-            warnedCauses.clear();
-        warnedCauses.add(cause);
-        deps.logger?.warn?.("session_title_failed", { ...meta, note: "同 cause 后续降为 debug 级" });
+        deps.logger?.debug?.("session_title_failed", { sessionId, error: error.slice(0, 200) });
+        recordFailOpen("server.session-titler.gateway-unreachable", error.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
     return {
         maybeTitle(sessionId, objective, model) {

package/dist/task-settings.d.ts

@@ -293,6 +293,36 @@ export interface FsWriteGateWiring {
      *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
      *  never-created sentinel dir (resolve-spec 修5). */
     cwd?: string;
+    /**
+     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基,与上面那个 `cwd` **刻意分成两个字段**。
+     *
+     * 两者在 host 腿上常常同值,但它们回答的不是同一个问题,而混用一个字段会让其中一个静默失效:
+     *  · `cwd` 是**写门**的基。它在「有 remoteExec 但这条 session 还没登记工作目录」时取的是一个
+     *    **永不创建的哨兵目录**(`resolve-spec` 的 `fs-write-gate-unrooted`)。对写门那是 fail-SAFE 的:
+     *    相对目标在哨兵下解析不出真身 ⇒ 落 ask。
+     *  · `taskRoot` 是**规则模式**的基(core `PathRuleBases.root`)。规则编译器按**词法**匹配,不问目录
+     *    存不存在 ⇒ 把哨兵递给它,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区
+     *    的 `<工作区>/src/secret.ts` 这类目标判 allow —— 一条运维亲手写下的收紧规则**静默失效**,方向与写门那条正相反。
+     *
+     * ⇒ 本字段**只在真任务根已知时**在场。缺席 ⇒ 规则编译器拿不到 `pathBases.root` ⇒ 需要该基的拼法
+     * (`Edit(src/**)` / `Edit(/etc/**)`)被 core 以 `unsupported.path_base` **整表拒**(→ 422,fail-loud),
+     * 而不是编成一条够不着任何东西的规则。绝对形(`//abs`)与 `~/` 形不需要基,两种部署形都照常编得出。
+     */
+    taskRoot?: string;
+    /**
+     * 🔴 S-177 / codex r2 [high](验真后修)—— **执行环境的 home**(core `PathRuleBases.home`,`~/…` 形的基)。
+     *
+     * core 对缺席的 `home` 回落 `os.homedir()` —— 那是**这个 server 进程**的 home。引擎与执行同机时它就是
+     * 对的;**远端车道**(SSH / 容器 / 沙箱)上执行用户的 home 与 server 的 home 是两个目录,于是
+     * `deny Edit(~/.sema/**)` 编译成功、却拿 server 的 home 去匹配远端的目标 ⇒ 一条收紧规则**静默失效**
+     * (与 `taskRoot` 那条哨兵病同族、同方向)。
+     *
+     * ⇒ 本字段只在 home **真知道**时在场(引擎与执行同机)。缺席时,`~/` 形的规则由
+     * {@link rejectUnmatchableSettingsNames} **响亮拒**(422),绝不回落到 server 的 home。
+     * ⚠️ 上游缺口如实登记:core 今天没有「这条规则需要哪些 base」的查询口,也不把 `home` 当必答项 ——
+     * 所以「这条规则用了 `~/` 吗」由本仓读**core 自己解析出的规范 command**(`~/` 前缀)来判,不自铸文法。
+     */
+    taskHome?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */
     scratchpadDir?: string;
     /** [ref]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),

package/dist/task-settings.js

@@ -1,5 +1,5 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, } from "@sema-agent/core";
-import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, ruleToolGrammarOf, } from "@sema-agent/core";
+import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
@@ -225,17 +225,18 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const ASK_RULE_SOURCE = "settings.permissions.ask";
-function createAskListPolicy(askNames) {
+const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
+function createRuleListPolicy(names, behavior, pathBases) {
     try {
-        return createPermissionRulePolicy(askNames.map((name) => ({ rule: name, behavior: "ask", source: ASK_RULE_SOURCE })), {
+        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source: RULE_SOURCE_BY_BEHAVIOR[behavior] })), {
             defaultAction: "allow",
             caps: { maxRules: MAX_SETTINGS_PERMISSION_RULES },
+            ...(pathBases !== undefined ? { pathBases } : {}),
         });
     }
     catch (e) {
         const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        throw new Error(`permissions.ask has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+        throw new Error(`${RULE_SOURCE_BY_BEHAVIOR[behavior].replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
@@ -267,31 +268,51 @@ function createWorkflowPlanDenyPolicy() {
         nameSets: [{ deny: WORKFLOW_ASK_NAMES }],
     };
 }
-function rejectUnmatchableSettingsNames(perms) {
-    for (const [field, names] of [["permissions.ask", perms.ask], ["permissions.deny", perms.deny]]) {
+function rejectUnmatchableSettingsNames(perms, pathBases) {
+    if (pathBases?.home === undefined) {
+        for (const [field, names, behavior] of [
+            ["permissions.ask", perms.ask, "ask"],
+            ["permissions.deny", perms.deny, "deny"],
+            ["permissions.allow", perms.allow, "allow"],
+        ]) {
+            for (const name of names ?? []) {
+                const parsed = parseRuleText(name, behavior);
+                if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
+                    throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
+                        `on a remote lane the engine's own home is a different user's directory, so the rule would compile and then match nothing that runs. ` +
+                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), or run the task on a lane whose home this worker knows.`);
+                }
+            }
+        }
+    }
+    for (const [field, names, behavior, consumer] of [
+        ["permissions.ask", perms.ask, "ask", "rule-policy"],
+        ["permissions.deny", perms.deny, "deny", "rule-policy"],
+        ["permissions.allow", perms.allow, "allow", "tool-name-table"],
+    ]) {
         if (!names)
             continue;
-        const bad = findUnmatchableToolNames(names);
+        const bad = findUnmatchableToolNames(names, { consumer, behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
         if (bad.length > 0)
             throw new Error(formatUnmatchableToolNames(field, bad));
     }
-    if (perms.allow) {
-        const bad = findCcRuleFormNames(perms.allow);
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames("permissions.allow", bad));
-    }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)
         return {};
     const { allow, deny, ask, defaultMode } = perms;
-    rejectUnmatchableSettingsNames(perms);
+    const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
+        ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
+        : undefined;
+    rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (allow || deny)
-        policies.push(createAllowDenyPolicy({ ...(allow ? { allow } : {}), ...(deny ? { deny } : {}) }));
+    if (allow)
+        policies.push(createAllowDenyPolicy({ allow }));
+    if (deny)
+        policies.push(createRuleListPolicy(deny, "deny", pathBases));
     if (ask)
-        policies.push(createAskListPolicy(ask));
+        policies.push(createRuleListPolicy(ask, "ask", pathBases));
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;

package/dist/tool-approval.d.ts

@@ -126,8 +126,9 @@ export interface ToolApprovalFrame {
     requiresRealApproval?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
-     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` 八员 content_question / unresolvable / org_unavailable /
-     * org_rule / hook / ask_rule / denial_limit_fallback / policy)。引擎在门上盖章(core d.ts:
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.9.0 现值:content_question /
+     * unresolvable / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
+     * denial_limit_fallback / shell_gate_tighten / safety_tighten / policy)。引擎在门上盖章(core d.ts:
      * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
      *
      * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
@@ -864,7 +865,7 @@ export declare class ToolApprovalCoordinator {
      * [ref] / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
      *
      * 🔴 病灶(真复现,`npm run build --flag=<700 字> && git status`):`batch` 成员的 `segment` 是复合命令
-     * 那一段的**原字节**,它**不经** `parseAllowRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
+     * 那一段的**原字节**,它**不经** `parseRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
      * 都不管;而卡的 `ApprovalCardSchema` 对四个文本座一律 `.max(MAX_RULE_TEXT_CHARS)`。逐字拷进卡 ⇒
      * `card_json` 落库 ⇒ `ensureAsk` 当场回读 `safeParse` 判假 ⇒ `persisted-row-unusable` ⇒ **整只 ask 走
      * park**,重放腿一并跳过该行。与「重扫二轮 §基数帽」是**同一条悬崖的另一条边**(那次是 offer 条数
@@ -885,7 +886,7 @@ export declare class ToolApprovalCoordinator {
     /** 兑付侧座(single 的 rule/command、command 成员的 rule/command、directoryRead 成员的 rule/directory)任一超尺?
      *  `segment` 与 `uncoveredDetail[].segment` 是纯渲染座,不在此列(截长是诚实省略)。 */
     private static ruleOfferTextsOverSize;
-    /** codex r1 [high]([ref]):offer 的自称座与 `parseAllowRuleText(rule)` 派生的三元组逐字一致?(理由见调用点) */
+    /** codex r1 [high]([ref]):offer 的自称座与 `parseRuleText(rule, "allow")` 派生的三元组逐字一致?(理由见调用点) */
     private static ruleOfferDerivedFactsAgree;
     private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -381,7 +381,7 @@ export class ToolApprovalCoordinator {
     }
     static ruleOfferDerivedFactsAgree(offer) {
         const derive = (rule) => {
-            const p = parseAllowRuleText(rule);
+            const p = parseRuleText(rule, "allow");
             return "rule" in p ? p.rule : undefined;
         };
         if (offer.kind === "single") {

package/dist/trace/project.d.ts

@@ -419,9 +419,10 @@ export declare function workspaceChangedEventData(ev: {
  * typebox schema `ToolRosterDelta`,过了整只透传,没过 ⇒ **整帧不发** + F 类留痕。半张名册变更帧比
  * 不发更坏:消费端会据它把没读到的行当成「这只工具被卸了」。
  *
- * ⚠️ **如实披露(core 7.8.0 自述)**:7.8.0 的 runtask **还没有**推这条帧([ref] S3 才接线),座位与
- * 类型先到货。本臂因此是**前瞻接线**:core 开始推的那一版,server 这一侧零改动即到达消费端;在那之前
- * 它永不触发。消费端在那一版之前**不得**依赖本帧(core 契约原文)。
+ * ✅ **已转正(core 7.9.0 / [ref] S3)**:引擎自 7.9.0 起**真推**这条帧 —— 驱动在推 `wiring_manifest`
+ * 的那一点订阅腿的名册增量座,一次改变名册的 refresh ⇒ **恰一帧**(序在 manifest 之后、那次 refresh 自己的
+ * `tool_end` 之前),`delta.fromDigest` = 消费端手上那份名册的 digest。7.66.0 写下的「前瞻接线」披露随本版
+ * 退役:本臂现在会真的触发,消费端可以依赖它了。
  */
 export declare function toolRosterDeltaEventData(ev: {
     delta?: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.66.0",
+  "version": "7.67.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.8.0",
+    "@sema-agent/core": "7.9.0",
     "@sema-agent/settings-schema": "1.9.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.5.0",
+    "@sema-agent/sdk": "8.6.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",