@sema-agent/server 7.66.0 → 7.68.0

package/dist/http/routes/diagnostics.js

@@ -1,3 +1,4 @@
+import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
@@ -11,7 +12,21 @@ export function buildServerWiringGates(input) {
     });
     return {
         streamApproval: gate.active ? "active" : gate.reason,
-        durableApproval: input.durableApproval,
+        durableApproval: buildPostureKnobReading(input.durableApproval, {
+            knob: "DURABLE_APPROVAL",
+            source: input.durableApprovalSource,
+            postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set) composed with a durable store being present: park/resume and the /v1/approvals routes are on by default — set DURABLE_APPROVAL=false to pin them off",
+        }),
+        streamAskWindowMs: buildPostureKnobReading(input.streamAskWindowMs, {
+            knob: "STREAM_ASK_WINDOW_MS",
+            source: input.streamAskWindowMsSource,
+            postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): an approval card waits 24h instead of 5 minutes, so stepping away does not settle the run unattended — set STREAM_ASK_WINDOW_MS to pin your own window",
+        }),
+        sessionAutoTitle: buildPostureKnobReading(input.sessionAutoTitle, {
+            knob: "SESSION_AUTO_TITLE",
+            source: input.sessionAutoTitleSource,
+            postureMeaning: "this knob has no posture arm — its default is the same on every deployment shape",
+        }),
         checkpointStore: input.checkpointStore !== undefined,
     };
 }
@@ -100,6 +115,11 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
                 backend: deps.backend,
                 checkpointStore: deps.checkpointStore,
                 durableApproval: deps.config.durableApproval === true,
+                durableApprovalSource: deps.config.durableApprovalSource,
+                streamAskWindowMs: deps.config.streamApproval?.windowMs ?? 0,
+                streamAskWindowMsSource: deps.config.streamAskWindowMsSource,
+                sessionAutoTitle: deps.config.sessionAutoTitle === true,
+                sessionAutoTitleSource: deps.config.sessionAutoTitleSource,
             }),
         });
         return;

package/dist/http/routes/rules.js

@@ -5,8 +5,8 @@ import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
-import { PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS } from "../../permission-rule-vocab.js";
+import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
+import { PERSISTED_RULE_MATCHES, isPersistedRuleTool } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -46,7 +46,8 @@ const LocalImportRowSchema = z
     .object({
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
-    tool: z.enum(PERSISTED_RULE_TOOLS),
+    behavior: z.enum(RULE_BEHAVIORS),
+    tool: z.string().min(1).max(190).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
     match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
@@ -58,16 +59,18 @@ const LocalImportPrepareBodySchema = z.object({ rows: z.array(LocalImportRowSche
 const LocalImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
 const RuleRevokeBodySchema = z
     .object({
+    behavior: z.enum(RULE_BEHAVIORS),
     rule: z.string().min(1).max(1024),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
     principal: z.string().min(1).max(190).optional(),
 })
     .strict();
+const RULES_CURSOR_FORMAT = 2;
 const RulesCursorSchema = z
-    .object({ rev: z.number().int().nonnegative().safe(), principal: z.string(), scope: z.string(), after: z.string() })
+    .object({ v: z.literal(RULES_CURSOR_FORMAT), rev: z.number().int().nonnegative().safe(), principal: z.string(), scope: z.string(), after: z.string() })
     .strict();
 function encodeRulesCursor(c) {
-    return Buffer.from(JSON.stringify(c)).toString("base64url");
+    return Buffer.from(JSON.stringify({ v: RULES_CURSOR_FORMAT, ...c })).toString("base64url");
 }
 function decodeRulesCursor(raw) {
     try {
@@ -78,7 +81,7 @@ function decodeRulesCursor(raw) {
         return { ok: false, why: err instanceof Error ? err.message : String(err) };
     }
 }
-const rowKey = (r) => `${r.scope}\u0000${r.rule}`;
+const rowKey = (r) => `${r.scope}\u0000${r.rule}\u0000${r.behavior}`;
 export async function handleRules(req, res, url, ctx) {
     const miss = { fell: false };
     await handleRulesBody(req, res, url, ctx, miss);
@@ -132,7 +135,7 @@ async function handleRulesBody(req, res, url, ctx, miss) {
     if (isLocalPrepare) {
         const parsed = LocalImportPrepareBodySchema.safeParse(rawBody);
         if (!parsed.success) {
-            sendError(res, 400, "request.body_shape", "body must be {rows:[{rule,scope,tool,match,command,adds}]}");
+            sendError(res, 400, "request.body_shape", "body must be {rows:[{behavior,rule,scope,tool,match,command,adds}]}");
             return;
         }
         const prepared = await lane.prepareLocalImport(principal, parsed.data.rows);
@@ -241,7 +244,9 @@ async function handleRuleList(req, res, caller, lane, operatorPrincipals) {
         sendError(res, 400, "request.query_invalid", "the rules cursor was minted at a different revision — restart the listing", { rev: listing.rev });
         return;
     }
-    const matching = listing.rows.filter((r) => (filterKey === "" || r.scope === filterKey) && (cursor === undefined || rowKey(r) > cursor.after));
+    const matching = listing.rows
+        .filter((r) => (filterKey === "" || r.scope === filterKey) && (cursor === undefined || rowKey(r) > cursor.after))
+        .sort((x, y) => (rowKey(x) < rowKey(y) ? -1 : rowKey(x) > rowKey(y) ? 1 : 0));
     const page = matching.slice(0, limit);
     const last = page[page.length - 1];
     const nextCursor = matching.length > limit && last !== undefined
@@ -252,7 +257,7 @@ async function handleRuleList(req, res, caller, lane, operatorPrincipals) {
 async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals) {
     const parsed = RuleRevokeBodySchema.safeParse(rawBody);
     if (!parsed.success) {
-        sendError(res, 400, "request.body_shape", "body must be {rule, scope} with an optional principal");
+        sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
         return;
     }
     const scope = parseRuleScope(parsed.data.scope);
@@ -265,7 +270,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
         sendError(res, 403, "auth.operator_only", "revoking another principal's rules is an operator-only action");
         return;
     }
-    const outcome = await lane.removeRule({ principal: target.principal, rule: parsed.data.rule, scope });
+    const outcome = await lane.removeRule({ principal: target.principal, behavior: parsed.data.behavior, rule: parsed.data.rule, scope });
     switch (outcome.status) {
         case "removed":
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });

package/dist/http/routes/runs.js

@@ -1609,7 +1609,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
                 windowMs: deps.config.streamApproval?.windowMs,
                 windowMarginMs: deps.config.streamAskWindowMarginMs,
             }
-            : undefined, deps.checkpointStore);
+            : undefined, deps.checkpointStore, prepared.engineNotices);
         return { status: 202, body: { taskId, sessionId, status: "running" } };
     }, (r) => r.status === 202);
     return resp;

package/dist/http/routes/tasks.js

@@ -231,20 +231,15 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 let ledgerSink;
                 let ledgerTerminal = false;
-                if (detachOnDisconnect && durableTaskId && deps.runStore) {
-                    const rs = deps.runStore;
-                    const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
-                    usageKey = durableTaskId;
-                    if (usageKey)
-                        deps.modelUsage?.register(usageKey);
-                }
                 if (deps.checkpointStore && prepared.spec.sessionId) {
                     await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
                 }
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
+                    usageKey = tid;
+                    deps.modelUsage?.register(tid);
                     const owner = principal ?? null;
                     const abortFromVerb = () => {
                         cancelledViaVerb.add(tid);
@@ -304,6 +299,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 const noticeLedger = ledgerSink;
                 const unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId: prepared.spec.sessionId,
+                    ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
                     live: (row) => {
                         if (res.writableEnded || res.destroyed) {
                             recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");

package/dist/http/server.d.ts

@@ -1,6 +1,6 @@
 import http from "node:http";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain } from "@sema-agent/core";
+import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
@@ -92,9 +92,14 @@ export interface ServiceCoreDeps {
      *  `boot/resolve-spec.ts` 的 `declaresInteractivePosture`)。缺席/false ⇒ 无人腿,不声明 posture ——
      *  bg(`POST /v1/runs`)、A2A、resume、cron/wake 一律走这一侧,行为字节不变。
      *  ⚠️ 它是**腿身份**不是能力表态:绝不从请求体读,只由路由装配点按 URL 定(客户端说了不算)。 */
+    /** `opts.onNotice` (L-167, core 7.9.1):装配期铸下的、**这条会话**的用户面通告(今天只有一族:请求腿
+     *  MCP 注入被丢弃)。装配跑在通告腿开口**之前**(`prepareSpec` → 路由注册 `registerEngineNoticeLeg`),
+     *  所以它不能在铸点直接 `route()` ——收下来交给调用腿,由腿在开口那一拍连同 `pending` 一起投。
+     *  缺席(桩、resume 家族)⇒ 只走结构化日志终点,行为逐字不变。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";
         liveStream?: boolean;
+        onNotice?: (notice: EngineNotice) => void;
     }) => TaskSpec | Promise<TaskSpec>;
     /**
      * [ref] 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。

package/dist/http/server.js

@@ -2,7 +2,7 @@ import http from "node:http";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
@@ -24,7 +24,6 @@ import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import { HANDS_BAND_TOOL_NAMES } from "../capabilities/hands-lane.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
@@ -115,10 +114,10 @@ export function validateUserSkills(skills) {
     }
     return null;
 }
+const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 const MAX_BODY = 8 * 1024 * 1024;
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
-const HAND_TOOL_NAMES = HANDS_BAND_TOOL_NAMES;
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
     return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
@@ -323,6 +322,7 @@ export function createHttpServer(rawDeps) {
                 ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
                 configHash,
                 pid: process.pid,
+                startedAt: PROCESS_STARTED_AT_MS,
                 port: deps.config.port,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
@@ -997,8 +997,9 @@ export function createHttpServer(rawDeps) {
         }
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}) });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body };
+            const engineNotices = [];
+            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body, ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {
@@ -1222,22 +1223,6 @@ export function createHttpServer(rawDeps) {
             throw e;
         }
         const pendingTool = cp.pendingAction.toolName;
-        const pendingToolCanon = pendingTool;
-        const availableTools = new Set((spec.tools ?? []).map((t) => t.name));
-        if (deps.config.remoteExec)
-            for (const name of HAND_TOOL_NAMES)
-                availableTools.add(name);
-        if (deps.checkpointStore)
-            availableTools.add("AskUserQuestion");
-        if (spec.selfOrchestration === true && deps.config.selfOrchestrationEnabled) {
-            availableTools.add(RUN_WORKFLOW_TOOL_NAME);
-        }
-        if (decision === "approve" && pendingToolCanon && !availableTools.has(pendingToolCanon)) {
-            return {
-                status: 422,
-                body: { error: `pending action no longer satisfiable: tool "${pendingToolCanon}" is not in the current task config (scenario changed since suspend)`, errorCode: "conflict.pending_action_unsatisfiable" },
-            };
-        }
         if (decision === "approve" && pendingTool === "AskUserQuestion" && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
         }
@@ -2434,6 +2419,7 @@ const WORKER_SWAP_REDEEMABLE = {
     env_factory_missing: true,
     governed_unwired: true,
     origin_missing: true,
+    ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
     read_face_damaged: false,

package/dist/mcp-tool-faces.js

@@ -1,4 +1,4 @@
-import { TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ACCESSES } from "@sema-agent/core";
+import { TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ABSENCES, TOOL_PATH_ACCESSES, TOOL_PATH_BASES } from "@sema-agent/core";
 function isRecord(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -26,17 +26,26 @@ function readOneFace(raw) {
         const pt = raw.pathTarget;
         if (!isRecord(pt) || typeof pt.param !== "string" || !memberOf(TOOL_PATH_ACCESSES, pt.access))
             return undefined;
-        if (!onlyKeys(pt, ["param", "access", "aliases", "skillScopeEligible"]))
+        if (!onlyKeys(pt, ["param", "access", "aliases", "skillScopeEligible", "base", "absent", "patternParam"]))
             return undefined;
         if (pt.aliases !== undefined && !isStringArray(pt.aliases))
             return undefined;
         if (pt.skillScopeEligible !== undefined && typeof pt.skillScopeEligible !== "boolean")
             return undefined;
+        if (pt.base !== undefined && !memberOf(TOOL_PATH_BASES, pt.base))
+            return undefined;
+        if (pt.absent !== undefined && !memberOf(TOOL_PATH_ABSENCES, pt.absent))
+            return undefined;
+        if (pt.patternParam !== undefined && typeof pt.patternParam !== "string")
+            return undefined;
         out.pathTarget = {
             param: pt.param,
             access: pt.access,
             ...(pt.aliases !== undefined ? { aliases: pt.aliases } : {}),
             ...(pt.skillScopeEligible === true ? { skillScopeEligible: true } : {}),
+            ...(pt.base !== undefined ? { base: pt.base } : {}),
+            ...(pt.absent !== undefined ? { absent: pt.absent } : {}),
+            ...(pt.patternParam !== undefined ? { patternParam: pt.patternParam } : {}),
         };
     }
     if (raw.renderHints !== undefined) {

package/dist/observability/fail-open.d.ts

@@ -69,6 +69,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "elicitation_complete 面包屑持久化失败。同上——答案已经在壳手里,丢的是收尾渲染。";
     };
+    readonly "server.session-titler.gateway-unreachable": {
+        readonly cls: "F";
+        readonly note: "S-178(cli [6662] ① clay 裁定转达,`session-titler.ts logFailure`):自动会话标题那一次廉价模型调用失败(gateway 不可达 / 凭据缺失 / 超时)。标题是**纯装饰**——列表面回退 objectivePreview,零行为影响,门/裁决/账本一个字节不受它管。此前每个新会话首次同 cause 打一条 `warn`,于是一台没配模型 gateway 的单机部署在日志里被这条噪音刷屏,壳因此去关 `SESSION_AUTO_TITLE`(替上游压噪),而那是把一个部署级旋钮当消音器用。现在:逐次 `debug` + 本计数 + 一次性 warn(recorder 自己的),运维仍看得见「这台机器的 titler 一直在失败」,用户面零噪音。观测面另有 `session_title_total{outcome}` 逐次记账。";
+    };
     readonly "server.prompts.artifact-cache-write-failed": {
         readonly cls: "F";
         readonly note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。";

package/dist/observability/fail-open.js

@@ -60,6 +60,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "elicitation_complete 面包屑持久化失败。同上——答案已经在壳手里,丢的是收尾渲染。",
     },
+    "server.session-titler.gateway-unreachable": {
+        cls: "F",
+        note: "S-178(cli [6662] ① clay 裁定转达,`session-titler.ts logFailure`):自动会话标题那一次廉价模型调用失败(gateway 不可达 / 凭据缺失 / 超时)。标题是**纯装饰**——列表面回退 objectivePreview,零行为影响,门/裁决/账本一个字节不受它管。此前每个新会话首次同 cause 打一条 `warn`,于是一台没配模型 gateway 的单机部署在日志里被这条噪音刷屏,壳因此去关 `SESSION_AUTO_TITLE`(替上游压噪),而那是把一个部署级旋钮当消音器用。现在:逐次 `debug` + 本计数 + 一次性 warn(recorder 自己的),运维仍看得见「这台机器的 titler 一直在失败」,用户面零噪音。观测面另有 `session_title_total{outcome}` 逐次记账。",
+    },
     "server.prompts.artifact-cache-write-failed": {
         cls: "F",
         note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。",

package/dist/observability/metrics.js

@@ -260,7 +260,7 @@ export function createMetrics() {
     m.counter("stale_cache_conflict_total", "Warm session-cache entries evicted by a cross-instance write while cached (S25)");
     m.counter("breaker_writethrough_failed_total", "Circuit-breaker cross-replica write-through failures (LOW), by backend");
     m.counter("web_search_bad_payload_total", "Web-search provider responses whose results field was not an array (LOW), by provider");
-    m.counter("permission_denied_total", "Tool-gate denials by the LAYER whose verdict is the deny (core's DeniedBy: policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution; 'other' = this build cannot name the layer; label is `deniedBy` since server 7.64.0 — it was `source` over core's retired PermissionDeniedSource; goal B4 always-on deny meter)");
+    m.counter("permission_denied_total", "Tool-gate denials by the LAYER whose verdict is the deny (core's DeniedBy: policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution/persisted_rule; 'other' = this build cannot name the layer; label is `deniedBy` since server 7.64.0 — it was `source` over core's retired PermissionDeniedSource; goal B4 always-on deny meter)");
     m.counter("permission_rule_events_total", "Persisted allow-rule seam events by event (persisted_rule_allowed = a rule authorized a call with nobody asked; rule_store_unreadable = the store failed to read so the call was adjudicated with ZERO rules)");
     m.counter("compaction_events_total", "Compaction lifecycle events by outcome (started/completed/failed/skipped) and trigger");
     m.counter("hook_llm_calls_total", "prompt/agent hook entries that completed a model call (hooks 3b), by type");

package/dist/permission-rule-vocab.d.ts

@@ -1,29 +1,21 @@
+import type { RuleApprovalRecord } from "@sema-agent/core";
 /**
- * [ref] + [ref](core `e298c9e0`,随 7.2.x 提货生效;[ref])—— 规则车道**闭词表的单一属主**。
- *
- * 为什么要一个模块而不是各处各写一份 `z.enum([...])`:同一张词表此前在四处各抄一份字面量
- * (`approval-card.ts` 两腿的 offer schema、`http/routes/rules.ts` 的直通票口行形、
- * `plugins/permission-rule-store-sql.ts` 的 `rules_json` 读/写形),core 给 `PersistedRuleMatch` 加两员
- * (wildcard / subpath)、给 `PersistedRuleTool` 加 Read 时,四份抄件**没有一份**会编译红 —— zod 的 enum
- * 只是运行期的一个 Set,静默把一次上游语义扩张翻成一整类合法行的拒收([ref] 词表纪律说的正是这形:
- * 未知词必须是**编译**错,不是运行期一个安静的 false)。
+ * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
+ * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
+ * 「转录一份名单」换成「转 core 的**谓词**」——名单在 core 的目录里,抄一份的那天目录加一个带
+ * `pathTarget` 的工具,本仓会静默拒收一整类合法行(正是本文件顶注说的那个病)。
  *
- * 🔴 每张表都带一条**双向全等钉**(`Exact<>`):元组的成员并 ≡ core 的联合型。core 加员 ⇒ 这里编译红,
- * 由人裁定新词在每个消费面的处置(收 / 拒 / 剥),而不是让它在某一处静默落进「不认识」臂;本仓多写一个
- * core 没有的词 ⇒ 同样红(词表属主是 core,本仓只转录)。
- *
- * ⚠️ 转录**不是**判据:一个词在表里只说「这是 core 定义的一员」,不说「本仓每条腿都接受它」。逐腿的收窄
- * (例如卡编辑臂对 `subpath` 的拒)写在那条腿自己的穷举 `switch` 里,并各带理由。
+ * 谓词方向仍是 fail-CLOSED:`ruleToolGrammarOf` 认不出的名字**不是**一条可持久化规则的工具位
+ * (既非命令文法也非路径文法 ⇒ 这条行永远匹配不上任何调用),两只店与票口一律拒。
  */
-import type { RuleApprovalRecord } from "@sema-agent/core";
-/** `PersistedRuleTool`([ref] §2.2:`"Read"` 只说一种文法 —— `Read(//abs-dir/**)` 目录只读授权)。 */
-export declare const PERSISTED_RULE_TOOLS: readonly ["Bash", "Read"];
+export declare function isPersistedRuleTool(name: string): boolean;
 /**
- * `PersistedRuleMatch` 四员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
+ * `PersistedRuleMatch` 五员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
  * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
- * `subpath`(Read 目录形,永不容纳任何命令)。
+ * `subpath`(Read 目录形,永不容纳任何命令)/ `path`(core 7.9.0 [ref]:路径族 deny/ask/allow 的模式文法
+ * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)。
  */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath"];
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path"];
 /** [ref] §2.3 B3:batch offer 成员的判别位(`command` = 历史逐段 Bash 规则;`directoryRead` = cd 段铸的目录只读授权)。 */
 export declare const RULE_OFFER_BATCH_MEMBER_KINDS: readonly ["command", "directoryRead"];
 /** [ref] §3.5:一段「为什么仍未被覆盖」的闭三词集(`redirection` 永久逐次 / `no_rule_form` 无可覆盖形 / `cap_overflow` 去重+帽挤出)。 */
@@ -31,7 +23,7 @@ export declare const UNCOVERED_SEGMENT_REASONS: readonly ["redirection", "no_rul
 /** [ref] §3.3-5:卡编辑面的 breadth 警告码(记录 `edited.warnings` 存的就是这两个字面)。 */
 export declare const EDITED_RULE_BREADTH_WARNING_CODES: readonly ["broad_prefix", "compound_prefix"];
 /**
- * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 2→3)。
+ * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 3→4;[ref] 三态 behavior 进候选行)。
  * 类型绑 core 的字面型:core 再升号 ⇒ 这里编译红,两只 durable 店(SQL 双方言 + File)的 stale 判别与写侧钉
  * 同批随之;判别是**等式**(`!==`)不是下限 —— 旧号的行按 stale 信封交还(不迁移、不 widen、不丢行),
  * pending 卡短命,重触发即取新卡(B7/B8 既诺)。

package/dist/permission-rule-vocab.js

@@ -1,7 +1,8 @@
-export const PERSISTED_RULE_TOOLS = ["Bash", "Read"];
-const TOOLS_PIN = true;
-void TOOLS_PIN;
-export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath"];
+import { ruleToolGrammarOf } from "@sema-agent/core";
+export function isPersistedRuleTool(name) {
+    return ruleToolGrammarOf(name) !== undefined;
+}
+export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path"];
 const MATCHES_PIN = true;
 void MATCHES_PIN;
 export const RULE_OFFER_BATCH_MEMBER_KINDS = ["command", "directoryRead"];
@@ -13,5 +14,5 @@ void REASONS_PIN;
 export const EDITED_RULE_BREADTH_WARNING_CODES = ["broad_prefix", "compound_prefix"];
 const WARNING_CODES_PIN = true;
 void WARNING_CODES_PIN;
-export const RULE_APPROVAL_RECORD_SCHEMA = 3;
+export const RULE_APPROVAL_RECORD_SCHEMA = 4;
 //# sourceMappingURL=permission-rule-vocab.js.map

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,6 +1,7 @@
-import { FileDurableRulePartitionProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope, type StaleRuleApprovalRecord } from "@sema-agent/core";
+import { FileDurableRulePartitionProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type StaleRuleApprovalRecord } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
+import { type RuleCandidate } from "@sema-agent/core";
 /**
  * `RuleApprovalRecordStore` 的 File 形。
  *
@@ -62,10 +63,7 @@ export declare class FileRuleImportTicketStore {
         principal: string;
         approvalId: string;
         purpose: RuleTicketPurpose;
-        candidates: ReadonlyArray<{
-            rule: string;
-            scope: RuleScope;
-        }>;
+        candidates: ReadonlyArray<RuleCandidate>;
         ttlMs: number;
     }): Promise<RuleImportTicket>;
     /** 一次性**认领**。五条否定项的判序与 SQL 形逐字相同(unknown → wrong-principal → wrong-purpose →

package/dist/plugins/permission-rule-store-file.js

@@ -6,12 +6,13 @@ import { FileDurableRulePartitionProvider, AppendLog, ensureDir, readJsonlRecord
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
 import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
+import { RULE_BEHAVIORS } from "@sema-agent/core";
 const RuleScopeSchema = z.union([
     z.object({ kind: z.literal("global") }).strict(),
     z.object({ kind: z.literal("project"), root: z.string().min(1) }).strict(),
 ]);
 const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().int().nonnegative().safe() }).strict();
-const RuleCandidateSchema = z.object({ rule: z.string(), scope: RuleScopeSchema }).strict();
+const RuleCandidateSchema = z.object({ behavior: z.enum(RULE_BEHAVIORS), rule: z.string(), scope: RuleScopeSchema }).strict();
 const RuleOffer2Schema = z.union([
     z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
     z

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { type PermissionRuleWriter, type DurableRulePartition, type DurableRulePartitionProvider, type RuleScope, type RuleSyncFrontier, type RuleApprovalRecord, type StaleRuleApprovalRecord, type RuleApprovalRecordStore, type RuleOwner } from "@sema-agent/core";
+import { type PermissionRuleWriter, type DurableRulePartition, type DurableRulePartitionProvider, type RuleScope, type RuleSyncFrontier, type RuleCandidate, type RuleApprovalRecord, type StaleRuleApprovalRecord, type RuleApprovalRecordStore, type RuleOwner } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { PgQueryFn } from "./pg-query.js";
 import { type SqlDriver } from "./sql-driver.js";
@@ -274,11 +274,14 @@ export declare const SQL_DB_NOW_MS: {
     readonly tidb: "CAST(UNIX_TIMESTAMP(NOW(3)) * 1000 AS SIGNED)";
     readonly pg: "(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint";
 };
-/** prepare 时刻候选集的规范摘要(载荷绑定 F1 ④ 的判据)。纯数据 ⇒ `build*`。 */
-export declare function buildRulePayloadHash(candidates: ReadonlyArray<{
-    rule: string;
-    scope: RuleScope;
-}>): string;
+/** prepare 时刻候选集的规范摘要(载荷绑定 F1 ④ 的判据)。纯数据 ⇒ `build*`。
+ *
+ *  🔴 入参型收到 core 的 `RuleCandidate`(core 7.9.0 [ref] 起含 `behavior`)—— 规则的身份是
+ *  **(behavior, 文本, 作用域) 三元组**,而这道摘要正是「prepare 那一刻的候选集」与「redeem 那一刻的
+ *  候选集」之间的等式。此前的形参写成 `{rule, scope}` 二元组:序列化器吃的是整只对象所以运行期**恰好**
+ *  覆盖了 behavior,但那是巧合不是保证 —— 哪天有人从一个只有二元组的地方喂进来,一次把候选从 `deny`
+ *  改写成 `allow`(文本一个字节不动)在这道等式下就认不出来了。收到域型让机器替人守这一条。 */
+export declare function buildRulePayloadHash(candidates: ReadonlyArray<RuleCandidate>): string;
 /**
  * 票面三态协议的 SQL 实现。
  *
@@ -315,10 +318,7 @@ export declare class SqlRuleImportTicketStore {
         principal: string;
         approvalId: string;
         purpose: RuleTicketPurpose;
-        candidates: ReadonlyArray<{
-            rule: string;
-            scope: RuleScope;
-        }>;
+        candidates: ReadonlyArray<RuleCandidate>;
         ttlMs: number;
     }): Promise<RuleImportTicket>;
     /**