@sema-agent/server 7.66.0 → 7.68.0

package/dist/plugins/permission-rule-store-sql.js

@@ -1,10 +1,10 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, parseAllowRuleText, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_SYNC_DROP_CODES, EMPTY_DURABLE_RULE_PARTITION, } from "@sema-agent/core";
+import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, foldDelta, parseRuleText, readRowBehavior, screenRuleSyncState, PERMISSION_RULE_WRITER, RULE_BEHAVIORS, RULE_SYNC_DROP_CODES, EMPTY_DURABLE_RULE_PARTITION, } from "@sema-agent/core";
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 import { canonicalJson } from "../canonical-json.js";
-import { EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
+import { EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, isPersistedRuleTool, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 export function writerOfSqlRuleStore(store) {
     const w = Reflect.get(store, PERMISSION_RULE_WRITER);
     if (w === null || typeof w !== "object")
@@ -24,10 +24,11 @@ const RuleDotSchema = z.object({ actor: z.string().min(1), counter: z.number().i
 const RuleAddSchema = z
     .object({ dot: RuleDotSchema, origin: z.enum(["user", "imported-cc", "starter"]), createdAt: z.string() })
     .strict();
-const PersistedAllowRuleSchema = z
+const PersistedRuleRowSchema = z
     .object({
+    behavior: z.string().optional(),
     rule: z.string(),
-    tool: z.enum(PERSISTED_RULE_TOOLS),
+    tool: z.string().min(1).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
     match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string(),
     scope: DurableRuleScopeSchema,
@@ -35,14 +36,15 @@ const PersistedAllowRuleSchema = z
 })
     .strict();
 const RuleTombstoneSchema = z
-    .object({ rule: z.string(), scope: DurableRuleScopeSchema, removedDots: z.array(RuleDotSchema).min(1), deletedBy: RuleDotSchema })
+    .object({ behavior: z.string().optional(), rule: z.string(), scope: DurableRuleScopeSchema, removedDots: z.array(RuleDotSchema).min(1), deletedBy: RuleDotSchema })
     .strict();
 const QUARANTINE_REASONS = new Set(Object.entries(RULE_SYNC_DROP_CODES)
     .filter(([, side]) => side.includes("local-quarantined"))
     .map(([code]) => code));
 const isQuarantineReason = (v) => typeof v === "string" && QUARANTINE_REASONS.has(v);
-const QuarantinedRuleAddSchema = z
+const QuarantinedRuleAddRowSchema = z
     .object({
+    behavior: z.string().optional(),
     rule: z.string(),
     scope: DurableRuleScopeSchema,
     add: RuleAddSchema,
@@ -50,8 +52,18 @@ const QuarantinedRuleAddSchema = z
     atMs: z.number().int().nonnegative().safe(),
 })
     .strict();
+function readBucketRowBehavior(raw, what, ownerKey) {
+    const behavior = readRowBehavior(raw);
+    if (behavior === undefined) {
+        throw new Error(`permission_rule bucket ${ownerKey} carries a ${what} whose behavior word is outside the closed set (${JSON.stringify(raw)}) — ` +
+            `refusing the whole bucket rather than reading a standing deny as "no rule"`);
+    }
+    return behavior;
+}
+const WritablePersistedRuleSchema = PersistedRuleRowSchema.extend({ behavior: z.enum(RULE_BEHAVIORS) });
+const WritableRuleTombstoneSchema = RuleTombstoneSchema.extend({ behavior: z.enum(RULE_BEHAVIORS) });
 const FrontierSchema = z.record(z.string(), z.number().int().nonnegative().safe());
-const RuleCandidateSchema = z.object({ rule: z.string(), scope: DurableRuleScopeSchema }).strict();
+const RuleCandidateSchema = z.object({ behavior: z.enum(RULE_BEHAVIORS), rule: z.string(), scope: DurableRuleScopeSchema }).strict();
 const RedeemedDotsSchema = z.record(z.string(), RuleDotSchema);
 const RuleEditedSchema = z
     .object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string(), warnings: z.array(z.enum(EDITED_RULE_BREADTH_WARNING_CODES)).optional() })
@@ -108,9 +120,9 @@ export const TIDB_PERMISSION_RULE_STATEMENTS = [
     state VARCHAR(32) NOT NULL,
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json LONGTEXT NOT NULL,
-    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 3 —— design/382 §3.5 由 2 升,
+    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 4 —— core 7.9.0 #625 由 3 升,
     -- 代码里的单点是 RULE_APPROVAL_RECORD_SCHEMA;OCC 守卫另在 rev,两轴禁混,schema-naming 门③ 白名单
-    -- 登记)。读侧对非 3 的行(含上一形的 2)交还 design/375 §4.5 的
+    -- 登记)。读侧对非 4 的行(含上一形的 3)交还 design/375 §4.5 的
     -- StaleRuleApprovalRecord 信封(identity 键 only)—— 本仓 SCHEMA POLICY 是删表重建,重建后的表
     -- 不该有这种行,这一臂是「未来再换形」的防御位,绝不静默 widen 成一条本形担保不了的记录。
     version INT NOT NULL,
@@ -263,7 +275,7 @@ export async function ensurePgPermissionRuleSchema(q) {
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json TEXT COLLATE "C" NOT NULL,
     -- version / offers_json / selected_offer:design/375 换形三列(MySQL 孪生的行内注写了理由:
-    -- version=数据格式版本恒 3(design/382 §3.5 由 2 升;单点 RULE_APPROVAL_RECORD_SCHEMA),非 3 的行(含 2)
+    -- version=数据格式版本恒 4(core 7.9.0 #625 由 3 升;单点 RULE_APPROVAL_RECORD_SCHEMA),非 4 的行(含 3)
     -- 读成 Stale 信封;offers_json=按 index 引用的 OPTION 结构,
     -- 禁存文本副本;selected_offer=确认的 OFFER index,与 ticket/redeemed_dots 的 CANDIDATE index
     -- 两空间分离)。
@@ -356,10 +368,18 @@ class SqlDurableRulePartition {
         const row = rows[0];
         if (row === undefined)
             return { ...EMPTY_BUCKET, rules: [], tombstones: [], quarantined: [] };
-        const rules = parseColumn(z.array(PersistedAllowRuleSchema), row.rules_json, "rules_json", this.ownerKey);
-        const tombstones = parseColumn(z.array(RuleTombstoneSchema), row.tombstones_json, "tombstones_json", this.ownerKey);
-        const quarantined = parseColumn(z.array(QuarantinedRuleAddSchema), row.quarantined_json, "quarantined_json", this.ownerKey);
+        const rulesRaw = parseColumn(z.array(PersistedRuleRowSchema), row.rules_json, "rules_json", this.ownerKey);
+        const tombstonesRaw = parseColumn(z.array(RuleTombstoneSchema), row.tombstones_json, "tombstones_json", this.ownerKey);
+        const quarantinedRaw = parseColumn(z.array(QuarantinedRuleAddRowSchema), row.quarantined_json, "quarantined_json", this.ownerKey);
         const observedVector = row.observed_vector_json === null || row.observed_vector_json === undefined ? undefined : parseColumn(FrontierSchema, row.observed_vector_json, "observed_vector_json", this.ownerKey);
+        const expected = buildRuleBucketChecksum({ rules: rulesRaw, tombstones: tombstonesRaw, quarantined: quarantinedRaw, ...(observedVector !== undefined ? { observedVector } : {}) });
+        if (String(row.checksum ?? "") !== expected) {
+            throw new Error(`permission_rule bucket ${this.ownerKey} failed its integrity check (stored ${String(row.checksum)}, computed ${expected}) — ` +
+                `refusing the whole bucket rather than reporting a partial rule set`);
+        }
+        const rules = rulesRaw.map((r) => ({ ...r, behavior: readBucketRowBehavior(r.behavior, "rule row", this.ownerKey) }));
+        const tombstones = tombstonesRaw.map((t) => ({ ...t, behavior: readBucketRowBehavior(t.behavior, "tombstone", this.ownerKey) }));
+        const quarantined = quarantinedRaw.map((q) => ({ ...q, behavior: readBucketRowBehavior(q.behavior, "quarantined row", this.ownerKey) }));
         const state = {
             actor: String(row.actor ?? ""),
             counter: Number(row.counter ?? 0),
@@ -369,13 +389,8 @@ class SqlDurableRulePartition {
             quarantined,
             ...(observedVector !== undefined ? { observedVector } : {}),
         };
-        const expected = buildRuleBucketChecksum({ rules, tombstones, quarantined, ...(observedVector !== undefined ? { observedVector } : {}) });
-        if (String(row.checksum ?? "") !== expected) {
-            throw new Error(`permission_rule bucket ${this.ownerKey} failed its integrity check (stored ${String(row.checksum)}, computed ${expected}) — ` +
-                `refusing the whole bucket rather than reporting a partial rule set`);
-        }
         const badTombstone = tombstones.find((t) => {
-            const parsed = parseAllowRuleText(t.rule);
+            const parsed = parseRuleText(t.rule, t.behavior);
             return "reject" in parsed || parsed.rule.rule !== t.rule;
         });
         if (badTombstone !== undefined) {
@@ -467,7 +482,7 @@ class SqlDurableRulePartition {
                 assertDeleteDeltaCarriesNoAdd(delta);
                 nextTombstones = [...cur.tombstones, delta.tombstone];
             }
-            const writable = z.object({ rules: z.array(PersistedAllowRuleSchema), tombstones: z.array(RuleTombstoneSchema) }).safeParse({ rules: nextRules, tombstones: nextTombstones });
+            const writable = z.object({ rules: z.array(WritablePersistedRuleSchema), tombstones: z.array(WritableRuleTombstoneSchema) }).safeParse({ rules: nextRules, tombstones: nextTombstones });
             if (!writable.success) {
                 throw new Error(`refusing to write a permission_rule bucket this backend could not read back: ${writable.error.message}`);
             }

package/dist/posture-source.d.ts

@@ -0,0 +1,57 @@
+/**
+ * S-167 → S-178 —— **一个部署级旋钮的值是谁定的**,四词闭集 + 一句运维指路。
+ *
+ * ## 为什么是一个共享件而不是每键一份
+ *
+ * S-167 给 `READ_FACE` 造了这套东西(值 + 来源 + 指路句),理由写在 `read-face-posture.ts` 的顶注里:
+ * 「缺席」这一态里塞着两件不同的事(单机 turnkey 没表态 vs 多租户就是要引擎默认),而把它们分开之后,
+ * **env 恒赢的判据**与**运维面「为什么这台机器是这个值」**才有真答案。S-178 把同一条律推到另外三个键
+ * (`STREAM_ASK_WINDOW_MS` / `DURABLE_APPROVAL` / `SESSION_AUTO_TITLE`)时,唯一诚实的做法是**抽这一份**
+ * ——四词表抄第二遍的那天,两份表会在加词时分家,而「这个值是谁定的」在运维面上是个是非题,不能有两个答案。
+ *
+ * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
+ * `env 显式` > `center 发布` > `posture 派生` > `引擎/服务端默认`。
+ *
+ * ## 定界
+ * 本模块只说**来源**。值本身、以及「这台机器凭什么派生出这个值」那句话,由每个键自己给
+ * ({@link PostureKnobFacts.postureMeaning})——那句话是键专属的事实,共享它只会得到一句谁都不认的空话。
+ */
+/** 旋钮取值来源的闭集词表(顺序 = 优先序)。 */
+export declare const POSTURE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
+/** 一个旋钮的取值来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export type PostureSource = (typeof POSTURE_SOURCE_WORDS)[number];
+/** 一个旋钮报出「我是谁定的」所需要的三件事。 */
+export interface PostureKnobFacts {
+    /** 这台机器上占住这个键的 env 变量名(指路句要逐字点它,运维才知道去改哪个)。 */
+    readonly knob: string;
+    readonly source: PostureSource;
+    /**
+     * `posture` 那一臂**专属**的一句话:这台机器为什么派生出了这个值,以及怎么把它钉回去。
+     * 只在 `source === "posture"` 时被读到 —— 别的臂的句子是通用的(见 {@link postureSourceNote})。
+     */
+    readonly postureMeaning: string;
+}
+/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+export declare function postureSourceNote(facts: PostureKnobFacts): string;
+/**
+ * 这个值是**运维显式表态**的吗?
+ *
+ * 🔴 S-178 施工时真踩(本批全量抓出):`hasOperatorGateIntent`(`src/approval.ts`)判「运维表达过门意图
+ * 没有」时读的是 `durableApproval` 这个**值** —— 那在本键进 posture 家族之前是对的(它只有显式设过才为
+ * 真),之后当场失真:单机 turnkey 上 posture 派生的 `true` 会被读成「运维要门」,于是 run-local 那条
+ * **结构上没有 durable 门**的腿在每次 boot 打一条补偿 warn,而它其实正处在「零门意图的既定姿势」里。
+ * 这与 S-167 头注①记的是**同一形**病(用一个会被 posture 铸出来的量当「有人表态过」的代理)。
+ *
+ * ⇒ 判据落到**来源**上,穷举 switch(四词闭集加员即编译红):`env`(这台机器的运维写下的)与 `center`
+ * (组织发布的)是表态;`posture`(姿态派生)与 `engine-default`(内建缺省)都**不是**「有人要求过」。
+ */
+export declare function isExplicitPosture(source: PostureSource): boolean;
+/** operator 诊断面的一行读数:值 + 来源 + 指路句。三个 S-178 旋钮与 S-167 的 readFace 同形。 */
+export interface PostureKnobReading<V> {
+    value: V;
+    source: PostureSource;
+    note: string;
+}
+/** 一行读数的铸点(纯数据 ⇒ `build*`)。 */
+export declare function buildPostureKnobReading<V>(value: V, facts: PostureKnobFacts): PostureKnobReading<V>;
+//# sourceMappingURL=posture-source.d.ts.map

package/dist/posture-source.js

@@ -0,0 +1,27 @@
+export const POSTURE_SOURCE_WORDS = ["env", "center", "posture", "engine-default"];
+export function postureSourceNote(facts) {
+    switch (facts.source) {
+        case "env":
+            return `pinned by this machine's ${facts.knob} env var (deployment sovereignty — it wins over any published value for this key)`;
+        case "center":
+            return `applied from the config-center (restart-to-apply); set ${facts.knob} on this machine to take the key back`;
+        case "posture":
+            return facts.postureMeaning;
+        case "engine-default":
+            return `not pinned by this deployment — the built-in default for ${facts.knob} is in force`;
+    }
+}
+export function isExplicitPosture(source) {
+    switch (source) {
+        case "env":
+        case "center":
+            return true;
+        case "posture":
+        case "engine-default":
+            return false;
+    }
+}
+export function buildPostureKnobReading(value, facts) {
+    return { value, source: facts.source, note: postureSourceNote(facts) };
+}
+//# sourceMappingURL=posture-source.js.map

package/dist/read-face-posture.d.ts

@@ -27,10 +27,14 @@
  * 两者在 core 里是并列机制(deny 表在 open 面上照样拦)。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
-/** 档位来源的闭集词表(顺序 = 优先序:env > center > posture > 引擎默认)。 */
+import { type PostureSource } from "./posture-source.js";
+/**
+ * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
+ * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
+ */
 export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
-/** 档位的来源(闭集四词)。加词 ⇒ {@link readFaceSourceNote} 的穷举 switch 编译红。 */
-export type ReadFaceSource = (typeof READ_FACE_SOURCE_WORDS)[number];
+/** 档位的来源(闭集四词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
+export type ReadFaceSource = PostureSource;
 /** 一台 worker 的 READ 面档位事实(值 + 来源)。`ServiceConfigFlat` 结构上满足本形。 */
 export interface ReadFacePostureFacts {
     readonly readFace?: "open" | "roots" | undefined;
@@ -41,7 +45,8 @@ export interface ReadFacePostureFacts {
  * 单用户 turnkey ⇒ `open`;多租户 ⇒ 不铸(引擎默认 `roots`,server 不复制上游默认)。
  */
 export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
-/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+/** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
+ *  本函数只提供 `posture` 那一臂的**键专属**事实句。 */
 export declare function readFaceSourceNote(source: ReadFaceSource): string;
 /** operator 诊断面的投影(`GET /v1/diagnostics/wiring`)。`face:null` = 本部署没钉档,引擎默认接管。 */
 export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {

package/dist/read-face-posture.js

@@ -1,18 +1,14 @@
-export const READ_FACE_SOURCE_WORDS = ["env", "center", "posture", "engine-default"];
+import { POSTURE_SOURCE_WORDS, postureSourceNote } from "./posture-source.js";
+export const READ_FACE_SOURCE_WORDS = POSTURE_SOURCE_WORDS;
 export function readFaceForPosture(singleUserTurnkey) {
     return singleUserTurnkey ? { readFace: "open", readFaceSource: "posture" } : { readFaceSource: "engine-default" };
 }
 export function readFaceSourceNote(source) {
-    switch (source) {
-        case "env":
-            return "pinned by this machine's READ_FACE env var (deployment sovereignty — it wins over any published readFace domain)";
-        case "center":
-            return "applied from the config-center readFace domain (restart-to-apply); set READ_FACE on this machine to take the key back";
-        case "posture":
-            return "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back";
-        case "engine-default":
-            return "not pinned by this deployment — the engine's own default (roots) is in force";
-    }
+    return postureSourceNote({
+        knob: "READ_FACE",
+        source,
+        postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
+    });
 }
 export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };

package/dist/rules-consent.d.ts

@@ -1,4 +1,4 @@
-import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedAllowRule, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
+import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
 /**
@@ -20,10 +20,7 @@ export interface RuleConsentRecordStores {
             principal: string;
             approvalId: string;
             purpose: RuleTicketPurpose;
-            candidates: ReadonlyArray<{
-                rule: string;
-                scope: RuleScope;
-            }>;
+            candidates: ReadonlyArray<RuleCandidate>;
             ttlMs: number;
         }): Promise<RuleImportTicket>;
         /** 一次**认领**(不是「已完成」)。语义与「认领之后怎么办」见 {@link RuleConsentStores.tickets.release}。
@@ -144,9 +141,12 @@ export declare const MAX_LOCAL_IMPORT_BYTES: number;
  *    救回来",而不是等下一次 prepare。运维旋钮暂不开(没有部署形要求它可调)。
  */
 export declare const LOCAL_IMPORT_CLAIM_LEASE_MS = 60000;
-/** 一条规则的 wire 身份键(规则文本 + {@link serializeRuleScope} 的判别式串)。两个面(预览 / 兑付回执)
- *  用**同一把键**,客户端拿它把两张表 join 起来。 */
+/** 一条规则的 wire 身份键(**态** + 规则文本 + {@link serializeRuleScope} 的判别式串)。两个面
+ *  (预览 / 兑付回执)用**同一把键**,客户端拿它把两张表 join 起来。
+ *  🔴 `behavior` 自 7.67.0 起是这把键的一格(core 7.9.0 [ref]:规则的身份是三元组)—— 少了它,同文本
+ *  同作用域的 deny 与 allow 两行会被本口判成 `duplicate_row`,而它们是两条不同的规则。 */
 export interface LocalImportRuleKey {
+    behavior: RuleBehavior;
     rule: string;
     scope: string;
 }
@@ -502,14 +502,18 @@ export declare function parseRuleScope(text: string): DurableRuleScope | undefin
  *  `adds` **如实上 wire**、不折叠成单值:同一条规则可以被批准过多次(不同 dot、不同来源、不同时刻),
  *  折成「一个 addedAt」会让「这条规则是我导入的还是我点过卡的」在治理面上不可分。 */
 export interface PersistedRuleWireRow {
+    /** core 7.9.0([ref])—— 这一行是哪一态的规则(`deny` / `ask` / `allow`)。**身份的一格**:
+     *  规则的身份是 (behavior, text, scope) 三元组,同文本不同态是两条不同的行(core `sameRuleIdentity`),
+     *  所以它既在列举面上,也在**导入/撤销的输入面**上必填 —— 少了它,一次撤销会瞄准同文本的另一态。 */
+    behavior: PersistedRule["behavior"];
     rule: string;
     /** {@link serializeRuleScope} 的判别式串。 */
     scope: string;
-    tool: PersistedAllowRule["tool"];
-    match: PersistedAllowRule["match"];
+    tool: PersistedRule["tool"];
+    match: PersistedRule["match"];
     /** 去规范化的命令(core 的匹配器信的就是它 + `match`,不是重新解析 `rule`)。 */
     command: string;
-    adds: PersistedAllowRule["adds"];
+    adds: PersistedRule["adds"];
     /** [ref](core 7.5.0):这一行来自哪个源。**由 `scope` 派生**(`global`⟺`user`、`project`⟺
      *  `project`、`session`⟺`session`),不是行上另存的第二个字节 —— core 的 `ruleSourceOf` 是整条映射。
      *  今天本部署只接 durable 一格分区 ⇒ 值域实为 `user | project`。
@@ -600,6 +604,7 @@ export interface RuleConsentLane {
      */
     removeRule(input: {
         principal: RuleBucketRef;
+        behavior: RuleBehavior;
         rule: string;
         scope: RuleScope;
     }): Promise<RemoveResult>;

package/dist/rules-consent.js

@@ -4,7 +4,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
 import { MAX_CWD_CHARS } from "./task-cwd.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, parseAllowRuleText, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, } from "@sema-agent/core";
+import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -18,7 +18,7 @@ const LocalImportOutcomeSchema = z
     .object({
     members: z.array(z
         .object({
-        key: z.object({ rule: z.string().min(1), scope: z.string().min(1) }).strict(),
+        key: z.object({ behavior: z.preprocess((v) => readRowBehavior(v) ?? v, z.enum(RULE_BEHAVIORS)), rule: z.string().min(1), scope: z.string().min(1) }).strict(),
         outcome: z.enum(["persisted", "no-op", "refused", "indeterminate"]),
         reason: z.enum(["store_refused", "walk_failed"]).optional(),
         detail: z.string().optional(),
@@ -83,6 +83,7 @@ function isSupportedRuleMatch(match) {
         case "wildcard":
             return true;
         case "subpath":
+        case "path":
             return false;
         default: {
             const unknown = match;
@@ -177,13 +178,25 @@ function screenLocalImportRow(row) {
                     `${derived.tool}/${derived.match}/${JSON.stringify(derived.command)} but the row says ${String(row.tool)}/${String(row.match)}/${JSON.stringify(row.command)}`,
             };
         }
-        return { rule: derived.rule, scope };
+        if (derived.behavior !== row.behavior) {
+            return { reason: "row_inconsistent", detail: `this row says behavior ${JSON.stringify(String(row.behavior))} but the parser resolved ${JSON.stringify(derived.behavior)}` };
+        }
+        return { behavior: derived.behavior, rule: derived.rule, scope };
     };
-    const written = parseAllowRuleText(row.rule);
+    const written = parseRuleText(row.rule, row.behavior);
     if ("reject" in written)
         return { reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
-    if (written.rule.tool === "Read")
+    if (ruleToolGrammarOf(written.rule.tool) !== "command")
+        return consistent(written.rule);
+    if (written.rule.behavior !== "allow") {
+        if (!ruleReachesProgramRun(written.rule, row.command)) {
+            return {
+                reason: "row_inconsistent",
+                detail: `this tightening rule does not speak about the command it names: ${JSON.stringify(written.rule.rule)} vs ${JSON.stringify(row.command)}`,
+            };
+        }
         return consistent(written.rule);
+    }
     const pre = precheckCardRuleText(row.rule, row.command);
     if (pre === undefined) {
         return { reason: "rule_uncheckable", detail: "the rule text gate could not be asked about this row (its command is absent or not a string) — the row itself is malformed" };
@@ -199,22 +212,29 @@ function buildLocalImportLayers(candidates) {
     const byRoot = new Map();
     for (const c of candidates) {
         const key = c.scope.kind === "global" ? "" : c.scope.root;
-        const bucket = byRoot.get(key);
-        if (bucket === undefined)
-            byRoot.set(key, [c.rule]);
-        else
-            bucket.push(c.rule);
+        let bucket = byRoot.get(key);
+        if (bucket === undefined) {
+            bucket = { deny: [], ask: [], allow: [] };
+            byRoot.set(key, bucket);
+        }
+        bucket[c.behavior].push(c.rule);
     }
-    return [...byRoot].map(([root, rules]) => ({
+    return [...byRoot].map(([root, lists]) => ({
         layer: root === "" ? "userSettings" : "projectSettings",
         path: root === "" ? LOCAL_IMPORT_LAYER_PATH : `${LOCAL_IMPORT_LAYER_PATH}:${root}`,
         root: root === "" ? "/" : root,
-        readFile: async () => JSON.stringify({ permissions: { allow: rules } }),
+        readFile: async () => JSON.stringify({
+            permissions: {
+                ...(lists.deny.length > 0 ? { deny: lists.deny } : {}),
+                ...(lists.ask.length > 0 ? { ask: lists.ask } : {}),
+                ...(lists.allow.length > 0 ? { allow: lists.allow } : {}),
+            },
+        }),
     }));
 }
 function buildLocalImportMembers(members) {
     return members.map((m) => {
-        const key = { rule: m.rule, scope: serializeRuleScope(m.scope) };
+        const key = { behavior: m.behavior, rule: m.rule, scope: serializeRuleScope(m.scope) };
         switch (m.status) {
             case "persisted":
                 return { key, outcome: "persisted" };
@@ -312,7 +332,7 @@ export function createRuleConsentLane(stores, opts) {
                 if (minted === undefined) {
                     return { ok: false, reason: "confirm-refused", detail: "the edited confirmation landed without a minted candidate — nothing to redeem" };
                 }
-                const canonical = parseAllowRuleText(minted.rule);
+                const canonical = parseRuleText(minted.rule, "allow");
                 if ("reject" in canonical) {
                     return { ok: false, reason: "edit-rejected", detail: `the canonical spelling the engine minted does not re-parse: ${canonical.reject.message}` };
                 }
@@ -444,11 +464,11 @@ export function createRuleConsentLane(stores, opts) {
             for (const row of rows) {
                 const screened = screenLocalImportRow(row);
                 if ("reason" in screened) {
-                    members.push({ key: { rule: row.rule, scope: row.scope }, admitted: false, reason: screened.reason, detail: screened.detail });
+                    members.push({ key: { behavior: row.behavior, rule: row.rule, scope: row.scope }, admitted: false, reason: screened.reason, detail: screened.detail });
                     continue;
                 }
-                const key = { rule: screened.rule, scope: serializeRuleScope(screened.scope) };
-                const dedupKey = `${key.scope}${LOCAL_IMPORT_KEY_SEP}${key.rule}`;
+                const key = { behavior: screened.behavior, rule: screened.rule, scope: serializeRuleScope(screened.scope) };
+                const dedupKey = `${key.behavior}${LOCAL_IMPORT_KEY_SEP}${key.scope}${LOCAL_IMPORT_KEY_SEP}${key.rule}`;
                 if (seen.has(dedupKey)) {
                     members.push({ key, admitted: false, reason: "duplicate_row", detail: "this (rule, scope) appears earlier in the same batch — the engine would fold the two silently, so it is reported here instead" });
                     continue;
@@ -460,12 +480,12 @@ export function createRuleConsentLane(stores, opts) {
             if (admitted.length === 0)
                 return { ok: true, preview: { members } };
             const { preview, approvalId } = await prepareCcImport({ layers: buildLocalImportLayers(admitted), principal, deps });
-            const engineKeys = new Set(preview.candidates.map((c) => `${serializeRuleScope(c.scope)}${LOCAL_IMPORT_KEY_SEP}${c.rule}`));
+            const engineKeys = new Set(preview.candidates.map((c) => `${c.behavior}${LOCAL_IMPORT_KEY_SEP}${serializeRuleScope(c.scope)}${LOCAL_IMPORT_KEY_SEP}${c.rule}`));
             for (let i = 0; i < members.length; i++) {
                 const m = members[i];
                 if (m === undefined || !m.admitted)
                     continue;
-                if (engineKeys.has(`${m.key.scope}${LOCAL_IMPORT_KEY_SEP}${m.key.rule}`))
+                if (engineKeys.has(`${m.key.behavior}${LOCAL_IMPORT_KEY_SEP}${m.key.scope}${LOCAL_IMPORT_KEY_SEP}${m.key.rule}`))
                     continue;
                 const why = preview.skipped.find((s) => s.rule === m.key.rule)?.reason ?? "the engine's import gate did not take it, and said nothing about it";
                 localImportLogger.warn("local_import_row_admitted_but_not_importable", {
@@ -683,12 +703,12 @@ export function createRuleConsentLane(stores, opts) {
         },
         async listRules(bucket) {
             const view = await effectiveOrThrow(storeForBucket(stores.provider, bucket));
-            const rows = view.rules.map((r) => ({ rule: r.rule, scope: serializeRuleScope(r.scope), tool: r.tool, match: r.match, command: r.command, adds: r.adds, source: r.source, status: r.status }));
+            const rows = view.rules.map((r) => ({ behavior: r.behavior, rule: r.rule, scope: serializeRuleScope(r.scope), tool: r.tool, match: r.match, command: r.command, adds: r.adds, source: r.source, status: r.status }));
             rows.sort((a, b) => (a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0));
             return { rows, rev: view.rev };
         },
         async removeRule(input) {
-            return await removePersistedRule({ rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });
+            return await removePersistedRule({ behavior: input.behavior, rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });
         },
     };
 }

package/dist/runs.d.ts

@@ -324,7 +324,16 @@ parkCheckpointReader?: {
             toolCallId?: unknown;
         };
     } | null>;
-}): Promise<void>;
+}, 
+/** L-167:装配期(`prepareSpec` → `resolveSpec`)铸下的用户面通告 —— 那一刻本腿的通告口还没开,
+ *  所以由本腿在 `registerEngineNoticeLeg` 那一拍连同 `pending` 一起投(投递单点仍是 `route()`)。
+ *  缺席 ⇒ 一个字节不投(既有调用方逐字不变)。 */
+pendingEngineNotices?: readonly {
+    code: string;
+    message: string;
+    detail?: Record<string, unknown>;
+    sessionId?: unknown;
+}[]): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -153,7 +153,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -248,6 +248,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     };
     const unregisterEngineNotice = registerEngineNoticeLeg({
         sessionId: spec.sessionId,
+        ...(pendingEngineNotices !== undefined ? { pending: pendingEngineNotices } : {}),
         durable: (row) => void append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`)),
     });
     try {

package/dist/session-titler.js

@@ -1,10 +1,10 @@
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 export const TITLE_MAX_CHARS = 80;
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
 const FAIL_CAUSE_KEY_CHARS = 80;
-const FAIL_CAUSE_CAP = 100;
 const SEEN_CAP = 10_000;
 export function sanitizeTitle(raw) {
     const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
@@ -22,18 +22,9 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const warnedCauses = new Set();
     const logFailure = (sessionId, error) => {
-        const cause = error.slice(0, FAIL_CAUSE_KEY_CHARS);
-        const meta = { sessionId, error: error.slice(0, 200) };
-        if (warnedCauses.has(cause)) {
-            deps.logger?.debug?.("session_title_failed", meta);
-            return;
-        }
-        if (warnedCauses.size >= FAIL_CAUSE_CAP)
-            warnedCauses.clear();
-        warnedCauses.add(cause);
-        deps.logger?.warn?.("session_title_failed", { ...meta, note: "同 cause 后续降为 debug 级" });
+        deps.logger?.debug?.("session_title_failed", { sessionId, error: error.slice(0, 200) });
+        recordFailOpen("server.session-titler.gateway-unreachable", error.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
     return {
         maybeTitle(sessionId, objective, model) {