@sema-agent/server 7.66.0 → 7.68.0

package/dist/task-mcp.d.ts

@@ -22,9 +22,25 @@
  *     `runtimeCapsResolver`) is a DEFERRED v2.
  * When the gate is closed, a sent `mcpServers` is IGNORED (advertised via `capabilities.mcpInjection`).
  */
-import { type CompliancePosture, type LockedKey, type McpServerSpec } from "@sema-agent/core";
+import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
+/**
+ * 🔴 **一类丢弃至多点名多少条**(codex 对抗复审 r1 [high],验真后采纳)—— 与挂载上限**同一个数**,
+ * 刻意不新造一个可调旋钮:点名的量级本就该与挂载的量级同阶。
+ *
+ * 病(本批引入,不是既有形):`MAX_REQUEST_MCP_SERVERS` 管的是「挂几台」,管不住「你发了几台」——
+ * HTTP 体上限 8 MiB 装得下十万个名字,而 `gate_closed`(整只列表被忽略)与 `over_cap`(上限之后的尾项)
+ * 两臂原本逐条点名,于是一条已认证请求就能造出十万条事实、十万条通告,逐条排进本腿的**串行账本写链**
+ * ——同一条链上后续的正常事件全部排在它们后面。修前的名字数组把超上限折成**一条**聚合串,所以无界的
+ * 是本批新写的那两个循环。
+ *
+ * 为什么不改成「数组太长就 400」(codex 的另一条建议,**未采纳**):今天 33 台的请求是**照常受理、挂前
+ * 32 台**的,加一条新的拒绝面为了一个资源边界去改受理语义,爆炸半径比病本身大(而且 resume 腿重放存量
+ * body 会当场砖死一批已 park 的任务——本仓 `opts.leg` 三处先例逐字写着「砖死 resume 比降级糟」)。
+ * 有界点名两头都占:该说的仍然说得出,量级钉死在与挂载同阶。
+ */
+export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (`requirePrincipal !== true`) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -37,19 +53,42 @@ export declare function mcpInjectionHonored(config: {
     lockedConfigKeys?: readonly LockedKey[];
     compliancePosture?: CompliancePosture;
 }): boolean;
+/**
+ * L-167(core 7.9.1)—— 一条**没有被挂上**的请求腿 MCP 条目的**事实**。宿主报事实,core 铸词:
+ * `reason` 的词表属主是 core(`McpInjectionDropReason` = malformed_entry / name_reserved_by_deployment /
+ * gate_closed / over_cap),本仓一个词都不枚举,通告的码/受众/句子一个字都不拼。
+ *
+ * `sessionId` **不在**这个形上:它是通告的**路由半场**,在铸点(`mintInjectionDropNotices`)才补 ——
+ * 一条丢弃事实在没有会话语境的调用方(桩、单测、未来的非 HTTP 腿)那里同样成立,而通告不成立。
+ */
+export interface McpInjectionDrop {
+    readonly server: string;
+    readonly reason: McpInjectionDropReason;
+    /** `malformed_entry` 专用:**哪个键**判不出形。结构性给出(读器在拒的那一行就知道),不从文案里 parse。 */
+    readonly field?: string;
+}
+/** L-167:本条腿的用户面通告席。`sessionId` = 路由半场(`auth.sessionId`,与 `spec.sessionId` 同源);
+ *  `emit` = 收下 core 铸好的 `EngineNotice`。**本模块不知道**它最后落在 SSE、账本还是日志上 —— 那是
+ *  投递腿的事,本模块只负责「事实 → core 工厂 → 一条通告」。 */
+export interface McpInjectionDropSeat {
+    readonly sessionId: string | undefined;
+    readonly emit: (notice: EngineNotice) => void;
+}
 /**
  * Shape-check the raw `body.mcpServers`. `null` → a non-array (caller error; the route may 400). Otherwise the
  * valid subset + the names of dropped (malformed/over-cap) entries + [ref]'s `badContentOrigin`
  * (**降级**掉的内容出处声明,与 `dropped` 是两回事:那条 server **留着**,丢的只是它的声明)。
  */
-export declare function validateRequestMcp(raw: unknown): {
+export declare function validateRequestMcp(raw: unknown): ValidatedRequestMcp | null;
+type ValidatedRequestMcp = {
     ok: McpServerSpec[];
-    dropped: string[];
+    dropped: McpInjectionDrop[];
+    droppedTotal: number;
     badContentOrigin: Array<{
         server: string;
         value: string;
     }>;
-} | null;
+};
 /**
  * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
@@ -128,7 +167,7 @@ export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, g
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
- * unchanged. Logs an `mcp_injection_ignored` when a caller SENT servers a closed gate dropped (so the shell never
+ * unchanged. Logs an `mcp_injection_dropped` (reason `gate_closed`) when a caller SENT servers a closed gate dropped (so the shell never
  * silently believes its `.mcp.json` took effect — it also reads `capabilities.mcpInjection`).
  */
 export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined, bodyMcp: unknown, config: {
@@ -144,5 +183,10 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
 }, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
-}): McpServerSpec[] | undefined;
+}, 
+/** L-167:本条腿的**用户面**投递口。`sessionId` = 通告的路由半场(缺席 ⇒ 一条都不铸,见
+ *  {@link mintInjectionDropNotices});`emit` 收下 core 铸好的通告,由调用腿决定投到哪(见 `boot/resolve-spec.ts`)。
+ *  整段缺席(桩、单测、非 HTTP 腿)⇒ 只走日志终点,行为逐字与本件之前相同。 */
+notice?: McpInjectionDropSeat): McpServerSpec[] | undefined;
+export {};
 //# sourceMappingURL=task-mcp.d.ts.map

package/dist/task-mcp.js

@@ -1,9 +1,10 @@
-import { resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
+export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;
@@ -14,20 +15,27 @@ export function mcpInjectionHonored(config) {
 function isStringRecord(v) {
     return !!v && typeof v === "object" && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string");
 }
+const bad = (field) => ({ ok: false, field });
+const MALFORMED_NAME = "<malformed>";
+function declaredName(e) {
+    return e && typeof e === "object" && typeof e.name === "string" && e.name !== ""
+        ? String(e.name)
+        : MALFORMED_NAME;
+}
 function normalizeServer(e, noteBadOrigin) {
     if (!e || typeof e !== "object")
-        return null;
+        return bad("entry");
     const o = e;
     if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 128)
-        return null;
+        return bad("name");
     const t = o.transport;
     if (!t || typeof t !== "object")
-        return null;
+        return bad("transport");
     const tr = t;
     let transport;
     if (tr.kind === "stdio") {
         if (typeof tr.command !== "string" || tr.command.length === 0)
-            return null;
+            return bad("transport.command");
         transport = {
             kind: "stdio",
             command: tr.command,
@@ -37,7 +45,7 @@ function normalizeServer(e, noteBadOrigin) {
     }
     else if (tr.kind === "http") {
         if (typeof tr.url !== "string" || !/^https?:\/\//i.test(tr.url))
-            return null;
+            return bad("transport.url");
         transport = {
             kind: "http",
             url: tr.url,
@@ -46,12 +54,12 @@ function normalizeServer(e, noteBadOrigin) {
         };
     }
     else {
-        return null;
+        return bad("transport.kind");
     }
     const spec = { name: o.name, transport };
     if (o.allowTools !== undefined) {
         if (!Array.isArray(o.allowTools) || !o.allowTools.every((a) => typeof a === "string"))
-            return null;
+            return bad("allowTools");
         spec.allowTools = o.allowTools;
     }
     if (typeof o.elicitation === "boolean")
@@ -82,29 +90,32 @@ function normalizeServer(e, noteBadOrigin) {
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
     const faces = readMcpToolFaces(o.toolFaces);
     if (!faces.ok)
-        return null;
+        return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
-    return spec;
+    return { ok: true, spec };
 }
 export function validateRequestMcp(raw) {
     if (raw === undefined || raw === null)
-        return { ok: [], dropped: [], badContentOrigin: [] };
+        return validateRequestMcpEntries([]);
     if (!Array.isArray(raw))
         return null;
+    return validateRequestMcpEntries(raw);
+}
+function validateRequestMcpEntries(raw) {
     const ok = [];
     const dropped = [];
     const badContentOrigin = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
         const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }));
-        if (v)
-            ok.push(v);
+        if (v.ok)
+            ok.push(v.spec);
         else
-            dropped.push(e && typeof e === "object" && typeof e.name === "string" ? String(e.name) : "<malformed>");
+            dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
-    if (raw.length > MAX_REQUEST_MCP_SERVERS)
-        dropped.push(`(+${raw.length - MAX_REQUEST_MCP_SERVERS} over cap of ${MAX_REQUEST_MCP_SERVERS})`);
-    return { ok, dropped, badContentOrigin };
+    for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
+        dropped.push({ server: declaredName(e), reason: "over_cap" });
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin };
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -140,21 +151,33 @@ export function mergeRequestMcp(baseline, gated, reservedNames) {
     const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
-export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
+export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice) {
     if (bodyMcp === undefined || bodyMcp === null)
         return baseline;
-    const honored = mcpInjectionHonored(config);
-    if (!honored) {
-        logger?.warn("mcp_injection_ignored", { reason: "gate_closed (per-request MCP honored only on single-user host lane)" });
-        return baseline;
-    }
-    const v = validateRequestMcp(bodyMcp);
-    if (v === null) {
+    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger);
+    mintInjectionDropNotices(drops, notice);
+    return mcp;
+}
+function classifyRequestMcp(baseline, bodyMcp, config, logger) {
+    if (bodyMcp !== undefined && bodyMcp !== null && !Array.isArray(bodyMcp)) {
         logger?.warn("mcp_injection_ignored", { reason: "mcpServers not an array" });
-        return baseline;
+        return { mcp: baseline, drops: [] };
     }
-    if (v.dropped.length > 0)
-        logger?.warn("mcp_injection_dropped", { dropped: v.dropped });
+    const entries = Array.isArray(bodyMcp) ? bodyMcp : [];
+    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger) : classifyGateClosed(baseline, entries);
+    if (outcome.drops.length > 0)
+        logger?.warn("mcp_injection_dropped", { dropped: outcome.drops, droppedTotal: outcome.droppedTotal });
+    return { mcp: outcome.mcp, drops: outcome.drops };
+}
+function classifyGateClosed(baseline, entries) {
+    return {
+        mcp: baseline,
+        drops: entries.slice(0, MAX_REQUEST_MCP_DROP_NAMES).map((e) => ({ server: declaredName(e), reason: "gate_closed" })),
+        droppedTotal: entries.length,
+    };
+}
+function classifyHonored(baseline, entries, config, logger) {
+    const v = validateRequestMcpEntries(entries);
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
             entries: v.badContentOrigin,
@@ -165,13 +188,26 @@ export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
     const reservedNames = config.mcpServers?.reservedNames ?? [];
     const closed = deploymentClosedMcpNames(baseline, reservedNames);
     const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
-    if (blocked.length > 0) {
-        logger?.warn("mcp_injection_dropped", {
-            reason: "name_reserved_by_deployment",
-            dropped: blocked,
-            note: "these names are declared by the deployment (center/config) — mounted or skipped, a caller can neither shadow nor refill them; rename the request-side server",
-        });
+    return {
+        mcp: mergeRequestMcp(baseline, v.ok, reservedNames),
+        drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],
+        droppedTotal: v.droppedTotal + blocked.length,
+    };
+}
+function mintInjectionDropNotices(drops, notice) {
+    if (notice === undefined || drops.length === 0)
+        return;
+    const sessionId = notice.sessionId;
+    if (typeof sessionId !== "string" || sessionId.length === 0)
+        return;
+    const said = new Set();
+    for (const d of drops) {
+        if (d.server !== MALFORMED_NAME) {
+            if (said.has(d.server))
+                continue;
+            said.add(d.server);
+        }
+        notice.emit(mcpInjectionDroppedNotice({ sessionId, server: d.server, reason: d.reason, ...(d.field !== undefined ? { field: d.field } : {}) }));
     }
-    return mergeRequestMcp(baseline, v.ok, reservedNames);
 }
 //# sourceMappingURL=task-mcp.js.map

package/dist/task-settings.d.ts

@@ -293,6 +293,36 @@ export interface FsWriteGateWiring {
      *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
      *  never-created sentinel dir (resolve-spec 修5). */
     cwd?: string;
+    /**
+     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基,与上面那个 `cwd` **刻意分成两个字段**。
+     *
+     * 两者在 host 腿上常常同值,但它们回答的不是同一个问题,而混用一个字段会让其中一个静默失效:
+     *  · `cwd` 是**写门**的基。它在「有 remoteExec 但这条 session 还没登记工作目录」时取的是一个
+     *    **永不创建的哨兵目录**(`resolve-spec` 的 `fs-write-gate-unrooted`)。对写门那是 fail-SAFE 的:
+     *    相对目标在哨兵下解析不出真身 ⇒ 落 ask。
+     *  · `taskRoot` 是**规则模式**的基(core `PathRuleBases.root`)。规则编译器按**词法**匹配,不问目录
+     *    存不存在 ⇒ 把哨兵递给它,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区
+     *    的 `<工作区>/src/secret.ts` 这类目标判 allow —— 一条运维亲手写下的收紧规则**静默失效**,方向与写门那条正相反。
+     *
+     * ⇒ 本字段**只在真任务根已知时**在场。缺席 ⇒ 规则编译器拿不到 `pathBases.root` ⇒ 需要该基的拼法
+     * (`Edit(src/**)` / `Edit(/etc/**)`)被 core 以 `unsupported.path_base` **整表拒**(→ 422,fail-loud),
+     * 而不是编成一条够不着任何东西的规则。绝对形(`//abs`)与 `~/` 形不需要基,两种部署形都照常编得出。
+     */
+    taskRoot?: string;
+    /**
+     * 🔴 S-177 / codex r2 [high](验真后修)—— **执行环境的 home**(core `PathRuleBases.home`,`~/…` 形的基)。
+     *
+     * core 对缺席的 `home` 回落 `os.homedir()` —— 那是**这个 server 进程**的 home。引擎与执行同机时它就是
+     * 对的;**远端车道**(SSH / 容器 / 沙箱)上执行用户的 home 与 server 的 home 是两个目录,于是
+     * `deny Edit(~/.sema/**)` 编译成功、却拿 server 的 home 去匹配远端的目标 ⇒ 一条收紧规则**静默失效**
+     * (与 `taskRoot` 那条哨兵病同族、同方向)。
+     *
+     * ⇒ 本字段只在 home **真知道**时在场(引擎与执行同机)。缺席时,`~/` 形的规则由
+     * {@link rejectUnmatchableSettingsNames} **响亮拒**(422),绝不回落到 server 的 home。
+     * ⚠️ 上游缺口如实登记:core 今天没有「这条规则需要哪些 base」的查询口,也不把 `home` 当必答项 ——
+     * 所以「这条规则用了 `~/` 吗」由本仓读**core 自己解析出的规范 command**(`~/` 前缀)来判,不自铸文法。
+     */
+    taskHome?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */
     scratchpadDir?: string;
     /** [ref]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),

package/dist/task-settings.js

@@ -1,5 +1,5 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, } from "@sema-agent/core";
-import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, ruleToolGrammarOf, } from "@sema-agent/core";
+import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
@@ -225,17 +225,18 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const ASK_RULE_SOURCE = "settings.permissions.ask";
-function createAskListPolicy(askNames) {
+const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
+function createRuleListPolicy(names, behavior, pathBases) {
     try {
-        return createPermissionRulePolicy(askNames.map((name) => ({ rule: name, behavior: "ask", source: ASK_RULE_SOURCE })), {
+        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source: RULE_SOURCE_BY_BEHAVIOR[behavior] })), {
             defaultAction: "allow",
             caps: { maxRules: MAX_SETTINGS_PERMISSION_RULES },
+            ...(pathBases !== undefined ? { pathBases } : {}),
         });
     }
     catch (e) {
         const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        throw new Error(`permissions.ask has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+        throw new Error(`${RULE_SOURCE_BY_BEHAVIOR[behavior].replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
@@ -267,31 +268,51 @@ function createWorkflowPlanDenyPolicy() {
         nameSets: [{ deny: WORKFLOW_ASK_NAMES }],
     };
 }
-function rejectUnmatchableSettingsNames(perms) {
-    for (const [field, names] of [["permissions.ask", perms.ask], ["permissions.deny", perms.deny]]) {
+function rejectUnmatchableSettingsNames(perms, pathBases) {
+    if (pathBases?.home === undefined) {
+        for (const [field, names, behavior] of [
+            ["permissions.ask", perms.ask, "ask"],
+            ["permissions.deny", perms.deny, "deny"],
+            ["permissions.allow", perms.allow, "allow"],
+        ]) {
+            for (const name of names ?? []) {
+                const parsed = parseRuleText(name, behavior);
+                if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
+                    throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
+                        `on a remote lane the engine's own home is a different user's directory, so the rule would compile and then match nothing that runs. ` +
+                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), or run the task on a lane whose home this worker knows.`);
+                }
+            }
+        }
+    }
+    for (const [field, names, behavior, consumer] of [
+        ["permissions.ask", perms.ask, "ask", "rule-policy"],
+        ["permissions.deny", perms.deny, "deny", "rule-policy"],
+        ["permissions.allow", perms.allow, "allow", "tool-name-table"],
+    ]) {
         if (!names)
             continue;
-        const bad = findUnmatchableToolNames(names);
+        const bad = findUnmatchableToolNames(names, { consumer, behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
         if (bad.length > 0)
             throw new Error(formatUnmatchableToolNames(field, bad));
     }
-    if (perms.allow) {
-        const bad = findCcRuleFormNames(perms.allow);
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames("permissions.allow", bad));
-    }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)
         return {};
     const { allow, deny, ask, defaultMode } = perms;
-    rejectUnmatchableSettingsNames(perms);
+    const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
+        ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
+        : undefined;
+    rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (allow || deny)
-        policies.push(createAllowDenyPolicy({ ...(allow ? { allow } : {}), ...(deny ? { deny } : {}) }));
+    if (allow)
+        policies.push(createAllowDenyPolicy({ allow }));
+    if (deny)
+        policies.push(createRuleListPolicy(deny, "deny", pathBases));
     if (ask)
-        policies.push(createAskListPolicy(ask));
+        policies.push(createRuleListPolicy(ask, "ask", pathBases));
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;

package/dist/tool-approval.d.ts

@@ -126,8 +126,9 @@ export interface ToolApprovalFrame {
     requiresRealApproval?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
-     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` 八员 content_question / unresolvable / org_unavailable /
-     * org_rule / hook / ask_rule / denial_limit_fallback / policy)。引擎在门上盖章(core d.ts:
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.9.0 现值:content_question /
+     * unresolvable / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
+     * denial_limit_fallback / shell_gate_tighten / safety_tighten / policy)。引擎在门上盖章(core d.ts:
      * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
      *
      * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
@@ -864,7 +865,7 @@ export declare class ToolApprovalCoordinator {
      * [ref] / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
      *
      * 🔴 病灶(真复现,`npm run build --flag=<700 字> && git status`):`batch` 成员的 `segment` 是复合命令
-     * 那一段的**原字节**,它**不经** `parseAllowRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
+     * 那一段的**原字节**,它**不经** `parseRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
      * 都不管;而卡的 `ApprovalCardSchema` 对四个文本座一律 `.max(MAX_RULE_TEXT_CHARS)`。逐字拷进卡 ⇒
      * `card_json` 落库 ⇒ `ensureAsk` 当场回读 `safeParse` 判假 ⇒ `persisted-row-unusable` ⇒ **整只 ask 走
      * park**,重放腿一并跳过该行。与「重扫二轮 §基数帽」是**同一条悬崖的另一条边**(那次是 offer 条数
@@ -885,7 +886,7 @@ export declare class ToolApprovalCoordinator {
     /** 兑付侧座(single 的 rule/command、command 成员的 rule/command、directoryRead 成员的 rule/directory)任一超尺?
      *  `segment` 与 `uncoveredDetail[].segment` 是纯渲染座,不在此列(截长是诚实省略)。 */
     private static ruleOfferTextsOverSize;
-    /** codex r1 [high]([ref]):offer 的自称座与 `parseAllowRuleText(rule)` 派生的三元组逐字一致?(理由见调用点) */
+    /** codex r1 [high]([ref]):offer 的自称座与 `parseRuleText(rule, "allow")` 派生的三元组逐字一致?(理由见调用点) */
     private static ruleOfferDerivedFactsAgree;
     private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -381,7 +381,7 @@ export class ToolApprovalCoordinator {
     }
     static ruleOfferDerivedFactsAgree(offer) {
         const derive = (rule) => {
-            const p = parseAllowRuleText(rule);
+            const p = parseRuleText(rule, "allow");
             return "rule" in p ? p.rule : undefined;
         };
         if (offer.kind === "single") {

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -136,5 +136,21 @@ export declare function registerEngineNoticeLeg(opts: {
     live?: EngineNoticeWireSink;
     durable?: EngineNoticeWireSink;
     router?: EngineNoticeRouter;
+    /**
+     * L-167 —— **腿开张之前**就已经铸好的通告(装配期 `resolveSpec` 的产物,经
+     * `PreparedTaskSubmission.engineNotices` 递过来)。注册完口**立刻**经同一只 {@link EngineNoticeRouter.route}
+     * 投出:白名单、归属键、消毒、隔离四件判据一个都不绕,**不是**第二条投递机制 —— 只是把 `route()` 挪到
+     * 「这条会话已经有口在听」的那一拍。
+     *
+     * 🔴 为什么不让铸点自己 `route()`:装配(`prepareSpec`)跑在本函数**之前**,那一刻这条会话一只口都没有,
+     * `route()` 恒返 0 —— 一条结构上永远投不出去的用户面披露,就是本仓 `task.user_steer_undrained` 陈腐明拒
+     * 那一族的病。缺席/空数组 ⇒ 一个字节不投(既有腿逐字不变)。
+     */
+    pending?: readonly {
+        code: string;
+        message: string;
+        detail?: Record<string, unknown>;
+        sessionId?: unknown;
+    }[];
 }): () => void;
 //# sourceMappingURL=engine-notice-wire.d.ts.map

package/dist/trace/engine-notice-wire.js

@@ -20,6 +20,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "peer.held_settled",
     "peer.idle_subscription",
     "classifier.denial_limit",
+    "mcp.injection_dropped",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -150,6 +151,10 @@ export function registerEngineNoticeLeg(opts) {
     const sinks = [...(live ? [live] : []), ...(durable ? [durable] : [])];
     if (sinks.length === 0)
         return () => undefined;
-    return (opts.router ?? defaultEngineNoticeRouter).registerLeg(sessionId, sinks);
+    const router = opts.router ?? defaultEngineNoticeRouter;
+    const unregister = router.registerLeg(sessionId, sinks);
+    for (const notice of opts.pending ?? [])
+        router.route(notice);
+    return unregister;
 }
 //# sourceMappingURL=engine-notice-wire.js.map

package/dist/trace/project.d.ts

@@ -419,9 +419,10 @@ export declare function workspaceChangedEventData(ev: {
  * typebox schema `ToolRosterDelta`,过了整只透传,没过 ⇒ **整帧不发** + F 类留痕。半张名册变更帧比
  * 不发更坏:消费端会据它把没读到的行当成「这只工具被卸了」。
  *
- * ⚠️ **如实披露(core 7.8.0 自述)**:7.8.0 的 runtask **还没有**推这条帧([ref] S3 才接线),座位与
- * 类型先到货。本臂因此是**前瞻接线**:core 开始推的那一版,server 这一侧零改动即到达消费端;在那之前
- * 它永不触发。消费端在那一版之前**不得**依赖本帧(core 契约原文)。
+ * ✅ **已转正(core 7.9.0 / [ref] S3)**:引擎自 7.9.0 起**真推**这条帧 —— 驱动在推 `wiring_manifest`
+ * 的那一点订阅腿的名册增量座,一次改变名册的 refresh ⇒ **恰一帧**(序在 manifest 之后、那次 refresh 自己的
+ * `tool_end` 之前),`delta.fromDigest` = 消费端手上那份名册的 digest。7.66.0 写下的「前瞻接线」披露随本版
+ * 退役:本臂现在会真的触发,消费端可以依赖它了。
  */
 export declare function toolRosterDeltaEventData(ev: {
     delta?: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.66.0",
+  "version": "7.68.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.8.0",
+    "@sema-agent/core": "7.9.2",
     "@sema-agent/settings-schema": "1.9.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.5.0",
+    "@sema-agent/sdk": "8.8.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",