@sema-agent/server 7.69.0 → 7.71.0

package/dist/run-local.d.ts

@@ -96,17 +96,25 @@ export interface LocalApproverIo {
 /**
  * [ref] 件三:**onAsk 座**(§0 潜雷 / §5 锁 6)。
  *
- * 🔴 为什么这个座位是接治理链的**同窗必做项**:run-local 有 checkpointStore(file backend),所以
- * `AUTONOMY=ask` ⇒ `shellGate:"always"` ⇒ Bash 进 `irreversibleTools` ⇒ park lane effective ⇒ **每一次
- * shell 调用都 durable park 成一张永远没人 resume 的 checkpoint**,任务挂起、CLI 退 1。一次性 CLI 里
- * 没有任何赎回腿,那不是「等人来批」,是卡死。core 的 `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk`
- * 早退(prepare-task dist 亲读),ask 于是落回本回调 —— 把 park 换成「问人 / 当场拒」的唯一正当接法。
+ * 🔴 为什么这个座位是接治理链的**同窗必做项**(成因,留档):彼时 run-local 的主 runner 带着
+ * checkpointStore(file backend),于是 `AUTONOMY=ask` ⇒ `shellGate:"always"` ⇒ Bash 进
+ * `irreversibleTools` ⇒ park lane effective ⇒ **每一次 shell 调用都 durable park 成一张永远没人 resume
+ * 的 checkpoint**,任务挂起、CLI 退 1。一次性 CLI 里没有任何赎回腿,那不是「等人来批」,是卡死。
+ * core 的 `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退(prepare-task dist 亲读),ask 于是落回
+ * 本回调 —— 把 park 换成「问人 / 当场拒」的正当接法。
+ *
+ * 🔴 **本席不是那颗雷的唯一防线,也从来不该是**(B-060 批 codex 交叉复审 [medium] 的教训):它只挡
+ * **审批**那条车道;core 的**平台/资源停驻**(`suspendForPlatformLimit`)由「店在不在」一位武装,
+ * 压根不经过 onAsk。所以自 B-060 起本腿的结构性防线是**整条腿不接 checkpointStore**(装配点在
+ * `createSharedRunnerDeps` 调用处,理由全文在那里),本席退回它本来的职责:**给 TTY 前的人一次真的
+ * 问答**。两道并存不是冗余 —— 一道管「谁来答」,一道管「答不了时会不会留下无人兑付的行」。
  *
  * ⛔ **不在 toolPolicy 层做 ask→deny 映射**:core 自己就有 headless auto-deny 的语义与文案,在策略层
  * 复刻一份 = 同源谎(两处判据日后各改各的)。裁决归 core,座位归这里。
  *
  * 🔴 非 TTY 臂答 `false`(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
- * `suspendAsk`**(dist `core/hooks.js:296` 的 `approverUnavailable` 重投),上面那颗雷会原样回来。
+ * `suspendAsk`**(dist `core/hooks.js:296` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
+ * 可去(fail-closed 拒),但这一条仍是本席的契约:答案是「不批」,不是「找不到人」。
  */
 export declare function createLocalApprover(io: LocalApproverIo): OnAsk;
 /** 默认的 TTY 问人器:一问一答,回答写 **stderr**(stdout 是任务结果的专用管道,别污染它)。

package/dist/run-local.js

@@ -19,6 +19,7 @@ import { loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./c
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
+import { executionLaneHomeDir } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
@@ -273,6 +274,7 @@ export async function runLocal(argv, deps = {}) {
     const executionEnvFactory = hostRx
         ? hostExecutionEnvFactory({
             workspaceDir,
+            ...((h) => (h === undefined ? {} : { homeDir: h }))(executionLaneHomeDir(config)),
             backgroundShell: config.requirePrincipal !== true,
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
@@ -369,6 +371,7 @@ export async function runLocal(argv, deps = {}) {
         ],
     });
     const sharedRunnerDeps = createSharedRunnerDeps({
+        metrics,
         config,
         governanceSeams,
         logger,
@@ -387,6 +390,7 @@ export async function runLocal(argv, deps = {}) {
             ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
         },
         toolResultStore: fileBackend.toolResultStore,
+        checkpointStore: undefined,
         sessionPolicyStore: fileBackend.sessionPolicyStore,
         usageWindowStore: config.usageWindows ? fileBackend.usageWindowStore : undefined,
         orgMemoryAdmission,
@@ -397,7 +401,6 @@ export async function runLocal(argv, deps = {}) {
         ...sharedRunnerDeps,
         sessionStore,
         ...(memoryEngine ? { memoryBackend: memoryEngine.backend, memoryEngineDir: memoryEngine.root } : {}),
-        checkpointStore: fileBackend.checkpointStore,
         onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled

package/dist/runs.d.ts

@@ -97,57 +97,6 @@ export declare function markChildrenStoppedByUserOnAbort(signal: AbortSignal, ta
 export declare function isSessionConflictResult(result: {
     terminal: TerminalCause;
 }): boolean;
-/**
- * E18 resume-at CALLER error → an HTTP 4xx. A bad/stale resume-at target (the resolved entryId is gone or is not a
- * settled message boundary) surfaces as a FAILED TaskResult carrying a `resume_at.*` errorCode (core swallows the
- * prepare-throw into the result, exactly like a session conflict — runtask catch → status:"failed"+errorCode). The
- * sync path otherwise 200s a failed result; map these to 4xx so a caller mistake reads as one. `not_found` (the
- * entry is genuinely absent) → 404; everything else (not_a_message / conflicts_resume / no_session) → 422.
- *
- * [ref] Phase3: `requireExistingSession` on a genuinely-missing/purged session ALSO surfaces as a failed result
- * (core prepare-task maps the store's `not_found` → `resume.session_not_found`); map it to 404 (the session is gone),
- * the same "caller mistake reads as a 4xx, not a silent 200 fresh run" discipline.
- *
- * [ref] rewind exclusive mode (core 1.292 resumeAtMode:"before"): its two edge rejections ride the same `resume_at.*`
- * prefix (before_target_not_user / before_root_unsupported → 422 via the existing branch, errorCode passed through
- * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
- * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
- * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
- *
- * [ref] 件A([ref] 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
- * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
- * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
- * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
- * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
- * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
- *
- * [ref] (core 7.0.0 片2/3, [ref] S-3): the session capture opt-out's four prepare-throw refusals ride the
- * same pipe. `memory.capture_optout_denied` is TERMINAL (the principal's `allowMemoryOptOut` verdict is an
- * explicit `false`, or the posture is `capture-required` / `governed`-with-absent-verdict — a retry cannot
- * change it) → 403, the `memory.admission_denied` twin. `memory.capture_optout_unpersisted` is the
- * declaration arm's "control-plane record could not be written" refusal — a store outage, retry may succeed
- * → 503 (transient fail-closed, the `memory.admission_required` twin; no retryAfterMs on this one — core
- * mints none, so the sync leg forwards no hint rather than inventing one). `config.memory_capture_spelling`
- * is a TaskSpec authoring mistake (the only legal spelling is the string "off") → 400, the
- * `config.memory_erasure_request` family shape. `config.memory_capture_unsupported` is the DEPLOYMENT SHAPE
- * refusing the declaration (remote/per-run execution with no durable capture-record carrier: the record
- * would not survive to a resume replica) → 409 — the request is well-formed, the deployment's state
- * conflicts with it, the `config.refresh_unavailable` family shape ("change the deployment, not the request").
- * Status choices are pinned by the `config.`/`memory.` family status sets in error-code-catalog-live.test.ts.
- *
- * S-125 件⑥(core 7.4.0 [ref]):`rewind.child_scope_unsupported` —— 这条腿是一个**委派子代**,它的文件编辑
- * 记在**根 session** 的文件历史里,所以「把文件还原到某个 entry」是根 session 的动作、不是子代的;core 在
- * prepare 期响亮拒(零计费,文件一个字节没动)。映射 **422**:请求形式合法、语义上找错了执行者 —— 与
- * `resume_at.*` 的「调用方指错了锚」同一族同一档,而不是 404(目标在,只是不归你)也不是 409(部署状态没冲突)。
- * ⚠️ **前缀不吞**:本码前缀是 `rewind.`,与下面那条 `resume_at.` **开集前缀臂**不同族 —— 它不会被那一臂顺手
- * 兜走(兜走会把一条「找错执行者」的拒答成「锚解析不了」),也不是 `rewind_snapshot.`(那是「快照找不到」)。
- * 三个前缀各自成族,逐码对表见 `test/resume-anchor.test.ts` 的 S-125 `rewind.` 族格。
- * 🔴 **可达性如实**:本仓的 HTTP 面**今天铸不出**这条腿 —— 子代由 core 内部的 Agent 工具派生,
- * `fileHistoryLineage` 是 core prepare 的 internals(不在 `TaskSpec` 上),server 从不直接 prepare 一条带
- * lineage 的子代腿。本臂是**分诊面的完备性**(core 说 X ⇒ wire 形是 Y),不是一条今天在跑的路;将来的
- * 委派入口接线那天零改动即生效。同族其余五码今天**仍落 200-with-failed-body**,那是本批**之前**就存在的
- * 缺口(不是本批回归),已在上述对表格里逐码显式登记为债务,并由那道门看住不许陈腐。
- */
 export declare function resumeAtHttpStatus(result: {
     terminal: TerminalCause;
 }): number | undefined;

package/dist/runs.js

@@ -7,7 +7,7 @@ import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest,
 import { createLedgerSink } from "./trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
-import { buildCancelContext } from "./run-cancel-context.js";
+import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
@@ -66,30 +66,35 @@ export function isSessionConflictResult(result) {
         return result.terminal.code === "conflict";
     return /stale write|concurrent write|conflict/i.test(result.terminal.message ?? "");
 }
+const GOVERNANCE_HTTP_STATUS = {
+    "memory.admission_denied": 403,
+    "memory.admission_required": 503,
+    "memory.capture_optout_denied": 403,
+    "config.tool_mount_denied": 400,
+    "config.locked_key": 400,
+    "usage.window_exhausted": null,
+    "config.compliance_required": null,
+    "config.compliance_denied": null,
+};
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
     if (code === undefined)
         return undefined;
+    if (Object.hasOwn(GOVERNANCE_HTTP_STATUS, code)) {
+        return GOVERNANCE_HTTP_STATUS[code] ?? undefined;
+    }
     if (code === "resume.session_not_found")
         return 404;
     if (code === "rewind_snapshot.unresolvable")
         return 422;
     if (code === "rewind.child_scope_unsupported")
         return 422;
-    if (code === "memory.admission_denied")
-        return 403;
-    if (code === "memory.admission_required")
-        return 503;
-    if (code === "memory.capture_optout_denied")
-        return 403;
     if (code === "memory.capture_optout_unpersisted")
         return 503;
     if (code === "config.memory_capture_spelling")
         return 400;
     if (code === "config.invalid_checkpoint_store")
         return 400;
-    if (code === "config.tool_mount_denied")
-        return 400;
     if (code === "config.memory_capture_unsupported")
         return 409;
     if (!code.startsWith("resume_at."))
@@ -166,10 +171,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const preemptCtrl = new AbortController();
     if (preemptEligible)
         preemptable?.set(taskId, preemptCtrl);
-    const cancelledResult = () => {
-        const ctx = buildCancelContext(taskId, startedAt);
-        return { taskId, sessionId: spec.sessionId, terminal: { kind: "failed", code: "cancelled", message: "cancelled by user" }, stats: { turns: 0, tokens: 0 }, ...(ctx ? { cancelContext: ctx } : {}) };
-    };
+    const cancelledResult = (engineResult) => mintCancelledResult({ taskId, sessionId: spec.sessionId ?? "", startedAtMs: startedAt, message: "cancelled by user", ...(engineResult !== undefined ? { engineResult } : {}) });
     const recordDone = (result, status) => {
         metrics?.addGauge("runs_active", -1);
         metrics?.inc("tasks_total", { status });
@@ -216,6 +218,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     heartbeat.unref?.();
     const anchor = new TurnAnchorCapture(captureTurnAnchor, () => metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
     let reached;
+    let observedDone;
+    let cancelledAtDone = false;
+    let settledAsCancel = false;
     let steerableStreamRef;
     let legLive = true;
     const notifiedKeys = new NotifiedKeys();
@@ -343,6 +348,10 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             steerableStreamRef = stream;
             steerable?.set(taskId, stream);
             for await (const ev of stream) {
+                if (ev.type === "done") {
+                    observedDone = ev.result;
+                    cancelledAtDone = cancelCtrl.signal.aborted;
+                }
                 fleetPublisher?.onEvent(ev);
                 await flushPromptManifest();
                 switch (ev.type) {
@@ -377,12 +386,14 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     }
                     evictIfConflict(runner, spec.sessionId, ev.result);
                     {
-                        const safe = await withModelUsage(stripResumeToken(ev.result));
+                        const settled = cancelledAtDone ? cancelledResult(ev.result) : ev.result;
+                        settledAsCancel = failureCodeOf(settled.terminal) === CANCELLED_CODE;
+                        const safe = await withModelUsage(stripResumeToken(settled));
                         await sink.appendDone(safe);
                         reached = { kind: "done", result: safe };
                         const plane = terminalProjection(safe.terminal);
                         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
-                        recordDone(safe, plane.status);
+                        recordDone(safe, failureCodeOf(safe.terminal) === CANCELLED_CODE ? CANCELLED_CODE : plane.status);
                     }
                     continue;
                 }
@@ -429,15 +440,16 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=flush-clean-cancel ${errText(e)}`);
             }
             const c = cancelledResult();
+            settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
             try {
-                await append("failed", { errorMessage: "cancelled by user", errorCode: "cancelled" });
+                await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
             }
             catch (e) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-clean-cancel ${errText(e)}`);
             }
             reached = { kind: "done", result: c };
             await runStore.setTerminal(taskId, "failed", c, terminalProjection(c.terminal).errorMessage ?? null);
-            recordDone(c, "cancelled");
+            recordDone(c, CANCELLED_CODE);
         }
     }
     catch (err) {
@@ -451,6 +463,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             }
             if (reached?.kind === "done") {
                 const plane = terminalProjection(reached.result.terminal);
+                settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
             }
             else if (reached?.kind === "suspended") {
@@ -459,10 +472,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             else if (reached?.kind === "needs_review") {
                 await runStore.setNeedsReview(taskId);
             }
-            else if (cancelCtrl.signal.aborted) {
+            else if (cancelCtrl.signal.aborted && observedDone === undefined) {
                 const c = cancelledResult();
+                settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
                 try {
-                    await append("failed", { errorMessage: "cancelled by user", errorCode: "cancelled" });
+                    await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
                 }
                 catch (e) {
                     recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-thrown-cancel ${errText(e)}`);
@@ -470,6 +484,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 await runStore.setTerminal(taskId, "failed", c, terminalProjection(c.terminal).errorMessage ?? null);
             }
             else {
+                settledAsCancel = false;
                 const safeMsg = redactErrorMessage(message) ?? message;
                 try {
                     await append("failed", { errorMessage: safeMsg });
@@ -483,13 +498,13 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         catch {
         }
         if (reached?.kind === "done")
-            recordDone(reached.result, failureCodeOf(reached.result.terminal) === "cancelled" ? "cancelled" : terminalProjection(reached.result.terminal).status);
+            recordDone(reached.result, failureCodeOf(reached.result.terminal) === CANCELLED_CODE ? CANCELLED_CODE : terminalProjection(reached.result.terminal).status);
         else if (reached?.kind === "suspended") {
             metrics?.addGauge("runs_active", -1);
             metrics?.inc("tasks_total", { status: "suspended" });
         }
-        else if (cancelCtrl.signal.aborted) {
-            recordDone(null, "cancelled");
+        else if (settledAsCancel) {
+            recordDone(null, CANCELLED_CODE);
         }
         else {
             recordDone(null, "failed");
@@ -500,14 +515,14 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         unregisterEngineNotice();
         if (fleetPublisher) {
             if (reached?.kind === "done")
-                fleetPublisher.onTerminal(failureCodeOf(reached.result.terminal) === "cancelled" ? "cancelled" : terminalProjection(reached.result.terminal).status, fleetRunResiduals(reached.result));
+                fleetPublisher.onTerminal(failureCodeOf(reached.result.terminal) === CANCELLED_CODE ? CANCELLED_CODE : terminalProjection(reached.result.terminal).status, fleetRunResiduals(reached.result));
             else if (reached?.kind === "suspended")
                 fleetPublisher.onTerminal("suspended");
             else if (reached?.kind === "needs_review")
                 fleetPublisher.onTerminal("needs_review");
             else
-                fleetPublisher.onTerminal(cancelCtrl.signal.aborted ? "cancelled" : "failed", {
-                    ...(cancelCtrl.signal.aborted ? { stoppedBy: "user" } : {}),
+                fleetPublisher.onTerminal(settledAsCancel ? CANCELLED_CODE : "failed", {
+                    ...(settledAsCancel ? { stoppedBy: "user" } : {}),
                     ...(spec.sessionId ? { transcriptId: spec.sessionId } : {}),
                 });
         }

package/dist/task-a2a.js

@@ -1,4 +1,4 @@
-import { resolveComplianceDenies } from "@sema-agent/core";
+import { resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
 export function a2aInjectionHonored(config) {
@@ -19,7 +19,7 @@ function normalizeA2aPeer(e) {
     if (!e || typeof e !== "object")
         return null;
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 128)
+    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
         return null;
     if (typeof o.url !== "string" || !HTTP_URL_RE.test(o.url))
         return null;

package/dist/task-mcp.js

@@ -1,4 +1,4 @@
-import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
@@ -26,7 +26,7 @@ function normalizeServer(e, noteBadOrigin) {
     if (!e || typeof e !== "object")
         return bad("entry");
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 128)
+    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
         return bad("name");
     const t = o.transport;
     if (!t || typeof t !== "object")

package/dist/task-settings.d.ts

@@ -312,15 +312,28 @@ export interface FsWriteGateWiring {
     /**
      * 🔴 S-177 / codex r2 [high](验真后修)—— **执行环境的 home**(core `PathRuleBases.home`,`~/…` 形的基)。
      *
-     * core 对缺席的 `home` 回落 `os.homedir()` —— 那是**这个 server 进程**的 home。引擎与执行同机时它就是
-     * 对的;**远端车道**(SSH / 容器 / 沙箱)上执行用户的 home 与 server 的 home 是两个目录,于是
-     * `deny Edit(~/.sema/**)` 编译成功、却拿 server 的 home 去匹配远端的目标 ⇒ 一条收紧规则**静默失效**
-     * (与 `taskRoot` 那条哨兵病同族、同方向)。
+     * 🔴 **S-213④ 起本字段在远端车道上也可以有值**:四只远端 adapter 此前一个都不声明 `ExecutionEnv.homeDir`,
+     * 而本字段那时只在 `remoteExec` 整个缺席时才铸 —— 于是**每一条远端部署的 `~/` 规则都恒 422**(接入审计
+     * M13)。修法不是放松下面那道门,而是让部署**真的知道** home:`execution-lane-caps.ts` 的
+     * `executionLaneHomeDir` 是唯一属主,`boot/execution-env.ts` 把它递给 adapter 的 `homeDir` 座、
+     * `boot/resolve-spec.ts` / `boot/parked-revive-gate.ts` 把**同一个值**递成本字段。两处同源是承重的:
+     * 各算一份就会出现「422 门放行而引擎判 unreadable」或反过来。
      *
-     * ⇒ 本字段只在 home **真知道**时在场(引擎与执行同机)。缺席时,`~/` 形的规则由
-     * {@link rejectUnmatchableSettingsNames} **响亮拒**(422),绝不回落到 server 的 home。
-     * ⚠️ 上游缺口如实登记:core 今天没有「这条规则需要哪些 base」的查询口,也不把 `home` 当必答项 ——
-     * 所以「这条规则用了 `~/` 吗」由本仓读**core 自己解析出的规范 command**(`~/` 前缀)来判,不自铸文法。
+     * 🔴 **S-213⑦ 改真话**(亲读 core 7.12.0 `dist/core/permission-rule-model.js:365-372` /
+     * `:340-350`,推翻本注此前的两句):
+     *  · core 对缺席的 `home` **不**回落 `os.homedir()` —— `resolvePathPattern` 走
+     *    `lexicalNormalAbsolutePathOf(baseValueOf("home", bases) ?? "")`,base 缺席 ⇒ `undefined` ⇒ 直接回
+     *    `{missingBase:"home"}`,该调用的射程判 `unreadable`(fail-closed 的 ask,人来清),从不猜一个目录。
+     *    换言之引擎侧本来就没有「拿 server 的 home 去匹配远端目标」这条静默腿(那句旧注是本仓自己的推断)。
+     *  · core **有**「这条规则需要哪些 base」的查询口 —— 根导出的 `ruleBasesNeeded(rule)`
+     *    (`//abs` ⇒ 空、`~/` ⇒ `["home"]`、`/x` ⇒ `["root"]`、其余 ⇒ `["cwd"]`),`resolvePathPattern`
+     *    自己也读它。本仓的判据腿今天读的是 core 解析出的规范 command 前缀,与该查询口**同一分类**、
+     *    不是第二套文法;两者哪天分叉由这条注负责被人看见。
+     *
+     * ⇒ 本字段在**这条部署的执行车道 home 已知**时在场(`executionLaneHomeDir`,见 `execution-lane-caps.ts`)。
+     * 缺席时 `~/` 形规则由 {@link rejectUnmatchableSettingsNames} **响亮拒**(422),而不是让它编译成一条
+     * core 只会判 `unreadable` 的规则 —— 两道门同向(都不猜目录),422 只是把同一个拒挪到更早、更响的地方:
+     * 运维在**下单那一刻**就知道这条规则这条车道读不了,而不是等到跑起来每次都弹一张 ask。
      */
     taskHome?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */

package/dist/task-settings.js

@@ -279,8 +279,8 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
                 const parsed = parseRuleText(name, behavior);
                 if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
                     throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
-                        `on a remote lane the engine's own home is a different user's directory, so the rule would compile and then match nothing that runs. ` +
-                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), or run the task on a lane whose home this worker knows.`);
+                        `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
+                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`);
                 }
             }
         }

package/dist/tool-approval.d.ts

@@ -145,9 +145,10 @@ export interface ToolApprovalFrame {
     origin?: string;
     /**
      * **S-185 / [ref]**(core 7.10.0;**ADDITIVE**,`"tool_approval"` only)—— 这一问**为什么**到了人手上:
-     * auto 档的分类器被咨询过、而它**跑不了**。`cause` = core 的闭三词
-     * (`AUTO_MODE_UNAVAILABLE_CAUSES` = `error` / `timeout` / `breaker_open`),`AskRequest.classifierUnavailable`
-     * 逐字透传。
+     * 分类器被咨询过、而它**跑不了**。`cause` = core 的闭集词
+     * (`AUTO_MODE_UNAVAILABLE_CAUSES`;core 7.12.0 起 = `error` / `timeout`),`AskRequest.classifierUnavailable`
+     * 逐字透传。core 7.12.0 / [ref] 起 ask 上这一位只由**策略层自声明**铸(引擎自己的那份改骑 deny —— 全文
+     * 在 `approval-card.ts` 同名键的顶注)。
      *
      * 🔴 **缺席 ≠「分类器好着呢」**:缺席同时覆盖三形 —— 分类器答上了 / 这只 ask 没资格走分类器
      * (`classifierMayAnswer` 的闭表)/ 本部署压根没接分类器。消费端**禁**把缺席读成对分类器健康的断言。
@@ -176,13 +177,18 @@ export interface ToolApprovalFrame {
      * 执行的那串字节(卡上显示的与真跑的不是同一个东西),**比不披露更坏**;所以 server 只报「有」,显形
      * 归壳的渲染面(转义/高亮/加标记,壳自己定)。
      *
-     * **判据素材** = `boundArgs` 那**一次**序列化的结果(脱敏后的 args),且在**字节帽判定之前**算:
+     * **判据素材** = `boundArgs` 里对**原字节**(`redactDeep` 之前)的那一次序列化,且在**字节帽判定之前**算:
      *  · 超帽时 args 以 `argsOmitted:true` 缺席上帧(卡上根本没有 args)—— 那正是人最看不见输入的一格,
      *    更需要知道「你看不到的那份里有隐形字符」,所以帽不影响本键;
-     *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**;
-     *  · 用脱敏后那份而不是原文,是因为它与卡面/`card_json` 是**同一份**素材(一次算定,三面同源),
-     *    且人眼看到的正是它。理论残余如实记:一段**被遮蔽掉的密钥**里的 bidi 会随遮蔽一起消失 —— 已知、
-     *    可忽略(密钥形不含 bidi),且方向安全(少报一次,不会误报干净为脏)。
+     *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**
+     *    (两次 `JSON.stringify` 共用同一个 try/catch —— 顶注反对的是第二个**静默降级点**,不是第二次序列化);
+     *  · 🔴 **7.70.0(S-103)改素材**:此前用的是脱敏后那份(理由=与卡面同源),而本版 `redactSecrets` 入口
+     *    先剥全部 `\p{Cf}` —— bidi 控制符**整族都是** `\p{Cf}` ⇒ 在脱敏后的文本上扫,本键恒缺席、E-14 整条
+     *    失效(六格红先复现)。所以判据素材改回原字节;同源那条理由让位于「信号必须真」。
+     *  · ⚠️ **上面「字节零改」那一条自 7.70.0 起对 `\p{Cf}` 族不再成立**:帧/卡上的 args 是**剥后**字节
+     *    (与 core 显示面 `renderUntrustedCommandText` 同律,显示的是真正执行的逻辑顺序),壳因此**拿不到
+     *    「在哪一位」**、只能按整只 args 打标。这是有意的取舍(夹层密钥的根治要求单一剥点),不是遗漏;
+     *    要恢复定位面需要给脱敏器一条 span/偏移表回填路(S-103 定案明确不做),不是在这条腿上加特判。
      *
      * 判据**不看 `message`**(引擎/策略写的说明文本,不是待执行输入):本键被壳读作「**待执行的输入**可能
      * 在骗你的眼睛」,把两个来源折进一个布尔会让壳无法判断该给哪一段加显形标记。

package/dist/tool-approval.js

@@ -2,7 +2,7 @@ import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
-import { redactDeep, redactSecrets } from "./trace/redact.js";
+import { normalizeForRedaction, redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
@@ -34,7 +34,7 @@ const PARKING_RETRY_AFTER_MS = 250;
 function durableRuleMaterial(material) {
     if (material === undefined)
         return { ruleCommand: null, ruleScopeRoot: null };
-    if (redactSecrets(material.command, { observe: false }) !== material.command) {
+    if (redactSecrets(material.command, { observe: false }) !== normalizeForRedaction(material.command)) {
         defaultLogger.warn("approval rule material withheld: the adjudicated command carries credential-shaped bytes", {
             commandChars: material.command.length,
         });
@@ -141,8 +141,8 @@ function boundArgs(args) {
     const redacted = redactDeep(args);
     let hasBidi = false;
     try {
+        hasBidi = hasBidiControls(JSON.stringify(args));
         const text = JSON.stringify(redacted);
-        hasBidi = hasBidiControls(text);
         if (Buffer.byteLength(text, "utf8") > MAX_APPROVAL_ARGS_BYTES)
             return { omitted: true, hasBidi };
     }