@sema-agent/server 7.88.2 → 7.90.0

package/dist/plugins/remote-env-device.js

@@ -99,6 +99,17 @@ const DEVICE_REJECT_TO_REMOTE_ERROR = {
 function rejectText(reject) {
     return `[${reject.code}] ${reject.message}`;
 }
+const ENV_TERMINAL = { kind: "env_terminal" };
+const ENV_TERMINAL_MESSAGE = "execution env already destroyed";
+function failureFor(code, message) {
+    return { remote: DEVICE_REJECT_TO_REMOTE_ERROR[code], exec: DEVICE_REJECT_TO_EXEC_ERROR[code], file: DEVICE_REJECT_TO_FILE_ERROR[code], message };
+}
+const ADMISSION_DESTROYED = {
+    remote: "connect_failed",
+    exec: "shell_unavailable",
+    file: "unknown",
+    message: "execution env already destroyed",
+};
 function assertPosixDevicePlatform(os, deviceId) {
     switch (os) {
         case "darwin":
@@ -118,6 +129,7 @@ export class RemoteDeviceExecutionEnv {
     writeFileExclusive;
     writeFileGuarded;
     connected = false;
+    connectPromise;
     destroyed = false;
     constructor(cfg) {
         this.cfg = cfg;
@@ -172,18 +184,61 @@ export class RemoteDeviceExecutionEnv {
         };
     }
     async connect(config) {
-        if (this.destroyed)
-            return { ok: false, error: new RemoteExecutionError("connect_failed", "device env destroyed — create a fresh env instead of reviving") };
         if (config?.abortSignal?.aborted === true)
             return { ok: false, error: new RemoteExecutionError("aborted", "connect aborted") };
-        const admitted = await this.cfg.enrollment.admitSession({ rootSessionId: this.cfg.rootSessionId, requester: this.cfg.owner });
+        const admitted = await this.admitShared();
+        if (admitted.ok)
+            return ok(admitted.value);
+        return { ok: false, error: new RemoteExecutionError(admitted.failure.remote, admitted.failure.message) };
+    }
+    async admitShared() {
+        const inflight = this.connectPromise;
+        if (inflight !== undefined)
+            return inflight;
+        const started = this.admit();
+        this.connectPromise = started;
+        try {
+            return await started;
+        }
+        finally {
+            if (this.connectPromise === started)
+                this.connectPromise = undefined;
+        }
+    }
+    async ensureConnected() {
+        if (this.destroyed)
+            return ADMISSION_DESTROYED;
+        if (this.connected)
+            return undefined;
+        const admitted = await this.admitShared();
+        return admitted.ok ? undefined : admitted.failure;
+    }
+    async admit() {
+        if (this.destroyed) {
+            return { ok: false, failure: { ...ADMISSION_DESTROYED, message: "device env destroyed — create a fresh env instead of reviving" } };
+        }
+        let admitted;
+        try {
+            admitted = await this.cfg.enrollment.admitSession({ rootSessionId: this.cfg.rootSessionId, requester: this.cfg.owner });
+        }
+        catch (err) {
+            return {
+                ok: false,
+                failure: {
+                    remote: "connect_failed",
+                    exec: "target_unavailable",
+                    file: "transport_lost",
+                    message: `[device.admission_unavailable] the device admission read failed, so this session's device could not be confirmed (fail-closed): ${err instanceof Error ? err.message : String(err)}`,
+                },
+            };
+        }
         if (!admitted.ok) {
-            return { ok: false, error: new RemoteExecutionError(DEVICE_REJECT_TO_REMOTE_ERROR[admitted.reject.code], rejectText(admitted.reject)) };
+            return { ok: false, failure: failureFor(admitted.reject.code, rejectText(admitted.reject)) };
         }
         if (admitted.value.deviceId !== this.cfg.deviceId) {
             return {
                 ok: false,
-                error: new RemoteExecutionError("auth_failed", `[${DEVICE_ERROR_CODES.IDENTITY_MISMATCH}] this session is now bound to a different device (${admitted.value.deviceId}) than the one this environment was minted for — refusing to silently re-target; re-initiate the work on the currently bound device (device lane identity, v2 §4.5/§3)`),
+                failure: failureFor("device.identity_mismatch", `[${DEVICE_ERROR_CODES.IDENTITY_MISMATCH}] this session is now bound to a different device (${admitted.value.deviceId}) than the one this environment was minted for — refusing to silently re-target; re-initiate the work on the currently bound device (device lane identity, v2 §4.5/§3)`),
             };
         }
         {
@@ -191,12 +246,20 @@ export class RemoteDeviceExecutionEnv {
             if (gained.length > 0) {
                 return {
                     ok: false,
-                    error: new RemoteExecutionError("connect_failed", `[device.capability_drift] this environment was minted while the device's protective write primitives (${gained.join(", ")}) were not observable, ` +
-                        "so they are absent from its filesystem face — core would read that absence as \"the backend has no such primitive\" and fall back to a NON-atomic write, " +
-                        "silently re-opening the TOCTOU window guarded writes exist to close (#157). Refusing this connect; the per-task factory will mint a correctly-shaped env on retry."),
+                    failure: {
+                        remote: "connect_failed",
+                        exec: "shell_unavailable",
+                        file: "not_supported",
+                        message: `[device.capability_drift] this environment was minted while the device's protective write primitives (${gained.join(", ")}) were not observable, ` +
+                            "so they are absent from its filesystem face — core would read that absence as \"the backend has no such primitive\" and fall back to a NON-atomic write, " +
+                            "silently re-opening the TOCTOU window guarded writes exist to close (#157). Refusing this connect; the per-task factory will mint a correctly-shaped env on retry.",
+                    },
                 };
             }
         }
+        if (this.destroyed) {
+            return { ok: false, failure: { ...ADMISSION_DESTROYED, message: "device env destroyed while admitting — create a fresh env instead of reviving" } };
+        }
         this.connected = true;
         return ok(this.workspaceHandle());
     }
@@ -226,24 +289,28 @@ export class RemoteDeviceExecutionEnv {
     async cleanup() {
         return this.destroy();
     }
-    shellGate() {
+    async shellGate() {
         if (this.destroyed)
             return { ok: false, error: new ExecutionError("shell_unavailable", "execution env already destroyed") };
-        if (!this.connected)
-            return { ok: false, error: new ExecutionError("shell_unavailable", "device env not connected — call connect() first") };
+        const failure = await this.ensureConnected();
+        if (failure)
+            return { ok: false, error: new ExecutionError(failure.exec, failure.message) };
         return undefined;
     }
-    fsGate(p) {
+    async fsGate(p) {
         if (this.destroyed)
             return { ok: false, error: new FileError("unknown", "execution env already destroyed", this.resolve(p)) };
-        if (!this.connected)
-            return { ok: false, error: new FileError("unknown", "device env not connected — call connect() first", this.resolve(p)) };
+        const failure = await this.ensureConnected();
+        if (failure)
+            return { ok: false, error: new FileError(failure.file, failure.message, this.resolve(p)) };
         return undefined;
     }
     timeoutMsFor(seconds) {
         return seconds != null && Number.isFinite(seconds) && seconds > 0 ? Math.ceil(seconds * 1000) : this.cfg.execTimeoutMs;
     }
     dispatch(kind, args, opts) {
+        if (this.destroyed)
+            return Promise.resolve(ENV_TERMINAL);
         const input = {
             rootSessionId: this.cfg.rootSessionId,
             requester: this.cfg.owner,
@@ -262,6 +329,8 @@ export class RemoteDeviceExecutionEnv {
     }
     fileOutcome(res, absPath, take) {
         switch (res.kind) {
+            case "env_terminal":
+                return { ok: false, error: new FileError("unknown", ENV_TERMINAL_MESSAGE, absPath) };
             case "rejected":
                 return { ok: false, error: new FileError(DEVICE_REJECT_TO_FILE_ERROR[res.reject.code], rejectText(res.reject), absPath) };
             case "never_started":
@@ -277,7 +346,7 @@ export class RemoteDeviceExecutionEnv {
         return { ok: false, error: new FileError("unknown", `device returned a "${got}" outcome for an operation that requires "${want}" — protocol violation`, absPath) };
     }
     async exec(command, options) {
-        const gated = this.shellGate();
+        const gated = await this.shellGate();
         if (gated)
             return gated;
         let stdout = "";
@@ -301,6 +370,8 @@ export class RemoteDeviceExecutionEnv {
             },
         });
         switch (res.kind) {
+            case "env_terminal":
+                return { ok: false, error: new ExecutionError("shell_unavailable", ENV_TERMINAL_MESSAGE) };
             case "rejected":
                 return { ok: false, error: new ExecutionError(DEVICE_REJECT_TO_EXEC_ERROR[res.reject.code], rejectText(res.reject)) };
             case "never_started":
@@ -321,8 +392,11 @@ export class RemoteDeviceExecutionEnv {
     async *execStream(command, options) {
         if (this.destroyed)
             throw new RemoteExecutionError("connect_failed", "execution env already destroyed");
-        if (!this.connected)
-            throw new RemoteExecutionError("connect_failed", "device env not connected — call connect() first");
+        {
+            const failure = await this.ensureConnected();
+            if (failure)
+                throw new RemoteExecutionError(failure.remote, failure.message);
+        }
         const queue = [];
         let queuedBytes = 0;
         let done = false;
@@ -434,7 +508,7 @@ export class RemoteDeviceExecutionEnv {
         }
     }
     async exists(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -448,7 +522,7 @@ export class RemoteDeviceExecutionEnv {
         });
     }
     async canonicalPath(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -462,7 +536,7 @@ export class RemoteDeviceExecutionEnv {
         });
     }
     async fileInfo(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -476,7 +550,7 @@ export class RemoteDeviceExecutionEnv {
         });
     }
     async doReadLink(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -492,7 +566,7 @@ export class RemoteDeviceExecutionEnv {
         });
     }
     async readBinaryFile(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -508,7 +582,7 @@ export class RemoteDeviceExecutionEnv {
         return this.fileOutcome(res, abs, (o) => (o.kind === "read" ? ok(new Uint8Array(Buffer.concat(parts))) : this.wrongOutcome("read", o.kind, abs)));
     }
     async readTextFile(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -524,7 +598,7 @@ export class RemoteDeviceExecutionEnv {
         return this.fileOutcome(res, abs, (o) => (o.kind === "read" ? ok(Buffer.concat(parts).toString("utf8")) : this.wrongOutcome("read", o.kind, abs)));
     }
     async readTextLines(p, options) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -547,7 +621,7 @@ export class RemoteDeviceExecutionEnv {
         });
     }
     async listDir(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -567,7 +641,7 @@ export class RemoteDeviceExecutionEnv {
         return this.doWrite("appendFile", p, content, undefined, abortSignal);
     }
     async doWrite(kind, p, content, _unused, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -590,7 +664,7 @@ export class RemoteDeviceExecutionEnv {
         });
     }
     async doGuardedWrite(p, content, expect, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -615,7 +689,7 @@ export class RemoteDeviceExecutionEnv {
         return false;
     }
     async createDir(p, options) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -623,7 +697,7 @@ export class RemoteDeviceExecutionEnv {
         return this.fileOutcome(res, abs, (o) => (o.kind === "void" ? ok(undefined) : this.wrongOutcome("void", o.kind, abs)));
     }
     async remove(p, options) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -631,14 +705,14 @@ export class RemoteDeviceExecutionEnv {
         return this.fileOutcome(res, abs, (o) => (o.kind === "void" ? ok(undefined) : this.wrongOutcome("void", o.kind, abs)));
     }
     async createTempDir(prefix = "tmp-", abortSignal) {
-        const gated = this.fsGate(this.cwd);
+        const gated = await this.fsGate(this.cwd);
         if (gated)
             return gated;
         const res = await this.dispatch("createTempDir", { prefix }, { timeoutMs: this.cfg.execTimeoutMs, ...(abortSignal === undefined ? {} : { signal: abortSignal }) });
         return this.fileOutcome(res, this.cwd, (o) => (o.kind === "write" ? ok(o.canonicalPath) : this.wrongOutcome("write", o.kind, this.cwd)));
     }
     async createTempFile(options) {
-        const gated = this.fsGate(this.cwd);
+        const gated = await this.fsGate(this.cwd);
         if (gated)
             return gated;
         const res = await this.dispatch("createTempFile", { ...(options?.prefix === undefined ? {} : { prefix: options.prefix }), ...(options?.suffix === undefined ? {} : { suffix: options.suffix }) }, { timeoutMs: this.cfg.execTimeoutMs, ...(options?.abortSignal === undefined ? {} : { signal: options.abortSignal }) });
@@ -666,6 +740,8 @@ function toWireExpectation(e) {
 }
 function streamFailure(res) {
     switch (res.kind) {
+        case "env_terminal":
+            return new RemoteExecutionError("connect_failed", ENV_TERMINAL_MESSAGE);
         case "rejected":
             return new RemoteExecutionError(DEVICE_REJECT_TO_REMOTE_ERROR[res.reject.code], rejectText(res.reject));
         case "never_started":

package/dist/request-key-closure.js

@@ -20,7 +20,8 @@ export function keyClosureClause(names, label) {
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
     "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
-    "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork", "excludeTools",
+    "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
+    "excludeAllTools", "excludeTools",
     "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",

package/dist/runtime-governance.d.ts

@@ -24,12 +24,14 @@
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
 import { type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
-/** A per-command governance rule (registry `runtime.commandPolicy[]`). */
-export type CommandRule = {
-    command: string;
-    decision: "allow" | "ask" | "deny";
-};
+/** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
+export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
+/** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
+ *  契约给 `command` 加一条 refine / 给 `decision` 加一个判词,本仓的型当场跟上(或在下面的
+ *  `RANK` / 穷尽 switch 上编译红),而不是靠人记得把手写联合改一遍。 */
+export type CommandRule = NonNullable<GovernanceConfig["commandPolicy"]>[number];
 /** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
  *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 [ref]:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
  *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
@@ -50,8 +52,8 @@ export declare function isDelegationToolName(name: string): boolean;
 export declare function stripDelegationTools<T extends {
     name: string;
 }>(tools: readonly T[]): T[];
-/** The operator autonomy mode (registry `runtime.autonomy`). */
-export type Autonomy = "read-only" | "ask" | "plan" | "auto";
+/** The operator autonomy mode (registry `governance.autonomy`) —— 契约派生(见 {@link AUTONOMY_MODES})。 */
+export type Autonomy = NonNullable<GovernanceConfig["autonomy"]>;
 /** 导出给 `test/coarse-shell-tools-mirror.test.ts` 的同源钉用(见那里的顶注)。 */
 export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
@@ -81,6 +83,13 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * Either way the result only ever ADDS asks/denies — composed onto the baseline via `combinePolicies`
  * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only. (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
+ *
+ * 🔴 **S-496:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
+ * 后果(「域外的 `decision` 穿过本函数的三元链落到 ASK,静默把一条 intended deny 弱化掉」)此前只靠
+ * **调用方记得先校验**挡着 —— 而本函数在 `resolve-spec` 里是逐请求现调的,`config.commandPolicy` 的来路
+ * (center hot apply / 本地 `config.d/governance.json` / LKG / 测试直塞)不止一条。现在闭集在本函数**内部**
+ * 收口:`VALID_DECISIONS` 之外的值一律折最严的 `deny`(fail-closed,[ref] 的运行期 miss 臂,下方自陈),
+ * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
 export declare function compileCommandPolicy(rules: CommandRule[] | undefined): ToolPolicy | undefined;
 /**

package/dist/runtime-governance.js

@@ -1,7 +1,10 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-import { SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
+import { GovernanceConfig, SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { operatorAsk } from "./operator-ask.js";
+const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
+const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
+export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
 export function isDelegationToolName(name) {
     return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
@@ -30,7 +33,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     };
 }
 const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
-const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);
+function isCommandDecision(raw) {
+    return typeof raw === "string" && COMMAND_DECISIONS.includes(raw);
+}
 export function validateCommandRules(rules) {
     const errors = [];
     if (!Array.isArray(rules))
@@ -45,8 +50,8 @@ export function validateCommandRules(rules) {
             errors.push(`commandPolicy command "${String(command)}" is not a bare argv[0] name — core matches the EXACT command name (no glob/path/operators). ` +
                 `Use e.g. "git" not "git*"; to gate sub-commands or pipes, deny the interpreter ("sh"/"bash") + rely on the sandbox.`);
         }
-        if (typeof decision !== "string" || !VALID_DECISIONS.has(decision)) {
-            errors.push(`commandPolicy command "${String(command)}" has invalid decision "${String(decision)}" — must be one of allow | ask | deny`);
+        if (!isCommandDecision(decision)) {
+            errors.push(`commandPolicy command "${String(command)}" has invalid decision "${String(decision)}" — must be one of ${COMMAND_DECISIONS.join(" | ")}`);
         }
     }
     return errors;
@@ -57,15 +62,30 @@ export function compileCommandPolicy(rules) {
     const RANK = { deny: 3, ask: 2, allow: 1 };
     const strictest = new Map();
     for (const r of rules) {
+        const decision = isCommandDecision(r.decision) ? r.decision : "deny";
         const prev = strictest.get(r.command);
-        if (prev === undefined || RANK[r.decision] > RANK[prev])
-            strictest.set(r.command, r.decision);
+        if (RANK[decision] > (prev === undefined ? 0 : RANK[prev]))
+            strictest.set(r.command, decision);
     }
     const deny = [];
     const allow = [];
     const ask = [];
     for (const [command, decision] of strictest) {
-        (decision === "deny" ? deny : decision === "allow" ? allow : ask).push(command);
+        switch (decision) {
+            case "deny":
+                deny.push(command);
+                break;
+            case "allow":
+                allow.push(command);
+                break;
+            case "ask":
+                ask.push(command);
+                break;
+            default: {
+                const unhandled = decision;
+                throw new Error(`commandPolicy decision "${String(unhandled)}" has no compilation arm`);
+            }
+        }
     }
     const policies = [];
     if (allow.length > 0) {

package/dist/session-policy-wire.d.ts

@@ -0,0 +1,103 @@
+/**
+ * `SessionPermissionRules` 的 **wire 形读者** —— 两条写入腿(`PUT /v1/sessions/:id/policy` 与
+ * `POST /v1/sessions/:id/sync/import` 的 `policy` 面)**唯一**的形判据。
+ *
+ * ── 为什么是一只共享读者(S-496 / [ref],取证 P4 + S-498)───────────────────────────────────────────
+ * 改前两条腿各自为政:
+ *  · PUT 腿在 `http/routes/sessions.ts` 里**手抄**五桶键名(`["toolAllow","toolDeny","allowDirs",
+ *    "commandAllow","commandDeny"] as const`),core 的 `SessionPermissionRules` 加第六桶 ⇒ 那一桶在
+ *    PUT 上被**静默丢**、200 回执却说「已生效」;
+ *  · sync/import 腿(S-498)只判 `Array.isArray(body.policy)` **外层**,逐条记录的 `principal` / `rules`
+ *    一个字节都不校验就裸交 `replayPolicyRecords` → `putRules`。坏形走的是**放宽**方向,亲读 core
+ *    `session-policy-store.js` 两处实现:
+ *      · `normalizeRules` 对每桶做 `[...rules.toolDeny]` ⇒ 一个**字符串** `"rm"` 被展开成 `["r","m"]`,
+ *        本来该拒 `rm` 的 deny 规则变成拒两个不存在的命令名 = 门整条失效;
+ *      · `allowDirs` 走 `.map(...)` ⇒ 字符串上没有 `.map` ⇒ **TypeError → 500**(路由头注 `:300-302`
+ *        自陈「Malformed shape → 400(never a downstream TypeError)」,这一半没守);
+ *      · `loosenReasons` 的每一臂都从 `prior` 出发,**prior 为空时恒回空集** ⇒ tighten-only 门对一条
+ *        全新的会话放行任何内容,坏形因此连「收紧门」这一层都碰不到。
+ * ⇒ 类修:一只读者,键集由 `keyof SessionPermissionRules` **派生**(下方 `RULE_FIELD_PRESENCE` 的
+ * `satisfies Record<keyof SessionPermissionRules, true>`:core 加桶 ⇒ 缺键**编译红**;core 删桶 ⇒
+ * 多键**编译红**),两条腿同调。
+ *
+ * ── 文案也在这里(codex 一轮追加:两条腿各铸一份句子 = 第二份手抄)───────────────────────────────
+ * 初版把 wire 文案留在两个路由各自铸,理由是错误文案冻结门(`test/api-error-text-freeze.test.ts`)锚的是
+ * `src/http/` 桶里的 `sendError` 站点。codex 一轮指出那等于**把同一句话写了两遍**(`sessions.ts` 与
+ * `session-sync.ts` 各一份),这正是本批要消灭的形。改法照本仓既有成案(S-405 / [ref] / [ref] 三处
+ * 「常量锚」):句子收进本文件**单一属主**,冻结职责搬到冻结门的**常量锚格** —— 那一格直接断言这两只
+ * 渲染器对每一种判词的输出字节,且对判词闭集穷尽(加一种判词 ⇒ 那一格编译红)。文案一个字节未改。
+ */
+import type { SessionPermissionRules, SessionRulesRecord } from "@sema-agent/core";
+/** core `SessionPermissionRules` 的桶名全集(派生,不是手抄)。 */
+export declare const SESSION_PERMISSION_RULE_FIELDS: readonly (keyof SessionPermissionRules)[];
+/** 一条规则体的形问题。判词而非文案(见文件头注的「文案属主」一段)。 */
+export type SessionPermissionRulesProblem = 
+/** 整体不是一只普通对象(`null` / 数组 / 标量 / 缺席)。 */
+{
+    kind: "not-an-object";
+}
+/** 某一桶在场但不是 `string[]`(字符串 / 数字 / 混杂数组都在此)。 */
+ | {
+    kind: "field-not-string-array";
+    field: keyof SessionPermissionRules;
+};
+/** {@link readSessionPermissionRules} 的读数:坏形给判词,好形给**已收窄**的规则体(调用方零 cast)。 */
+export type SessionPermissionRulesRead = {
+    problem: SessionPermissionRulesProblem;
+    rules?: undefined;
+} | {
+    problem?: undefined;
+    rules: SessionPermissionRules;
+};
+/**
+ * 读一只 wire 上的 `SessionPermissionRules`:形不对给判词,形对给**只含五桶**的规则体。
+ *
+ * 认识面窄得刻意:**只判形**,不判内容(桶内字符串的 pattern 文法、路径是否可达、tighten-only 是否成立
+ * 都不在这里 —— 前两者归 core 的 rule 文法与 `normalizeRules`,后者归 `putRules` 的收紧门)。
+ * 未知键**照旧忽略**(不是新的拒因):core 的 `normalizeRules` 本来就只搬这五桶,本读者与它同口径。
+ */
+export declare function readSessionPermissionRules(raw: unknown): SessionPermissionRulesRead;
+/** 一条 `SessionRulesRecord` 的形问题(`policy[]` 的元素级;桶级问题原样转载在 `rules` 位)。 */
+export type SessionRulesRecordProblem = 
+/** `policy` 本身不是数组。 */
+{
+    kind: "not-an-array";
+}
+/** 第 `index` 条记录不是一只普通对象。 */
+ | {
+    kind: "record-not-an-object";
+    index: number;
+}
+/** 第 `index` 条的 `principal` 在场但不是字符串(**缺席**才是「会话级默认行」的合法写法 —— 两个店的
+ *  `listBySession` 对无 principal 的行都产 `undefined`,JSON 序列化后即缺席,所以 `null` 不在受理面)。 */
+ | {
+    kind: "principal-not-a-string";
+    index: number;
+}
+/** 第 `index` 条的 `rules` 形不对(转载桶级判词)。 */
+ | {
+    kind: "rules";
+    index: number;
+    problem: SessionPermissionRulesProblem;
+};
+/** {@link readSessionRulesRecords} 的读数。 */
+export type SessionRulesRecordsRead = {
+    problem: SessionRulesRecordProblem;
+    records?: undefined;
+} | {
+    problem?: undefined;
+    records: SessionRulesRecord[];
+};
+/**
+ * 读 sync/import 的 `policy` 面(`SessionRulesRecord[]`)。好形返回**已收窄**的记录数组,坏形给判词。
+ *
+ * `rev`:记录里带的 `rev` 是**导出端的**乐观锁读数,`putRules` 侧一进门就 `stripRev` 掉(`sameRulesContent`
+ * 也比的是去 rev 的字节形),所以它在本读者里只是过境位 —— 非数字即当缺席(不是拒因:一个坏 rev 改变不了
+ * 任何一次写入的结果,拒它只会把合法同步砖死)。
+ */
+export declare function readSessionRulesRecords(raw: unknown): SessionRulesRecordsRead;
+/** 桶级判词 → 人话。闭集穷尽:{@link SessionPermissionRulesProblem} 加一种判词 ⇒ 本 switch 编译红。 */
+export declare function describeSessionPermissionRulesProblem(p: SessionPermissionRulesProblem): string;
+/** `policy[]` 判词 → 人话(sync/import 腿在它前面拼 `policy: `)。闭集穷尽同上。 */
+export declare function describeSessionRulesRecordProblem(p: SessionRulesRecordProblem): string;
+//# sourceMappingURL=session-policy-wire.d.ts.map

package/dist/session-policy-wire.js

@@ -0,0 +1,66 @@
+const RULE_FIELD_PRESENCE = {
+    toolAllow: true,
+    toolDeny: true,
+    allowDirs: true,
+    commandAllow: true,
+    commandDeny: true,
+};
+export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_PRESENCE);
+export function readSessionPermissionRules(raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return { problem: { kind: "not-an-object" } };
+    const src = raw;
+    const rules = {};
+    for (const field of SESSION_PERMISSION_RULE_FIELDS) {
+        const v = src[field];
+        if (v === undefined)
+            continue;
+        if (!Array.isArray(v) || !v.every((x) => typeof x === "string"))
+            return { problem: { kind: "field-not-string-array", field } };
+        rules[field] = v;
+    }
+    return { rules };
+}
+export function readSessionRulesRecords(raw) {
+    if (!Array.isArray(raw))
+        return { problem: { kind: "not-an-array" } };
+    const records = [];
+    for (let index = 0; index < raw.length; index++) {
+        const e = raw[index];
+        if (e === null || typeof e !== "object" || Array.isArray(e))
+            return { problem: { kind: "record-not-an-object", index } };
+        const { principal, rules, rev } = e;
+        if (principal !== undefined && typeof principal !== "string")
+            return { problem: { kind: "principal-not-a-string", index } };
+        const read = readSessionPermissionRules(rules);
+        if (read.problem !== undefined)
+            return { problem: { kind: "rules", index, problem: read.problem } };
+        const innerRev = rules?.rev;
+        const carried = typeof innerRev === "number" ? innerRev : typeof rev === "number" ? rev : 0;
+        records.push({ principal, rules: { ...read.rules, rev: carried } });
+    }
+    return { records };
+}
+export function describeSessionPermissionRulesProblem(p) {
+    switch (p.kind) {
+        case "not-an-object": return "rules must be a SessionPermissionRules object";
+        case "field-not-string-array": return `${p.field} must be an array of strings`;
+        default: {
+            const unhandled = p;
+            throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function describeSessionRulesRecordProblem(p) {
+    switch (p.kind) {
+        case "not-an-array": return "must be an array of {principal, rules} records";
+        case "record-not-an-object": return `[${p.index}] must be a {principal, rules} record`;
+        case "principal-not-a-string": return `[${p.index}].principal must be a string when present (omit it for the session-wide row)`;
+        case "rules": return `[${p.index}].rules: ${describeSessionPermissionRulesProblem(p.problem)}`;
+        default: {
+            const unhandled = p;
+            throw new Error(`unhandled SessionRulesRecord problem: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=session-policy-wire.js.map

package/dist/task-settings.d.ts

@@ -48,7 +48,16 @@ import { type KeyClosureIssue } from "./request-key-closure.js";
  *  deployment approval/governance baseline is composed OUTSIDE this derive and is untouchable from a settings stamp),
  *  and `auto` adds the same ask gate as `default` with core's auto-mode classifier screening the asks upstream
  *  (entitlement-gated in core, [ref]②). */
-export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto";
+export declare const SETTINGS_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
+/** 五模式闭集的型形 —— **从值表派生**(S-496 / [ref]):改前本仓有 **4 份**同一张五词表(本处的手写联合 /
+ *  下面 `coercePermissionModeStrict` 的运行期字面量链 / `http/admission.ts` 顶层 `permissionMode` 的比较链 /
+ *  同文件 `settings.permissions.defaultMode` 的比较链),外加两句错误文案里各抄一遍词。现在值表一份、
+ *  型与文案都从它派生,比较链改调 {@link isSettingsPermissionMode}。 */
+export type SettingsPermissionMode = (typeof SETTINGS_PERMISSION_MODES)[number];
+/** 五词表的 wire 文案形(`"a" | "b" | …`)—— 两条 400 的句子从这里取词,不再各抄一份。 */
+export declare const SETTINGS_PERMISSION_MODE_WORDS: string;
+/** 闭集成员判定(`unknown` 入口用)—— 词表的**唯一**运行期读者:wire 门与 coerce 两族同调。 */
+export declare function isSettingsPermissionMode(raw: unknown): raw is SettingsPermissionMode;
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
  * CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
@@ -68,7 +77,8 @@ export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypas
  */
 export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
 /** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
- *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
+ *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠。
+ *  S-496:词表单点已上移到 {@link SETTINGS_PERMISSION_MODES},本函数只是它的 `undefined` 形读者。 */
 export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
 /**
  * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的