@sema-agent/server 7.89.0 → 7.91.1

package/dist/config-catalog.js

@@ -5,6 +5,7 @@ import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-sear
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -55,7 +56,7 @@ export const CONFIG_CATALOG = [
     r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
     r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(与 AUTH_TOKEN 二选一,AUTH_TOKEN 优先;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
     r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(设了则不发 x-api-key)", { danger: [...SEC, ...BILL] }),
-    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo`;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`)"),
+    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo`;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment` —— fragment 从不上线,后缀会落进被丢弃的那一半)"),
     r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
     r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
@@ -282,8 +283,8 @@ export const CONFIG_CATALOG = [
     r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
     r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
-    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
-    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`)", { configKey: "gatewayFallbackUrls" }),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
     r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
     r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0=关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
@@ -478,19 +479,6 @@ function primitiveConfigValue(config, key) {
         return v;
     return undefined;
 }
-const REDACTED_UNPARSEABLE_URL = "(redacted:unparseable-url)";
-function stripUrlUserinfo(v) {
-    if (!URL.canParse(v))
-        return REDACTED_UNPARSEABLE_URL;
-    const u = new URL(v);
-    u.username = "";
-    u.password = "";
-    if (u.search === "" && u.hash === "" && u.href === v)
-        return v;
-    u.search = "";
-    u.hash = "";
-    return u.href;
-}
 function sanitizeEnumValue(spec, v) {
     const words = spec.echoWords ?? spec.enumValues;
     if (v === null)
@@ -511,9 +499,9 @@ function sanitizeValue(spec, v) {
     const type = spec.type;
     if (type === "url") {
         if (typeof v === "string")
-            return { value: v.includes(",") ? v.split(",").map((s) => stripUrlUserinfo(s.trim())).filter((s) => s.length > 0) : stripUrlUserinfo(v) };
+            return { value: v.includes(",") ? v.split(",").map((s) => buildDisplaySafeUrl(s.trim())).filter((s) => s.length > 0) : buildDisplaySafeUrl(v) };
         if (Array.isArray(v))
-            return { value: v.map((s) => stripUrlUserinfo(s)) };
+            return { value: v.map((s) => buildDisplaySafeUrl(s)) };
         return { value: v };
     }
     if (type === "csv" && typeof v === "string")

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import { type Model, type PathRuleBases, type RuleBehavior } from "@sema-agent/core";
-import type { Autonomy } from "./runtime-governance.js";
+import { type Autonomy } from "./runtime-governance.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
 /** [ref] A1: the config TYPE face lives in the leaf module config-types.ts; re-exported here so
  *  every existing `from "./config.js"` importer compiles unchanged (pure-type consumers should prefer

package/dist/config.js

@@ -17,9 +17,10 @@ import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -27,7 +28,6 @@ function csv(name) {
         .map((s) => s.trim())
         .filter(Boolean);
 }
-const AUTONOMY_MODES = ["read-only", "ask", "plan", "auto"];
 export function parseAutonomy(raw) {
     const v = raw?.trim();
     if (!v)
@@ -1972,9 +1972,9 @@ function parseA2aServe() {
         throw new Error(`A2A_SERVE_URL must not carry userinfo (credentials before "@") — it is published verbatim on the ANONYMOUSLY readable agent card, so those credentials would be handed to every discovery caller. ` +
             `Inbound authentication on this endpoint is header-shaped (a service credential), not URL-embedded; strip the userinfo and keep the secret in the caller's headers.`);
     }
-    const a2aDisplaySafe = buildDisplaySafeUrl(rawUrl);
-    if (a2aDisplaySafe !== parsed.href) {
-        throw new Error(`A2A_SERVE_URL carries something the credential-redaction law recognizes (${a2aDisplaySafe}) — this address is published VERBATIM on the ANONYMOUSLY readable agent card (the card's url is a functional address: peers fetch it, so it is never rewritten for display), ` +
+    const a2aCredentialScan = redactSecrets(parsed.href);
+    if (a2aCredentialScan !== parsed.href) {
+        throw new Error(`A2A_SERVE_URL carries something the credential-redaction law recognizes (${a2aCredentialScan}) — this address is published VERBATIM on the ANONYMOUSLY readable agent card (the card's url is a functional address: peers fetch it, so it is never rewritten for display), ` +
             `so it must not carry credentials of ANY shape: no userinfo, no credential-named query parameter (api_key/token/…), no token-shaped path segment or parameter value. ` +
             `Keep A2A_SERVE_URL to scheme://host[:port][/path] and move the secret into the caller's headers.`);
     }

package/dist/cross-session-settings.d.ts

@@ -28,8 +28,12 @@
  * ### 另一件如实:整条车道今日未挂
  *
  * 两个座位在引擎侧都**以 `RunnerDeps.peerDirectory` 在场为前提**(座缺席 ⇒ 跨会话车道整条不挂,
- * 每个面与 pre-385 构建逐字节相同)。本仓的 peer 目录席位是另一件欠账,故本文件铸出的层今天是
- * **就位待命**而非生效中。这不改变供层的正确性:目录席到货那天零改动即生效。
+ * 每个面与 pre-385 构建逐字节相同)。
+ *
+ * ✅ **7.91.0:目录席已接线**([ref],`boot/runner-deps.ts` 的三合取:会话枚举面 ∧ mailbox 店 ∧ 收件人生命周期面)
+ * —— 旧文字写的是「另一件欠账 …… 就位待命而非生效中」,如实订正:本文件铸的 managed 层在**有席的部署**上
+ * 真的在治理 drain 点的判决了;缺任一合取项的部署(典型 = 无耐久 mailbox 的单机形)上车道整条不挂,层仍是
+ * 就位待命。当初那句「目录席到货那天零改动即生效」已兑现:本文件一个字节未改。
  */
 import type { CrossSessionDialogExpiry, CrossSessionInboundSetting, CrossSessionInboundSettingLayers } from "@sema-agent/core";
 /** 引擎层形的层名 —— 从 core 的类型上取,**引擎加一层 = 本文件编译错**(下面两处闭集都锁在这个联合上)。 */

package/dist/hooks/hook-llm.js

@@ -1,6 +1,6 @@
-import { adjudicateModelRoute, normalizeBaseUrl, resolveRouteCredential, routeRefusalText } from "@sema-agent/core";
+import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
 import { matchCatalogModel } from "../model-select.js";
-import { redactSecrets } from "../trace/redact.js";
+import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
     if (raw === "")
         return raw;
@@ -53,9 +53,13 @@ export function createHookLlm(deps) {
         });
         const verdict = adjudicateModelRoute({ id: pick.catalogRef, baseUrl: pick.baseUrl }, credential, { ...(declaredRoot !== undefined ? { baseUrl: declaredRoot } : {}) });
         if (!verdict.ok) {
-            return { ok: false, error: `hook model "${pick.catalogRef}" cannot be routed — ${routeRefusalText(verdict)}` };
+            return {
+                ok: false,
+                error: `hook model "${pick.catalogRef}" cannot be routed (${verdict.code}) — ` +
+                    buildDisplaySafeRefusal(routeRefusalText(verdict), [pick.baseUrl, declaredRoot ?? ""]),
+            };
         }
-        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && normalizeBaseUrl(pick.baseUrl) !== normalizeBaseUrl(declaredRoot)) {
+        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && routeKeyOf(pick.baseUrl) !== routeKeyOf(declaredRoot)) {
             return {
                 ok: false,
                 error: `hook model "${pick.catalogRef}" points at ${pick.baseUrl}, which this deployment did not declare as its own endpoint, ` +
@@ -91,7 +95,7 @@ export function createHookLlm(deps) {
                 const routed = judgeRoute(pick, perModelKey, config.anthropic?.authToken ?? config.anthropic?.apiKey, routeBase);
                 if (!routed.ok)
                     return routed;
-                url = `${pick.baseUrl.replace(/\/+$/, "")}/v1/messages`;
+                url = joinRequestUrl(pick.baseUrl, "/v1/messages");
                 headers = {
                     "content-type": "application/json",
                     "anthropic-version": config.anthropic?.version ?? "2023-06-01",
@@ -112,7 +116,7 @@ export function createHookLlm(deps) {
                 if (!routed.ok)
                     return routed;
                 const hookKey = routed.credential.apiKey;
-                url = `${pick.baseUrl.replace(/\/+$/, "")}/chat/completions`;
+                url = joinRequestUrl(pick.baseUrl, "/chat/completions");
                 headers = { "content-type": "application/json", ...(hookKey ? { authorization: `Bearer ${hookKey}` } : {}) };
                 body = JSON.stringify({ model: pick.providerModelId, ...(maxOutputTokens !== undefined ? { max_tokens: maxOutputTokens } : {}), messages: [...(system ? [{ role: "system", content: system }] : []), { role: "user", content: prompt }], stream: false });
             }

package/dist/hooks/hook-runner.js

@@ -52,7 +52,9 @@ const BRAIN_TO_TURN_ERROR = {
     max_output_tokens: "max_output_tokens",
 };
 function toAssistantTurnError(errorKind) {
-    return (errorKind !== undefined ? BRAIN_TO_TURN_ERROR[errorKind] : undefined) ?? "unknown";
+    if (errorKind === undefined)
+        return "unknown";
+    return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
 export function parseHooksConfig(raw) {
     const parsed = HooksConfig.safeParse(raw);
@@ -1148,6 +1150,21 @@ export function createTaskHooks(config, ctx) {
     }
     return hooks;
 }
+const HOOK_SLOT_FOLD = {
+    preToolUse: "custom",
+    preToolUseObservational: "custom",
+    postToolUse: "custom",
+    postToolUseFailure: "custom",
+    postToolBatch: "custom",
+    userPromptSubmit: "custom",
+    stop: "custom",
+    preCompact: "custom",
+    timeoutMs: "scalar",
+    postCompact: "observe-void",
+    stopFailure: "observe-void",
+    permissionDenied: "observe-void",
+};
+const OBSERVE_VOID_HOOK_SLOTS = Object.keys(HOOK_SLOT_FOLD).filter((k) => HOOK_SLOT_FOLD[k] === "observe-void");
 export function composeHooks(deployment, task) {
     if (!deployment)
         return task;
@@ -1270,7 +1287,7 @@ export function composeHooks(deployment, task) {
             };
         };
     }
-    for (const slot of ["stopFailure", "postCompact", "permissionDenied"]) {
+    for (const slot of OBSERVE_VOID_HOOK_SLOTS) {
         const ds = d[slot];
         const ts = t[slot];
         if (ds && ts) {

package/dist/http/admission.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -430,6 +430,10 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
+        if (body.excludeAllTools !== undefined && typeof body.excludeAllTools !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "excludeAllTools must be a boolean");
+            return null;
+        }
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
@@ -453,8 +457,8 @@ export function createAdmission(ctx) {
         }
         {
             const v = body.permissionMode;
-            if (v !== undefined && v !== "default" && v !== "acceptEdits" && v !== "plan" && v !== "bypassPermissions" && v !== "auto") {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+            if (v !== undefined && !isSettingsPermissionMode(v)) {
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                 return null;
             }
         }
@@ -464,8 +468,8 @@ export function createAdmission(ctx) {
                 const p = s.permissions;
                 if (p !== null && typeof p === "object" && !Array.isArray(p)) {
                     const m = p.defaultMode;
-                    if (m !== undefined && m !== "default" && m !== "acceptEdits" && m !== "plan" && m !== "bypassPermissions" && m !== "auto") {
-                        sendError(res, 400, "request.field_invalid", 'settings.permissions.defaultMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+                    if (m !== undefined && !isSettingsPermissionMode(m)) {
+                        sendError(res, 400, "request.field_invalid", `settings.permissions.defaultMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                         return null;
                     }
                     const d = p.disableAutoMode;

package/dist/http/routes/capabilities.js

@@ -18,7 +18,7 @@ import { projectApprovalsStreamLiveCapability } from "../../capabilities/approva
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict } from "../../task-settings.js";
+import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../../task-settings.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
@@ -52,13 +52,14 @@ export async function handleCapabilities(req, res, match, ctx) {
             const requestedModeRaw = new URLSearchParams(match.search).get("permissionMode");
             const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
             if (requestedModeRaw !== null && requestedMode === undefined) {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
             const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), entitlementSource, localDeny: deps.config.permissionsDisableAutoMode });
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
+            const rulesLaneReachable = Boolean(deps.ruleConsent) && gatedPrincipal(req, deps.config) !== undefined;
             sendJson(res, 200, {
                 ...deps.capabilities,
                 asyncRuns: Boolean(deps.runStore),
@@ -91,7 +92,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 memoryConsolidationDriver: Boolean(deps.memoryConsolidation) && deps.config.operatorPrincipals.length > 0,
                 memoryOptOutGrant: Boolean(deps.memoryOptOutGrant) && deps.config.operatorPrincipals.length > 0,
                 outcomeLedger: Boolean(deps.outcomeSink?.summary) && (deps.config.requirePrincipal !== true || deps.config.operatorPrincipals.length > 0),
-                permissionRules: Boolean(deps.ruleConsent) && gatedPrincipal(req, deps.config) !== undefined,
+                permissionRules: rulesLaneReachable,
+                permissionRulesWrite: rulesLaneReachable,
                 permissionRulesRevoke: Boolean(deps.ruleConsent),
                 respondFreeFormRules: true,
                 respondBatchRuleOffers: true,
@@ -150,6 +152,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sideQuery: true,
                 agentRoster: Boolean(deps.backgroundAgentStore),
                 retention: retentionAdvertisement(deps.config),
+                peerLane: Boolean(deps.peerDirectory),
                 sessionList: Boolean(deps.sessionStorage?.listSessions ?? deps.runStore?.listSessions),
                 sessionSearch: Boolean(deps.sessionStorage?.listSessions ?? deps.runStore?.listSessions),
                 sessionFork: Boolean(deps.sessionStorage?.fork),

package/dist/http/routes/rules.d.ts

@@ -1,6 +1,7 @@
 /**
  * [ref] 车二 + [ref] §2 —— **规则车道的 wire 面**([ref] §7 的导入半场 + [ref] 的撤销半场)。
  *
+ *   POST   /v1/rules                    → 写一条**收紧**规则(deny/ask)进 durable 分区,单步、无票仪式
  *   POST   /v1/rules/cc-import/prepare  → 预览 + 一张**一次性、principal 绑定、有期、载荷绑定**的票
  *   POST   /v1/rules/cc-import/redeem   → 原子消费票 → confirm → 批量兑付进店
  *   GET    /v1/rules                    → 列出自己名下**活着**的规则(keyset 分页,游标绑 rev)
@@ -11,6 +12,11 @@
  * 因此**导入两口**只认已验明的 principal,连 `explicitOperatorOk` 的旁路都不给:一个 operator 想给
  * 自己导规则,用他自己的 principal 走同一条路即可(那时他就是租户)。
  *
+ * 🔴 **`POST /v1/rules` 是撤销口的对偶,不是导入口的简写**(S-511):它写的只有**收紧**方向
+ * (deny/ask),而收紧不需要同意仪式 —— 与撤销为什么不需要是同一条理由(core `removePersistedRule`
+ * 头注逐字:「a host may narrow on a user's behalf, it may not widen」)。放宽(allow)仍然只有两条路:
+ * 一张卡上的人点头,或一次显式的 settings 导入。方向表在 `permission-rule-vocab.ts`,不在本文件。
+ *
  * 🔴 **撤销面两口多一条 operator 超范围域,而这不是上面那句话的例外,是它的对偶**([ref] §2 设计题
  * 一裁定):`?principal=` / body 里的 `principal` 让 operator 读**或收回**任一租户的规则。方向决定授权:
  * 收回是**收紧**(core 的 `removePersistedRule` 头注逐字:「a host may narrow on a user's behalf, it may
@@ -55,6 +61,11 @@ export declare const RULES_ROUTES: readonly [{
     readonly id: "rules-list";
     readonly path: "/v1/rules";
     readonly methods: readonly ["GET"];
+}, {
+    readonly id: "rules-write";
+    readonly path: "/v1/rules";
+    readonly credentialGated: readonly ["POST"];
+    readonly methods: readonly ["POST"];
 }, {
     readonly id: "rules-revoke";
     readonly path: "/v1/rules";

package/dist/http/routes/rules.js

@@ -3,11 +3,11 @@ import { sendJson, sendError, httpErrorCode } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import { createLogger } from "../../observability/logger.js";
-import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
+import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, sameWireRuleIdentity, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
 import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
-import { PERSISTED_RULE_MATCHES, isPersistedRuleTool } from "../../permission-rule-vocab.js";
+import { PERSISTED_RULE_MATCHES, isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -58,7 +58,7 @@ const LOCAL_IMPORT_ROW_SHAPE_PIN = true;
 void LOCAL_IMPORT_ROW_SHAPE_PIN;
 const LocalImportPrepareBodySchema = z.object({ rows: z.array(LocalImportRowSchema).min(1) }).strict();
 const LocalImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
-const RuleRevokeBodySchema = z
+const RuleIdentityBodySchema = z
     .object({
     behavior: z.enum(RULE_BEHAVIORS),
     rule: z.string().min(1).max(1024),
@@ -118,6 +118,10 @@ export async function handleRules(req, res, match, ctx) {
         await handleRuleRevoke(res, rawBody, principal, lane, deps.config.operatorPrincipals);
         return;
     }
+    if (match.decl.id === "rules-write") {
+        await handleRuleWrite(res, rawBody, principal, lane, deps.config.operatorPrincipals);
+        return;
+    }
     if (match.decl.id === "rules-local-import-prepare") {
         const parsed = LocalImportPrepareBodySchema.safeParse(rawBody);
         if (!parsed.success) {
@@ -242,8 +246,52 @@ async function handleRuleList(res, search, caller, lane, operatorPrincipals) {
         : undefined;
     sendJson(res, 200, { rules: page, rev: listing.rev, ...(nextCursor !== undefined ? { nextCursor } : {}) });
 }
+async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
+    const parsed = RuleIdentityBodySchema.safeParse(rawBody);
+    if (!parsed.success) {
+        sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
+        return;
+    }
+    const behavior = parsed.data.behavior;
+    if (!isDirectWritableRuleBehavior(behavior)) {
+        sendError(res, 400, "request.field_invalid", "this endpoint writes standing refusals only: behavior must be 'deny' or 'ask' — a standing approval is minted by answering a permission question or by importing settings, never by this call");
+        return;
+    }
+    const scope = parseRuleScope(parsed.data.scope);
+    if (scope === undefined) {
+        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        return;
+    }
+    const target = resolveTargetPrincipal(parsed.data.principal, caller, operatorPrincipals);
+    if (!target.ok) {
+        sendError(res, 403, "auth.operator_only", "writing another principal's rules is an operator-only action");
+        return;
+    }
+    const written = await lane.writeRule({ principal: target.principal, behavior, rule: parsed.data.rule, scope });
+    switch (written.status) {
+        case "persisted":
+        case "no-op":
+            sendJson(res, 200, { status: written.status, rev: written.rev, rule: written.row });
+            return;
+        case "rejected":
+            logger.info("rule write refused", { reason: written.reason, detail: written.detail });
+            sendError(res, 400, "request.field_invalid", "this rule was not written — `reason` names which check refused it and `detail` says why", {
+                reason: written.reason,
+                detail: written.detail,
+            });
+            return;
+        case "indeterminate":
+            logger.info("rule write indeterminate", { detail: written.detail });
+            sendError(res, 503, "state.rule_write_failed", "this write could not be confirmed as a standing rule — retry, then reconcile with GET /v1/rules");
+            return;
+        default: {
+            const unknown = written;
+            throw new Error(`unknown rule write outcome: ${JSON.stringify(unknown)}`);
+        }
+    }
+}
 async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals) {
-    const parsed = RuleRevokeBodySchema.safeParse(rawBody);
+    const parsed = RuleIdentityBodySchema.safeParse(rawBody);
     if (!parsed.success) {
         sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
         return;
@@ -264,7 +312,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });
             return;
         case "no-op": {
-            const stillLive = (await lane.listRules(target.principal)).rows.some((r) => r.rule === parsed.data.rule && r.scope === serializeRuleScope(scope));
+            const stillLive = (await lane.listRules(target.principal)).rows.some((r) => sameWireRuleIdentity(r, { behavior: parsed.data.behavior, rule: parsed.data.rule, scope: serializeRuleScope(scope) }));
             sendJson(res, 200, { status: "no-op", rev: outcome.rev, stillLive });
             return;
         }
@@ -280,6 +328,7 @@ export const RULES_ROUTES = [
     { id: "rules-local-import-prepare", path: RULES_LOCAL_IMPORT_PREPARE_PATH, methods: ["POST"] },
     { id: "rules-local-import-redeem", path: RULES_LOCAL_IMPORT_REDEEM_PATH, methods: ["POST"] },
     { id: "rules-list", path: RULES_PATH, methods: ["GET"] },
+    { id: "rules-write", path: RULES_PATH, credentialGated: ["POST"], methods: ["POST"] },
     { id: "rules-revoke", path: RULES_PATH, credentialGated: ["DELETE"], methods: ["DELETE"] },
     { prefix: "/v1/rules/cc-import/", credentialGated: ["POST"] },
     { prefix: "/v1/rules/local-import/", credentialGated: ["POST"] },

package/dist/http/routes/session-sync.js

@@ -13,6 +13,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -215,10 +216,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 400, "request.field_invalid", "entryIds must be an array of strings");
                     return;
                 }
-                if (!Array.isArray(body.policy) || !Array.isArray(body.anchors)) {
+                if (!Array.isArray(body.anchors)) {
                     sendError(res, 400, "request.body_shape", "malformed import metadata");
                     return;
                 }
+                const policyRead = readSessionRulesRecords(body.policy);
+                if (policyRead.problem !== undefined) {
+                    sendError(res, 400, "request.field_invalid", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`);
+                    return;
+                }
                 let fileHistory = null;
                 if (body.fileHistory !== undefined && body.fileHistory !== null) {
                     const door = validateFileHistoryExport(body.fileHistory);
@@ -235,7 +241,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const resolution = body.resolution;
                 const srcLogDigest = typeof body.logDigest === "string" && body.logDigest.length > 0 ? body.logDigest : undefined;
                 const entryIds = body.entryIds;
-                const policy = body.policy;
+                const policy = policyRead.records;
                 const anchors = body.anchors;
                 const dstIds = (await deps.sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);

package/dist/http/routes/sessions-list.js

@@ -1,6 +1,7 @@
 import { isUuidV7, legacyUnownedAmnestyOpen } from "../../security.js";
 import { sendJson, sendError } from "../send.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
+import { sessionTempoOfRunStatus } from "../../plugins/store-contracts.js";
 import { assertNever } from "../route-ctx.js";
 export async function handleSessionsList(req, res, match, ctx) {
     const { deps } = ctx;
@@ -120,7 +121,11 @@ async function handleSessionList(res, lister, query, forceOwner, includeUnowned
     const page = hasMore ? rows.slice(0, limit) : rows;
     const last = page[page.length - 1];
     const nextCursor = hasMore && last ? encodeSessionCursor({ lastActivityAt: last.lastActivityAt, sessionId: last.sessionId }, f) : undefined;
-    sendJson(res, 200, { sessions: page, ...(nextCursor ? { nextCursor } : {}) });
+    const sessions = page.map((r) => {
+        const tempo = sessionTempoOfRunStatus(r.lastStatus);
+        return tempo === undefined ? r : { ...r, tempo };
+    });
+    sendJson(res, 200, { sessions, ...(nextCursor ? { nextCursor } : {}) });
 }
 export const SESSIONS_LIST_ROUTES = [
     { id: "sessions-list", path: "/v1/sessions", methods: ["GET"] },

package/dist/http/routes/sessions.js

@@ -5,6 +5,7 @@ import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -741,25 +742,26 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.invalid_json", "invalid JSON body");
                 return;
             }
-            if (typeof body.rules !== "object" || body.rules === null || Array.isArray(body.rules)) {
-                sendError(res, 400, "request.body_shape", "rules must be a SessionPermissionRules object");
-                return;
+            const read = readSessionPermissionRules(body.rules);
+            if (read.problem !== undefined) {
+                switch (read.problem.kind) {
+                    case "not-an-object":
+                        sendError(res, 400, "request.body_shape", describeSessionPermissionRulesProblem(read.problem));
+                        return;
+                    case "field-not-string-array":
+                        sendError(res, 400, "request.field_invalid", describeSessionPermissionRulesProblem(read.problem));
+                        return;
+                    default: {
+                        const unhandled = read.problem;
+                        throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+                    }
+                }
             }
             if (body.expectedRev !== undefined && (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0)) {
                 sendError(res, 400, "request.field_invalid", "expectedRev must be a non-negative integer");
                 return;
             }
-            const raw = body.rules;
-            const rules = {};
-            for (const f of ["toolAllow", "toolDeny", "allowDirs", "commandAllow", "commandDeny"]) {
-                if (raw[f] === undefined)
-                    continue;
-                if (!Array.isArray(raw[f]) || !raw[f].every((x) => typeof x === "string")) {
-                    sendError(res, 400, "request.field_invalid", `${f} must be an array of strings`);
-                    return;
-                }
-                rules[f] = raw[f];
-            }
+            const rules = read.rules;
             try {
                 const stored = await store.putRules(sessionId, target, rules, { ...(typeof body.expectedRev === "number" ? { expectedRev: body.expectedRev } : {}), operator });
                 sendJson(res, 200, { rules: stored });

package/dist/http/server.d.ts

@@ -163,6 +163,18 @@ export interface ServiceStoreDeps {
      *  `task_run` runs ledger. When it carries `listSessions`, GET /v1/sessions sources sessions from the session
      *  store (task_run only joins for run preview); `fork`/`deleteSession` enable the fork/delete routes. */
     sessionStorage?: OwnerAwareSessionStore;
+    /**
+     * [ref] —— 跨会话车道的**发现席**(core `RunnerDeps.peerDirectory`),与 `RunnerDeps` 侧**同一个对象**
+     * (`boot/stage-10-http-server.ts` 直接递 `runnerDeps.peerDirectory`)。
+     *
+     * 🔴 HTTP 面**今天不读它的内容**:它在这里的唯一作用是让 `GET /v1/capabilities.peerLane` 那一位
+     * 「说 yes ⟺ 车道真的挂上了」成为**同一个值**的读取,而不是把那条三合取的装配谓词在路由里**重写一遍**
+     * (重写的那一份必然漂 —— 本仓能力位族的既有病,见 `routes/capabilities.ts` 里 `agentRoster` 的同款注)。
+     * ⚠️ 精确说法是**值** iff,不是键 present-iff:那一位与同族的 `sessionList` 一样是 `Boolean(...)`,
+     * 本席缺席时键仍在、值为 `false`(`test/capabilities-http.test.ts` 的桩部署那一格逐字钉着它)。
+     * 「键缺席」只发生在**老版本 worker** 上,那是版本事实,不是本部署的车道事实。
+     */
+    peerDirectory?: import("@sema-agent/core").PeerDirectory;
     /** S8 workflow-run store ([ref]/98): enables GET /v1/workflows (list) + /v1/workflows/:id (detail).
      *  Set when SELF_ORCHESTRATION_ENABLED. Live progress (/v1/workflows/:id/stream) is in-process
      *  (subscribeWorkflow) and works whenever self-orchestration is on, store or not. Runs are owner-gated by

package/dist/http/wire-types.d.ts

@@ -264,6 +264,18 @@ export interface TaskRequestBody {
      *  it takes the same single-user gate as backgroundShell/hooks (multi-tenant warns + ignores; advertised via
      *  capabilities.retainBackgroundProcesses). Boolean fail-loud at submit; only `true` rides the spec. */
     retainBackgroundProcesses?: boolean;
+    /** S-493(core 7.8.0 [ref] `TaskSpec.excludeAllTools`,cli L-207 / 板 [ref]): **整只工具面卸载**
+     *  —— 调用方工具、脚手架、手、MCP、skills 一个都不挂,模型这一 run 里没有任何工具可调、终局是纯文本。
+     *
+     *  🔴 **与 {@link excludeTools} 是两种语义,刻意不折叠**:`"*"` 是一个合法的调用方工具名,所以「卸全部」
+     *  不能写成一条通配规则(那会把「卸全部」与「卸一只叫 `*` 的工具」塌成一件事)。两键同带 ⇒ 各自生效
+     *  (全卸之后名单里那几只本来也不在,不矛盾、不拒)。
+     *  只 literal `true` 上 spec(`false` / 缺席 = 名册照旧,不挂键保持 byte-compat —— 挂一个 `false` 上去
+     *  等于替引擎重申了一次它自己的缺省);非 boolean 由 HTTP 门 400 `request.field_invalid`,resume 重放
+     *  defensive DROP。per-run 工具面**收窄**无跨租户面 ⇒ 无租户门(`excludeTools` 同姿势)。
+     *  探测:本键在不在受理面由**键闭集**自己回答 —— 没接线的 server 版本对它 400 `request.body_shape`
+     *  并逐字列名,所以**不加能力位**(一个键一条探测路,不长第二条)。 */
+    excludeAllTools?: boolean;
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
      *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
     excludeTools?: string[];

package/dist/main.js

@@ -1,4 +1,5 @@
 import { createLogger } from "./observability/logger.js";
+import { buildFatalErrorText } from "./boot/fatal-exit.js";
 import { runStage01 } from "./boot/stage-01-config.js";
 import { runStage02 } from "./boot/stage-02-registry-pull.js";
 import { runStage03 } from "./boot/stage-03-store-backend.js";
@@ -22,7 +23,7 @@ async function main() {
     await runStage10(s09);
 }
 void main().catch((err) => {
-    createLogger().error("fatal", { err: String(err) });
+    createLogger().error("fatal", { err: buildFatalErrorText(err) });
     process.exit(1);
 });
 //# sourceMappingURL=main.js.map

package/dist/model-route-url.d.ts

@@ -3,6 +3,14 @@ export declare const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
 /** 同族第二码(S-483 座⑨):这一位根本不是一个层级式绝对 URL。三根键共用一码,与上面那只同纪律
  *  (码按**规则**命名,不按键名 —— 键名已经逐字在拒因文案里点过了)。 */
 export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
+/**
+ * 🔴 **第三条臂的机读码(S-514;core 7.24.2 / [ref] 提货)——请求根带 `#fragment`**。
+ *
+ * 为什么与前两条各自一码:运维要按码行动,而三条臂的**出路不同**(补全 URL / 把凭据搬去旋钮 / 删掉 `#`
+ * 之后的一切)。`fetch` **从不把 fragment 发上线**,所以这一形此前是**静默**打根自己的路径、端点后缀整段
+ * 落进被丢弃的那一半 —— 请求发得出去、也可能 200,只是打错了地方而一个字不说。
+ */
+export declare const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
 /**
  * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— **这三根键的唯一判官**。
  *