@sema-agent/server 7.89.0 → 7.91.1

package/dist/plugins/memory-embedder.d.ts

@@ -26,12 +26,6 @@ export interface OpenAiCompatEmbedderOptions extends MemoryEmbedderConfig {
  * URL 合法性门,只在运行期炸(而运行期的炸法就是上面那条「写入失败/检索退档」的静默病)。
  */
 export declare function embeddingsUrl(endpoint: string): string;
-/**
- * 诊断面用的**脱敏** URL(codex 复审 F4,已核真):端点里可能带 userinfo(`https://user:pass@h/v1`)
- * 或把凭据放 query(Azure 的 `api-key=`),而错误文本会进日志、进 PatchReport 的 conflict reason。
- * 主机与路径保留(诊断价值全在这里),userinfo 抹掉、query 值一律换成 `***`(键名保留,便于认形)。
- */
-export declare function redactEndpointForLog(raw: string): string;
 /** 造一个 OpenAI 兼容的 `PgEmbedder`(工厂命名律:返回带行为的对象 ⇒ `create*`)。 */
 export declare function createOpenAiCompatEmbedder(opts: OpenAiCompatEmbedderOptions): PgEmbedder;
 /**

package/dist/plugins/memory-embedder.js

@@ -1,13 +1,17 @@
+import { joinRequestUrl } from "@sema-agent/core";
 import { z } from "zod";
+import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "../trace/redact.js";
 const EmbeddingsResponse = z.object({
     data: z.array(z.object({ embedding: z.array(z.number()) })).min(1),
 });
 export function embeddingsUrl(endpoint) {
-    const u = new URL(endpoint);
-    u.hash = "";
-    const path = u.pathname.replace(/\/+$/, "");
-    u.pathname = decodeUnreservedEscapes(path).endsWith("/embeddings") ? path : `${path}/embeddings`;
-    return u.toString();
+    const path = URL.canParse(endpoint) ? new URL(endpoint).pathname.replace(/\/+$/, "") : "";
+    try {
+        return joinRequestUrl(endpoint, decodeUnreservedEscapes(path).endsWith("/embeddings") ? "" : "/embeddings");
+    }
+    catch (e) {
+        throw new Error(buildDisplaySafeRefusal(e instanceof Error ? e.message : String(e), [endpoint]), { cause: undefined });
+    }
 }
 function decodeUnreservedEscapes(s) {
     return s.replace(/%([0-9A-Fa-f]{2})/g, (whole, hex) => {
@@ -15,16 +19,6 @@ function decodeUnreservedEscapes(s) {
         return /[A-Za-z0-9\-._~]/.test(c) ? c : whole;
     });
 }
-export function redactEndpointForLog(raw) {
-    if (!URL.canParse(raw))
-        return "<invalid-url>";
-    const u = new URL(raw);
-    u.username = "";
-    u.password = "";
-    for (const k of [...u.searchParams.keys()])
-        u.searchParams.set(k, "***");
-    return u.toString();
-}
 function credentialsInQuery(endpoint) {
     if (!URL.canParse(endpoint))
         return [];
@@ -32,7 +26,7 @@ function credentialsInQuery(endpoint) {
 }
 export function createOpenAiCompatEmbedder(opts) {
     const url = embeddingsUrl(opts.endpoint);
-    const shownUrl = redactEndpointForLog(url);
+    const shownUrl = buildDisplaySafeUrl(url);
     const fetchImpl = opts.fetchImpl ?? fetch;
     const { model, dimensions, timeoutMs, apiKey, onFailure } = opts;
     const secrets = [...(apiKey !== undefined ? [apiKey] : []), ...credentialsInQuery(opts.endpoint)];

package/dist/plugins/store-contracts.d.ts

@@ -14,7 +14,7 @@
  *  - The TiDB adapters re-export these names for back-compat (the historical import surface), but new
  *    code should import from this file.
  */
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
+import type { PeerSessionTempo, TaskResult, TaskStatus } from "@sema-agent/core";
 /**
  * **File 店族的 boot 期拒启基类**(S-384;把 `RunStoreStrictHydrateError` 的那条论证升成一条族规)。
  *
@@ -240,6 +240,41 @@ export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): bo
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 会话的**活动词**(core `PeerSessionTempo`)——「这条会话现在在忙还是闲」的**唯一**一张表([ref])。
+ *
+ * 🔴 为什么键是 {@link RunStatusClass} 而不是状态词本身:那张状态词表(`RUN_STATUS_CLASS`)已经是这条
+ * 车道上唯一的词表属主,它的双向编译钉(core 加词 / 删词当场红)是本表白拿的。按状态词再写一张表
+ * 等于给同一族词开第二个写者 —— 正是那张表顶注里 `blocked` 长出两个互斥读法的成因。
+ *
+ * 🔴 两处读、一处定义:core 的 peer 目录席(`src/peer-directory.ts` 的 `PeerSessionRecord.tempo`)与
+ * `GET /v1/sessions` 列表行的 `tempo` 列读的是**同一次调用**的结果 —— 同一条会话在两个面上不可能给出
+ * 两个不同的忙闲。
+ *
+ * 🔴 **未知词 / 无读数 ⇒ 词缺席(`undefined`),不是 `idle`**(诚实缺席,不是静默兜底):
+ *  · `lastStatus === ""` 有两个真来源 ——(a)SQL 双生:这条会话**还没有任何 run**;(b)local 文件车道:
+ *    该 lister **结构上说不出** run 状态(`local-session-store.ts:465` 自陈的诚实降级 `lastStatus: ""`)。
+ *    两者都不是「我知道它闲着」,所以都不许铸出 `idle` 这个断言;
+ *  · 读不懂的词(滚动升级里新副本写入的新状态词经裸 cast 读到本进程)同判 —— 与
+ *    {@link isTerminalRunStatus} 族的保守方向一致。
+ *  · **缺席怎么渲染是 core 的辖域,本仓一个字都不复述**(S-514-JU:此处原写着「core 对缺席渲染成 `idle`」
+ *    并抄了当时 `list-agents-tool.js:58` 的旧三元 —— core 7.24.0 [ref] 把那一臂改成了一张 own-key 表 +
+ *    `unknown` 兜底,于是那句复述当天就成了假话,而它在本仓被抄了六处)。本表只负责**铸不铸键**;
+ *    渲染词由**跑真 core 的黑盒**钉住(`test/peer-lane-e2e.test.ts` 的 G1 格),core 哪天再改那张表,
+ *    红的是那一格而不是一句注释。承重的不变量只有一条,且它与渲染词无关:**缺席绝不铸 `dead`** ——
+ *    `liveness` 才是 core 会拿来**整行隐藏**的那一位(7.24.2 dist 的 `list-agents-tool.js:60/62`),而任何 tempo 词
+ *    (含缺席)都照样列出。
+ */
+export declare const SESSION_TEMPO_BY_RUN_CLASS: {
+    readonly live: "active";
+    readonly parked: "blocked";
+    readonly succeeded: "idle";
+    readonly unsuccessful: "idle";
+};
+/** {@link SESSION_TEMPO_BY_RUN_CLASS} 的查表面 —— 入参是**最近一条 run 的状态词**({@link SessionSummary.lastStatus},
+ *  开集 `string`:它来自无约束的 SQL 文本列 / 诚实降级的空串,收成闭集等于在签名上撒谎)。
+ *  返回词缺席 ⇒ 调用方**不铸键**(不是铸 `idle`),理由逐字见上表头注。 */
+export declare function sessionTempoOfRunStatus(lastStatus: string): PeerSessionTempo | undefined;
 /**
  * 「**证得出**这条 run 活在别的副本上」——「他副本」那一句话的**唯一判据**(S-381 收编;S-430 迁居)。
  *

package/dist/plugins/store-contracts.js

@@ -23,6 +23,16 @@ export function isUnsuccessfulRunStatus(status) {
 export function isParkedRunStatus(status) {
     return runStatusClassOf(status) === "parked";
 }
+export const SESSION_TEMPO_BY_RUN_CLASS = {
+    live: "active",
+    parked: "blocked",
+    succeeded: "idle",
+    unsuccessful: "idle",
+};
+export function sessionTempoOfRunStatus(lastStatus) {
+    const cls = runStatusClassOf(lastStatus);
+    return cls === undefined ? undefined : SESSION_TEMPO_BY_RUN_CLASS[cls];
+}
 export function runProvenElsewhere(run, thisInstanceId) {
     return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
 }

package/dist/request-key-closure.js

@@ -20,7 +20,8 @@ export function keyClosureClause(names, label) {
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
     "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
-    "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork", "excludeTools",
+    "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
+    "excludeAllTools", "excludeTools",
     "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",

package/dist/rules-consent.d.ts

@@ -1,3 +1,4 @@
+import { type DirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
@@ -155,7 +156,12 @@ export interface LocalImportRuleKey {
  *
  * 🔴 闭集而不是自由文本:客户端要按拒因分流(「这条是你本机的数据坏了」vs「这条规则本身不合法」是
  * 两句不同的话),而自由文本只能被展示、不能被分支。`detail` 才是给人看的那一半。
- */
+ *
+ * 🔴 S-511 起**两条腿共用这一张表**(导入面的逐行预览 + 单步写口的拒):它们判的是同一件事,而判据
+ * 本身就是同一个函数({@link screenLocalImportRow})。给写口另起一张同形的表,就是给同一个问题立第二个
+ * 说话人 —— 漂的表现会是「同一条规则在一条腿上收、在另一条腿上拒」。写口的**方向**判据不在这张表里:
+ * 它在端点上先判、有自己的整句文案,而且判完就把类型收窄掉(`permission-rule-vocab.ts` 的
+ * `DIRECT_RULE_WRITE_ADMITS`)⇒ 放宽态根本到不了本表所服务的那段代码。 */
 export type LocalImportRefusalCode = 
 /** scope 串读不出形(既不是 `global` 也不是 `project:<非空 root>`)。 */
 "scope_unreadable"
@@ -501,6 +507,22 @@ export declare function parseRuleScope(text: string): DurableRuleScope | undefin
 /** 一条规则在 wire 上的行 = 一个逻辑 (rule, scope) 对([ref] v2 §6 F5)。
  *  `adds` **如实上 wire**、不折叠成单值:同一条规则可以被批准过多次(不同 dot、不同来源、不同时刻),
  *  折成「一个 addedAt」会让「这条规则是我导入的还是我点过卡的」在治理面上不可分。 */
+/**
+ * 一条 wire 行与一份身份三元组是不是**同一条规则**。
+ *
+ * 🔴 **三元组,不是 `(rule, scope)` 二元组**(异源复核 [medium],验真后修):core 的 `sameRuleIdentity`
+ * 头注逐字 ——「a comparison that forgot the behavior member would let a delete aimed at an allow take the
+ * same-text deny」。漏掉 behavior 的比较在 wire 上的表现不是「删错行」,是**报错行的死活**:撤一条从来
+ * 没有过的 `allow` 会因为看见同文本的兄弟 `deny` 而答 `stillLive: true`,那句话说的是另一条规则。
+ *
+ * 凡「这份清单里有没有这条规则」一律走这一只(撤销口的存活回读 / 单步写口的写前问与写后读回)——
+ * 同一个问题有两个说话人,迟早会给两个答案。
+ */
+export declare function sameWireRuleIdentity(row: PersistedRuleWireRow, identity: {
+    behavior: RuleBehavior;
+    rule: string;
+    scope: string;
+}): boolean;
 export interface PersistedRuleWireRow {
     /** core 7.9.0([ref])—— 这一行是哪一态的规则(`deny` / `ask` / `allow`)。**身份的一格**:
      *  规则的身份是 (behavior, text, scope) 三元组,同文本不同态是两条不同的行(core `sameRuleIdentity`),
@@ -557,6 +579,37 @@ export interface PersistedRuleListing {
  * 不可分。判别式联合是唯一诚实的形。
  */
 export type RuleBucketRef = string | RuleOwner;
+/**
+ * S-511 —— 单步写的结果(闭集三臂)。
+ *
+ * 🔴 三臂**刻意不塌成布尔**:「落了」「早就有了」「不知道落没落」对调用方是三种不同的处置,而把第三种
+ * 折进前两种里的任一边都是编一个结论(猜"成了"会谎报一次没发生的写,猜"没成"会让人以为可以重来)。
+ * 与导入面的成员级四态({@link LocalImportMemberOutcome})同一条纪律,词更少是因为本口只有一行。
+ */
+export type RuleWritten = 
+/** `persisted` = 这一次**真的往店里写了**;`no-op` = 这条身份**此前就站在店里**,本次调用**一个字都没写**
+ *  (幂等重写)。两支都带 `row` —— 它是**从店里读出来的**那一行,不是我方按入参拼出来的回声。
+ *
+ *  🔴 两个词的判别位是「**这次调用有没有写**」,不是 core 的 `deduped`(codex 对抗复审 F1,验真后修)。
+ *  core 的 `deduped` 只说「等价规则此前已站」,它**仍然落了一枚新的 dot**(契约逐字:`deduped` counts
+ *  as LANDED;亲读 dist 的成员循环:`res.dot` 无条件进 members)。把它当 `no-op` 上 wire 是一句假话:
+ *  一个照常重试的客户端会让 `adds` 台账无界增长、桶的 rev 逐次推进(在翻页的治理面全体重列)。 */
+{
+    status: "persisted" | "no-op";
+    rev: number;
+    row: PersistedRuleWireRow;
+}
+/** 裁定性不收(内容判据 / 方向判据)。`detail` 是给人看的那一半,`reason` 是给客户端分流的那一半。 */
+ | {
+    status: "rejected";
+    reason: LocalImportRefusalCode;
+    detail: string;
+}
+/** **不知道落没落**:店在这一条上出了状况。如实编,禁猜(端点侧 503 + 指路 `GET /v1/rules` 对账)。 */
+ | {
+    status: "indeterminate";
+    detail: string;
+};
 export interface RuleConsentLane {
     /** 卡道兑付口:一次 ask 决议携规则确认 ⇒ prepare→confirm→redeem 一气呵成。 */
     persistCardRule(input: {
@@ -608,6 +661,26 @@ export interface RuleConsentLane {
         rule: string;
         scope: RuleScope;
     }): Promise<RemoveResult>;
+    /**
+     * S-511 撤销面写半场的**对偶** —— 一条**收紧**规则(deny/ask)的单步写入,无同意仪式往返。
+     *
+     * 它为什么可以没有仪式,与 `removeRule` 为什么可以没有仪式是**同一条理由**(core
+     * `removePersistedRule` 头注逐字:「a host may narrow on a user's behalf, it may not widen」)。放宽
+     * 方向在类型上就到不了这里:`behavior` 收窄成 {@link DirectWritableRuleBehavior}。
+     *
+     * 🔴 **一行都不自造**:行的 tool/match/command 三格是规则文本的**派生事实**,由 core 的
+     * `parseRuleText` 铸;落店走的是导入面那条**同一条**兑付腿(逐行判据 → core 的记录铸造口 → confirm
+     * → 批兑付),于是本口与导入口对「一条规则能不能进店」永远给同一个答案。
+     *
+     * `principal` 是裸串(与 prepare/redeem 两腿同形);local-owner 桶**不在本口**上 —— 那只桶没有
+     * 「谁在写」这个主体,而本口的授权基础就是已验明的 principal。
+     */
+    writeRule(input: {
+        principal: string;
+        behavior: DirectWritableRuleBehavior;
+        rule: string;
+        scope: DurableRuleScope;
+    }): Promise<RuleWritten>;
 }
 export declare function createRuleConsentLane(stores: RuleConsentStores, opts?: {
     ticketTtlMs?: number;

package/dist/rules-consent.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
 import { MAX_CWD_CHARS } from "./task-cwd.js";
+import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
 import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
@@ -59,6 +60,9 @@ export function parseRuleScope(text) {
     const root = text.slice("project:".length);
     return root === "" ? undefined : { kind: "project", root };
 }
+export function sameWireRuleIdentity(row, identity) {
+    return row.behavior === identity.behavior && row.rule === identity.rule && row.scope === identity.scope;
+}
 function storeForBucket(provider, ref) {
     if (typeof ref === "string")
         return provider.forPrincipal(ref);
@@ -256,7 +260,7 @@ export function createRuleConsentLane(stores, opts) {
     const monotonic = opts?.monotonic ?? (() => performance.now());
     const sleep = opts?.sleep ?? (async (ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const localImportLogger = createLogger();
-    return {
+    const lane = {
         async persistCardRule(input) {
             let prepared;
             try {
@@ -710,6 +714,82 @@ export function createRuleConsentLane(stores, opts) {
         async removeRule(input) {
             return await removePersistedRule({ behavior: input.behavior, rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });
         },
+        async writeRule(input) {
+            const written = parseRuleText(input.rule, input.behavior);
+            if ("reject" in written)
+                return { status: "rejected", reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
+            if (input.rule !== written.rule.rule) {
+                return {
+                    status: "rejected",
+                    reason: "rule_rejected",
+                    detail: `this rule text is not the spelling the store would hold: send ${JSON.stringify(written.rule.rule)} instead ` +
+                        `— a rule written under one spelling and held under another cannot be listed or revoked by the bytes you sent`,
+                };
+            }
+            const row = {
+                behavior: input.behavior,
+                rule: input.rule,
+                scope: serializeRuleScope(input.scope),
+                tool: written.rule.tool,
+                match: written.rule.match,
+                command: written.rule.command,
+                adds: [],
+            };
+            const rowOf = (rows) => rows.find((r) => sameWireRuleIdentity(r, { behavior: input.behavior, rule: written.rule.rule, scope: row.scope }));
+            const before = await lane.listRules(input.principal);
+            const standing = rowOf(before.rows);
+            if (standing !== undefined)
+                return { status: "no-op", rev: before.rev, row: standing };
+            const prepared = await lane.prepareLocalImport(input.principal, [row]);
+            if (!prepared.ok) {
+                throw new Error(`a single-rule write hit the batch ceiling (${prepared.reason}) — the write door and the batch caps are out of step`);
+            }
+            if (prepared.ticket === undefined) {
+                const member = prepared.preview.members[0];
+                if (member === undefined || member.admitted) {
+                    throw new Error("the rule screening reported neither an admitted row nor a refusal for this write — refusing to guess which of the two happened");
+                }
+                return { status: "rejected", reason: member.reason, detail: member.detail };
+            }
+            const redeemed = await lane.redeemLocalImport(input.principal, prepared.ticket);
+            if (!redeemed.ok) {
+                localImportLogger.warn("direct_rule_write_ticket_refused", {
+                    reason: redeemed.reason,
+                    detail: redeemed.detail,
+                    note: "a self-minted, immediately redeemed ticket was refused — the outcome of this write is not known",
+                });
+                return { status: "indeterminate", detail: `${redeemed.reason}: ${redeemed.detail}` };
+            }
+            const member = redeemed.outcome.members[0];
+            if (member === undefined) {
+                throw new Error("the redemption of a single-rule write came back with no member — refusing to report an outcome nobody computed");
+            }
+            switch (member.outcome) {
+                case "persisted":
+                    break;
+                case "no-op":
+                    break;
+                case "indeterminate":
+                    return { status: "indeterminate", detail: member.detail ?? member.reason ?? "the store did not say whether this rule landed" };
+                case "refused":
+                    return { status: "indeterminate", detail: member.detail ?? "the store refused this rule without a machine-readable reason" };
+                default: {
+                    const unknown = member.outcome;
+                    throw new Error(`unknown single-rule write outcome: ${JSON.stringify(unknown)}`);
+                }
+            }
+            const landed = rowOf((await lane.listRules(input.principal)).rows);
+            if (landed === undefined) {
+                localImportLogger.warn("direct_rule_write_vanished_before_read_back", {
+                    behavior: input.behavior,
+                    scope: row.scope,
+                    note: "the store reported this rule as landed, and it was already gone when the row was read back — a revocation landed in between",
+                });
+                return { status: "indeterminate", detail: "this rule landed and was already gone when it was read back — a revocation landed in between" };
+            }
+            return { status: "persisted", rev: redeemed.outcome.rev, row: landed };
+        },
     };
+    return lane;
 }
 //# sourceMappingURL=rules-consent.js.map

package/dist/runtime-governance.d.ts

@@ -24,12 +24,14 @@
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
 import { type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
-/** A per-command governance rule (registry `runtime.commandPolicy[]`). */
-export type CommandRule = {
-    command: string;
-    decision: "allow" | "ask" | "deny";
-};
+/** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
+export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
+/** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
+ *  契约给 `command` 加一条 refine / 给 `decision` 加一个判词,本仓的型当场跟上(或在下面的
+ *  `RANK` / 穷尽 switch 上编译红),而不是靠人记得把手写联合改一遍。 */
+export type CommandRule = NonNullable<GovernanceConfig["commandPolicy"]>[number];
 /** True when `name` names a DELEGATION tool — the subagent tool(CC-187 canonical `"Agent"`,core
  *  `DEFAULT_SUBAGENT_TOOL_NAME`)。5.0.0 [ref]:折叠面退役,RAW 比对 core 单源常量——旧名("Task")
  *  在 core roster 层响亮 miss,不再需要归一;单源常量本身就防了当年 1.202 改名时裸字符串失配的
@@ -50,8 +52,8 @@ export declare function isDelegationToolName(name: string): boolean;
 export declare function stripDelegationTools<T extends {
     name: string;
 }>(tools: readonly T[]): T[];
-/** The operator autonomy mode (registry `runtime.autonomy`). */
-export type Autonomy = "read-only" | "ask" | "plan" | "auto";
+/** The operator autonomy mode (registry `governance.autonomy`) —— 契约派生(见 {@link AUTONOMY_MODES})。 */
+export type Autonomy = NonNullable<GovernanceConfig["autonomy"]>;
 /** 导出给 `test/coarse-shell-tools-mirror.test.ts` 的同源钉用(见那里的顶注)。 */
 export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
@@ -81,6 +83,13 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * Either way the result only ever ADDS asks/denies — composed onto the baseline via `combinePolicies`
  * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only. (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
+ *
+ * 🔴 **S-496:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
+ * 后果(「域外的 `decision` 穿过本函数的三元链落到 ASK,静默把一条 intended deny 弱化掉」)此前只靠
+ * **调用方记得先校验**挡着 —— 而本函数在 `resolve-spec` 里是逐请求现调的,`config.commandPolicy` 的来路
+ * (center hot apply / 本地 `config.d/governance.json` / LKG / 测试直塞)不止一条。现在闭集在本函数**内部**
+ * 收口:`VALID_DECISIONS` 之外的值一律折最严的 `deny`(fail-closed,[ref] 的运行期 miss 臂,下方自陈),
+ * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
 export declare function compileCommandPolicy(rules: CommandRule[] | undefined): ToolPolicy | undefined;
 /**

package/dist/runtime-governance.js

@@ -1,7 +1,10 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
-import { SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
+import { GovernanceConfig, SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { operatorAsk } from "./operator-ask.js";
+const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
+const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
+export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
 export function isDelegationToolName(name) {
     return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
@@ -30,7 +33,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     };
 }
 const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
-const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);
+function isCommandDecision(raw) {
+    return typeof raw === "string" && COMMAND_DECISIONS.includes(raw);
+}
 export function validateCommandRules(rules) {
     const errors = [];
     if (!Array.isArray(rules))
@@ -45,8 +50,8 @@ export function validateCommandRules(rules) {
             errors.push(`commandPolicy command "${String(command)}" is not a bare argv[0] name — core matches the EXACT command name (no glob/path/operators). ` +
                 `Use e.g. "git" not "git*"; to gate sub-commands or pipes, deny the interpreter ("sh"/"bash") + rely on the sandbox.`);
         }
-        if (typeof decision !== "string" || !VALID_DECISIONS.has(decision)) {
-            errors.push(`commandPolicy command "${String(command)}" has invalid decision "${String(decision)}" — must be one of allow | ask | deny`);
+        if (!isCommandDecision(decision)) {
+            errors.push(`commandPolicy command "${String(command)}" has invalid decision "${String(decision)}" — must be one of ${COMMAND_DECISIONS.join(" | ")}`);
         }
     }
     return errors;
@@ -57,15 +62,30 @@ export function compileCommandPolicy(rules) {
     const RANK = { deny: 3, ask: 2, allow: 1 };
     const strictest = new Map();
     for (const r of rules) {
+        const decision = isCommandDecision(r.decision) ? r.decision : "deny";
         const prev = strictest.get(r.command);
-        if (prev === undefined || RANK[r.decision] > RANK[prev])
-            strictest.set(r.command, r.decision);
+        if (RANK[decision] > (prev === undefined ? 0 : RANK[prev]))
+            strictest.set(r.command, decision);
     }
     const deny = [];
     const allow = [];
     const ask = [];
     for (const [command, decision] of strictest) {
-        (decision === "deny" ? deny : decision === "allow" ? allow : ask).push(command);
+        switch (decision) {
+            case "deny":
+                deny.push(command);
+                break;
+            case "allow":
+                allow.push(command);
+                break;
+            case "ask":
+                ask.push(command);
+                break;
+            default: {
+                const unhandled = decision;
+                throw new Error(`commandPolicy decision "${String(unhandled)}" has no compilation arm`);
+            }
+        }
     }
     const policies = [];
     if (allow.length > 0) {

package/dist/session-policy-wire.d.ts

@@ -0,0 +1,103 @@
+/**
+ * `SessionPermissionRules` 的 **wire 形读者** —— 两条写入腿(`PUT /v1/sessions/:id/policy` 与
+ * `POST /v1/sessions/:id/sync/import` 的 `policy` 面)**唯一**的形判据。
+ *
+ * ── 为什么是一只共享读者(S-496 / [ref],取证 P4 + S-498)───────────────────────────────────────────
+ * 改前两条腿各自为政:
+ *  · PUT 腿在 `http/routes/sessions.ts` 里**手抄**五桶键名(`["toolAllow","toolDeny","allowDirs",
+ *    "commandAllow","commandDeny"] as const`),core 的 `SessionPermissionRules` 加第六桶 ⇒ 那一桶在
+ *    PUT 上被**静默丢**、200 回执却说「已生效」;
+ *  · sync/import 腿(S-498)只判 `Array.isArray(body.policy)` **外层**,逐条记录的 `principal` / `rules`
+ *    一个字节都不校验就裸交 `replayPolicyRecords` → `putRules`。坏形走的是**放宽**方向,亲读 core
+ *    `session-policy-store.js` 两处实现:
+ *      · `normalizeRules` 对每桶做 `[...rules.toolDeny]` ⇒ 一个**字符串** `"rm"` 被展开成 `["r","m"]`,
+ *        本来该拒 `rm` 的 deny 规则变成拒两个不存在的命令名 = 门整条失效;
+ *      · `allowDirs` 走 `.map(...)` ⇒ 字符串上没有 `.map` ⇒ **TypeError → 500**(路由头注 `:300-302`
+ *        自陈「Malformed shape → 400(never a downstream TypeError)」,这一半没守);
+ *      · `loosenReasons` 的每一臂都从 `prior` 出发,**prior 为空时恒回空集** ⇒ tighten-only 门对一条
+ *        全新的会话放行任何内容,坏形因此连「收紧门」这一层都碰不到。
+ * ⇒ 类修:一只读者,键集由 `keyof SessionPermissionRules` **派生**(下方 `RULE_FIELD_PRESENCE` 的
+ * `satisfies Record<keyof SessionPermissionRules, true>`:core 加桶 ⇒ 缺键**编译红**;core 删桶 ⇒
+ * 多键**编译红**),两条腿同调。
+ *
+ * ── 文案也在这里(codex 一轮追加:两条腿各铸一份句子 = 第二份手抄)───────────────────────────────
+ * 初版把 wire 文案留在两个路由各自铸,理由是错误文案冻结门(`test/api-error-text-freeze.test.ts`)锚的是
+ * `src/http/` 桶里的 `sendError` 站点。codex 一轮指出那等于**把同一句话写了两遍**(`sessions.ts` 与
+ * `session-sync.ts` 各一份),这正是本批要消灭的形。改法照本仓既有成案(S-405 / [ref] / [ref] 三处
+ * 「常量锚」):句子收进本文件**单一属主**,冻结职责搬到冻结门的**常量锚格** —— 那一格直接断言这两只
+ * 渲染器对每一种判词的输出字节,且对判词闭集穷尽(加一种判词 ⇒ 那一格编译红)。文案一个字节未改。
+ */
+import type { SessionPermissionRules, SessionRulesRecord } from "@sema-agent/core";
+/** core `SessionPermissionRules` 的桶名全集(派生,不是手抄)。 */
+export declare const SESSION_PERMISSION_RULE_FIELDS: readonly (keyof SessionPermissionRules)[];
+/** 一条规则体的形问题。判词而非文案(见文件头注的「文案属主」一段)。 */
+export type SessionPermissionRulesProblem = 
+/** 整体不是一只普通对象(`null` / 数组 / 标量 / 缺席)。 */
+{
+    kind: "not-an-object";
+}
+/** 某一桶在场但不是 `string[]`(字符串 / 数字 / 混杂数组都在此)。 */
+ | {
+    kind: "field-not-string-array";
+    field: keyof SessionPermissionRules;
+};
+/** {@link readSessionPermissionRules} 的读数:坏形给判词,好形给**已收窄**的规则体(调用方零 cast)。 */
+export type SessionPermissionRulesRead = {
+    problem: SessionPermissionRulesProblem;
+    rules?: undefined;
+} | {
+    problem?: undefined;
+    rules: SessionPermissionRules;
+};
+/**
+ * 读一只 wire 上的 `SessionPermissionRules`:形不对给判词,形对给**只含五桶**的规则体。
+ *
+ * 认识面窄得刻意:**只判形**,不判内容(桶内字符串的 pattern 文法、路径是否可达、tighten-only 是否成立
+ * 都不在这里 —— 前两者归 core 的 rule 文法与 `normalizeRules`,后者归 `putRules` 的收紧门)。
+ * 未知键**照旧忽略**(不是新的拒因):core 的 `normalizeRules` 本来就只搬这五桶,本读者与它同口径。
+ */
+export declare function readSessionPermissionRules(raw: unknown): SessionPermissionRulesRead;
+/** 一条 `SessionRulesRecord` 的形问题(`policy[]` 的元素级;桶级问题原样转载在 `rules` 位)。 */
+export type SessionRulesRecordProblem = 
+/** `policy` 本身不是数组。 */
+{
+    kind: "not-an-array";
+}
+/** 第 `index` 条记录不是一只普通对象。 */
+ | {
+    kind: "record-not-an-object";
+    index: number;
+}
+/** 第 `index` 条的 `principal` 在场但不是字符串(**缺席**才是「会话级默认行」的合法写法 —— 两个店的
+ *  `listBySession` 对无 principal 的行都产 `undefined`,JSON 序列化后即缺席,所以 `null` 不在受理面)。 */
+ | {
+    kind: "principal-not-a-string";
+    index: number;
+}
+/** 第 `index` 条的 `rules` 形不对(转载桶级判词)。 */
+ | {
+    kind: "rules";
+    index: number;
+    problem: SessionPermissionRulesProblem;
+};
+/** {@link readSessionRulesRecords} 的读数。 */
+export type SessionRulesRecordsRead = {
+    problem: SessionRulesRecordProblem;
+    records?: undefined;
+} | {
+    problem?: undefined;
+    records: SessionRulesRecord[];
+};
+/**
+ * 读 sync/import 的 `policy` 面(`SessionRulesRecord[]`)。好形返回**已收窄**的记录数组,坏形给判词。
+ *
+ * `rev`:记录里带的 `rev` 是**导出端的**乐观锁读数,`putRules` 侧一进门就 `stripRev` 掉(`sameRulesContent`
+ * 也比的是去 rev 的字节形),所以它在本读者里只是过境位 —— 非数字即当缺席(不是拒因:一个坏 rev 改变不了
+ * 任何一次写入的结果,拒它只会把合法同步砖死)。
+ */
+export declare function readSessionRulesRecords(raw: unknown): SessionRulesRecordsRead;
+/** 桶级判词 → 人话。闭集穷尽:{@link SessionPermissionRulesProblem} 加一种判词 ⇒ 本 switch 编译红。 */
+export declare function describeSessionPermissionRulesProblem(p: SessionPermissionRulesProblem): string;
+/** `policy[]` 判词 → 人话(sync/import 腿在它前面拼 `policy: `)。闭集穷尽同上。 */
+export declare function describeSessionRulesRecordProblem(p: SessionRulesRecordProblem): string;
+//# sourceMappingURL=session-policy-wire.d.ts.map

package/dist/session-policy-wire.js

@@ -0,0 +1,66 @@
+const RULE_FIELD_PRESENCE = {
+    toolAllow: true,
+    toolDeny: true,
+    allowDirs: true,
+    commandAllow: true,
+    commandDeny: true,
+};
+export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_PRESENCE);
+export function readSessionPermissionRules(raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return { problem: { kind: "not-an-object" } };
+    const src = raw;
+    const rules = {};
+    for (const field of SESSION_PERMISSION_RULE_FIELDS) {
+        const v = src[field];
+        if (v === undefined)
+            continue;
+        if (!Array.isArray(v) || !v.every((x) => typeof x === "string"))
+            return { problem: { kind: "field-not-string-array", field } };
+        rules[field] = v;
+    }
+    return { rules };
+}
+export function readSessionRulesRecords(raw) {
+    if (!Array.isArray(raw))
+        return { problem: { kind: "not-an-array" } };
+    const records = [];
+    for (let index = 0; index < raw.length; index++) {
+        const e = raw[index];
+        if (e === null || typeof e !== "object" || Array.isArray(e))
+            return { problem: { kind: "record-not-an-object", index } };
+        const { principal, rules, rev } = e;
+        if (principal !== undefined && typeof principal !== "string")
+            return { problem: { kind: "principal-not-a-string", index } };
+        const read = readSessionPermissionRules(rules);
+        if (read.problem !== undefined)
+            return { problem: { kind: "rules", index, problem: read.problem } };
+        const innerRev = rules?.rev;
+        const carried = typeof innerRev === "number" ? innerRev : typeof rev === "number" ? rev : 0;
+        records.push({ principal, rules: { ...read.rules, rev: carried } });
+    }
+    return { records };
+}
+export function describeSessionPermissionRulesProblem(p) {
+    switch (p.kind) {
+        case "not-an-object": return "rules must be a SessionPermissionRules object";
+        case "field-not-string-array": return `${p.field} must be an array of strings`;
+        default: {
+            const unhandled = p;
+            throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function describeSessionRulesRecordProblem(p) {
+    switch (p.kind) {
+        case "not-an-array": return "must be an array of {principal, rules} records";
+        case "record-not-an-object": return `[${p.index}] must be a {principal, rules} record`;
+        case "principal-not-a-string": return `[${p.index}].principal must be a string when present (omit it for the session-wide row)`;
+        case "rules": return `[${p.index}].rules: ${describeSessionPermissionRulesProblem(p.problem)}`;
+        default: {
+            const unhandled = p;
+            throw new Error(`unhandled SessionRulesRecord problem: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+//# sourceMappingURL=session-policy-wire.js.map