@sema-agent/settings-schema 14.0.0 → 14.2.0

package/dist/mcp-request-entry.js

@@ -7,8 +7,10 @@
  * 或者自己抄一份 —— 两份判据就是将来漂开的那一份。现在判官在契约包,服务端与壳读同一份,同一条条目在两处同受理 / 同拒、同一个键路径、同一句原因。
  *
  * ## 语义是搬来的,不是重写的
- * 判据与原因句逐字等于消费方 7.131.x 的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
+ * 判据与原因句逐字等于消费方请求腿的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
  * 本模块只答「这一格的形」;拒绝的整句(条目下标、条目名的回显清洗、收尾句)与「拒还是降级」的后果仍是消费方按自己的腿定的 —— 判据一份,后果按腿分。
+ * 与最初搬来时相比有三处收严,都是收到与消费方请求腿同严、不是新语义,消费方改 import 这一份之后不再各留一份旧判据:申报名判官另判**首尾空白**;
+ * `env` / `headers` 只收**纯数据**的「名 → 串」记录(Map / 类实例 / 自有 `__proto__` 成员不收,交出的是副本);两只回显描述器用消费方的回显口径(剥控制与双向字符、截 64 字、引号形)。
  *
  * ## 依赖的引擎事实(镜像 + 漂移门)
  *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
@@ -21,6 +23,7 @@
  * 两份契约对「名」与「url」今天给的判据不同(配置面:名按字符集、url 按 `NON_SECRET_URL`;请求面:名按长度界、url 按 http(s) 前缀),本版刻意不动
  * (语义逐字搬),是一项已知待收的分歧。
  */
+import { echoCallerText } from "./caller-text-echo.js";
 import { MCP_CONTENT_ORIGINS } from "./types.js";
 import { startsWithHttpScheme } from "./url-shape.js";
 // ── 值的种类描述(拒句只说「你写的是什么形」,不回显值:值可能带凭据、可能任意长)──────────────────────────────────────
@@ -50,31 +53,53 @@ export function describeNotStringRecord(v) {
 export function isStringArray(v) {
     return Array.isArray(v) && v.every((a) => typeof a === "string");
 }
-/** 字符串值的对象(空对象合法;数组不是)。 */
+/**
+ * 纯数据的「名 → 串」记录(空对象合法;数组、`Map`、类实例、自有 `__proto__` 成员、有非串成员的对象都不是)。与传输读器读 `env` / `headers` 是**同一个**定义
+ * ({@link readPlainStringRecord}):包内没有第二把更宽的尺。
+ */
 export function isStringRecord(v) {
-    return !!v && typeof v === "object" && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string");
+    const read = readPlainStringRecord(v);
+    return read.ok && !read.reservedMember;
 }
 function isRecord(v) {
     return v !== null && typeof v === "object" && !Array.isArray(v);
 }
+// ── 调用方写的串的回显口径 ──────────────────────────────────────────────────────────────────────────
+/** 句子里点名一个值的写法:{@link echoCallerText} 外加一对双引号;内部的引号与反斜杠逐字(不转义)。 */
+function quotedCallerText(text) {
+    return `"${echoCallerText(text)}"`;
+}
 // ── 申报名的线长界 ──────────────────────────────────────────────────────────────────────────────────
 /** 引擎 `TOOL_WIRE_NAME_MAX_CHARS` 的镜像:一台 MCP server(或 A2A 对端)的申报名会成为线上工具名的命名空间段,引擎对超界名是**拒**(不截断)。 */
 export const TOOL_WIRE_NAME_MAX_CHARS = 128;
 /**
- * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS} 一律不可用。不截断、不规范化 —— 截短一个名字就是**换一个身份**,
- * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。
+ * 首尾带空白吗 —— 「空白」就是 `String.prototype.trim` 剥的那一组(ECMAScript 的 WhiteSpace + LineTerminator:空格 / 制表 / 换行 / NBSP / BOM / 全角空格 / 行段分隔符等)。
+ * {@link isUsableWireName} 与 {@link describeBadWireName} 共读这一个定义,判与说不会各按各的口径。
+ */
+const hasEdgeWhitespace = (v) => v.trim() !== v;
+/**
+ * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS}、**首尾带空白**一律不可用。不截断、不 trim、不规范化 —— 截短或剥掉一个名字就是**换一个身份**,
+ * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。首尾空白 = 坏名(它不是另一个名字:名字是 `mcp__<server>__<tool>` 的身份片,
+ * 带着空白的一端无从与不带的那个对上号);内部空白(`a b`)照旧是合法名,本判官不扩判。
  */
 export function isUsableWireName(v) {
-    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS;
+    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS && !hasEdgeWhitespace(v);
 }
-/** 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或截到 32 字加长度事实 —— 绝不把任意长度的申报串原样回显。 */
+/**
+ * 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或引号形的回显加原因 —— 绝不把任意长度的申报串原样回显。回显口径见 {@link quotedCallerText}
+ * (剥控制与双向字符、截 64 字)。串的原因是:超界 ⇒ `N chars > 128`(N 是送来的原长度,不是剥完的);首尾带空白 ⇒ `leading or trailing whitespace`
+ * (制表 / 换行这类控制空白在回显里被剥掉,所以看得出是空白靠这个种类词,不靠引号里的样子);两件事并存 ⇒ 一句说全(`N chars > 128, leading or trailing whitespace`)。
+ */
 export function describeBadWireName(v) {
     if (typeof v !== "string")
         return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
     if (v.length === 0)
         return "empty";
-    const head = v.length > 32 ? `${JSON.stringify(v.slice(0, 32))}…` : JSON.stringify(v);
-    return `${head} (${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS})`;
+    const head = quotedCallerText(v);
+    const tooLong = `${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS}`;
+    if (!hasEdgeWhitespace(v))
+        return `${head} (${tooLong})`;
+    return `${head} (${v.length > TOOL_WIRE_NAME_MAX_CHARS ? `${tooLong}, ` : ""}leading or trailing whitespace)`;
 }
 // ── 内容出处词 ──────────────────────────────────────────────────────────────────────────────────────
 const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
@@ -85,10 +110,9 @@ const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
 export function isContentOriginWord(v) {
     return typeof v === "string" && CONTENT_ORIGIN_WORDS.has(v);
 }
-/** 坏内容出处值的**可打印**摘要:串 JSON 化、64 字截断加 `…`;非串只说种类。 */
+/** 坏内容出处值的**可打印**摘要:串 ⇒ 引号形的回显({@link quotedCallerText}:剥控制与双向字符、截 64 字);非串只说种类。 */
 export function describeBadContentOrigin(v) {
-    const raw = typeof v === "string" ? JSON.stringify(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
-    return raw.length > 64 ? `${raw.slice(0, 64)}…` : raw;
+    return typeof v === "string" ? quotedCallerText(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
 }
 // ── 两个身份头 ──────────────────────────────────────────────────────────────────────────────────────
 /**
@@ -105,8 +129,11 @@ const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
 /**
  * 请求面 `transport` 的**唯一读器**:读器投影 transport 用它,发送前 / 受理时的判形读它报的 `lost` —— 同一只函数两个消费点,「读器丢了什么」与「门拒什么」不可能分岔。
  *  · 硬坏形(`transport` 不是对象 / `kind` 出闭集 / stdio 缺 `command` / http 的 `url` 不是 http(s))⇒ `ok:false`,`path` 是读器点名的键路径;
- *  · 软坏形(`args` 不是串数组 / `env` `headers` 含非串值 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
+ *  · 软坏形(`args` 不是串数组 / `env` `headers` 不是纯数据的串记录 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
  *    (受理新提交的门据它响亮拒)。`assertionHeader` 不在 `lost` 里:两个身份头的键组合与 `assertionHeader` 的值形由调用方在读之前对原始传输判。
+ *  · `env` / `headers` 只收**纯数据**的记录({@link readPlainStringRecord}):原型必须是 `Object.prototype` 或 `null`(`Map`、`Set`、类实例整张不收),每个自有成员的值都是串;
+ *    交出的是**副本**(不是调用方的对象,改原对象不影响读后的形)。名叫 `__proto__` 的成员(JSON 文本铸得出这个自有键,对象字面量写不出)不进副本、单独记进 `lost`。
+ *    坏形的 `lost` 条目带机读位(见 {@link McpEntryKeyIssue})。
  * url 的拒句不回显值:它常规地带凭据(userinfo)。
  */
 export function readRequestMcpTransport(t) {
@@ -119,15 +146,14 @@ export function readRequestMcpTransport(t) {
             return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
         if (tr.args !== undefined && !isStringArray(tr.args))
             lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
-        if (tr.env !== undefined && !isStringRecord(tr.env))
-            lost.push({ path: "transport.env", reason: `must be an object of string values — got ${describeNotStringRecord(tr.env)}` });
+        const env = readTransportRecord("transport.env", tr.env, lost);
         return {
             ok: true,
             transport: {
                 kind: "stdio",
                 command: tr.command,
                 ...(isStringArray(tr.args) ? { args: tr.args } : {}),
-                ...(isStringRecord(tr.env) ? { env: tr.env } : {}),
+                ...(env !== undefined ? { env } : {}),
             },
             lost,
         };
@@ -137,8 +163,7 @@ export function readRequestMcpTransport(t) {
         if (typeof tr.url !== "string" || !startsWithHttpScheme(tr.url))
             return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
         const ids = readMcpIdentityHeaders(tr);
-        if (tr.headers !== undefined && !isStringRecord(tr.headers))
-            lost.push({ path: "transport.headers", reason: `must be an object of string values — got ${describeNotStringRecord(tr.headers)}` });
+        const headers = readTransportRecord("transport.headers", tr.headers, lost);
         if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
             lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
         }
@@ -147,7 +172,7 @@ export function readRequestMcpTransport(t) {
             transport: {
                 kind: "http",
                 url: tr.url,
-                ...(isStringRecord(tr.headers) ? { headers: tr.headers } : {}),
+                ...(headers !== undefined ? { headers } : {}),
                 ...ids,
             },
             lost,
@@ -155,3 +180,75 @@ export function readRequestMcpTransport(t) {
     }
     return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
 }
+// ── 「名 → 串」记录的读法(`env` / `headers`)────────────────────────────────────────────────────────
+/** 引擎的声明收据不收的成员名(core `mcp-server-spec`:按赋值拷贝它会变成原型):JSON 文本铸得出这个**自有**键,对象字面量写不出。 */
+const RESERVED_MEMBER_NAME = "__proto__";
+const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${RESERVED_MEMBER_NAME}"`;
+/**
+ * 读一份「名 → 串」记录。记录交不交:是对象(不是数组 / `null`),原型是 `Object.prototype` 或 `null`(纯数据:`Map`、`Set`、类实例、建在原型上的记录都不是),
+ * 且每个成员的值都是串。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算 —— 引擎的收据按全部自有属性名读),值按属性描述读:数据属性取值,访问器调一次(访问器或描述 trap 抛了同判为坏)。
+ * 读原型与成员名时代理 trap 抛了 ⇒ 整张不交(读器对调用方递来的任何对象都不抛;`JSON` 存体里不会有代理,这条只落在直接调读器的嵌入方身上)。
+ * 交出去的是副本(原型 `Object.prototype`、成员全可枚举),调用方的对象不被交出去、也不被改;名叫 `__proto__` 的成员不进副本,`reservedMember` 记下它。
+ * 名叫 `__proto__` 而值也坏的成员,句子一次说全两件事(名坏在前、值坏并列):调用方照值改完再撞第二条是两步才改对。
+ */
+function readPlainStringRecord(v) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return { ok: false, fault: "not_plain_record", detail: v === null ? "got null" : Array.isArray(v) ? "got an array" : `got a ${typeof v}` };
+    let proto;
+    let names;
+    try {
+        proto = Object.getPrototypeOf(v);
+        names = Object.getOwnPropertyNames(v);
+    }
+    catch {
+        // 代理的 trap 抛了:读不出原型与成员名的对象不是纯数据。读器不抛出去 —— 重放存量提交体的腿被一次抛错砖死比整键不交糟,而「整键不交」是响亮的(进 `lost`)。
+        return { ok: false, fault: "not_plain_record", detail: "got an object that could not be inspected (a proxy trap threw)" };
+    }
+    if (proto !== Object.prototype && proto !== null) {
+        return { ok: false, fault: "not_plain_record", detail: "got an object that is not plain data (a class instance, a Map, process.env, or a record built on a prototype; copy it into a plain object)" };
+    }
+    const record = {};
+    let reservedMember = false;
+    for (const name of names) {
+        let value;
+        let unreadable = false;
+        try {
+            const d = Object.getOwnPropertyDescriptor(v, name);
+            value = d === undefined ? undefined : Object.hasOwn(d, "value") ? d.value : d.get === undefined ? undefined : Reflect.apply(d.get, v, []);
+        }
+        catch {
+            unreadable = true;
+        }
+        if (unreadable || typeof value !== "string") {
+            const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
+            const reserved = name === RESERVED_MEMBER_NAME;
+            return {
+                ok: false,
+                fault: reserved ? "member_name_reserved" : "member_not_string",
+                member: echoCallerText(name),
+                detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
+            };
+        }
+        if (name === RESERVED_MEMBER_NAME)
+            reservedMember = true;
+        else
+            record[name] = value;
+    }
+    return { ok: true, record, reservedMember };
+}
+/**
+ * `transport.env` / `transport.headers` 的读法(两键同一只):缺席 ⇒ 缺席;记录不交 ⇒ `lost` 一处点名**这个键**(不交的是整张记录;坏在某个成员时句子与 `member` 点名它);
+ * 交 ⇒ 纯数据副本,名叫 `__proto__` 的成员在 `lost` 里单记一处、路径 `<键>.__proto__`。
+ */
+function readTransportRecord(path, raw, lost) {
+    if (raw === undefined)
+        return undefined;
+    const read = readPlainStringRecord(raw);
+    if (!read.ok) {
+        lost.push({ path, reason: `must be a plain object of string values — ${read.detail}`, ...(read.member !== undefined ? { member: read.member } : {}), fault: read.fault });
+        return undefined;
+    }
+    if (read.reservedMember)
+        lost.push({ path: `${path}.${RESERVED_MEMBER_NAME}`, reason: RESERVED_MEMBER_FAULT, member: RESERVED_MEMBER_NAME, fault: "member_name_reserved" });
+    return read.record;
+}

package/dist/mcp-server-policy.d.ts

@@ -5,7 +5,8 @@
  *
  * 判法(锚 = cli main ceff8bc6 `mcpServerPolicyBlock`,它与 CC 2.1.296 名单判法逐支一致;URL 条目按本包 `url-pattern` 两只出口判):
  *  - 拒绝名单**绝对优先**,各层都算(用户可以替自己拒):名字条目 → 命令条目(只对 stdio,整数组逐项相等)→ URL 条目(只对远端,拒绝出口)。
- *  - 允许名单:各层写的拼成一张(CC「Arrays merge across settings sources」);托管层(源表 `SETTINGS_SOURCE_CONTRACT` 档 = `managed` 的源,
+ *  - 允许名单:各层写的拼成一张(CC「Arrays merge across settings sources」);拼接会**放宽**别层的名单,所以只收紧的源(源表 `tightenOnly`,
+ *    仓库里写给另一个工具的设置文件)的允许名单不读 —— 它只贡献拒绝名单;托管层(源表 `SETTINGS_SOURCE_CONTRACT` 档 = `managed` 的源,
  *    经 `settingsSourceContract` 查 —— 调用方不给档)写了 `allowManagedMcpServersOnly: true` ⇒ 只读托管层那一张(别层写的这个开关不生效)。没有一层写 ⇒ 不限;空 ⇒ 一台都不许;
  *    stdio 且名单里有命令条目 ⇒ 必须命中其一;远端且名单里有 URL 条目 ⇒ 必须命中其一(放行出口);否则按名字。
  *  - SDK 型等「不由宿主连接」的条目是否豁免,归调用方(cli 的过滤口豁免、盘上加载器不豁免 —— 那是接线,不是判法)。

package/dist/mcp-server-policy.js

@@ -5,7 +5,8 @@
  *
  * 判法(锚 = cli main ceff8bc6 `mcpServerPolicyBlock`,它与 CC 2.1.296 名单判法逐支一致;URL 条目按本包 `url-pattern` 两只出口判):
  *  - 拒绝名单**绝对优先**,各层都算(用户可以替自己拒):名字条目 → 命令条目(只对 stdio,整数组逐项相等)→ URL 条目(只对远端,拒绝出口)。
- *  - 允许名单:各层写的拼成一张(CC「Arrays merge across settings sources」);托管层(源表 `SETTINGS_SOURCE_CONTRACT` 档 = `managed` 的源,
+ *  - 允许名单:各层写的拼成一张(CC「Arrays merge across settings sources」);拼接会**放宽**别层的名单,所以只收紧的源(源表 `tightenOnly`,
+ *    仓库里写给另一个工具的设置文件)的允许名单不读 —— 它只贡献拒绝名单;托管层(源表 `SETTINGS_SOURCE_CONTRACT` 档 = `managed` 的源,
  *    经 `settingsSourceContract` 查 —— 调用方不给档)写了 `allowManagedMcpServersOnly: true` ⇒ 只读托管层那一张(别层写的这个开关不生效)。没有一层写 ⇒ 不限;空 ⇒ 一台都不许;
  *    stdio 且名单里有命令条目 ⇒ 必须命中其一;远端且名单里有 URL 条目 ⇒ 必须命中其一(放行出口);否则按名字。
  *  - SDK 型等「不由宿主连接」的条目是否豁免,归调用方(cli 的过滤口豁免、盘上加载器不豁免 —— 那是接线,不是判法)。
@@ -60,8 +61,9 @@ function writtenOf(server) {
 }
 /** 名单对这一台的判决:放行 ⇒ `undefined`;拦下 ⇒ 原因(判法见文件头)。 */
 export function mcpServerPolicyVerdict(server, layers) {
-    // 每一层先过源表(闭集外的源在这里响亮抛,哪怕那一层什么都没写);托管 ⇔ 源表档 = managed。
+    // 每一层先过源表(闭集外的源在这里响亮抛,哪怕那一层什么都没写);托管 ⇔ 源表档 = managed;只收紧的源不进允许名单(拼接是放宽)。
     const managed = new Set(layers.filter((l) => settingsSourceContract(l.source).trust === "managed"));
+    const tightenOnly = new Set(layers.filter((l) => settingsSourceContract(l.source).tightenOnly === true));
     const block = (list, rule, sources) => ({
         name: server.name,
         list,
@@ -76,7 +78,7 @@ export function mcpServerPolicyVerdict(server, layers) {
             return block("deniedMcpServers", rule, sources);
     }
     const managedOnly = layers.some((l) => managed.has(l) && l.allowManagedMcpServersOnly === true);
-    const allowLayers = layers.filter((l) => l.allowedMcpServers !== undefined && (!managedOnly || managed.has(l)));
+    const allowLayers = layers.filter((l) => l.allowedMcpServers !== undefined && !tightenOnly.has(l) && (!managedOnly || managed.has(l)));
     if (allowLayers.length === 0)
         return undefined;
     const miss = allowMiss(allowLayers.flatMap((l) => l.allowedMcpServers), server);

package/dist/safety-merge-spec.d.ts

@@ -296,7 +296,7 @@ export declare const SAFETY_MERGE_SPEC: {
         };
         readonly enforcement: "gate";
         readonly fail: "closed";
-        readonly seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only + MANAGED kill-switch";
+        readonly seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only; the kill-switches are the killSwitches row";
     };
     readonly handsReadOnly: {
         readonly mergeShape: "replace";
@@ -534,6 +534,35 @@ export declare const SAFETY_MERGE_SPEC: {
         readonly fail: "closed";
         readonly seam: "http hook URL / header-env allowlists (httpHookUrlVerdict / httpHookEnvVarsAllowed)";
     };
+    readonly killSwitches: {
+        readonly mergeShape: "replace";
+        readonly minTrust: "global";
+        readonly tighten: {
+            readonly rule: "boolStricter";
+            readonly strict: true;
+        };
+        readonly enforcement: "gate";
+        readonly fail: "closed";
+        readonly seam: "permission-mode kill-switches (a switch ON removes bypassPermissions / auto from every layer's mode choice)";
+        readonly members: {
+            readonly disableBypassPermissionsMode: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly disableAutoMode: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+        };
+    };
 };
 export type SafetyMergeCategory = keyof typeof SAFETY_MERGE_SPEC;
 /** The members a category declares, as a CLOSED SET TYPE: `"allow" | "deny" | "ask"` for `permissions`, `never` for

package/dist/safety-merge-spec.js

@@ -166,7 +166,7 @@ export const SAFETY_MERGE_SPEC = {
     // releases every releasable ask; auto hands them to the classifier, which may auto-release ANY benign ask (⊇
     // acceptEdits' edits-only auto-allow); dontAsk = every would-ask → deny (allow rules still pass, tighter than default,
     // looser than plan's handsReadOnly).
-    permissionMode: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["bypassPermissions", "auto", "acceptEdits", "default", "dontAsk", "plan"] }, enforcement: "gate", fail: "closed", seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only + MANAGED kill-switch" },
+    permissionMode: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["bypassPermissions", "auto", "acceptEdits", "default", "dontAsk", "plan"] }, enforcement: "gate", fail: "closed", seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only; the kill-switches are the killSwitches row" },
     handsReadOnly: { mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed", seam: "handsReadOnly" },
     // The engine's shell floor has ONE word, `"always"` (the operator mandates a per-call confirmation for every shell command);
     // the earlier `off` / `classify` are refused at the engine's door, so a layer carrying either is out of vocabulary here too.
@@ -239,6 +239,24 @@ export const SAFETY_MERGE_SPEC = {
     // tightening word with a loosening consequence, the same boundary as sandboxNetwork.failIfUnavailable. Read and judged by
     // ./http-hook-allowlists (`httpHookUrlVerdict` / `httpHookEnvVarsAllowed`); not `sandboxNetwork` (that row is enforcement:"gate").
     httpHookAllowlists: { mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "resolver", fail: "closed", seam: "http hook URL / header-env allowlists (httpHookUrlVerdict / httpHookEnvVarsAllowed)" },
+    // The permission-mode KILL-SWITCHES — `disableBypassPermissionsMode` / `disableAutoMode` (the switch ON removes that mode from every layer's
+    // choice). TIGHTEN-ONLY FROM EVERY LAYER: turning a switch on only narrows, so any settings-file layer may do it (the strict pole is
+    // tighten@"local", the lowest settings-FILE tier — the permissions.deny / ask law); nothing can turn it back off, because the merge is
+    // boolStricter(strict: true) — one layer's ON beats every layer's OFF. CC 2.1.296's restrictive-key table has the same shape
+    // ({path: ["permissions", "disableBypassPermissionsMode"], restrictive: "disable"}; CC spells ON "disable", consumers read it as `true`).
+    // There is no managed-only floor for them: before this row the table had none, a consumer stamped "managed" on them locally, and its judge
+    // (every source counts) and its resolver ("may only be set by managed-level configuration") said opposite things.
+    // VALUE-directional rows (the sandboxNetwork boolean law): the ON pole at "local"; OFF, a non-boolean or a valueless query at the row floor
+    // "global" = the category floor (a pre-members / pre-boolPole consumer withholds BOTH poles from the repository layers — fail-closed).
+    // A switch this row does not declare stays under the category floor "global", whole-key (the 1.1.0 header law).
+    killSwitches: {
+        mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed",
+        seam: "permission-mode kill-switches (a switch ON removes bypassPermissions / auto from every layer's mode choice)",
+        members: {
+            disableBypassPermissionsMode: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            disableAutoMode: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+        },
+    },
 };
 /** Own-property table lookup. The category union is compile-time only; a JavaScript or deserialized caller can
  *  hand in `"__proto__"` / `"constructor"` / `"toString"`, which a bare index resolves through Object.prototype

package/dist/settings-sources.d.ts

@@ -1,41 +1,18 @@
-/**
- * Settings SOURCES and the ONE layer-admission function.
- *
- * `SAFETY_MERGE_SPEC` answers "how trusted must a layer be to set this category / member, and which way does it move the unattended
- * surface" (floor + direction); `trustRank` / `isAtLeast` are the ladder. What was missing is the LAYER side: which settings sources
- * there are, which trust tier each one carries, which of them a repository controls, and what an untrusted workspace does to them —
- * every host kept its own table for that. This file is that table, plus the one function a resolver asks per layer × key.
- *
- * THE RULE (one, no per-key special case): a repository-controllable source (`projectSettings` / `localSettings` — a clone brings or the
- * repository's tooling writes them) in a workspace whose trust reading is not `accepted` admits only the members whose published
- * direction is `"tighten"`; everything it may otherwise set is `trust_withheld`. In every case the source's tier must reach the floor
- * (`isAtLeast(tier, floor)`), checked first — a write below its floor is `below_trust_floor` whether or not the workspace is trusted, which
- * also keeps the loose pole of a value-directional (`boolPole`) member out of an untrusted layer. The `direction` data already says which
- * keys an untrusted repository may still set (restricting needs no trust); there is no per-row workspace column (that would copy a
- * layer fact into every category row).
- *
- * CC 2.1.296 (the reference): trust is one per-session boolean (a non-interactive session counts as trusted, `cli296.js:238351`); keys split
- * into the operator tier `policy / flag / user` and the repository-controllable tier `project / local` ("projectSettings and
- * localSettings are repo-controllable", `:237757`); merge order user < project < local < flag < policy (`:237339`).
- * The local layer sits in the project tier here too: a `.local` settings file is gitignored, so a clone cannot bring one, and whoever can
- * write it can write the project file next to it — "local below project" was never a written rule (it arrived with the first import of the
- * table) and holds no threat model. The category rows (`hooks` / `env` / `mcpServers` / `rulesInstructions` at `minTrust: "project"`) and
- * the ladder numbers are untouched: the change is on the source's tier, not on any row.
- *
- * NOT here (each has its own place): the hooks EXECUTION gate (`declined` ⇒ no hook from any layer runs) is contract text in `./hooks`'
- * header and executes in the client core; the workspace trust RECORD (where "this folder was accepted" is stored) is host state.
- */
 import { type MinTrust, type SafetyMergeCategory, type SafetyMergeMember } from "./safety-merge-spec.js";
 /** The settings sources, in MERGE order (a later source overrides an earlier one where a category's merge shape lets it):
  *  user < project < local < flag < policy. `flagSettings` = settings handed in at launch (`--settings <file|json>`, an SDK embedder's inline
- *  settings); `policySettings` = managed. */
-export declare const SETTINGS_SOURCES: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings"];
+ *  settings); `policySettings` = managed. `foreignProjectSettings` (appended) = the repository's settings files written for another tool; it
+ *  contributes tightening writes only, and every tighten rule merges by "the stricter wins" (order-independent), so its place in the order
+ *  changes no merged value. */
+export declare const SETTINGS_SOURCES: readonly ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings", "foreignProjectSettings"];
 export type SettingsSource = (typeof SETTINGS_SOURCES)[number];
-/** One source's admission facts: its trust tier (a {@link MinTrust} word, compared with `isAtLeast` against a floor) and whether a
- *  repository controls it (⇒ subject to the workspace trust reading). */
+/** One source's admission facts: its trust tier (a {@link MinTrust} word, compared with `isAtLeast` against a floor), whether a
+ *  repository controls it (⇒ subject to the workspace trust reading), and whether it is read in the tighten direction only whatever that
+ *  reading is (`tightenOnly`; absent = false). */
 export interface SettingsSourceContract {
     readonly trust: MinTrust;
     readonly repoControllable: boolean;
+    readonly tightenOnly?: boolean;
 }
 /**
  * The source table. `flagSettings` is in the operator tier (`global`, not repository-controllable) like CC's: settings handed in at launch are
@@ -63,6 +40,11 @@ export declare const SETTINGS_SOURCE_CONTRACT: {
         readonly trust: "managed";
         readonly repoControllable: false;
     };
+    readonly foreignProjectSettings: {
+        readonly trust: "project";
+        readonly repoControllable: true;
+        readonly tightenOnly: true;
+    };
 };
 /**
  * The ONE lookup of {@link SETTINGS_SOURCE_CONTRACT}: a source's tier and whether a repository controls it. Every function in this package
@@ -78,8 +60,9 @@ export declare function settingsSourceContract(source: SettingsSource): Settings
 export declare const WORKSPACE_TRUST_STATES: readonly ["accepted", "declined", "no_trust_step"];
 export type WorkspaceTrustState = (typeof WORKSPACE_TRUST_STATES)[number];
 /** What {@link layerAdmission} answers (closed): `admitted`; `trust_withheld` = would be admitted once the workspace is `accepted`;
- *  `below_trust_floor` = this source can never set it (its tier is below the floor). */
-export declare const LAYER_ADMISSION_VERDICTS: readonly ["admitted", "trust_withheld", "below_trust_floor"];
+ *  `below_trust_floor` = this source can never set it (its tier is below the floor); `tighten_only` = this source is read in the tighten direction
+ *  only, so nothing — no workspace decision — admits this write from it. */
+export declare const LAYER_ADMISSION_VERDICTS: readonly ["admitted", "trust_withheld", "below_trust_floor", "tighten_only"];
 export type LayerAdmissionVerdict = (typeof LAYER_ADMISSION_VERDICTS)[number];
 /**
  * Does a value from `source` for `category` (or one of its declared `member`s; `value` = the candidate value, for a value-directional member)
@@ -89,3 +72,36 @@ export type LayerAdmissionVerdict = (typeof LAYER_ADMISSION_VERDICTS)[number];
  * Unknown source / trust reading / category, a member named on a whole-key category, or an undeclared member ⇒ RangeError (never a fallback).
  */
 export declare function layerAdmission<C extends SafetyMergeCategory>(source: SettingsSource, workspace: WorkspaceTrustState, category: C, member?: SafetyMergeMember<C>, value?: unknown): LayerAdmissionVerdict;
+/**
+ * Is a layer from `source` read in the tighten direction only, given the workspace trust reading? — the ONE answer {@link layerAdmission} and the
+ * disclosure ({@link buildLayerPartsUnreadNotice}) read: a tighten-only source always; a repository-controllable source while the reading is not
+ * `accepted`; an operator source never. Unknown source / reading ⇒ RangeError.
+ */
+export declare function layerReadsTightenOnly(source: SettingsSource, workspace: WorkspaceTrustState): boolean;
+/** The event code of the one-line disclosure of what a tighten-direction-only layer did not read ({@link buildLayerPartsUnreadNotice}). */
+export declare const LAYER_PARTS_UNREAD_CODE = "settings.layer_parts_unread";
+/** The disclosure: plain data — the code, the source, the parts as handed in (machine face, unaltered) and the one line (display face). */
+export interface LayerPartsUnreadNotice {
+    readonly code: typeof LAYER_PARTS_UNREAD_CODE;
+    readonly source: SettingsSource;
+    readonly parts: readonly string[];
+    readonly line: string;
+}
+/**
+ * The ONE line that names what a layer read in the tighten direction only did not read — the consumer emits it under {@link LAYER_PARTS_UNREAD_CODE}.
+ * `file` = how the consumer shows the path of the layer's file it opened (its own display string, bounded by the platform's path limit — stripped of
+ * control and bidi characters but not cut, so the file name at its end survives); `parts` = the setting paths it did not read, as written in the file
+ * (repository-written text: echoed in the bounded caller-text form; dot-joined, document order):
+ * every write `layerAdmission` did not admit, AND every key the consumer does not map to a category at all (not read either). Line form —
+ * `<file>: read for restrictions only (<cause>) — not read: <parts>`, the cause `it is written for another tool` for a tighten-only source and
+ * `this workspace is not trusted` for a repository-controllable one; each part cut at 64 characters after stripping, at most 16 parts named and the rest
+ * counted (`+N more`). No unread part ⇒ `undefined` (nothing to disclose).
+ * A layer that is NOT read in the tighten direction only (an operator source; this product's repository files in an accepted workspace) ⇒ RangeError:
+ * this sentence would be false for it — a caller bug, loud. Unknown source / reading ⇒ RangeError.
+ */
+export declare function buildLayerPartsUnreadNotice(input: {
+    readonly source: SettingsSource;
+    readonly workspace: WorkspaceTrustState;
+    readonly file: string;
+    readonly parts: readonly string[];
+}): LayerPartsUnreadNotice | undefined;

package/dist/settings-sources.js

@@ -6,13 +6,20 @@
  * there are, which trust tier each one carries, which of them a repository controls, and what an untrusted workspace does to them —
  * every host kept its own table for that. This file is that table, plus the one function a resolver asks per layer × key.
  *
- * THE RULE (one, no per-key special case): a repository-controllable source (`projectSettings` / `localSettings` — a clone brings or the
- * repository's tooling writes them) in a workspace whose trust reading is not `accepted` admits only the members whose published
- * direction is `"tighten"`; everything it may otherwise set is `trust_withheld`. In every case the source's tier must reach the floor
- * (`isAtLeast(tier, floor)`), checked first — a write below its floor is `below_trust_floor` whether or not the workspace is trusted, which
- * also keeps the loose pole of a value-directional (`boolPole`) member out of an untrusted layer. The `direction` data already says which
- * keys an untrusted repository may still set (restricting needs no trust); there is no per-row workspace column (that would copy a
- * layer fact into every category row).
+ * THE RULE (one, no per-key special case): a layer that is READ IN THE TIGHTEN DIRECTION ONLY ({@link layerReadsTightenOnly}) admits only the
+ * members whose published direction is `"tighten"`. Which layers those are is one answer, from the source table and the workspace reading:
+ *   · a repository-controllable source of this product (`projectSettings` / `localSettings` — a clone brings or the repository's tooling writes
+ *     them) while the workspace trust reading is not `accepted` — everything else it may set is `trust_withheld` (accepting the workspace admits it);
+ *   · a tighten-only source (`foreignProjectSettings` — the repository's settings files written for ANOTHER tool, today the `.claude/settings.json` /
+ *     `.claude/settings.local.json` a cloned repository carries) whatever the reading — everything else is `tighten_only` (nothing admits it:
+ *     accepting a workspace is consent to this product's files, not to another tool's hooks, env and allow rules).
+ * In every case the source's tier must reach the floor (`isAtLeast(tier, floor)`), checked first — a write below its floor is `below_trust_floor`
+ * whatever the reading, which also keeps the loose pole of a value-directional (`boolPole`) member out of such a layer. The `direction` data
+ * already says which keys such a layer may still set (restricting needs no trust); there is no per-row workspace or source column (that would
+ * copy a layer fact into every category row).
+ *
+ * DISCLOSURE (one event code, {@link LAYER_PARTS_UNREAD_CODE}): a layer read in the tighten direction only names what it did not read in ONE
+ * line ({@link buildLayerPartsUnreadNotice}) — the same line form for both causes above, the cause in parentheses.
  *
  * CC 2.1.296 (the reference): trust is one per-session boolean (a non-interactive session counts as trusted, `cli296.js:238351`); keys split
  * into the operator tier `policy / flag / user` and the repository-controllable tier `project / local` ("projectSettings and
@@ -25,11 +32,15 @@
  * NOT here (each has its own place): the hooks EXECUTION gate (`declined` ⇒ no hook from any layer runs) is contract text in `./hooks`'
  * header and executes in the client core; the workspace trust RECORD (where "this folder was accepted" is stored) is host state.
  */
+import { echoCallerText } from "./caller-text-echo.js";
+import { stripControlAndBidi } from "./control-and-bidi.js";
 import { SAFETY_MERGE_SPEC, isAtLeast, memberAdmission } from "./safety-merge-spec.js";
 /** The settings sources, in MERGE order (a later source overrides an earlier one where a category's merge shape lets it):
  *  user < project < local < flag < policy. `flagSettings` = settings handed in at launch (`--settings <file|json>`, an SDK embedder's inline
- *  settings); `policySettings` = managed. */
-export const SETTINGS_SOURCES = ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings"];
+ *  settings); `policySettings` = managed. `foreignProjectSettings` (appended) = the repository's settings files written for another tool; it
+ *  contributes tightening writes only, and every tighten rule merges by "the stricter wins" (order-independent), so its place in the order
+ *  changes no merged value. */
+export const SETTINGS_SOURCES = ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings", "foreignProjectSettings"];
 /**
  * The source table. `flagSettings` is in the operator tier (`global`, not repository-controllable) like CC's: settings handed in at launch are
  * the launcher's own act — an SDK embedder or a wrapper script — not something a repository brings (a wrapper that turns repository content
@@ -41,6 +52,10 @@ export const SETTINGS_SOURCE_CONTRACT = {
     localSettings: { trust: "project", repoControllable: true },
     flagSettings: { trust: "global", repoControllable: false },
     policySettings: { trust: "managed", repoControllable: false },
+    // The repository's settings files written for another tool (a cloned repository's `.claude/settings.json` / `.claude/settings.local.json`):
+    // project tier and repository-controlled like this product's own project files, and tighten-only — its deny / ask rules, kill-switches ON and
+    // sandbox restrictions are read, its allow rules, hooks, env, MCP servers and the rest never are (see the file header).
+    foreignProjectSettings: { trust: "project", repoControllable: true, tightenOnly: true },
 };
 /**
  * The ONE lookup of {@link SETTINGS_SOURCE_CONTRACT}: a source's tier and whether a repository controls it. Every function in this package
@@ -60,8 +75,9 @@ export function settingsSourceContract(source) {
  */
 export const WORKSPACE_TRUST_STATES = ["accepted", "declined", "no_trust_step"];
 /** What {@link layerAdmission} answers (closed): `admitted`; `trust_withheld` = would be admitted once the workspace is `accepted`;
- *  `below_trust_floor` = this source can never set it (its tier is below the floor). */
-export const LAYER_ADMISSION_VERDICTS = ["admitted", "trust_withheld", "below_trust_floor"];
+ *  `below_trust_floor` = this source can never set it (its tier is below the floor); `tighten_only` = this source is read in the tighten direction
+ *  only, so nothing — no workspace decision — admits this write from it. */
+export const LAYER_ADMISSION_VERDICTS = ["admitted", "trust_withheld", "below_trust_floor", "tighten_only"];
 /**
  * Does a value from `source` for `category` (or one of its declared `member`s; `value` = the candidate value, for a value-directional member)
  * enter the effective settings, given the workspace trust reading? The rule is in the file header; the data is {@link SETTINGS_SOURCE_CONTRACT}
@@ -71,7 +87,7 @@ export const LAYER_ADMISSION_VERDICTS = ["admitted", "trust_withheld", "below_tr
  */
 export function layerAdmission(source, workspace, category, member, value) {
     const layer = settingsSourceContract(source);
-    const trusted = workspaceAccepted(workspace);
+    const tightenOnlyLayer = readsTightenOnly(layer, workspace); // an unknown reading throws here, before any category lookup
     let floor;
     let direction;
     if (member === undefined) {
@@ -87,9 +103,55 @@ export function layerAdmission(source, workspace, category, member, value) {
     }
     if (!isAtLeast(layer.trust, floor))
         return "below_trust_floor";
-    if (layer.repoControllable && !trusted && direction !== "tighten")
-        return "trust_withheld";
-    return "admitted";
+    if (direction === "tighten" || !tightenOnlyLayer)
+        return "admitted";
+    return layer.tightenOnly === true ? "tighten_only" : "trust_withheld";
+}
+/**
+ * Is a layer from `source` read in the tighten direction only, given the workspace trust reading? — the ONE answer {@link layerAdmission} and the
+ * disclosure ({@link buildLayerPartsUnreadNotice}) read: a tighten-only source always; a repository-controllable source while the reading is not
+ * `accepted`; an operator source never. Unknown source / reading ⇒ RangeError.
+ */
+export function layerReadsTightenOnly(source, workspace) {
+    return readsTightenOnly(settingsSourceContract(source), workspace);
+}
+function readsTightenOnly(layer, workspace) {
+    const accepted = workspaceAccepted(workspace); // judged first: an unknown reading throws whatever the source
+    return layer.tightenOnly === true || (layer.repoControllable && !accepted);
+}
+/** The event code of the one-line disclosure of what a tighten-direction-only layer did not read ({@link buildLayerPartsUnreadNotice}). */
+export const LAYER_PARTS_UNREAD_CODE = "settings.layer_parts_unread";
+/** How many unread parts the line names before it counts the rest (`+N more`): a repository's file can carry any number of keys. */
+const NOTICE_PARTS_SHOWN = 16;
+/**
+ * The ONE line that names what a layer read in the tighten direction only did not read — the consumer emits it under {@link LAYER_PARTS_UNREAD_CODE}.
+ * `file` = how the consumer shows the path of the layer's file it opened (its own display string, bounded by the platform's path limit — stripped of
+ * control and bidi characters but not cut, so the file name at its end survives); `parts` = the setting paths it did not read, as written in the file
+ * (repository-written text: echoed in the bounded caller-text form; dot-joined, document order):
+ * every write `layerAdmission` did not admit, AND every key the consumer does not map to a category at all (not read either). Line form —
+ * `<file>: read for restrictions only (<cause>) — not read: <parts>`, the cause `it is written for another tool` for a tighten-only source and
+ * `this workspace is not trusted` for a repository-controllable one; each part cut at 64 characters after stripping, at most 16 parts named and the rest
+ * counted (`+N more`). No unread part ⇒ `undefined` (nothing to disclose).
+ * A layer that is NOT read in the tighten direction only (an operator source; this product's repository files in an accepted workspace) ⇒ RangeError:
+ * this sentence would be false for it — a caller bug, loud. Unknown source / reading ⇒ RangeError.
+ */
+export function buildLayerPartsUnreadNotice(input) {
+    const layer = settingsSourceContract(input.source);
+    if (!readsTightenOnly(layer, input.workspace)) {
+        throw new RangeError(`buildLayerPartsUnreadNotice: source '${input.source}' is not read in the tighten direction only under workspace reading '${input.workspace}' — there is nothing "read for restrictions only" to disclose`);
+    }
+    if (input.parts.length === 0)
+        return undefined;
+    const cause = layer.tightenOnly === true ? "it is written for another tool" : "this workspace is not trusted";
+    const shown = input.parts.slice(0, NOTICE_PARTS_SHOWN).map(echoCallerText);
+    const rest = input.parts.length - shown.length;
+    const named = rest > 0 ? `${shown.join(", ")}, +${rest} more` : shown.join(", ");
+    return {
+        code: LAYER_PARTS_UNREAD_CODE,
+        source: input.source,
+        parts: [...input.parts],
+        line: `${stripControlAndBidi(input.file)}: read for restrictions only (${cause}) — not read: ${named}`,
+    };
 }
 /** `accepted` ⇒ true; `declined` / `no_trust_step` ⇒ false (they differ only at the hooks execution gate, not here); anything else ⇒ RangeError. */
 function workspaceAccepted(workspace) {