@sema-agent/settings-schema 14.5.0 → 14.6.0

package/dist/settings-units.js

@@ -0,0 +1,175 @@
+/**
+ * SETTINGS UNITS (14.6.0) — the settings-document unit table: which keys of a settings file carry a merge contract, where each
+ * sits in the document, which {@link SAFETY_MERGE_SPEC} category it maps into, and how its raw value READS. Every resolver of a
+ * settings file (the shell reads it for each of its sources; a profile loader is a second projection) reads THIS table instead of
+ * keeping a key→category map of its own for these ten units. Unit names are the shell's established ten; the two permission-mode
+ * kill-switches map to their own `killSwitches` member rows (the table has no managed-only floor for them).
+ *
+ * NOT in this table: the two http-hook allowlist keys (`allowedHttpHookUrls` / `httpHookAllowedEnvVars`). They carry a merge contract
+ * too (the `httpHookAllowlists` category of {@link SAFETY_MERGE_SPEC}) but are keyed and read by `./http-hook-allowlists` on its own
+ * (`HTTP_HOOK_ALLOWLIST_KEYS`, `readHttpHookAllowlistLayer`), and read a malformed value differently: there it is `[]` plus a
+ * `malformed` mark (the failure direction is "no hook may run"), while a unit reading answers `unreadable`. Folding the two tables
+ * into one is a design question (which reading is right), not a drive-by — until it is settled a consumer that wants the allowlist
+ * layers reads that module, not this table.
+ *
+ * How a unit is addressed (`reads`):
+ *  · `whole`   — the unit's value is one value under its category: compared by the category's `tighten`
+ *                (the only thing a category's `tighten` answers — safety-merge-spec header);
+ *  · `member`  — the unit IS one declared member of its category (the two kill-switches): compared by that member's comparator;
+ *  · `members` — the unit is an object of declared members (`permissions`, `sandbox`): every question names ONE declared member,
+ *                compared and read by that member's row ({@link memberTighten}; its value class `boolPole` / `list`). The unit's whole
+ *                value and its undeclared members have no comparator and no reading here — asking is a RangeError.
+ *
+ * How a unit READS (`reading`, on every `whole` / `member` row; a `members` unit reads each member by the member row's value class):
+ *  · `stringList`     — an array whose every element is a non-empty string (`[]` reads); a bare string is NOT wrapped into an array;
+ *  · `permissionMode` — a word of the `permissionMode` category's order other than `bypassPermissions`; `"manual"` reads as
+ *                       `"default"` (the alias); `"bypassPermissions"` is `launch_only` — a launch flag, never a settings-file value;
+ *  · `killSwitch`     — a boolean; `"disable"` (CC's spelling of ON) reads as `true`; `false` is the loose pole — a value, not absence;
+ *  · `hooks`          — what the one hooks judge (`classifyHooksConfig`) classifies as `loaded`;
+ *  · `envMap`         — a plain object whose keys are non-empty and whose values are all strings;
+ *  · `nonEmptyString` — a non-empty string;
+ *  and a member's value class: `boolPole` ⇒ a boolean, `list` ⇒ the `stringList` reading.
+ * Everything else is `unreadable` — no default arm. Two laws for every unit: `undefined` and JSON `null` are `unreadable` (absence
+ * is not a value; "an absent landing spot takes the write" is the loader's business, before it calls the reader), and the reader
+ * only recognizes a shape, never rewrites it — an accepted value comes back as the same reference; the only rewrites are the two
+ * spellings above (`"manual"` ⇒ `"default"`, `"disable"` ⇒ `true`).
+ * WHATEVER READS, COMPARES: a reading has two halves — its shape / spelling half (the table above) and, as its last step, the
+ * unit comparator's OWN domain (`tightenVerdict(unitTighten(unit, member), value, value)` must be `equal`). The domain has one
+ * owner, the comparator; a reading only adds what it needs on top (non-empty list elements, the hooks judge, …). So a value the
+ * shape half accepts but the comparator cannot place — a hooks document the hooks judge loads while a key it strips hides data
+ * nested deeper than `MAX_HASH_DEPTH`, or an `undefined` — is `unreadable`, never "read but not comparable".
+ * The env DOCUMENT's literal grammar (boolean words, csv + empty-set sentinel, a "≤ 0 means off" cap) is not here: it belongs to
+ * the engine's env catalog, whose one implementation is the server's.
+ */
+import { classifyHooksConfig } from "./hooks-config.js";
+import { isPlainJsonObject } from "./plain-json-object.js";
+import { SAFETY_MERGE_SPEC, resolveMemberTighten, tightenVerdict } from "./safety-merge-spec.js";
+/** The settings-document units (see the file header). `path` is the unit's place in a settings document. */
+export const SETTINGS_UNITS = {
+    permissions: { path: ["permissions"], category: "permissions", reads: "members" },
+    permissionMode: { path: ["permissions", "defaultMode"], category: "permissionMode", reads: "whole", reading: "permissionMode" },
+    additionalDirectories: { path: ["permissions", "additionalDirectories"], category: "sandboxNetwork", reads: "whole", reading: "stringList" },
+    sandbox: { path: ["sandbox"], category: "sandboxNetwork", reads: "members" },
+    disableBypassPermissionsMode: { path: ["permissions", "disableBypassPermissionsMode"], category: "killSwitches", reads: "member", member: "disableBypassPermissionsMode", reading: "killSwitch" },
+    disableAutoMode: { path: ["permissions", "disableAutoMode"], category: "killSwitches", reads: "member", member: "disableAutoMode", reading: "killSwitch" },
+    hooks: { path: ["hooks"], category: "hooks", reads: "whole", reading: "hooks" },
+    env: { path: ["env"], category: "env", reads: "whole", reading: "envMap" },
+    model: { path: ["model"], category: "model", reads: "whole", reading: "nonEmptyString" },
+    outputStyle: { path: ["outputStyle"], category: "ui", reads: "whole", reading: "nonEmptyString" },
+};
+/** The one place a unit + optional member resolves to what is being asked about — the row and its comparator. Fail-closed
+ *  and loud on every misaddressing: an unknown unit (own-property lookup — `"__proto__"` is unknown, not Object.prototype),
+ *  a `members` unit without a member, a `whole` unit with one, a `member` unit given another one, an undeclared member
+ *  (refused by the member row lookup in {@link resolveMemberTighten}). */
+function unitTarget(unit, member) {
+    if (!Object.hasOwn(SETTINGS_UNITS, unit)) {
+        throw new RangeError(`SETTINGS_UNITS: unknown unit '${unit}' (units: ${Object.keys(SETTINGS_UNITS).join(", ")})`);
+    }
+    const row = SETTINGS_UNITS[unit];
+    const spec = SAFETY_MERGE_SPEC[row.category];
+    switch (row.reads) {
+        case "whole":
+            if (member !== undefined)
+                throw new RangeError(`SETTINGS_UNITS: unit '${unit}' is read whole — it has no member '${member}'`);
+            return { row, rule: spec.tighten };
+        case "member":
+            if (member !== undefined)
+                throw new RangeError(`SETTINGS_UNITS: unit '${unit}' already names its member ('${row.member}' of '${row.category}') — pass no member`);
+            return { row, rule: resolveMemberTighten(spec, row.member, row.category) };
+        case "members":
+            if (member === undefined) {
+                throw new RangeError(`SETTINGS_UNITS: unit '${unit}' is read per declared member of '${row.category}' (members: ${Object.keys(spec.members ?? {}).join(", ")}) — its whole value and its undeclared members have no comparator`);
+            }
+            return { row, rule: resolveMemberTighten(spec, member, row.category) };
+        default: {
+            const unknown = row;
+            throw new RangeError(`SETTINGS_UNITS: unit '${unit}' has an unknown addressing '${String(unknown.reads)}'`);
+        }
+    }
+}
+/** The comparator of one unit — or, for a `members` unit, of one DECLARED member of it: `whole` ⇒ the category's `tighten`;
+ *  `member` ⇒ that member's comparator; `members` ⇒ the named member's comparator ({@link resolveMemberTighten}). Compare two values
+ *  with `tightenVerdict`. A `members` unit without a member (its whole value), an undeclared member (e.g. `sandbox`'s
+ *  `failIfUnavailable`), a `whole` unit given a member, a `member` unit given another one, an unknown unit ⇒ RangeError. */
+export function unitTighten(unit, member) {
+    return unitTarget(unit, member).rule;
+}
+const UNREADABLE = { ok: false, reason: "unreadable" };
+const LAUNCH_ONLY = { ok: false, reason: "launch_only" };
+/** `stringList`: an array whose every element is a non-empty string (a hole reads as `undefined`, so a sparse array is not one). */
+function isNonEmptyStringList(v) {
+    if (!Array.isArray(v))
+        return false;
+    for (let i = 0; i < v.length; i++) {
+        const x = v[i];
+        if (typeof x !== "string" || x.length === 0)
+            return false;
+    }
+    return true;
+}
+/** `envMap`: a plain object (prototype `Object.prototype` or `null`), non-empty keys, string values. */
+function isEnvMap(v) {
+    if (!isPlainJsonObject(v))
+        return false;
+    return Object.keys(v).every((k) => k.length > 0 && typeof v[k] === "string");
+}
+/** What a declared member's value class adds on top of its comparator's domain — read through the comparator
+ *  {@link resolveMemberTighten} derived from the row, so the seat is interpreted in one place: `list` ⇒ setUnion / setNarrower,
+ *  whose domain takes any strings, so the `stringList` reading adds "every element non-empty"; `boolPole` ⇒ boolStricter, whose
+ *  domain IS the boolean — nothing to add. A member comparator is only ever one of those three. */
+function memberShapeReads(unit, rule, value) {
+    switch (rule.rule) {
+        case "boolStricter":
+            return true;
+        case "setUnion":
+        case "setNarrower":
+            return isNonEmptyStringList(value);
+        default:
+            throw new RangeError(`SETTINGS_UNITS: unit '${unit}' resolved to the comparator '${rule.rule}', which no member value class derives`);
+    }
+}
+/** A reading's shape / spelling half (the file header's table): the value the raw input reads as, or a refusal. The domain half
+ *  is the unit comparator's, applied by {@link readSettingsUnit} after this. */
+function shapedReading(unit, row, rule, raw) {
+    if (row.reads === "members")
+        return memberShapeReads(unit, rule, raw) ? { ok: true, value: raw } : UNREADABLE;
+    switch (row.reading) {
+        case "stringList":
+            return isNonEmptyStringList(raw) ? { ok: true, value: raw } : UNREADABLE;
+        case "permissionMode":
+            // the words are the category's order (the comparator's enumRank domain); the reading owns the two spellings around it
+            if (raw === "bypassPermissions")
+                return LAUNCH_ONLY;
+            return { ok: true, value: raw === "manual" ? "default" : raw };
+        case "killSwitch":
+            // CC spells ON "disable"; the boolean itself is the member comparator's domain
+            return { ok: true, value: raw === "disable" ? true : raw };
+        case "hooks":
+            return classifyHooksConfig({ hooks: raw }).outcome === "loaded" ? { ok: true, value: raw } : UNREADABLE;
+        case "envMap":
+            return isEnvMap(raw) ? { ok: true, value: raw } : UNREADABLE;
+        case "nonEmptyString":
+            return typeof raw === "string" && raw.length > 0 ? { ok: true, value: raw } : UNREADABLE;
+        default: {
+            const unknown = row.reading;
+            throw new RangeError(`SETTINGS_UNITS: unit '${unit}' has an unknown reading '${String(unknown)}'`);
+        }
+    }
+}
+/**
+ * Read one unit's raw value out of a settings document (14.6.0) — the settings half of "how an existing value is normalized
+ * before it is compared". The reading of every unit is the file header's table; anything outside it is `unreadable`, and
+ * `undefined` / `null` are `unreadable` for every unit. An accepted value is returned as is (same reference) — the only rewrites
+ * are `"manual"` ⇒ `"default"` (permissionMode) and `"disable"` ⇒ `true` (kill-switches); `"bypassPermissions"` is `launch_only`.
+ * The last step of every reading is the unit comparator's own domain: whatever reads, compares (file header).
+ * Addressing is {@link unitTighten}'s (same RangeErrors: a `members` unit needs a declared member, …).
+ */
+export function readSettingsUnit(unit, raw, member) {
+    const t = unitTarget(unit, member);
+    if (raw === undefined || raw === null)
+        return UNREADABLE;
+    const shaped = shapedReading(unit, t.row, t.rule, raw);
+    if (!shaped.ok)
+        return shaped;
+    return tightenVerdict(t.rule, shaped.value, shaped.value) === "equal" ? shaped : UNREADABLE;
+}

package/dist/types.js

@@ -21,6 +21,7 @@ import { INTEGER } from "./integer.js";
 import { MAX_EXTRA_BODY_DEPTH } from "./hash.js"; // reconcile the extraBody depth cap with the hash cap (R18)
 import { DispatchPolicy, FLEET_GENERATION_ENV, FLEET_SCOPE_ENV } from "./fleet.js"; // WorkerSpec.fleet.dispatch (scheduling framework D3)
 import { isLoopbackAuthHost } from "./loopback.js";
+import { isJsonArray, isPlainJsonObject } from "./plain-json-object.js"; // THE "is this a JSON object" predicate + the total array test
 import { httpUrlFlaws, httpUrlRule } from "./url-shape.js"; // 11.0.0: THE URL shape judge // 11.0.0: the one narrow「本机」predicate (auth relaxation)
 import { secretScanForms } from "./secret-scan.js"; // package-private normalization — the one set of forms both scanners read (not in the barrel)
 import { WEB_ADMIN_ENV } from "./web-admin-env.js"; // the three connection keys the config renderer writes are reserved worker env
@@ -216,62 +217,66 @@ export const NON_SECRET_URL_NO_MIGRATION = createNonSecretUrl(false);
  *  is proven plain JSON (no toJSON/getters), the stored original == what JSON.stringify persists — closing the
  *  non-idempotent-toJSON / accessor-leak / non-plain-container bypasses. Round 2-5 hardening. */
 export function extraBodyUnsafe(v) {
-    const stack = [[v, 0]];
-    const seen = new WeakSet();
-    let budget = 100_000;
-    while (stack.length) {
-        if (budget-- <= 0)
-            return true; // too large to vet → fail-closed
-        const [cur, depth] = stack.pop();
-        if (depth > MAX_EXTRA_BODY_DEPTH)
-            return true; // too deep to hash later — cap = hash cap MINUS the wrapper reserve, since extraBody is always hashed NESTED (R18: a value passing at the raw hash cap would still overflow once wrapped → write fail-open + read hard-DoS)
-        if (cur === null)
-            continue;
-        const t = typeof cur;
-        if (t === "string") {
-            if (containsSecretToken(cur))
-                return true; // tokenized (mid-string secret too) — sibling of URL/coords/mcp. R8
-            continue;
-        }
-        if (t === "number") {
-            if (!Number.isFinite(cur))
-                return true; // Infinity/NaN → JSON null on persist
-            continue;
-        }
-        if (t === "boolean")
-            continue;
-        if (t !== "object")
-            return true; // undefined / function / symbol / bigint
-        if (seen.has(cur))
-            return true; // cycle → reject (would also break stableStringify)
-        seen.add(cur);
-        if (Array.isArray(cur)) {
-            if (cur.length !== Object.keys(cur).length)
-                return true; // sparse array (holes → null on persist)
-            // descriptor walk for arrays too (NOT `for…of`/index access — that would INVOKE an accessor index's
-            // getter, which could throw a secret-bearing message). Reject accessor elements. R11.
+    try {
+        const stack = [[v, 0]];
+        const seen = new WeakSet();
+        let budget = 100_000;
+        while (stack.length) {
+            if (budget-- <= 0)
+                return true; // too large to vet → fail-closed
+            const [cur, depth] = stack.pop();
+            if (depth > MAX_EXTRA_BODY_DEPTH)
+                return true; // too deep to hash later — cap = hash cap MINUS the wrapper reserve, since extraBody is always hashed NESTED (R18: a value passing at the raw hash cap would still overflow once wrapped → write fail-open + read hard-DoS)
+            if (cur === null)
+                continue;
+            const t = typeof cur;
+            if (t === "string") {
+                if (containsSecretToken(cur))
+                    return true; // tokenized (mid-string secret too) — sibling of URL/coords/mcp. R8
+                continue;
+            }
+            if (t === "number") {
+                if (!Number.isFinite(cur))
+                    return true; // Infinity/NaN → JSON null on persist
+                continue;
+            }
+            if (t === "boolean")
+                continue;
+            if (t !== "object")
+                return true; // undefined / function / symbol / bigint
+            if (seen.has(cur))
+                return true; // cycle → reject (would also break stableStringify)
+            seen.add(cur);
+            if (isJsonArray(cur)) {
+                if (cur.length !== Object.keys(cur).length)
+                    return true; // sparse array (holes → null on persist)
+                // descriptor walk for arrays too (NOT `for…of`/index access — that would INVOKE an accessor index's
+                // getter, which could throw a secret-bearing message). Reject accessor elements. R11.
+                for (const [k, desc] of Object.entries(Object.getOwnPropertyDescriptors(cur))) {
+                    if (k === "length")
+                        continue; // the array's own `length` data prop — not an element
+                    if (!Object.hasOwn(desc, "value"))
+                        return true; // accessor element — do NOT invoke
+                    stack.push([desc.value, depth + 1]);
+                }
+                continue;
+            }
+            if (!isPlainJsonObject(cur))
+                return true; // Map/Set/Date/class/toJSON-bearing → not plain
+            // descriptor walk: never read a value via [] (would invoke a getter); reject accessors outright.
             for (const [k, desc] of Object.entries(Object.getOwnPropertyDescriptors(cur))) {
-                if (k === "length")
-                    continue; // the array's own `length` data prop — not an element
-                if (!("value" in desc))
-                    return true; // accessor element — do NOT invoke
+                if (!Object.hasOwn(desc, "value"))
+                    return true; // accessor (get/set) — do NOT invoke
+                if (containsSecretToken(k))
+                    return true; // secret-shaped KEY (tokenized). R8
                 stack.push([desc.value, depth + 1]);
             }
-            continue;
-        }
-        const proto = Object.getPrototypeOf(cur);
-        if (proto !== Object.prototype && proto !== null)
-            return true; // Map/Set/Date/class/toJSON-bearing → not plain
-        // descriptor walk: never read a value via [] (would invoke a getter); reject accessors outright.
-        for (const [k, desc] of Object.entries(Object.getOwnPropertyDescriptors(cur))) {
-            if (!("value" in desc))
-                return true; // accessor (get/set) — do NOT invoke
-            if (containsSecretToken(k))
-                return true; // secret-shaped KEY (tokenized). R8
-            stack.push([desc.value, depth + 1]);
         }
+        return false;
+    }
+    catch {
+        return true; // a value the walk cannot read (a proxy that has been revoked, a trap that throws) cannot be vetted ⇒ UNSAFE (fail-closed), never a throw
     }
-    return false;
 }
 /** THE vetting pipeline for every FREE-FORM JSON value that lands in the persisted config — `ModelEntry.extraBody`,
  *  `ModelEntry.compat` and `ModelEntry.headers` share this ONE function (1.10.0; before that it was inline in `extraBody`
@@ -518,8 +523,7 @@ export const ModelEntry = z.object({
         .transform((v, ctx) => {
         if (v === undefined)
             return undefined;
-        const proto = typeof v === "object" && v !== null ? Object.getPrototypeOf(v) : undefined;
-        if (typeof v !== "object" || v === null || Array.isArray(v) || (proto !== Object.prototype && proto !== null)) {
+        if (!isPlainJsonObject(v)) {
             ctx.addIssue({ code: "custom", ...buildQuotedIssue `extraBody must be a plain JSON object` });
             return z.NEVER;
         }

package/dist/url-shape.d.ts

@@ -13,10 +13,16 @@
  *
  * 拒句里值的样子(展示铸点)不在本模块:那是各宿主自己的展示律(server `buildRefusalShownUrl`)。本模块零 import,纯函数,浏览器安全。
  *
- * ## 本模块里的第二个答案(如实,14.0.0)
+ * ## 本模块里的第二个答案(如实,14.0.0 起;14.6.0 把分歧写成读数)
  * 请求面 MCP 传输的 url(任务提交体 `mcpServers[i].transport.url`,`./mcp-request-entry`)今天不走上面的形判官,而是只看前缀
- * ({@link startsWithHttpScheme}):那是消费方请求腿既有的读法,入包时语义逐字冻结。两者对同一个值可以答得不同(空 host、带 userinfo 的
- * url 前缀判收、形判官拒)—— 一项已知待收的分歧;放在这里,是为了让「本包里判 URL 的正则」只有这一个模块。
+ * ({@link startsWithHttpScheme}):那是消费方请求腿既有的读法,入包时语义逐字冻结。两者对同一个串的答案是两张表(读数逐串钉在 `test/request-url-two-answers-14.6.0.test.ts`):
+ *  · **读器收、判官拒** —— 前缀对、WHATWG 解析不了的串:裸 scheme `https://`、host 里有空格、未闭合的 IPv6 字面量、非法端口……读器收下,判官答 `not-http-url`;
+ *  · **判官收、读器拒** —— 不是照字面写全 `http(s)://` 的串:`https:host`、前导空白。WHATWG 会把它们修成合法 URL,读器按字面规则拒;
+ *  · **部件** —— 读器的座位今天不禁 userinfo / query / fragment(全收),判官在禁这些部件的座位上点名它们。
+ * 这是一项**已知待收、收口是收紧所以不走 minor** 的分歧(S-2106):读器收下的是此前能解析出传输的提交体(含重放存量提交体时读它的那一路),把读器收严 = 同一份配置解析出不同结果,发版纪律里是 major,
+ * 不是 minor;而「读器直接换成判官」还会放宽第二张表,更不行。S-2106 的收口形与 `PLUGIN_ORIGIN` 座位(`./types`)同构 —— 读器收 ⟺ `startsWithHttpScheme(url)`(座位自己的「照字面写全」规则)∧
+ * `httpUrlFlaws(url, [座位禁的部件]).length === 0`(形与部件归本判官)—— 只收紧,不放宽;座位禁不禁 userinfo 是同一次 major 里要定的另一格(读器的拒句已写着凭据别放 URL)。
+ * 这个前缀守卫放在这里,是为了让「本包里判 URL 的正则」只有这一个模块。
  */
 /** 座位可以禁掉的部件(闭集;判序 = 本数组序)。 */
 export declare const HTTP_URL_PARTS: readonly ["userinfo", "query", "fragment"];
@@ -35,8 +41,8 @@ export declare function isHierarchicalUrl(raw: string): boolean;
  * 层级式非 http(s) ⇒ `not-http-url` 之后照判部件。返回类型按 `forbid` 收窄:座位没禁的部件不会出现在答案里。
  */
 export declare function httpUrlFlaws<P extends HttpUrlPart>(raw: string, forbid: readonly P[]): ReadonlyArray<"not-http-url" | P>;
-/** 以 `http://` / `https://` 起头(大小写不敏感)—— 一道**语法前缀**守卫,不是形判官:不解析、不看 host / 部件(见头注「第二个答案」)。
- *  唯一读者是请求面 MCP 传输读器(`readRequestMcpTransport`)。 */
+/** 以 `http://` / `https://` 起头(大小写不敏感)—— 一道**语法前缀**守卫,不是形判官:不解析、不看 host / 部件,所以 `https://` 这样的裸 scheme 它也收(见头注「第二个答案」)。
+ *  唯一读者是请求面 MCP 传输读器(`readRequestMcpTransport`);S-2106 收口时它退成那个读器座位的「照字面写全」规则,与形判官合取。 */
 export declare function startsWithHttpScheme(raw: string): boolean;
 /** 一个拒因词的规则句(穷举;新词不补 = 编译红)。句子只说规则,不含值。 */
 export declare function httpUrlRule(flaw: HttpUrlFlaw): string;

package/dist/url-shape.js

@@ -13,10 +13,16 @@
  *
  * 拒句里值的样子(展示铸点)不在本模块:那是各宿主自己的展示律(server `buildRefusalShownUrl`)。本模块零 import,纯函数,浏览器安全。
  *
- * ## 本模块里的第二个答案(如实,14.0.0)
+ * ## 本模块里的第二个答案(如实,14.0.0 起;14.6.0 把分歧写成读数)
  * 请求面 MCP 传输的 url(任务提交体 `mcpServers[i].transport.url`,`./mcp-request-entry`)今天不走上面的形判官,而是只看前缀
- * ({@link startsWithHttpScheme}):那是消费方请求腿既有的读法,入包时语义逐字冻结。两者对同一个值可以答得不同(空 host、带 userinfo 的
- * url 前缀判收、形判官拒)—— 一项已知待收的分歧;放在这里,是为了让「本包里判 URL 的正则」只有这一个模块。
+ * ({@link startsWithHttpScheme}):那是消费方请求腿既有的读法,入包时语义逐字冻结。两者对同一个串的答案是两张表(读数逐串钉在 `test/request-url-two-answers-14.6.0.test.ts`):
+ *  · **读器收、判官拒** —— 前缀对、WHATWG 解析不了的串:裸 scheme `https://`、host 里有空格、未闭合的 IPv6 字面量、非法端口……读器收下,判官答 `not-http-url`;
+ *  · **判官收、读器拒** —— 不是照字面写全 `http(s)://` 的串:`https:host`、前导空白。WHATWG 会把它们修成合法 URL,读器按字面规则拒;
+ *  · **部件** —— 读器的座位今天不禁 userinfo / query / fragment(全收),判官在禁这些部件的座位上点名它们。
+ * 这是一项**已知待收、收口是收紧所以不走 minor** 的分歧(S-2106):读器收下的是此前能解析出传输的提交体(含重放存量提交体时读它的那一路),把读器收严 = 同一份配置解析出不同结果,发版纪律里是 major,
+ * 不是 minor;而「读器直接换成判官」还会放宽第二张表,更不行。S-2106 的收口形与 `PLUGIN_ORIGIN` 座位(`./types`)同构 —— 读器收 ⟺ `startsWithHttpScheme(url)`(座位自己的「照字面写全」规则)∧
+ * `httpUrlFlaws(url, [座位禁的部件]).length === 0`(形与部件归本判官)—— 只收紧,不放宽;座位禁不禁 userinfo 是同一次 major 里要定的另一格(读器的拒句已写着凭据别放 URL)。
+ * 这个前缀守卫放在这里,是为了让「本包里判 URL 的正则」只有这一个模块。
  */
 /** 座位可以禁掉的部件(闭集;判序 = 本数组序)。 */
 export const HTTP_URL_PARTS = ["userinfo", "query", "fragment"];
@@ -51,8 +57,8 @@ export function httpUrlFlaws(raw, forbid) {
     const shape = u.protocol === "http:" || u.protocol === "https:" ? [] : ["not-http-url"];
     return [...shape, ...HTTP_URL_PARTS.filter((p) => forbid.includes(p) && present[p])];
 }
-/** 以 `http://` / `https://` 起头(大小写不敏感)—— 一道**语法前缀**守卫,不是形判官:不解析、不看 host / 部件(见头注「第二个答案」)。
- *  唯一读者是请求面 MCP 传输读器(`readRequestMcpTransport`)。 */
+/** 以 `http://` / `https://` 起头(大小写不敏感)—— 一道**语法前缀**守卫,不是形判官:不解析、不看 host / 部件,所以 `https://` 这样的裸 scheme 它也收(见头注「第二个答案」)。
+ *  唯一读者是请求面 MCP 传输读器(`readRequestMcpTransport`);S-2106 收口时它退成那个读器座位的「照字面写全」规则,与形判官合取。 */
 export function startsWithHttpScheme(raw) {
     return /^https?:\/\//i.test(raw);
 }

package/dist/workers-rows.d.ts

@@ -7,7 +7,8 @@
  * web-admin 的 workers 读口先过本函数:每一只**认得出名字**的 worker 单独过读侧自己的判据(只含这一行的 workers 域读不读得进,
  * `WorkersConfig` —— 与 `parseDomain("workers")` 同一只 schema,不另抄任何规则;判据与拒句拼装在包内私有的 `./worker-row-verdict`,
  * 一次性迁移 SS-M4 判改写后的行调同一只);读不进的那一行扣下(`held`,带原文与拒因),
- * 其余照常进 `doc`。整域读侧仍是最后围栏,只剩两类归它:认不出名字的条目(不是对象 / 没有字符串名字 —— 原样留在 `doc`)与跨行规则
+ * 其余照常进 `doc`。整域读侧仍是最后围栏,只剩两类归它:认不出名字的条目(不是朴素 JSON 对象〔类实例 / `Map` / `Date` 一类,JSON 解析不出来,走到这里只能是程序拼的〕/ 没有字符串名字 —— 原样留在 `doc`;
+ * 非朴素的**坏**行因此不在这里单行扣下,而是交整域 `parseDomain("workers")` 判,整张舰队清单读不出 —— 响亮、fail-closed,只落在非 JSON 值上)与跨行规则
  * (名字 / 路由前缀唯一 —— 两行单独都读得进、合起来才不行,这里不替运维挑留哪一行)。
  *
  * 被扣下的行**不进** `doc`,但随 `held[].original` 逐字带回:`doc` ∪ `held[].original` 覆盖输入的全部 worker。读口不写回 —— 原文留在盘上,

package/dist/workers-rows.js

@@ -7,27 +7,28 @@
  * web-admin 的 workers 读口先过本函数:每一只**认得出名字**的 worker 单独过读侧自己的判据(只含这一行的 workers 域读不读得进,
  * `WorkersConfig` —— 与 `parseDomain("workers")` 同一只 schema,不另抄任何规则;判据与拒句拼装在包内私有的 `./worker-row-verdict`,
  * 一次性迁移 SS-M4 判改写后的行调同一只);读不进的那一行扣下(`held`,带原文与拒因),
- * 其余照常进 `doc`。整域读侧仍是最后围栏,只剩两类归它:认不出名字的条目(不是对象 / 没有字符串名字 —— 原样留在 `doc`)与跨行规则
+ * 其余照常进 `doc`。整域读侧仍是最后围栏,只剩两类归它:认不出名字的条目(不是朴素 JSON 对象〔类实例 / `Map` / `Date` 一类,JSON 解析不出来,走到这里只能是程序拼的〕/ 没有字符串名字 —— 原样留在 `doc`;
+ * 非朴素的**坏**行因此不在这里单行扣下,而是交整域 `parseDomain("workers")` 判,整张舰队清单读不出 —— 响亮、fail-closed,只落在非 JSON 值上)与跨行规则
  * (名字 / 路由前缀唯一 —— 两行单独都读得进、合起来才不行,这里不替运维挑留哪一行)。
  *
  * 被扣下的行**不进** `doc`,但随 `held[].original` 逐字带回:`doc` ∪ `held[].original` 覆盖输入的全部 worker。读口不写回 —— 原文留在盘上,
  * web-admin 在列表里标红点名 `field` / `reason`。拒因只点名字段、不回显值。
  */
 import { outgoingPath, redactSecrets } from "./config-fns.js";
+import { isJsonArray, isPlainJsonObject } from "./plain-json-object.js";
 import { workerRowVerdict } from "./worker-row-verdict.js";
-const isRec = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 /**
  * 逐行读一份 workers 域**原始**文档(`{ workers: [...] }`)。不是这个形 ⇒ 原样返回、零扣下(判形是 `parseDomain` 的事)。
  * 规则见文件头。
  */
 export function readWorkersRows(raw) {
-    if (!isRec(raw) || !Array.isArray(raw.workers))
+    if (!isPlainJsonObject(raw) || !isJsonArray(raw.workers))
         return { doc: raw, held: [] };
     const rows = raw.workers;
     const kept = [];
     const held = [];
     rows.forEach((row, index) => {
-        if (!isRec(row) || typeof row.name !== "string") {
+        if (!isPlainJsonObject(row) || typeof row.name !== "string") {
             kept.push(row); // 认不出名字:整域读侧判
             return;
         }

package/docs/API-SURFACE.md

@@ -4,9 +4,9 @@
 > 每次全量重算并逐名比对 —— 加 / 删 / 改形一个导出而不重生成本档 ⇒ 红。导出面的每次变动因此以本档的 diff 出现在评审里。
 > 形:`value` = 运行期拿得到的值;`type` = 只在类型层;`value+type` = 同名的值与类型(zod schema 与它推出的类型)。
 
-子路径 24 条(资产出口 `./package.json` / `./fleet-paths.json` 不是模块,不列),导出名合计 1351 个(同名在多条子路径上各计一次)。
+子路径 24 条(资产出口 `./package.json` / `./fleet-paths.json` 不是模块,不列),导出名合计 1365 个(同名在多条子路径上各计一次)。
 
-## `.`(671)
+## `.`(680)
 
 - `ABSOLUTE_HOST_PATH_MAX` — value
 - `ACCESS_TOKEN_TTL_SECONDS` — value
@@ -395,6 +395,7 @@
 - `SESSION_MIRROR_ENGINE_URL` — value
 - `SETTINGS_SOURCES` — value
 - `SETTINGS_SOURCE_CONTRACT` — value
+- `SETTINGS_UNITS` — value
 - `SHA256_DIGEST_RE` — value
 - `STALE_HEARTBEAT_MULTIPLIER` — value
 - `STALE_SESSION_RECORD_MS` — value
@@ -442,6 +443,7 @@
 - `SettingSource` — value+type
 - `SettingsSource` — type
 - `SettingsSourceContract` — type
+- `SettingsUnitName` — type
 - `SetupHookInput` — value
 - `Sha256Digest` — value
 - `SiblingResolver` — type
@@ -465,6 +467,7 @@
 - `TCP_PORT` — value
 - `TENANT_SEPARATION_BASES` — value
 - `TENANT_SEPARATION_WORDS` — value
+- `TIGHTEN_VERDICTS` — value
 - `TOKEN_SCOPE_REFUSALS` — value
 - `TOOL_WIRE_NAME_MAX_CHARS` — value
 - `TaskCompletedHookInput` — value
@@ -475,6 +478,7 @@
 - `TierBindings` — value+type
 - `TierGroup` — value+type
 - `TightenRule` — value+type
+- `TightenVerdict` — type
 - `TokenGrantResponse` — value+type
 - `TokenQuota` — value+type
 - `TokenRefreshRequest` — value+type
@@ -601,6 +605,7 @@
 - `mcpServerPolicyVerdict` — value
 - `memberAdmission` — value
 - `memberMinTrust` — value
+- `memberTighten` — value
 - `membersOf` — value
 - `mintScopedToken` — value
 - `narrowAtMention` — value
@@ -631,6 +636,7 @@
 - `readScopedTokenBinding` — value
 - `readServingLeaseRequest` — value
 - `readServingLeaseResponse` — value
+- `readSettingsUnit` — value
 - `readTokenScope` — value
 - `readUiLanguage` — value
 - `readWorkersRows` — value
@@ -645,6 +651,7 @@
 - `resolveCatalogDefaultModel` — value
 - `resolveEffectiveForWorker` — value
 - `resolveMemberAdmission` — value
+- `resolveMemberTighten` — value
 - `resolveTokenScope` — value
 - `retiredDomainSentence` — value
 - `retiredEnvRefusal` — value
@@ -667,9 +674,11 @@
 - `statusRowsToPrune` — value
 - `stopAttributionText` — value
 - `stripControlAndBidi` — value
+- `tightenVerdict` — value
 - `toSkillsManifest` — value
 - `toVerifiedIdentity` — value
 - `trustRank` — value
+- `unitTighten` — value
 - `urlAllowPatternMatches` — value
 - `urlCredentialRule` — value
 - `urlDenyPatternMatches` — value
@@ -1047,7 +1056,7 @@
 - `REMOTE_EXEC_DOCUMENT` — value
 - `RemoteExecSpec` — value+type
 
-## `./safety-merge-spec`(19)
+## `./safety-merge-spec`(24)
 
 - `FailMode` — value+type
 - `MIN_TRUST_WORDS` — value
@@ -1061,12 +1070,17 @@
 - `SafetyMergeCategory` — type
 - `SafetyMergeMember` — type
 - `SpecEnforcement` — value+type
+- `TIGHTEN_VERDICTS` — value
 - `TightenRule` — value+type
+- `TightenVerdict` — type
 - `isAtLeast` — value
 - `memberAdmission` — value
 - `memberMinTrust` — value
+- `memberTighten` — value
 - `membersOf` — value
 - `resolveMemberAdmission` — value
+- `resolveMemberTighten` — value
+- `tightenVerdict` — value
 - `trustRank` — value
 
 ## `./node`(39)

package/llms-full.txt

@@ -1,6 +1,6 @@
 <!--
 llms-full.txt — 自包含全文 · 消费方(使用者)视角 · @sema-agent/settings-schema
-重写日期: 2026-10-23 | 包版本: 14.5.0
+重写日期: 2026-10-24 | 包版本: 14.6.0
 生成方式: 无生成脚本——按当前树 src/*.ts 导出面 + package.json + README/CHANGELOG 手写事实版。
 证据约定: 每条"它怎么工作"的断言附 (文件: 符号) 坐标,刻意不用行号(行号逐版腐烂;符号名由
 typecheck 与 test/package-surface.test.ts、test/docs-hygiene.test.ts 等常驻门钉住)。无证据推断显式标【推断】。
@@ -345,6 +345,15 @@ entitlement/execution/limits = `none`;`projects` = `salvage`,整域档位仍 `"t
   `boolPole{strict,minTrust:"local"}`,严格极写=local、松极/非布尔/无值=global;放宽面/failIfUnavailable/
   未声明新子键回落类目 floor global = fail-closed);读法 `membersOf`/`memberAdmission`(可带候写值)/
   `memberMinTrust`(禁自铸表)。
+- 比较(14.6.0):唯一比较器 `tightenVerdict(rule, existing, candidate)` → `TIGHTEN_VERDICTS`(equal / stricter / looser /
+  unordered / unreadable);只认序不认拼写:enumRank 序内词、boolStricter 严格布尔(不真值化)、setUnion / setNarrower 字符串
+  数组按集合比、numericLower 有限数或 +Infinity(无上限最松)、none 严格 JSON(深度 ≤ MAX_HASH_DEPTH);域外 / 缺席 ⇒
+  unreadable;policyDenyWins ⇒ RangeError。`TightenRule` 尾插无参 `setUnion` / `numericLower`。类目 `tighten` 只答整值单元;
+  声明成员的比较器 `memberTighten` / `resolveMemberTighten` 由行的值类座推出(`list` / `boolPole` 恰一;皆无 / 皆有 ⇒
+  RangeError);memberized 类目整值与未声明成员无比较器。
+- settings 单元表(14.6.0,`src/settings-units.ts`,主 barrel):`SETTINGS_UNITS` 十单元(path / category / reads / reading)、
+  `unitTighten(unit, member?)`、`readSettingsUnit(unit, raw, member?)`(manual ⇒ default、"disable" ⇒ true、false 仍 false、
+  bypassPermissions ⇒ launch_only;表外与 undefined / null ⇒ unreadable;收下原样返回)。
 - 信任阶梯(1.2.0):`trustRank`(managed 6 > global 5 > project 4 > local 3 > session 2 > task 1)、
   `isAtLeast`;`MinTrust` 含 `task`(声明序非阶梯,阶梯唯一真源是 `trustRank`)。
   词表是一只纯常量 `MIN_TRUST_WORDS`(`local, session, project, global, managed, task`;`MinTrust` zod 枚举由它派生):`trustRank` 的闭包自由名 = `MIN_TRUST_WORDS` + JS 内建
@@ -650,7 +659,8 @@ R5. fleet 配置种到本地/反向:`exportBundle`/`writeBundle`/`readBundle`(re
 R6. 复用 secret 边界:直接用 `ENV_NAME`/`NON_SECRET_URL`/`containsSecretToken`,别自写正则。
 R7. ETag/漂移检测:`stableHash`;skills 内容寻址:`skillContentHash`/`sha256Hex`(prompts 的身份是引擎铸的 `artifactDigest`,本包不铸)。
 R8. 消费端读 wire:`readEffectiveWire(raw, onWarning)`(容错极性是裁定过的语义,别自己 parse 全量域)。
-R9. settings resolver:类别合并律读 `SAFETY_MERGE_SPEC` + `trustRank`/`isAtLeast`/`memberAdmission`,层准入读 `layerAdmission` +
+R9. settings resolver:类别合并律读 `SAFETY_MERGE_SPEC` + `trustRank`/`isAtLeast`/`memberAdmission`,「谁更严」读 `tightenVerdict` +
+    `unitTighten` / `memberTighten`,单元与原值读法读 `SETTINGS_UNITS` / `readSettingsUnit`(14.6.0),层准入读 `layerAdmission` +
     `SETTINGS_SOURCE_CONTRACT`(查口 `settingsSourceContract`),禁自铸 rank/成员/层档表;hooks 坏形读 `classifyHooksConfig`,禁自铸判官。
 
 ================================================================================

package/llms.txt

@@ -1,6 +1,6 @@
 <!--
 llms.txt — 消费方(使用者)视角索引 · @sema-agent/settings-schema
-重写日期: 2026-10-23 | 包版本: 14.5.0
+重写日期: 2026-10-24 | 包版本: 14.6.0
 生成方式: 无生成脚本——按当前树的 src/*.ts 导出面 + package.json + README/CHANGELOG 手写事实版;
 每条断言附证据坐标(文件:符号),刻意不用行号(行号随每版腐烂,符号名由 typecheck/test 钉住)。
 刷新触发: package.json 版号变更(test/docs-hygiene.test.ts D 组钉「包版本:」与 package.json 相等、
@@ -97,7 +97,9 @@ llms.txt — 消费方(使用者)视角索引 · @sema-agent/settings-schema
   (src/cross-session.ts: `CrossSessionSettings` / `readCrossSessionInbound` / `readDialogExpiry`)
 - **安全合并表** `SAFETY_MERGE_SPEC` + 信任阶梯 `trustRank` / `isAtLeast`(词表来源 = 纯常量 `MIN_TRUST_WORDS`,闭包零 zod)+ 成员级准入 `memberAdmission`;关停位 `disableBypassPermissionsMode` / `disableAutoMode`
   = 类目 `killSwitches`(尾插):任一层可收紧、不放宽 —— 开 = tighten@local(任一设置文件层),关 / 非布尔 / 不带值 = 行地板 global,合并 boolStricter;没有「只许托管层」的地板。
-  (src/safety-merge-spec.ts)
+  14.6.0:唯一比较器 `tightenVerdict(rule, existing, candidate)`(判词闭集 `TIGHTEN_VERDICTS`;只认序不认拼写,域外 / 缺席 ⇒ `unreadable`;`TightenRule` 尾插无参 `setUnion` / `numericLower`);
+  成员比较器 `memberTighten` 由成员行值类座推出(`MemberAdmission.list` / `boolPole`,每行恰一);settings 单元表 `SETTINGS_UNITS` + `unitTighten` + `readSettingsUnit`(单元读法,表外一切 `unreadable`)。
+  (src/safety-merge-spec.ts · src/settings-units.ts)
 - **设置源表 + 层准入**:`SETTINGS_SOURCES`(合并序)/ `SETTINGS_SOURCE_CONTRACT`(信任档 + 是否仓库可控;本地层与项目层同 `project` 档)/
   `WORKSPACE_TRUST_STATES` / `layerAdmission(source, workspace, category, member?, value?)`(地板先判;仓库可控层未受信只收 tighten)/
   `settingsSourceContract(source)`(源表唯一查口:本包要层档的函数都经它,不收调用方给的档;层只带源名)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "14.5.0",
+  "version": "14.6.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-web-admin, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",