@sema-agent/cli 1.0.112 → 1.0.113

package/npm-shrinkwrap.json

@@ -1,16 +1,16 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.112",
+  "version": "1.0.113",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sema-agent/cli",
-      "version": "1.0.112",
+      "version": "1.0.113",
       "license": "BUSL-1.1",
       "dependencies": {
         "@sema-agent/sdk": "9.3.0",
-        "@sema-agent/server": "7.75.4"
+        "@sema-agent/server": "7.76.1"
       },
       "bin": {
         "sema": "sema.js"
@@ -620,9 +620,9 @@
       }
     },
     "node_modules/@sema-agent/core": {
-      "version": "7.17.6",
-      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-7.17.6.tgz",
-      "integrity": "sha512-ubDEJyOLiB8SkaS+nwVIw/Fh8xP56mpgk0rKcIJyNtWBJNQugW6yw9fHd8a9ZTT+lGJQjD+dGH+ITogXshvIqQ==",
+      "version": "7.17.7",
+      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-7.17.7.tgz",
+      "integrity": "sha512-7rETEzf8dRvuBO+js9r+GRFBCyFq7oYqrRpd/zbTKwLEc44X1JjsK0yAYRGebTS5K+/EHKc15KXiqWu6XsAsHw==",
       "license": "BUSL-1.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.30.0",
@@ -645,12 +645,12 @@
       }
     },
     "node_modules/@sema-agent/server": {
-      "version": "7.75.4",
-      "resolved": "https://registry.npmjs.org/@sema-agent/server/-/server-7.75.4.tgz",
-      "integrity": "sha512-WLh3T2s1RF4EYr+bKOa8UiVRdJHpQwaRkVDC+UgztpnRvx21Bu8lt21H8/N2K/Ub4SXetprhvtitshTUtMjFJA==",
+      "version": "7.76.1",
+      "resolved": "https://registry.npmjs.org/@sema-agent/server/-/server-7.76.1.tgz",
+      "integrity": "sha512-q8LrcnZfyLPlRZwJyTDAoVYGEEeMjoWoZX1gwg6g/bQ1PnjZL8f9F5dyFjg3tqB1Az7qFgNULN4hfQfposmXBw==",
       "license": "BUSL-1.1",
       "dependencies": {
-        "@sema-agent/core": "7.17.6",
+        "@sema-agent/core": "7.17.7",
         "@sema-agent/settings-schema": "1.10.0",
         "e2b": "^2.28.0",
         "libsodium-wrappers": "^0.8.4",
@@ -826,9 +826,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.112",
+  "version": "1.0.113",
   "description": "Sema — your own Claude Code-grade coding agent, in the terminal.",
   "license": "BUSL-1.1",
   "bin": {
@@ -24,13 +24,13 @@
   ],
   "dependencies": {
     "@sema-agent/sdk": "9.3.0",
-    "@sema-agent/server": "7.75.4"
+    "@sema-agent/server": "7.76.1"
   },
   "overrides": {
-    "@sema-agent/core": "7.17.6",
+    "@sema-agent/core": "7.17.7",
     "@sema-agent/settings-schema": "1.10.0"
   },
-  "semaEngineVersion": "server 7.75.4 / core 7.17.6 / settings-schema 1.10.0",
+  "semaEngineVersion": "server 7.76.1 / core 7.17.7 / settings-schema 1.10.0",
   "engines": {
     "node": ">=20.3"
   }

package/sema-main.js

@@ -4075,8 +4075,13 @@ var CHROME_ARM_TABLE, CHROME_ARMS, init_seam = __esm({
         duty: "\u7528 sdk isApprovalRevokeFrameV1 \u7A84\u5316 frame \u53D6 batchId/askIds/taskId;\u7A84\u4E0D\u4E0B\u6765\u6309\u901A\u7528\u64A4\u5361\u5904\u7406(\u8BE5\u6279\u672C\u5730\u5361\u7167\u6E05);\u{1F534} \u4E09\u7EAA\u5F8B:\u2460\u6309 taskId \u5F52\u5C5E\u8FC7\u6EE4(\u5B64\u513F\u64A4\u5E27\u884C\u975E\u6211\u5373\u5FFD\u7565)\u2461\u8D26\u672C\u91CD\u653E\u7684\u64A4\u5E27\u53EA\u7528\u4E8E\u65F6\u95F4\u7EBF\u6E32\u67D3,\u5361\u96C6\u57FA\u51C6\u6052\u4E3A\u5F00\u6D41 preamble(\u64A4\u5E27\u53EF\u80FD\u6574\u5E27\u4E22\u5931)\u2462\u5DF2 DECIDED \u7684\u5144\u5F1F\u4E0D\u5728 askIds \u91CC;\u771F\u64A4\u5230\u672C\u5730\u5361\u65F6\u7ED9\u4E00\u884C\u5F52\u56E0(reason \u6D88\u6BD2\u540E\u5448\u73B0),\u96F6\u547D\u4E2D\u4E0D\u8981\u591A\u8BF4\u90A3\u4E00\u884C"
       },
       text_segment_end: {
-        required: !1,
-        duty: "\u53EF\u9009:\u5F15\u64CE\u660E\u62A5\u7684 assistant \u6563\u6587\u6BB5\u8FB9\u754C(#323/core #447)\u3002\u{1F534} content \u662F\u5BF9\u8D26/\u5B9A\u754C\u7528\u7684\u6743\u5A01\u5168\u6587,\u62FF\u5B83\u518D\u6E32\u4E00\u884C = \u540C\u4E00\u6BB5\u4E0A\u5C4F\u4E24\u904D;\u7F3A\u5E2D\u53EA\u8868\u793A\u300C\u6CA1\u62A5\u300D,\u7EDD\u4E0D\u7B49\u4E8E\u300C\u6BB5\u6CA1\u7ED3\u675F\u300D\u2014\u2014\u8981\u9000\u56DE\u81EA\u5BB6\u542F\u53D1\u5F0F\u5FC5\u987B\u6309\u6574\u6761\u6D41\u5224\u3001\u4E0D\u6309\u5355\u5E27\u5224"
+        // 🔴 0.68.1 / L-310:`false` → `true`。改的理由不是「这一面更重要了」,是**后果类目变了**:
+        //    本表的 `false` 语义逐字是「不接 = 这条披露看不见,不属『已发生的行为丢失』」,而 server
+        //    7.75.3 起不接的后果是**未脱敏字节留在本地转录里**(b2 那一形上,那条明文消息**已经渲过**
+        //    ⇒ 就是「已发生的行为」)。留 `false` = 把一条安全面义务标成可选,正是本仓点名要治的
+        //    「假 affordance / 悄悄的谎」。⚠️ 这一位翻面会让按本表自检覆盖率的端**当场显形**——那正是目的。
+        required: !0,
+        duty: "\u{1F534} \u5F15\u64CE\u660E\u62A5\u7684 assistant \u6563\u6587\u6BB5\u8FB9\u754C + **\u8BE5\u6BB5\u6743\u5A01\u5168\u6587**(#323/core #447;server \u22657.75.3 \u8D77 content \u7ECF\u8131\u654F\u5668\u3001text_delta \u4ECD\u9010\u5B57 \u21D2 \u4E24\u8005**\u53EF\u4EE5\u4E0D\u76F8\u7B49**)\u3002\u2460`diverged` \u5728\u573A(never false)\u21D2 \u4F60\u6309\u589E\u91CF\u62FC\u51FA\u6765\u7684\u90A3\u4E00\u6BB5\u662F\u8FC7\u671F\u7684,\u5FC5\u987B\u7528 content **\u91CD\u6E32\u8BE5\u6BB5**\u5E76\u4EE5\u5B83\u4E3A\u8BE5\u6BB5 committed \u6587\u672C,\u4E0D\u8BB8\u4FDD\u7559\u589E\u91CF\u62FC\u6587;\u2461`committedPrefixDiverged` \u5728\u573A(never false)\u21D2 \u8FD9\u4E00\u6BB5\u6B64\u524D\u5DF2 committed \u4E0A\u5C4F\u7684\u6B63\u6587**\u4E5F**\u8FC7\u671F\u4E86,\u{1F534} \u672C\u5305\u5728\u8FD9\u4E00\u5F62\u4E0A**\u4E00\u4E2A\u5B57\u8282\u90FD\u4E0D\u518D\u4EA4**(\u64A4\u4E0D\u56DE\u7684\u90A3\u622A\u62FC\u4E0D\u51FA content)\u21D2 \u628A committedPrefixLen \u6307\u7684\u90A3\u4E00\u622A\u6362\u6210 content,\u8FD9\u4E00\u6761**\u6240\u6709\u5BBF\u4E3B\u90FD\u8981\u505A**;\u7F3A\u5E2D \u21D2 \u672C\u5305\u4EA4\u7684\u662F\u5C3E\u6BB5,\u524D\u7F00+\u5C3E\u6BB5=content,\u4EC0\u4E48\u90FD\u4E0D\u7528\u4E22;\u2462`committedPrefixLen`(never 0)= \u5B9A\u4F4D\u91CF,\u{1F534} **\u5355\u4F4D = JS \u5B57\u7B26\u4E32\u957F\u5EA6(UTF-16 \u4EE3\u7801\u5355\u5143),\u4E0D\u662F UTF-8 \u5B57\u8282\u3001\u4E5F\u4E0D\u662F\u51E0\u6761\u6D88\u606F**(\u6309 UTF-8 \u5B57\u8282\u622A\u4F1A\u5728\u975E ASCII \u6B63\u6587\u4E0A\u622A\u9519\u4F4D\u7F6E\u628A\u51ED\u636E\u7559\u5728\u5C4F\u4E0A;\u6309\u6D88\u606F\u4E22\u4F1A\u8FDE\u5408\u5E76\u5728\u540C\u4E00\u6761\u6D88\u606F\u91CC\u7684\u4E0A\u4E00\u6BB5\u5B9A\u7A3F\u4E00\u8D77\u5220\u6389),\u7167\u6284 `\u5DF2committed\u6B63\u6587.slice(0, \u957F\u5EA6 - committedPrefixLen) + content`;\u6309**\u589E\u91CF\u62FC\u6587**\u8BA1\u957F\u3001\u4E0D\u662F content \u4E0A\u7684\u504F\u79FB;\u2463\u4E09\u952E\u5168\u7F3A\u5E2D \u21D2 \u7167\u65E7\u53EA\u5F53\u5BF9\u8D26/\u5B9A\u754C,\u62FF content \u518D\u6E32\u4E00\u884C = \u540C\u4E00\u6BB5\u4E0A\u5C4F\u4E24\u904D\u3002\u{1F534} \u7F3A\u5E2D\u53EA\u8868\u793A\u300C\u6CA1\u62A5\u300D,\u7EDD\u4E0D\u7B49\u4E8E\u300C\u6BB5\u6CA1\u7ED3\u675F\u300D\u2014\u2014\u8981\u9000\u56DE\u81EA\u5BB6\u542F\u53D1\u5F0F\u5FC5\u987B\u6309\u6574\u6761\u6D41\u5224\u3001\u4E0D\u6309\u5355\u5E27\u5224"
       }
     }, CHROME_ARMS = Object.entries(CHROME_ARM_TABLE).map(([kind, d4]) => ({ kind, required: d4.required, duty: d4.duty }));
   }
@@ -5384,7 +5389,7 @@ function endsAtSentenceBoundary(s) {
 ` || last3 === "\r" || SENTENCE_END_CHARS.has(last3);
 }
 function createTextStream(ctx, idOf) {
-  let answer = "", answerSegment = "", thinking = "", emittedAssistantText = !1, committedText = "", previousCommittedText = "", textPending = "", thinkingPending = "", textBlockOpen = !1, thinkingBlockOpen = !1, lastFlushAt = 0, idleFlushUsedInSegment = !1, flushEveryMs = typeof ctx.coalesceIntervalMs == "number" && ctx.coalesceIntervalMs >= 0 ? ctx.coalesceIntervalMs : 100, segmentAnchor = null, thinkingAnchor = null;
+  let answer = "", answerSegment = "", thinking = "", emittedAssistantText = !1, committedText = "", previousCommittedText = "", textPending = "", thinkingPending = "", textBlockOpen = !1, thinkingBlockOpen = !1, lastFlushAt = 0, idleFlushUsedInSegment = !1, segmentCommitted = "", previousSegmentCommitted = "", segmentSealed = "", flushEveryMs = typeof ctx.coalesceIntervalMs == "number" && ctx.coalesceIntervalMs >= 0 ? ctx.coalesceIntervalMs : 100, segmentAnchor = null, thinkingAnchor = null;
   function* takeThinking() {
     if (thinking.length === 0)
       return;
@@ -5400,23 +5405,25 @@ function createTextStream(ctx, idOf) {
     thinking = "", thinkingAnchor = null, thinkingBlockOpen = !1, yield chrome({ kind: "thinking_activity", laneProof: MAIN, active: !1 }), yield transcript(msg, ctx.now());
   }
   function* emitAnswerSegment() {
-    if (answerSegment.length === 0)
+    let body = segmentSealed + answerSegment;
+    if (body.length === 0)
       return;
     let anchor = segmentAnchor ?? {}, msg = {
       type: "assistant",
       // L-215③:同 takeThinking —— 身份位接力(帧优先、ctx 兜底;两位都读不出就一个都不铸)。
-      message: { role: "assistant", content: [{ type: "text", text: answerSegment }], ...messageIdentityOf(anchor, ctx) },
+      message: { role: "assistant", content: [{ type: "text", text: body }], ...messageIdentityOf(anchor, ctx) },
       uuid: idOf(anchor, "text"),
       session_id: ctx.sessionId,
       parent_tool_use_id: null
     };
-    committedText += answerSegment, answerSegment = "", segmentAnchor = null, emittedAssistantText = !0, textBlockOpen = !1, yield transcript(msg, ctx.now());
+    committedText += body, segmentCommitted += answerSegment, segmentSealed = "", answerSegment = "", segmentAnchor = null, emittedAssistantText = !0, textBlockOpen = !1, yield transcript(msg, ctx.now());
   }
   function* takeAnswerSegment() {
-    idleFlushUsedInSegment = !1, yield* emitAnswerSegment();
+    idleFlushUsedInSegment = !1, yield* emitAnswerSegment(), previousSegmentCommitted += segmentCommitted, segmentCommitted = "";
   }
   function* takeAnswerSegmentOnIdle() {
-    answerSegment.length !== 0 && (idleFlushUsedInSegment || endsAtSentenceBoundary(answerSegment) && (idleFlushUsedInSegment = !0, yield* emitAnswerSegment()));
+    let body = segmentSealed + answerSegment;
+    body.length !== 0 && (idleFlushUsedInSegment || endsAtSentenceBoundary(body) && (idleFlushUsedInSegment = !0, yield* emitAnswerSegment()));
   }
   function* drainLive() {
     if (thinkingPending.length > 0) {
@@ -5444,7 +5451,7 @@ function createTextStream(ctx, idOf) {
   }
   return {
     *feedText(delta, frame) {
-      (thinking.length > 0 || thinkingPending.length > 0) && (yield* drainLive(), yield* takeThinking()), answerSegment.length === 0 && (segmentAnchor = frame), answer += delta, answerSegment += delta, textPending += delta;
+      (thinking.length > 0 || thinkingPending.length > 0) && (yield* drainLive(), yield* takeThinking()), answerSegment.length === 0 && segmentSealed.length === 0 && (segmentAnchor = frame), answer += delta, answerSegment += delta, textPending += delta;
     },
     *feedThinking(delta, frame) {
       thinking.length === 0 && (thinkingAnchor = frame, yield chrome({ kind: "thinking_activity", laneProof: MAIN, active: !0 })), thinking += delta, thinkingPending += delta;
@@ -5453,7 +5460,18 @@ function createTextStream(ctx, idOf) {
     takeThinking,
     takeAnswerSegment,
     takeAnswerSegmentOnIdle,
-    hasPendingContent: () => thinking.length > 0 || answerSegment.length > 0 || thinkingPending.length > 0 || textPending.length > 0,
+    replaceAnswerSegment: (content, anchor) => {
+      let prevSegment = answerSegment, livePrefix = previousSegmentCommitted + segmentCommitted;
+      if (livePrefix.length === 0 && prevSegment.length === 0)
+        return { diverged: !1, committedPrefixLen: 0, committedPrefixDiverged: !1 };
+      let liveSegment = livePrefix + prevSegment, diverged = liveSegment !== content, committedPrefixLen = livePrefix.length, committedPrefixDiverged = committedPrefixLen > 0 && !content.startsWith(livePrefix);
+      if (committedPrefixDiverged && previousSegmentCommitted.length > 0)
+        return segmentCommitted = "", previousSegmentCommitted = "", idleFlushUsedInSegment = !1, { diverged, committedPrefixLen, committedPrefixDiverged };
+      let segTailLen = Math.min(textPending.length, prevSegment.length), carry = textPending.slice(0, textPending.length - segTailLen), emittedForSegment = livePrefix + prevSegment.slice(0, prevSegment.length - segTailLen);
+      return textPending = content.startsWith(emittedForSegment) ? carry + content.slice(emittedForSegment.length) : carry, committedPrefixDiverged ? committedText.endsWith(livePrefix) && (committedText = committedText.slice(0, committedText.length - livePrefix.length) + content) : segmentSealed += content.slice(committedPrefixLen), answerSegment = "", answer.endsWith(liveSegment) && (answer = answer.slice(0, answer.length - liveSegment.length) + content), segmentAnchor === null && anchor !== void 0 && (segmentAnchor = anchor), segmentCommitted = "", previousSegmentCommitted = "", idleFlushUsedInSegment = !1, { diverged, committedPrefixLen, committedPrefixDiverged };
+    },
+    hasPendingContent: () => thinking.length > 0 || // L-310:已封存的定稿段同样是「有已生成未提交的内容」(不算进来会让它一直押到 turn 收口)。
+    segmentSealed.length > 0 || answerSegment.length > 0 || thinkingPending.length > 0 || textPending.length > 0,
     *maybeFlushOnBeat(nowMs2) {
       (textPending.length > 0 || thinkingPending.length > 0) && nowMs2 - lastFlushAt >= flushEveryMs && (yield* drainLive(), lastFlushAt = nowMs2);
     },
@@ -5464,7 +5482,7 @@ function createTextStream(ctx, idOf) {
       emittedAssistantText = !0, typeof committed == "string" && (committedText += committed);
     },
     beginAssistantMessage: () => {
-      committedText.length > 0 && (previousCommittedText = committedText), committedText = "";
+      committedText.length > 0 && (previousCommittedText = committedText), committedText = "", previousSegmentCommitted += segmentCommitted, segmentCommitted = "";
     },
     get committedAnswerText() {
       return committedText;
@@ -7807,16 +7825,22 @@ var assistantArm, userArm, systemArm, diagnosticsArm, steeringInjectedArm, works
         return;
       let frame = m2.frame;
       typeof frame != "object" || frame === null || (yield chrome({ kind, laneProof: MAIN, frame, schemaVersion }));
-    }, textSegmentEndArm = function* (m2) {
+    }, textSegmentEndArm = function* (m2, { text: text2 }) {
       if (m2.parentToolCallId !== void 0)
         return;
       let content = typeof m2.content == "string" ? m2.content : "";
-      content.length !== 0 && (yield chrome({
+      if (content.length === 0)
+        return;
+      let r = text2.replaceAnswerSegment(content, m2);
+      yield chrome({
         kind: "text_segment_end",
         laneProof: MAIN,
         content,
+        ...r.diverged ? { diverged: !0 } : {},
+        ...r.committedPrefixDiverged ? { committedPrefixDiverged: !0 } : {},
+        ...r.committedPrefixLen > 0 ? { committedPrefixLen: r.committedPrefixLen } : {},
         ...typeof m2.eventId == "string" && m2.eventId.length > 0 ? { eventId: m2.eventId } : {}
-      }));
+      });
     }, promptSuggestionsArm = function* (m2) {
       if (typeof m2.parentToolCallId == "string")
         return;
@@ -8141,7 +8165,10 @@ var ADAPTER_COVERAGE, ADAPTER_DIVERGENCES, WireToCcAdapterImpl, init_adapt = __e
         "message_committed",
         // #318 件①(2026-08-21):`engine_notice` 引擎结构化通告 —— 投 chrome(开集,一个码都不判)。
         "engine_notice",
-        // #323 / core #447:assistant 散文段边界 → chrome text_segment_end(子流断闸;本批**不**动文本缓冲)。
+        // #323 / core #447 + L-310(0.68.1 改口):assistant 散文段边界 → **整段替换文本缓冲** +
+        // chrome text_segment_end(子流断闸在替换之前)。修前这里写「本批**不**动文本缓冲」——
+        // server 7.75.3 起 `text_end.content` 经脱敏器而 `text_delta` 仍逐字,不动缓冲 = 未脱敏字节
+        // committed 进本地转录;替换语义见 `adapt/textStream.ts` 的 `replaceAnswerSegment` 头注。
         "text_end",
         "prompt_suggestions",
         "retry_status",
@@ -9631,9 +9658,13 @@ function readEntry(raw2) {
     ...str3(o.cardId) !== void 0 ? { cardId: str3(o.cardId) } : {},
     ...str3(o.capabilityId) !== void 0 ? { capabilityId: str3(o.capabilityId) } : {},
     ...str3(o.effect) !== void 0 ? { effect: str3(o.effect) } : {},
+    // L-290 族扫:三根轴各自的**出身**键(开集读,`str()` 同律;坏形只丢这一格,行还在 —— 出身不是身份)。
+    ...str3(o.effectProvenance) !== void 0 ? { effectProvenance: str3(o.effectProvenance) } : {},
     ...typeof o.egress == "boolean" ? { egress: o.egress } : {},
+    ...str3(o.egressProvenance) !== void 0 ? { egressProvenance: str3(o.egressProvenance) } : {},
     ...str3(o.irreversibility) !== void 0 ? { irreversibility: str3(o.irreversibility) } : {},
     ...str3(o.contentOrigin) !== void 0 ? { contentOrigin: str3(o.contentOrigin) } : {},
+    ...str3(o.contentOriginProvenance) !== void 0 ? { contentOriginProvenance: str3(o.contentOriginProvenance) } : {},
     ...str3(o.family) !== void 0 ? { family: str3(o.family) } : {},
     ...readPathTarget(o.pathTarget) !== void 0 ? { pathTarget: readPathTarget(o.pathTarget) } : {},
     ...hintsRaw !== void 0 ? {
@@ -10338,7 +10369,12 @@ var ControlSafetyError, BAND_RANK, ControlRouter, STEERING_CODE_TO_SAFETY, STEER
       ["steering.duplicate_input_id", "duplicate_input_id"],
       ["steering.ambiguous_target", "ambiguous_target"],
       ["steering.ambiguous_label", "ambiguous_target"],
-      ["steering.still_running", "still_running"]
+      ["steering.still_running", "still_running"],
+      // [7226] 包侧缺口 ①(0.68.1):server 契约 (2) 表第 8 码(422)。SDK 8.8.0 **没有**专属子类
+      // (`errors.d.ts` 的 `Steering*Error` 只有六只)⇒ 只能按 `errorCode` 认;认不出时它会落开集位
+      // `steering_other`,而那一位的判词是「别猜它的意思」—— 恰好把一条「改内容重试即可」的拒绝
+      // 说成没救。所以码表必须点名它,不能靠前缀兜底。
+      ["steering.blocked_by_hook", "blocked_by_hook"]
     ]), STEERING_NAME_TO_SAFETY = /* @__PURE__ */ new Map([
       ["SteeringNotRunningError", "not_running"],
       ["SteeringInvalidContentError", "invalid_content"],
@@ -10352,6 +10388,7 @@ var ControlSafetyError, BAND_RANK, ControlRouter, STEERING_CODE_TO_SAFETY, STEER
       ["duplicate_input_id", "this Idempotency-Key is already parked with DIFFERENT steering content \u2014 reissue with a fresh key, resending verbatim will never succeed"],
       ["ambiguous_target", "more than one live target matches \u2014 address it uniquely (sub-agent: parentToolCallId; workflow: a more specific label); retrying verbatim yields the same result"],
       ["still_running", "the target is STILL RUNNING \u2014 steer it instead of resuming, or wait for it to settle (this is the exact opposite of not_running: never collapse the two)"],
+      ["blocked_by_hook", "this deployment's userPromptSubmit gate refused the input (block, timeout and crash all report this one code, fail-closed) \u2014 the input was NOT accepted: no human_input frame, the inputId is not on the ledger, so editing the text and sending again is a normal retry, not a duplicate"],
       ["steering_other", "an unrecognized steering.* refusal (open set) \u2014 the steer did NOT land; log the errorCode verbatim, do not guess its meaning"]
     ]);
   }
@@ -13483,7 +13520,9 @@ var PLAN_REVIEW_GATE_KIND, PLAN_REVIEW_GATE_KINDS, ASK_PARK_GATE_KINDS, PLAN_REV
 
 // node_modules/@sema-agent/client-core/dist/request/taskRequest.js
 function buildTaskRequest(input, lane) {
-  let live = input.live, on = (field, value) => {
+  let live = input.live;
+  refuseBadMemoryCapture(input.memoryCapture);
+  let on = (field, value) => {
     if (value == null)
       return !1;
     let spec = REQUEST_FIELD_MATRIX.find((f) => f.field === field);
@@ -13531,6 +13570,8 @@ function buildTaskRequest(input, lane) {
     ...on("limits", input.limits) ? { limits: input.limits } : {},
     ...on("interactiveTools", input.interactiveTools) && input.interactiveTools === !1 ? { interactiveTools: !1 } : {},
     ...on("oneShot", input.oneShot) && input.oneShot === !0 ? { oneShot: !0 } : {},
+    // ⑤ 单成员闭集:值**恰是** `'off'` 才 stamp。表外拼写在上面已经**响亮拒**(见 `refuseBadMemoryCapture`)。
+    ...on("memoryCapture", input.memoryCapture) && input.memoryCapture === "off" ? { memoryCapture: "off" } : {},
     ...Object.keys(settingsOut).length > 0 ? { settings: settingsOut } : {}
   };
 }
@@ -13572,7 +13613,7 @@ function unregisteredRequestKeys(req, lane) {
   }
   return out6;
 }
-var REQUEST_FIELD_MATRIX, LIVE_DEFAULT_FIELDS, laneHas, foreignSettingsSubKeys, namedSettingsSubKeys, PERMISSION_FACE_KEY, shapeTag, isPlainRecord, materializeJsonFaithful, resolvedSnapshotForWire, init_taskRequest = __esm({
+var REQUEST_FIELD_MATRIX, LIVE_DEFAULT_FIELDS, laneHas, foreignSettingsSubKeys, namedSettingsSubKeys, PERMISSION_FACE_KEY, shapeTag, isPlainRecord, materializeJsonFaithful, resolvedSnapshotForWire, refuseBadMemoryCapture, init_taskRequest = __esm({
   "node_modules/@sema-agent/client-core/dist/request/taskRequest.js"() {
     REQUEST_FIELD_MATRIX = [
       // ── 两条车道都有 ────────────────────────────────────────────────────────────────────────────
@@ -13612,6 +13653,15 @@ var REQUEST_FIELD_MATRIX, LIVE_DEFAULT_FIELDS, laneHas, foreignSettingsSubKeys,
       { field: "debate", lanes: ["interactive", "print"], live: !0, why: "council \u7684 debate \u53D8\u4F53\u5F00\u5173(server \u8BFB `=== true`)" },
       { field: "rounds", lanes: ["interactive", "print"], live: !0, why: "debate \u8F6E\u6570(server clamp [1,3],\u975E\u6709\u9650\u6570\u88AB server \u5F52 undefined\u2014\u2014\u672C\u5C42\u539F\u6837\u900F\u4F20\u4E0D\u9884 clamp)" },
       { field: "lenses", lanes: ["interactive", "print"], live: !0, why: "code-review \u955C\u5934\u96C6(passthrough \u540C repo;\u5F62\u72B6\u7531 server \u573A\u666F\u5B9A\u4E49,\u672C\u5C42\u4E0D\u95ED\u96C6)" },
+      // ── memoryCapture([7226] 包侧缺口 ⑤,0.68.1)──────────────────────────────────────────────
+      // 🔴 **单成员闭集**:server 契约 §12.4 逐字「`memoryCapture?: "off"`。单成员闭集(**没有**
+      //    `"on"`)」—— 所以本层只在值**恰是** `'off'` 时 stamp;`'on'` / 坏拼写一律不上 wire
+      //    (坏拼写 server 判 400 `request.field_invalid`,本层不预铸第二判官,但也不替它买路)。
+      // 🔴 与**中途翻转 verb** `POST /v1/runs/:id/memory/capture-optout`(§12.5,能力位
+      //    `runMemoryCaptureOptOut`)是**同一条一次性单向记录的两个口**,不是两个轴:verb 管这一条
+      //    在飞的 run,本键管「本会话的下一次新提交」。非 live 的 verb(parked / 终态 / 他副本)回
+      //    409 `steering.not_running` 并**指路本键** —— 端没有本键就接不住那条指路。
+      { field: "memoryCapture", lanes: ["interactive", "print"], live: !0, why: '\u672C\u4F1A\u8BDD\u6C38\u8FDC\u4E0D\u8FDB\u957F\u671F\u8BB0\u5FC6\u7684**\u58F0\u660E\u5F62**(server \xA712.4 body \u952E,\u5355\u6210\u5458\u95ED\u96C6 "off");\u4E24\u6761\u8F66\u9053\u90FD\u662F\u63D0\u4EA4\u9762 \u21D2 \u90FD\u80FD\u58F0\u660E\u3002\u4E0E memoryWrite:false \u4E0D\u662F\u4E00\u4E2A\u8F74(\u90A3\u662F\u300C\u672C run \u53EA\u8BFB\u5E73\u9762\u300D)\u3002\u26A0\uFE0F parked \u7EED\u8DD1\u817F\u7ED3\u6784\u6027\u62FF\u4E0D\u5230\u58F0\u660E(\u51B3\u7B56/\u7EED\u8DD1\u7AEF\u70B9\u4ECE\u6301\u4E45 body \u91CD\u5EFA spec),\u90A3\u662F\u5F15\u64CE\u4FA7\u4E8B\u5B9E,\u4E0D\u662F\u672C\u5C42\u7684\u6F0F' },
       // ── print 独有(§8-5 认定的**有理由**的差异)──────────────────────────────────────────────
       { field: "finalVerification", lanes: ["print"], live: !0, why: "P1-1 \u7EC8\u9A8C:\u65E0\u4EBA\u503C\u5B88\u8F66\u9053\u624D\u9700\u8981\u5F15\u64CE\u81EA\u8BC1;\u4EA4\u4E92 REPL \u7531\u4EBA\u5F53\u573A\u770B\u7ED3\u679C\u3002#106 \u88C1 B(\u8BA9\u4F4D+\u544A\u77E5)\u540E\u4EA4\u4E92\u9762\u9ED8\u8BA4\u5173" },
       { field: "limits", lanes: ["print"], live: !0, why: "P2-3-b:`-p` \u7684\u9884\u7B97\u62A4\u680F(--max-* flag \u65CF),\u4EA4\u4E92 REPL \u7531\u4EBA\u968F\u65F6 Esc" },
@@ -13740,6 +13790,9 @@ var REQUEST_FIELD_MATRIX, LIVE_DEFAULT_FIELDS, laneHas, foreignSettingsSubKeys,
       if (!isPlainRecord(resolved))
         throw new TypeError(`buildTaskRequest: settings.resolved \u53EA\u63A5\u53D7 plain object \u6216\u7F3A\u5E2D(undefined/null)\u2014\u2014 \u6536\u5230 ${shapeTag(resolved)}\u3002\u8FD9\u4E00\u4F4D\u644A\u5F00\u7684\u662F\u5DF2\u89E3\u6790\u6743\u9650\u9762(permissions.deny/ask \u7B49\u5B50\u952E\u5373 wire \u952E):\u628A\u7578\u5F62\u503C\u964D\u6210\u7A7A\u5BF9\u8C61\u7B49\u4E8E\u8BA9\u8BF7\u6C42\u5E26\u7740\u88AB\u5265\u6389\u7684\u6743\u9650\u9762\u53D1\u51FA\u53BB(deny \u9759\u9ED8\u5931\u6548),\u6240\u4EE5\u5728\u63D0\u4EA4\u524D\u62D2\u3002\u9519\u8BEF\u6587\u672C\u53EA\u62A5\u5F62\u72B6,\u4E0D\u56DE\u663E\u5FEB\u7167\u5185\u5BB9\u3002`);
       return out6;
+    }, refuseBadMemoryCapture = (v2) => {
+      if (v2 != null && v2 !== "off")
+        throw new TypeError(`buildTaskRequest: memoryCapture \u53EA\u63A5\u53D7\u5B57\u9762\u91CF \`'off'\` \u6216\u7F3A\u5E2D(undefined/null)\u2014\u2014 \u6536\u5230 ${shapeTag(v2)}\u3002\u8FD9\u4E00\u4F4D\u662F**\u4F1A\u8BDD\u7EA7\u9690\u79C1\u58F0\u660E**(\u300C\u672C\u4F1A\u8BDD\u6C38\u8FDC\u4E0D\u8FDB\u957F\u671F\u8BB0\u5FC6\u300D),\u4E0A\u6E38\u662F**\u5355\u6210\u5458\u95ED\u96C6**(\u6CA1\u6709 \`"on"\`)\u4E14\u5BF9\u574F\u62FC\u5199**\u54CD\u4EAE\u62D2**(core \`config.memory_capture_spelling\` / server 400 \`request.field_invalid\`)\u3002\u672C\u5C42\u82E5\u628A\u574F\u503C\u9759\u9ED8\u5220\u952E,\u8BF7\u6C42\u4F1A\u7167\u53D1\u3001\u5F15\u64CE\u4F1A\u7167\u5E38\u91C7\u96C6,\u800C\u58F0\u660E\u4EBA\u4E0D\u4F1A\u77E5\u9053\u81EA\u5DF1\u7684 opt-out \u4E22\u4E86 \u2014\u2014 \u628A\u4E00\u6761\u9690\u79C1\u8BF7\u6C42\u6309\u6253\u5B57\u9519\u8BEF\u9759\u9ED8\u4E22\u6389\u662F**\u7981\u7684\u65B9\u5411**\u3002\u9519\u8BEF\u6587\u672C\u53EA\u62A5\u5F62\u72B6,\u4E0D\u56DE\u663E\u503C\u3002`);
     };
   }
 });
@@ -144738,6 +144791,7 @@ __export(interactiveReattach_exports, {
   _resetInteractiveReattachForTest: () => _resetInteractiveReattachForTest,
   _setReattachTuningForTest: () => _setReattachTuningForTest,
   activeReattachMachine: () => activeReattachMachine,
+  committedPrefixUnretractableRow: () => committedPrefixUnretractableRow,
   isReattachSettleError: () => isReattachSettleError,
   isReattachableTear: () => isReattachableTear,
   isRetriableTailFailure: () => isRetriableTailFailure,
@@ -144831,6 +144885,9 @@ function reattachSynthesizedTerminalRow(state5, partial2) {
 function resultTextDivergedRow() {
   return "the engine's final answer for this turn does not match the text streamed above; neither version is shown as the other \u2014 read the run on the engine if you need the authoritative one";
 }
+function committedPrefixUnretractableRow() {
+  return "the engine sent a redacted authoritative copy of a passage that is already on screen above, and this shell could not substitute it in place \u2014 the copy above may still contain the raw text; read the run on the engine for the authoritative version";
+}
 function reattachSettleRow(err8, entry = "reconnect") {
   if (err8.name === "ReattachUnauthorizedError")
     return `The engine rejected this session's credentials while run ${err8.taskId} was still in flight, so sema stopped reattaching \u2014 this is NOT a lost connection. The usual cause: the engine was restarted by another sema session, and a restarted engine mints a fresh service token, so the token this screen was holding belongs to the engine that went away. sema already re-read the engine's credential file before giving up. What you see above may be incomplete. ${NEXT_MESSAGE_EXIT} If that message is rejected too, this session never picked up the new credential \u2014 restart sema and it will attach to the engine that is running now.`;
@@ -152959,6 +153016,88 @@ var init_applySettingsChange = __esm({
   }
 });
 
+// build-src/src/sema/controlSafetyAdvice.ts
+function controlSafetyAdvice(code2) {
+  switch (code2) {
+    case "not_running":
+      return {
+        headline: "that run is not in flight (it is suspended, already finished, or lives on another replica)",
+        nextStep: "resolve its gate first \u2014 steering a run that is not running has no effect",
+        accepted: "refused"
+      };
+    case "invalid_content":
+      return {
+        // 🔴 文案里**不复述**被拒的正文(它正是越狱串本身),只说「正文里有控制面标记」。
+        headline: "the engine rejected that message because its text carries control-plane markers",
+        nextStep: "rewrite the message yourself \u2014 this shell will not strip parts of it and resend",
+        accepted: "refused"
+      };
+    case "queue_full":
+      return {
+        headline: "the steering queue on that checkpoint is full \u2014 the engine refuses to evict anything it already accepted",
+        nextStep: "wait for it to drain, then send again",
+        accepted: "refused"
+      };
+    case "duplicate_input_id":
+      return {
+        headline: "that idempotency key was already used with DIFFERENT text",
+        nextStep: "send it under a new key \u2014 resending the same body under the reused key cannot land",
+        accepted: "refused"
+      };
+    case "ambiguous_target":
+      return {
+        headline: "more than one live target matched",
+        nextStep: "name it unambiguously (an id rather than a label) and try again",
+        accepted: "refused"
+      };
+    case "still_running":
+      return {
+        headline: "that agent is STILL running \u2014 resume only applies to one that has stopped",
+        nextStep: "steer it instead, or wait for it to settle",
+        accepted: "refused"
+      };
+    case "blocked_by_hook":
+      return {
+        headline: "that message was not accepted \u2014 a deployment prompt hook blocked it, so nothing was delivered to the model",
+        nextStep: "edit the content and send it again \u2014 this is not a duplicate submission",
+        accepted: "refused"
+      };
+    case "steering_other":
+      return UNRECOGNISED;
+    case "cancel_lost_race":
+      return {
+        headline: "the pending gate was decided or expired concurrently, so the cancel lost the race",
+        nextStep: "re-read the run state, then cancel again if it is still pending",
+        accepted: "refused"
+      };
+    case "not_found":
+      return {
+        headline: "the engine does not have that run (unknown id, or it belongs to another owner)",
+        nextStep: "nothing was cancelled \u2014 re-read the run list",
+        accepted: "refused"
+      };
+    default:
+      return UNRECOGNISED;
+  }
+}
+function controlSafetyNote(code2) {
+  let a = controlSafetyAdvice(code2);
+  return [`control request refused (${code2})`, a.headline, a.nextStep].join(" \xB7 ");
+}
+function controlSafetyCodeOf(err8) {
+  let c3 = err8?.code;
+  return typeof c3 == "string" && c3.length > 0 ? c3 : void 0;
+}
+var UNRECOGNISED, init_controlSafetyAdvice = __esm({
+  "build-src/src/sema/controlSafetyAdvice.ts"() {
+    UNRECOGNISED = {
+      headline: "the engine refused that control request with a reason this shell does not recognise",
+      nextStep: "nothing was delivered \u2014 retry it, and report the code above if it keeps happening",
+      accepted: "refused"
+    };
+  }
+});
+
 // node_modules/lodash-es/_baseForOwn.js
 function baseForOwn(object4, iteratee) {
   return object4 && baseFor_default(object4, iteratee, keys_default);
@@ -389202,7 +389341,7 @@ function splitShellCompoundSegments(source, options) {
   }
   return segments.push(cur), { segments, pipeFed: connectors.map((k2) => k2 === "|"), connectors };
 }
-var NOT_AUTO_ALLOWED, BASH_READONLY_DEFAULT_ALLOW, BASH_CLASSIFY_DEFAULT_ALLOW, SHELL_OPERATORS2, SHELL_SEGMENT_HARD_REJECT, SHELL_REDIRECTION_OPERATORS, SHELL_CONNECTOR_CHARS, init_bash_readonly_classifier = __esm({
+var NOT_AUTO_ALLOWED, BASH_READONLY_DEFAULT_ALLOW, BASH_CLASSIFY_DEFAULT_ALLOW, SHELL_OPERATORS2, SHELL_SEGMENT_HARD_REJECT, SHELL_REDIRECTION_OPERATORS, SHELL_CONNECTOR_CHARS, BLANK_INLINE, PERL_INLINE, RUBY_INLINE, PYTHON_INLINE, NODE_INLINE, PHP_INLINE, LUA_INLINE, TCL_INLINE, EXPECT_INLINE, AWK_INLINE, JQ_INLINE, BC_INLINE, DC_INLINE, SQLITE_INLINE, PSQL_INLINE, OSASCRIPT_INLINE, RSCRIPT_INLINE, JULIA_INLINE, GHCI_INLINE, GROOVY_INLINE, BUN_INLINE, init_bash_readonly_classifier = __esm({
   "node_modules/@sema-agent/core/dist/tools/fs/bash-readonly-classifier.js"() {
     init_safety();
     NOT_AUTO_ALLOWED = "\u2014 not auto-allowed", BASH_READONLY_DEFAULT_ALLOW = [
@@ -389245,6 +389384,181 @@ var NOT_AUTO_ALLOWED, BASH_READONLY_DEFAULT_ALLOW, BASH_CLASSIFY_DEFAULT_ALLOW,
     ], BASH_CLASSIFY_DEFAULT_ALLOW = [...BASH_READONLY_DEFAULT_ALLOW, "find", "sed", "cd"], SHELL_OPERATORS2 = /[;&|<>$()`\n\r\\]/;
     SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
     SHELL_REDIRECTION_OPERATORS = /[<>]/, SHELL_CONNECTOR_CHARS = /[|&;]/;
+    BLANK_INLINE = {
+      longText: /* @__PURE__ */ new Set(),
+      longFile: /* @__PURE__ */ new Set(),
+      longNamesProgram: /* @__PURE__ */ new Set(),
+      longSupplemental: /* @__PURE__ */ new Set(),
+      longValue: /* @__PURE__ */ new Set(),
+      longPlain: /* @__PURE__ */ new Set(),
+      fileOptionEndsOptions: !1,
+      textLetters: "",
+      fileLetters: "",
+      separatedValueLetters: "",
+      attachedValueLetters: "",
+      plainLetters: "",
+      bannerLetters: "",
+      interactiveLetters: "",
+      programOperand: { at: 0, isText: !1 }
+    }, PERL_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "eEmM",
+      separatedValueLetters: "I",
+      attachedValueLetters: "iCFxDV",
+      plainLetters: "nplawcsStTUWX",
+      bannerLetters: "vVh",
+      stdinWhenUnnamed: !0
+    }, RUBY_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "e",
+      separatedValueLetters: "IrECFKT",
+      plainLetters: "nplawcsSU",
+      bannerLetters: "vh",
+      stdinWhenUnnamed: !0
+    }, PYTHON_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "c",
+      fileLetters: "m",
+      separatedValueLetters: "WXQ",
+      plainLetters: "uBEIsSqbdvxOtR",
+      bannerLetters: "Vh?",
+      interactiveLetters: "i",
+      fileOptionEndsOptions: !0,
+      stdinWhenUnnamed: !0
+    }, NODE_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--eval", "--print"]),
+      textLetters: "ep",
+      longValue: /* @__PURE__ */ new Set(["--import", "--loader", "--experimental-loader", "--require", "--env-file", "--conditions", "--max-old-space-size"]),
+      longNamesProgram: /* @__PURE__ */ new Set(["--test"]),
+      longPlain: /* @__PURE__ */ new Set(["--inspect", "--inspect-brk", "--no-warnings", "--trace-warnings", "--watch", "--enable-source-maps", "--experimental-modules", "--no-deprecation", "--check"]),
+      separatedValueLetters: "r",
+      plainLetters: "c",
+      bannerLetters: "vh",
+      interactiveLetters: "i",
+      stdinWhenUnnamed: !0
+    }, PHP_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--run", "--process-begin", "--process-code", "--process-end"]),
+      textLetters: "rRBE",
+      fileLetters: "fF",
+      separatedValueLetters: "dcz",
+      plainLetters: "nqswl",
+      bannerLetters: "vhi",
+      interactiveLetters: "a",
+      stdinWhenUnnamed: !0
+    }, LUA_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "e",
+      separatedValueLetters: "l",
+      bannerLetters: "vh",
+      interactiveLetters: "i",
+      stdinWhenUnnamed: !0
+    }, TCL_INLINE = { ...BLANK_INLINE, stdinWhenUnnamed: !0 }, EXPECT_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "c",
+      separatedValueLetters: "Db",
+      plainLetters: "dN",
+      bannerLetters: "vh",
+      interactiveLetters: "i",
+      stdinWhenUnnamed: !0
+    }, AWK_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--source"]),
+      textLetters: "e",
+      longFile: /* @__PURE__ */ new Set(["--file", "--exec"]),
+      fileLetters: "fE",
+      separatedValueLetters: "vF",
+      bannerLetters: "V",
+      programOperand: { at: 0, isText: !0 },
+      stdinWhenUnnamed: !1
+    }, JQ_INLINE = {
+      ...BLANK_INLINE,
+      longFile: /* @__PURE__ */ new Set(["--from-file"]),
+      fileLetters: "f",
+      separatedValueLetters: "L",
+      plainLetters: "nrjcsSaCMRe",
+      bannerLetters: "h",
+      programOperand: { at: 0, isText: !0 },
+      stdinWhenUnnamed: !1
+    }, BC_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--expression"]),
+      textLetters: "e",
+      plainLetters: "lqsw",
+      bannerLetters: "vh",
+      interactiveLetters: "i",
+      programOperand: void 0,
+      stdinWhenUnnamed: !0
+    }, DC_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--expression"]),
+      textLetters: "e",
+      longFile: /* @__PURE__ */ new Set(["--file"]),
+      fileLetters: "f",
+      bannerLetters: "hV",
+      programOperand: void 0,
+      stdinWhenUnnamed: !0
+    }, SQLITE_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["-cmd"]),
+      longSupplemental: /* @__PURE__ */ new Set(["-init"]),
+      programOperand: { at: 1, isText: !0 },
+      stdinWhenUnnamed: !0
+    }, PSQL_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--command"]),
+      textLetters: "c",
+      longFile: /* @__PURE__ */ new Set(["--file"]),
+      fileLetters: "f",
+      separatedValueLetters: "hpUdoF",
+      plainLetters: "aeEqtxXwW",
+      bannerLetters: "lV?",
+      programOperand: void 0,
+      stdinWhenUnnamed: !0
+    }, OSASCRIPT_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "e",
+      separatedValueLetters: "ls",
+      plainLetters: "i",
+      bannerLetters: "h",
+      stdinWhenUnnamed: !0
+    }, RSCRIPT_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "e",
+      bannerLetters: "h",
+      stdinWhenUnnamed: !1
+    }, JULIA_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--eval", "--print"]),
+      textLetters: "eE",
+      separatedValueLetters: "JLp",
+      plainLetters: "q",
+      bannerLetters: "vh",
+      interactiveLetters: "i",
+      stdinWhenUnnamed: !0
+    }, GHCI_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "e",
+      separatedValueLetters: "io",
+      programOperand: void 0,
+      stdinWhenUnnamed: !0
+    }, GROOVY_INLINE = {
+      ...BLANK_INLINE,
+      textLetters: "e",
+      separatedValueLetters: "Dcl",
+      plainLetters: "n",
+      bannerLetters: "vh",
+      interactiveLetters: "i",
+      stdinWhenUnnamed: !1
+    }, BUN_INLINE = {
+      ...BLANK_INLINE,
+      longText: /* @__PURE__ */ new Set(["--eval", "--print"]),
+      textLetters: "ep",
+      separatedValueLetters: "r",
+      bannerLetters: "vh",
+      stdinWhenUnnamed: !1
+    };
   }
 });
 
@@ -401635,7 +401949,8 @@ async function durableCancelAttempt(router, taskId) {
         })
       ]);
     } catch (e) {
-      throw !deadlineHit && isDefiniteCancelRefusal(e) && restoreTerminationIntentIf(taskId, durableVersion, beforeAttempt), e;
+      let safetyCode = controlSafetyCodeOf(e);
+      throw safetyCode !== void 0 && semaDebugLine(`[sema][seamQuery] durable cancel refused \xB7 ${controlSafetyNote(safetyCode)}`), !deadlineHit && isDefiniteCancelRefusal(e) && restoreTerminationIntentIf(taskId, durableVersion, beforeAttempt), e;
     } finally {
       deadlineTimer !== void 0 && clearTimeout(deadlineTimer);
     }
@@ -401920,6 +402235,7 @@ function resumeRunningArmWiring() {
 var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, drainingBackoffMs, client, clientExplicitlySet, seamSettings, seamSettingsLastGood, seamSettingsLastGoodSet, printResolvedSettingsProvider, seamWebSearch, seamSkills, seamMcp, seamRewindCapture, seamPendingRewind, INTERRUPT_WIRE_MARKER, seamHistorySeedPending, seamSandbox, seamAutoSandboxInjected, semaAutoResumeStore, HISTORY_SEED_MAX_CHARS, SCENARIO_KEYS, API_ERROR_PREFIX, defaultGatePrompt, canUseTool, durableCancelInFlight, foregroundInteractiveRunId, foregroundInteractiveRunChanged, subscribeToForegroundInteractiveRun, foregroundInteractiveDetachArmed, escCancelInFlight, ESC_CANCEL_TIMEOUT_MS, escCancelTimeoutOverrideMs, RUN_PROBE_TIMEOUT_MS, init_seamQuery = __esm({
   "build-src/src/sema/seamQuery.ts"() {
     init_debugLine();
+    init_controlSafetyAdvice();
     init_hotReconcile();
     init_selfOrchestrationDenial2();
     init_adapter();
@@ -432049,21 +432365,19 @@ var sema_brand_default, init_sema_brand = __esm({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.112",
+        version: "1.0.113",
         notes: [
-          "The bundled engine moves from 7.75.3 to 7.75.4 (core 7.17.5 to 7.17.6). The shell itself is unchanged in this release; the client SDK stays at 9.3.0 and the shared client runtime at 0.68.0.",
-          "Read these next three together with one precondition: the execute-time recheck they describe runs only where the deployment has pinned the read roots (`READ_FACE=roots`, or `engineReadFace` in your settings). With no configuration at all the engine reports an open read face and the recheck does not run, so these three change nothing for a default single-machine setup. `sema doctor` states the engine's read-boundary posture in the engine's own words.",
-          "Security, where read roots are pinned: a shell read that only leaves the roots once the filesystem resolves it is now refused before the command runs. Previously the check was skipped on the lane sema itself uses to run the engine, so reading through a link pointing outside the roots succeeded with no prompt. It now comes back as a failed tool call naming the resolved path and the directories that are allowed. Upgrading is recommended.",
-          "The same refusal now also covers what a glob expands to: `cat vendor/*` is refused when a match resolves outside the roots, as is a pattern the engine cannot enumerate (an unreadable directory, or one matching more than 256 directories). As the engine reports plainly, this also refuses `ls -d .*` and `cat .*`, because `.*` includes the parent of the root.",
-          "A `..` written after a link is now judged where the kernel actually lands: `cat link/../file` is refused when the link's target sits outside the roots, even though the path reads as if it stayed inside. A `..` that stays inside is unchanged.",
-          "These three are refusals, not questions: they happen after the approval step, so a deployment with no approver sees them refused rather than asked. The refusal message states the fix: declare the link's target as a read root. A deployment that declares its execution environment as isolated skips the check entirely.",
-          "Separately, and with no read-face precondition: `sed` is now judged by what its script does, not only by its flags. A script that names a file or runs a command (`r`, `R`, `w`, `W`, `e`, `s///w FILE`, `s///e`) or a script read from a file (`-f FILE`, `--file=`) asks once before the command would run, the request cannot be cleared by an allow rule, and the command does not execute. Plain `sed -i`, `s///` and `sed -n '1,10p'` are unchanged. `env -- <program>` and `coproc <command>` are handled the same way. Widening the read roots does not clear this one.",
-          "For deployments that keep the engine's control directory and its memory directory on two different mounts: a delegated memory hold is no longer quarantined as polluted when the two cannot be renamed across. Single-mount setups are unchanged, and notes already sitting in quarantine are not brought back automatically.",
-          "Known limitation, stated plainly: the shell read boundary is a friction floor at the text level, not containment. It does not model a file read written inside an inline interpreter script (`perl -e`, `ruby -e`, a script piped to `tclsh`), and `time -p` in front of a command can defeat the check for programs invoked through `xargs`. If a task is not trusted, run it in a sandboxed execution environment rather than relying on this floor."
+          "A model answer that quotes a credential now reaches your screen in its redacted form. The engine sends a redacted authoritative copy of each finished passage, and the shell now re-renders the live text from it instead of leaving the character-by-character stream on screen.",
+          "When part of such a passage was already committed above and the engine's redacted copy no longer matches it, the shell now says so in one line \u2014 it names that the copy above may still hold the raw text and that the authoritative version is on the engine. Previously it said nothing at all.",
+          "When a deployment's submit gate blocks something you typed, the line you get now says the three things that matter: it was not accepted, a submit gate blocked it, and editing the content and sending again is the way forward \u2014 it is no longer worded as a duplicate submission or as a content violation.",
+          "The bundled engine moves to 7.76.1 and its read-boundary rules to 7.17.7: passing a program inline to an interpreter (perl -e, python3 -c, node -e, php -r, an awk program, a jq filter, SQL after a database name), starting a bare interpreter that would read its program from standard input, `time -p xargs cat <<< <path>`, and `busybox sh -c ...` now ask for approval instead of running straight through.",
+          "Unchanged by that: running a program from a file. `awk -f prog.awk`, `jq -f filter.jq`, `perl script.pl`, `node app.js`, `python3 -m pytest`, `node --version`, `time -p ls` and `busybox cat f` behave exactly as before. On a setup with nobody to approve, the first group is refused, so move the program into a file if you need it to run unattended.",
+          "Waking a long session is faster on MySQL-protocol and TiDB stores: the engine now pins the query plan for reading a session's newest events instead of letting stale table statistics pick a full-session scan.",
+          "/doctor and the engine line report 7.76.1 so you can confirm which engine you are actually talking to."
         ]
       },
-      productVersion: "1.0.112",
-      announcement: "sema 1.0.112 \u2014 engine pickup only: bundled engine 7.75.4 (core 7.17.6); the shell, client SDK 9.3.0 and client runtime 0.68.0 are unchanged. Security, for deployments that pin read roots: shell reads that only escape the roots once resolved (a link target, a glob match, a `..` after a link) are now refused before the command runs, on every lane including the default host lane. `sed` scripts that name a file or run a command are judged as scripts. Known limitation: inline interpreter scripts (perl -e, ruby -e) are not modelled yet.",
+      productVersion: "1.0.113",
+      announcement: "sema 1.0.113 \u2014 engine pickup + redaction on screen: bundled engine 7.76.1 (core 7.17.7), client runtime 0.68.1, client SDK 9.3.0. A model answer that quotes a credential now reaches the screen in the engine's redacted form; where an earlier part of the passage was already committed, the shell says so in one line instead of staying silent. A message refused by a deployment's prompt hook now explains itself and what to do next. Interpreter one-liners (perl -e, ruby -e, time -p xargs, busybox sh -c) are now judged as programs by the read boundary.",
       version: "1.0.91"
     };
   }
@@ -436396,21 +436710,19 @@ var require_sema_brand = __commonJS({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.112",
+        version: "1.0.113",
         notes: [
-          "The bundled engine moves from 7.75.3 to 7.75.4 (core 7.17.5 to 7.17.6). The shell itself is unchanged in this release; the client SDK stays at 9.3.0 and the shared client runtime at 0.68.0.",
-          "Read these next three together with one precondition: the execute-time recheck they describe runs only where the deployment has pinned the read roots (`READ_FACE=roots`, or `engineReadFace` in your settings). With no configuration at all the engine reports an open read face and the recheck does not run, so these three change nothing for a default single-machine setup. `sema doctor` states the engine's read-boundary posture in the engine's own words.",
-          "Security, where read roots are pinned: a shell read that only leaves the roots once the filesystem resolves it is now refused before the command runs. Previously the check was skipped on the lane sema itself uses to run the engine, so reading through a link pointing outside the roots succeeded with no prompt. It now comes back as a failed tool call naming the resolved path and the directories that are allowed. Upgrading is recommended.",
-          "The same refusal now also covers what a glob expands to: `cat vendor/*` is refused when a match resolves outside the roots, as is a pattern the engine cannot enumerate (an unreadable directory, or one matching more than 256 directories). As the engine reports plainly, this also refuses `ls -d .*` and `cat .*`, because `.*` includes the parent of the root.",
-          "A `..` written after a link is now judged where the kernel actually lands: `cat link/../file` is refused when the link's target sits outside the roots, even though the path reads as if it stayed inside. A `..` that stays inside is unchanged.",
-          "These three are refusals, not questions: they happen after the approval step, so a deployment with no approver sees them refused rather than asked. The refusal message states the fix: declare the link's target as a read root. A deployment that declares its execution environment as isolated skips the check entirely.",
-          "Separately, and with no read-face precondition: `sed` is now judged by what its script does, not only by its flags. A script that names a file or runs a command (`r`, `R`, `w`, `W`, `e`, `s///w FILE`, `s///e`) or a script read from a file (`-f FILE`, `--file=`) asks once before the command would run, the request cannot be cleared by an allow rule, and the command does not execute. Plain `sed -i`, `s///` and `sed -n '1,10p'` are unchanged. `env -- <program>` and `coproc <command>` are handled the same way. Widening the read roots does not clear this one.",
-          "For deployments that keep the engine's control directory and its memory directory on two different mounts: a delegated memory hold is no longer quarantined as polluted when the two cannot be renamed across. Single-mount setups are unchanged, and notes already sitting in quarantine are not brought back automatically.",
-          "Known limitation, stated plainly: the shell read boundary is a friction floor at the text level, not containment. It does not model a file read written inside an inline interpreter script (`perl -e`, `ruby -e`, a script piped to `tclsh`), and `time -p` in front of a command can defeat the check for programs invoked through `xargs`. If a task is not trusted, run it in a sandboxed execution environment rather than relying on this floor."
+          "A model answer that quotes a credential now reaches your screen in its redacted form. The engine sends a redacted authoritative copy of each finished passage, and the shell now re-renders the live text from it instead of leaving the character-by-character stream on screen.",
+          "When part of such a passage was already committed above and the engine's redacted copy no longer matches it, the shell now says so in one line \u2014 it names that the copy above may still hold the raw text and that the authoritative version is on the engine. Previously it said nothing at all.",
+          "When a deployment's submit gate blocks something you typed, the line you get now says the three things that matter: it was not accepted, a submit gate blocked it, and editing the content and sending again is the way forward \u2014 it is no longer worded as a duplicate submission or as a content violation.",
+          "The bundled engine moves to 7.76.1 and its read-boundary rules to 7.17.7: passing a program inline to an interpreter (perl -e, python3 -c, node -e, php -r, an awk program, a jq filter, SQL after a database name), starting a bare interpreter that would read its program from standard input, `time -p xargs cat <<< <path>`, and `busybox sh -c ...` now ask for approval instead of running straight through.",
+          "Unchanged by that: running a program from a file. `awk -f prog.awk`, `jq -f filter.jq`, `perl script.pl`, `node app.js`, `python3 -m pytest`, `node --version`, `time -p ls` and `busybox cat f` behave exactly as before. On a setup with nobody to approve, the first group is refused, so move the program into a file if you need it to run unattended.",
+          "Waking a long session is faster on MySQL-protocol and TiDB stores: the engine now pins the query plan for reading a session's newest events instead of letting stale table statistics pick a full-session scan.",
+          "/doctor and the engine line report 7.76.1 so you can confirm which engine you are actually talking to."
         ]
       },
-      productVersion: "1.0.112",
-      announcement: "sema 1.0.112 \u2014 engine pickup only: bundled engine 7.75.4 (core 7.17.6); the shell, client SDK 9.3.0 and client runtime 0.68.0 are unchanged. Security, for deployments that pin read roots: shell reads that only escape the roots once resolved (a link target, a glob match, a `..` after a link) are now refused before the command runs, on every lane including the default host lane. `sed` scripts that name a file or run a command are judged as scripts. Known limitation: inline interpreter scripts (perl -e, ruby -e) are not modelled yet.",
+      productVersion: "1.0.113",
+      announcement: "sema 1.0.113 \u2014 engine pickup + redaction on screen: bundled engine 7.76.1 (core 7.17.7), client runtime 0.68.1, client SDK 9.3.0. A model answer that quotes a credential now reaches the screen in the engine's redacted form; where an earlier part of the passage was already committed, the shell says so in one line instead of staying silent. A message refused by a deployment's prompt hook now explains itself and what to do next. Interpreter one-liners (perl -e, ruby -e, time -p xargs, busybox sh -c) are now judged as programs by the read boundary.",
       version: "1.0.91"
     };
   }
@@ -475277,8 +475589,18 @@ async function* sdkMessagesToCcEvents(sdk, meta3) {
       }
       case "text_segment_end": {
         textSegmentEndSeen++;
-        let authoritative = e.content, blocks = liveSegmentBlocks, truncated = segmentTruncated, stitchedLen = liveSegmentLen, stitched = liveSegmentText;
-        if (liveSegmentText = "", liveSegmentLen = 0, liveSegmentBlocks = 0, segmentTruncated = !1, !process.env.SEMA_DEBUG) return [];
+        let authoritative = e.content, blocks = liveSegmentBlocks, truncated = segmentTruncated, stitchedLen = liveSegmentLen, stitched = liveSegmentText, out6 = [], divergedLive = e.diverged === !0, committedStale = e.committedPrefixDiverged === !0, prefixLen = typeof e.committedPrefixLen == "number" && Number.isInteger(e.committedPrefixLen) && e.committedPrefixLen > 0 ? e.committedPrefixLen : 0;
+        if (liveSegmentText = "", liveSegmentLen = 0, liveSegmentBlocks = 0, segmentTruncated = !1, divergedLive || committedStale) {
+          let liveTail = committedStale ? "" : authoritative.slice(prefixLen);
+          textBlockIndex = nextBlockIndex++, out6.push(
+            streamEvt({ type: "content_block_start", index: textBlockIndex, content_block: { type: "text", text: "" } })
+          ), liveTail.length > 0 && out6.push(
+            streamEvt({ type: "content_block_delta", index: textBlockIndex, delta: { type: "text_delta", text: liveTail } })
+          );
+        }
+        if (committedStale && (surfaceTranscriptSystemNotice(committedPrefixUnretractableRow(), "warning"), logForDebugging(
+          `[sema][bridge] text_segment_end committedPrefixDiverged (disclosed, not substituted; L-312): prefixLen=${String(prefixLen)} authoritativeLen=${String(authoritative.length)}`
+        )), !process.env.SEMA_DEBUG) return out6;
         try {
           let verdict = stitchedLen === 0 ? "no-live-material" : truncated ? stitchedLen === authoritative.length ? "length-only-match" : "length-only-mismatch" : stitched === authoritative ? "match" : "mismatch", id = wireIdentity(e.eventId);
           semaDebugLine(
@@ -475287,7 +475609,7 @@ async function* sdkMessagesToCcEvents(sdk, meta3) {
         } catch (err8) {
           logForDebugging(`[sema][bridge] text_segment_end reconcile failed (non-fatal): ${String(err8)}`);
         }
-        return [];
+        return out6;
       }
       // 🔴 `tasks_expand`:本通道**今天**无对位面(ctrl+t 面板的展开态由 `task_ledger_sync` 供给,
       //    adapt() 现不发这一臂)。但它仍然是一条**显式臂**,不靠豁免表放行 ——
@@ -502463,7 +502785,7 @@ function refusalKind(err8) {
   return code2 !== void 0 || status3 !== void 0 ? `engine refused: ${code2 ?? ""}${code2 !== void 0 && status3 !== void 0 ? " " : ""}${status3 ?? ""}`.trim() : "outcome UNKNOWN (no status \u2014 the engine may or may not have taken it; steer is at-most-once and is never retried)";
 }
 function blockedByHookNoticeLine(err8) {
-  let raw2 = err8?.message, why = cleanUntrustedForDisplay(typeof raw2 == "string" ? raw2 : "", STEER_BLOCKED_REASON_MAX), head = "That message was not accepted \u2014 a deployment prompt hook blocked it, so nothing was delivered to the model", tail = "it stays queued and will be submitted as-is when this turn ends \u2014 press Up to edit it first.";
+  let raw2 = err8?.message, why = cleanUntrustedForDisplay(typeof raw2 == "string" ? raw2 : "", STEER_BLOCKED_REASON_MAX), headline = controlSafetyAdvice("blocked_by_hook").headline, head = headline.charAt(0).toUpperCase() + headline.slice(1), tail = "it stays queued and will be submitted as-is when this turn ends \u2014 press Up to edit it first.";
   return why.length > 0 ? `${head} (${why}) \u2014 ${tail}` : `${head} \u2014 ${tail}`;
 }
 async function absorbQueuedPromptsViaSteer(deps2) {
@@ -502559,6 +502881,7 @@ var absorbing, host, STEERING_BLOCKED_BY_HOOK_CODE, STEER_BLOCKED_REASON_MAX, in
     init_debug();
     init_transcriptSystemNotice();
     init_untrustedDisplayText();
+    init_controlSafetyAdvice();
     init_messageQueueManager();
     absorbing = !1, host = {};
     STEERING_BLOCKED_BY_HOOK_CODE = "steering.blocked_by_hook", STEER_BLOCKED_REASON_MAX = 400;
@@ -554128,7 +554451,7 @@ Usage: sema --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.112", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
+  }).version("sema 1.0.113", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).psHandler([]), process.exit(process.exitCode ?? 0);
   }), program2.command("logs [id]").description("Print a background session's recent terminal output").action(async (id) => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).logsHandler(id, []), process.exit(process.exitCode ?? 0);

package/sema.js

@@ -80,7 +80,7 @@ function installBootSignalTailFrame(argv2 = process.argv.slice(2)) {
 installBootSignalTailFrame();
 
 // build-src/src/sema/preludeEntry.ts
-var versionLine = "sema 1.0.112" ? "sema 1.0.112" : "";
+var versionLine = "sema 1.0.113" ? "sema 1.0.113" : "";
 var argv = process.argv.slice(2);
 var wantsVersionFastPath = argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v");
 var EARLY_INPUT_PRELUDE_SLOT = /* @__PURE__ */ Symbol.for("sema.earlyInputPrelude");