@sema-agent/server 3.4.2 → 3.5.0

package/dist/bench/s1/reviewer.d.ts

@@ -22,7 +22,6 @@ export declare const THINK_MS: {
     /** A pre-action plan review (`CheckpointGate.kind === "plan_review"`). */
     readonly plan_review: 45000;
 };
-export type GateKind = keyof typeof THINK_MS;
 /** Look up the fixed modeled think-time for a gate kind (defaults to the `human` rubric for an unknown kind). */
 export declare function thinkMsForGate(gateKind: string): number;
 /** The trap slice the reviewer needs to apply its rubric (kept narrow to avoid a circular import on tasks.ts). */

package/dist/config-types.d.ts

@@ -357,6 +357,10 @@ export interface ServiceConfigFlat {
      *  `BIND_HOST`(兼容 `HOST`)。显式值恒生效;缺省见 {@link resolveBindHost}——**无鉴权写面
      *  (allowUnauthedWrites 且零凭证)自动收窄到 127.0.0.1**,其余维持全接口(既有部署零影响)。 */
     bindHost?: string;
+    /** [2062]③ `bindHost` 的取值来源(BIND_HOST 显式 / HOST 兼容名 / 未设)。`"HOST"` 时 main.ts 打一行
+     *  启动告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给引擎——bind 面被 shell
+     *  环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。 */
+    bindHostSource?: "BIND_HOST" | "HOST";
     /** D-1 附件孤儿对象 GC 的 grace(毫秒;`ATTACHMENT_ORPHAN_GRACE_MS`,默认 1h,**0=关掉本腿**)。
      *  复审 F10:同 tick 邻居(workflowOrphanGraceMs/attachmentUnboundTtlMs/scratchpadSweepTtlMs)都有
      *  旋钮——存量对象巨大的部署要调慢/停掉,不该被迫取消 MinIO 配置(那会连带关掉整个附件面)。 */
@@ -864,7 +868,7 @@ export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" |
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
 export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */

package/dist/config.js

@@ -873,6 +873,9 @@ function parseAuthDomain(ctx) {
     return {
         // 绑址([1934]):BIND_HOST 优先,HOST 兼容(cli/桌面传的就是它);空串=未设。
         bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
+        // [2062]③ 来源记账:HOST 是 zsh 会替用户设的名字(HOST=机器名),{...process.env} 起底的壳会把它
+        // 静默继承给引擎——bind 面被 shell 环境暗配而部署者不知情。main.ts 对 "HOST" 来源打一行启动告警。
+        bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : process.env.HOST ? "HOST" : undefined,
         authToken: process.env.SERVICE_AUTH_TOKEN,
         authTokens,
         allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
@@ -1224,7 +1227,7 @@ const MEMORY_GROUP_KEYS = [
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "operatorPrincipals", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
-    "principalJwtMaxTtlSec", "bindHost",
+    "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
     "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",

package/dist/elicitation.d.ts

@@ -25,9 +25,6 @@ export interface ElicitationRunContext {
     emit: (frame: ElicitationFrame) => void | Promise<void>;
     abortSignal?: AbortSignal;
 }
-/** @deprecated design/158 N22: the root word got truncated at naming time — `ElicitationFrame` / `ElicitationThrottle` /
- *  `ElicitationCoordinator` all spell it out; this alias was the odd one. Use {@link ElicitationRunContext}. */
-export type ElicitRunContext = ElicitationRunContext;
 export interface ElicitationThrottle {
     /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ decline. */
     maxConcurrentPerRun: number;
@@ -49,10 +46,6 @@ export declare function parseElicitationResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseElicitationResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export declare const parseElicitResponse: typeof parseElicitationResponse;
 /**
  * Coordinates inbound MCP elicitations for one server instance. Process-local + same-replica (the pending map is in
  * memory, like `steerableRuns`): a respond that lands on another replica finds nothing → 404. Present (passed into

package/dist/elicitation.js

@@ -65,10 +65,6 @@ export function parseElicitationResponse(body) {
     }
     return { ok: true, value: { action: b.action } };
 }
-/** @deprecated design/158 N22: renamed to {@link parseElicitationResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export const parseElicitResponse = parseElicitationResponse;
 /** redactDeep + size-bound an UNTRUSTED `requestedSchema` before it is persisted to the durable log / streamed
  *  (the same redact-at-write contract every other untrusted structured field honors, e.g. tool_end.output). A JSON
  *  Schema's free-text carriers (description/title/default/enum) can smuggle a secret. Over the byte cap ⇒ undefined

package/dist/http/server.d.ts

@@ -466,4 +466,6 @@ export declare function clampVerifyRounds(v: unknown): number;
 export declare function createHttpServer(rawDeps: ServiceDeps): http.Server & {
     denyExpiredApprovals: (now: number) => Promise<void>;
 };
+/** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`). */
+export declare function routeLabel(_method: string, url: string): string;
 //# sourceMappingURL=server.d.ts.map

package/dist/http/server.js

@@ -35,15 +35,15 @@ import { handleFleet } from "./routes/fleet.js";
 import { handleTraceUsage } from "./routes/trace-usage.js";
 import { handleWorkflows, handleWorkflowAgentSteer } from "./routes/workflows.js";
 import { handleNotifyWake } from "./routes/notify-wake.js";
-import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_PREEMPT_RE, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
+import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
-import { handleRuns, handleRunVerbs, RUN_CANCEL_RE, RUN_STEER_RE, RUN_DETACH_RE, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
 import { handleSideQuery } from "./routes/side-query.js";
 import { handleTasks } from "./routes/tasks.js";
 import { handleLeader } from "./routes/leader.js";
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
-import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit, BAKE_ID_RE, BAKE_EVENTS_RE, BAKE_CANCEL_RE, BAKE_CLAIM_RE, BAKE_INGEST_RE } from "./routes/images.js";
+import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 // design/158 A9:装配器缝——发送器/身份门下沉到 http/ 叶子模块,routes/* 与 server.ts 共用同一实现
 // (routes/* 绝不可值 import server.ts:那条边会闭合运行时环,见 test/module-cycle-gate.test.ts)。
@@ -2452,50 +2452,65 @@ function isBillableSubmitPath(url) {
 // ⚠️ SSE 帧纪律(2026-07-12):center BFF 中继凭「data 无 type 字段」识别心跳帧并吞掉
 // (AgentEvent 是 closed oneof 全带 type,故可控)。**未来新增任何 SSE data 帧必须带 type 字段**,否则会被
 // 中继当心跳吞掉、永远到不了前端。heartbeat 帧(`event: heartbeat` + `data: {}`)是唯一豁免。
+/** 路由标签表(表驱动;[2061] 批1 层A 重写)。顺序=具体先于泛化。
+ *  🔴 本表由 `test/route-shape-roster.test.ts` 棘轮看守:门机器枚举源码全部路由模式并断言每条都映射到
+ *  非 "other"——新路由不补此表该门当场红(census 抓获本表曾漂掉 56 条模式:session-sync/workspace/
+ *  workflows/subagents/attachments/images/leader 等整族全折 "other",metrics 不可分桶)。 */
+const ROUTE_LABEL_PATTERNS = [
+    [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
+    [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
+    [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
+    [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
+    [/^\/v1\/runs\/[^/]+\/events$/, "/v1/runs/:id/events"],
+    [/^\/v1\/runs\/[^/]+\/subagents\/[^/]+\/(steer|resume|output|stream)$/, "/v1/runs/:id/subagents/:sub/*"],
+    [/^\/v1\/runs\/[^/]+\/tasks\/[^/]+\/(output|stop)$/, "/v1/runs/:id/tasks/:tid/*"],
+    [/^\/v1\/runs\/[^/]+$/, "/v1/runs/:id"],
+    [/^\/v1\/images\/bakes\/[^/]+\/events$/, "/v1/images/bakes/:id/events"],
+    [/^\/v1\/images\/bakes\/[^/]+\/cancel$/, "/v1/images/bakes/:id/cancel"],
+    [/^\/v1\/images\/bakes\/[^/]+\/claim$/, "/v1/images/bakes/:id/claim"],
+    [/^\/v1\/images\/bakes\/[^/]+\/ingest$/, "/v1/images/bakes/:id/ingest"],
+    [/^\/v1\/images\/bakes\/[^/]+$/, "/v1/images/bakes/:id"],
+    [/^\/v1\/images\/digests\/[^/]+$/, "/v1/images/digests/:digest"],
+    [/^\/v1\/images\/[^/]+$/, "/v1/images/:profile"],
+    [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
+    [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
+    [/^\/v1\/approvals\/[^/]+$/, "/v1/approvals/:id"],
+    [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|policy|settings)$/, "/v1/sessions/:id/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/snapshots\/[^/]+\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/snapshots/:key/blobs/:hash"],
+    [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
+    [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/resume$/, "/v1/assistant/tasks/:id/resume"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/plan_review$/, "/v1/assistant/tasks/:id/plan_review"],
+    [/^\/v1\/(elicitations|questions|tool-approvals)\/[^/]+\/respond$/, "/v1/$hitl/:id/respond"],
+    [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
+    [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
+    [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],
+    [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
+    [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
+    [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
+    [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
+    [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
+    [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
+];
+const ROUTE_LABEL_LITERALS = new Set([
+    "/health", "/metrics", "/metrics/summary", "/metrics/plan-cache",
+    "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/tasks/source-summary",
+    "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/approvals/stream",
+    "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities",
+    "/v1/images", "/v1/images/bakes", "/v1/images/bakes/claim", "/v1/images/select", "/v1/images/register",
+    "/v1/workflows", "/v1/attachments", "/v1/leader", "/v1/outcomes", "/v1/side-query",
+    "/v1/memory/export", "/v1/sendfile-links",
+]);
 /** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`). */
-function routeLabel(_method, url) {
-    if (RUN_STEER_RE.test(url))
-        return "/v1/runs/:id/steer";
-    if (RUN_DETACH_RE.test(url))
-        return "/v1/runs/:id/detach";
-    if (RUN_CANCEL_RE.test(url))
-        return "/v1/runs/:id/cancel";
-    if (/^\/v1\/runs\/[^/]+\/events$/.test(url))
-        return "/v1/runs/:id/events";
-    if (/^\/v1\/runs\/[^/]+$/.test(url))
-        return "/v1/runs/:id";
-    if (url === "/v1/images/bakes")
-        return "/v1/images/bakes";
-    if (BAKE_EVENTS_RE.test(url))
-        return "/v1/images/bakes/:id/events";
-    if (BAKE_CANCEL_RE.test(url))
-        return "/v1/images/bakes/:id/cancel";
-    if (BAKE_CLAIM_RE.test(url))
-        return "/v1/images/bakes/:id/claim";
-    if (BAKE_INGEST_RE.test(url))
-        return "/v1/images/bakes/:id/ingest";
-    if (BAKE_ID_RE.test(url))
-        return "/v1/images/bakes/:id";
-    if (url === "/v1/approvals/stream")
-        return "/v1/approvals/stream"; // native-push SSE — distinct from a /:id decide
-    if (/^\/v1\/approvals\/[^/]+$/.test(url))
-        return "/v1/approvals/:id";
-    if (/^\/v1\/sessions\/[^/]+\/wake$/.test(url))
-        return "/v1/sessions/:id/wake";
-    if (/^\/v1\/sessions\/[^/]+\/fork$/.test(url))
-        return "/v1/sessions/:id/fork";
-    if (/^\/v1\/sessions\/[^/]+\/init$/.test(url))
-        return "/v1/sessions/:id/init";
-    if (/^\/v1\/sessions\/[^/]+$/.test(url))
-        return "/v1/sessions/:id";
-    if (ASSISTANT_PREEMPT_RE.test(url))
-        return "/v1/assistant/tasks/:id/preempt";
-    if (ASSISTANT_RESUME_RE.test(url))
-        return "/v1/assistant/tasks/:id/resume";
-    if (ASSISTANT_PLAN_REVIEW_RE.test(url))
-        return "/v1/assistant/tasks/:id/plan_review";
-    const known = ["/health", "/metrics", "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities"];
-    if (known.includes(url))
+export function routeLabel(_method, url) {
+    for (const [re, label] of ROUTE_LABEL_PATTERNS)
+        if (re.test(url))
+            return label;
+    if (ROUTE_LABEL_LITERALS.has(url))
         return url;
     return "other";
 }

package/dist/lsp/types.d.ts

@@ -8,5 +8,5 @@
  * `LspTransport` IMPLEMENTATION (`WsLspTransport` in ws-transport.ts) — core has no WebSocket transport (raw TCP
  * doesn't traverse E2B's HTTP proxy; WS does). "1:1-copy-CC" is the protocol; the WS transport is ours.
  */
-export type { LspOperation, LspRequestParams, LspResult, LspLocation, LspSymbolInfo, LspServerManager, LspSession, LspTransport, LspReadText, } from "@sema-agent/core";
+export type { LspOperation, LspRequestParams, LspResult, LspServerManager, LspSession, LspTransport, LspReadText, } from "@sema-agent/core";
 //# sourceMappingURL=types.d.ts.map

package/dist/main.js

@@ -816,6 +816,14 @@ async function main() {
             ? { note: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
             : {}),
     });
+    // [2062]③ HOST 继承暗通道告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给
+    // 引擎——bind 面被 shell 环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。
+    if (config.bindHostSource === "HOST") {
+        logger.warn("bind_host_from_HOST_env", {
+            bindHost,
+            note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
+        });
+    }
     // fleet worker 接线(announce/heartbeat + usage 批报;lease 消费后一拍):boot 完成后
     // 注册(=首次心跳)。门 = center lane 配置 ∧ FLEET_ADVERTISE_ADDRESS 显式声明(不自猜可达地址);任一缺 → undefined
     // = 非 fleet 部署零行为。draining 翻转的即刻 announce 在 drainThenShutdown;退出 DELETE 在 hardShutdown。

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -62,8 +62,6 @@ export interface HardenedVmLimits {
      *  A script exceeding it OOMs the WORKER (killed), never the shared main process. Default 128. */
     maxHeapMb?: number;
 }
-/** Optional observability hook for contained script-realm rejections (e.g. wire to the deployment logger). */
-export declare function setScriptRealmRejectionObserver(observer: (summary: string) => void): void;
 export declare function installScriptRealmRejectionGuard(): void;
 /**
  * The membrane handed to a surface's `buildGlobals` callback to construct the CONTEXT-LOCAL bindings the

package/dist/orchestration/hardened-vm-runner.js

@@ -48,11 +48,6 @@ function scrubProtoDeep(value) {
  * their global posture, and only then is the hazard live. Idempotent.
  */
 let rejectionGuardInstalled = false;
-let onScriptRealmRejection;
-/** Optional observability hook for contained script-realm rejections (e.g. wire to the deployment logger). */
-export function setScriptRealmRejectionObserver(observer) {
-    onScriptRealmRejection = observer;
-}
 export function installScriptRealmRejectionGuard() {
     if (rejectionGuardInstalled)
         return;
@@ -62,7 +57,7 @@ export function installScriptRealmRejectionGuard() {
             // cross-realm ⇒ minted in a vm context ⇒ an un-awaited rejection inside an untrusted script. Contain.
             const summary = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
             try {
-                (onScriptRealmRejection ?? ((s) => console.warn(`hardened-vm: un-awaited script rejection contained: ${s}`)))(summary);
+                console.warn(`hardened-vm: un-awaited script rejection contained: ${summary}`);
             }
             catch {
                 /* the guard must never become a crash source itself */

package/dist/question.d.ts

@@ -39,10 +39,6 @@ export declare function parseQuestionResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseQuestionResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export declare const parseQuestionAnswer: typeof parseQuestionResponse;
 /**
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present

package/dist/question.js

@@ -63,10 +63,6 @@ export function parseQuestionResponse(body) {
     }
     return { ok: true, value: { answers: out } };
 }
-/** @deprecated design/158 N22: renamed to {@link parseQuestionResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export const parseQuestionAnswer = parseQuestionResponse;
 /** redactDeep + size-bound the UNTRUSTED model-authored questions before they are persisted/streamed (a question's
  *  free-text — question/header/option label+description — can echo a secret from the model's context). Over the byte
  *  cap OR unserializable ⇒ undefined (drop; the ask headless-defaults). */

package/dist/tool-approval.d.ts

@@ -53,11 +53,6 @@ export declare function parseToolApprovalResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseToolApprovalResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"; `ToolApprovalDecision` itself is unchanged — it names the allow/deny VALUE, not the
- *  parse function). Kept as a compat alias. */
-export declare const parseToolApprovalDecision: typeof parseToolApprovalResponse;
 /**
  * Coordinates the live tool-approval HITL for the singleton runner. Process-local + same-replica (the pending map is
  * in memory, like QuestionCoordinator): a respond that lands on another replica finds nothing → 404. Present (passed

package/dist/tool-approval.js

@@ -85,11 +85,6 @@ export function parseToolApprovalResponse(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
-/** @deprecated design/158 N22: renamed to {@link parseToolApprovalResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"; `ToolApprovalDecision` itself is unchanged — it names the allow/deny VALUE, not the
- *  parse function). Kept as a compat alias. */
-export const parseToolApprovalDecision = parseToolApprovalResponse;
 /** [1550] RB-39② 兑现:判别式换 core 1.378 显式键 `fromSubagent`(委派子代 gate 发起的 ask 恒带,受信
  *  internals 事实——worker 不可伪造/不可抑制)。取代 [1546] MED-1 的「在场 ∧ ≠ 宿主 sessionId」权宜式
  *  (旧判别式靠 ctx.sessionId 参与推导,sessionless adhoc 场景无法区分;显式键不依赖 ctx,恒定准确)。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.4.2",
+  "version": "3.5.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",