@sema-agent/server 3.4.2 → 3.5.1

package/dist/bench/s1/reviewer.d.ts

@@ -22,7 +22,6 @@ export declare const THINK_MS: {
     /** A pre-action plan review (`CheckpointGate.kind === "plan_review"`). */
     readonly plan_review: 45000;
 };
-export type GateKind = keyof typeof THINK_MS;
 /** Look up the fixed modeled think-time for a gate kind (defaults to the `human` rubric for an unknown kind). */
 export declare function thinkMsForGate(gateKind: string): number;
 /** The trap slice the reviewer needs to apply its rubric (kept narrow to avoid a circular import on tasks.ts). */

package/dist/config-types.d.ts

@@ -357,6 +357,10 @@ export interface ServiceConfigFlat {
      *  `BIND_HOST`(兼容 `HOST`)。显式值恒生效;缺省见 {@link resolveBindHost}——**无鉴权写面
      *  (allowUnauthedWrites 且零凭证)自动收窄到 127.0.0.1**,其余维持全接口(既有部署零影响)。 */
     bindHost?: string;
+    /** [2062]③ `bindHost` 的取值来源(BIND_HOST 显式 / HOST 兼容名 / 未设)。`"HOST"` 时 main.ts 打一行
+     *  启动告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给引擎——bind 面被 shell
+     *  环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。 */
+    bindHostSource?: "BIND_HOST" | "HOST";
     /** D-1 附件孤儿对象 GC 的 grace(毫秒;`ATTACHMENT_ORPHAN_GRACE_MS`,默认 1h,**0=关掉本腿**)。
      *  复审 F10:同 tick 邻居(workflowOrphanGraceMs/attachmentUnboundTtlMs/scratchpadSweepTtlMs)都有
      *  旋钮——存量对象巨大的部署要调慢/停掉,不该被迫取消 MinIO 配置(那会连带关掉整个附件面)。 */
@@ -864,7 +868,7 @@ export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" |
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memorySync" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
 export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */

package/dist/config.js

@@ -873,6 +873,9 @@ function parseAuthDomain(ctx) {
     return {
         // 绑址([1934]):BIND_HOST 优先,HOST 兼容(cli/桌面传的就是它);空串=未设。
         bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
+        // [2062]③ 来源记账:HOST 是 zsh 会替用户设的名字(HOST=机器名),{...process.env} 起底的壳会把它
+        // 静默继承给引擎——bind 面被 shell 环境暗配而部署者不知情。main.ts 对 "HOST" 来源打一行启动告警。
+        bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : process.env.HOST ? "HOST" : undefined,
         authToken: process.env.SERVICE_AUTH_TOKEN,
         authTokens,
         allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
@@ -1224,7 +1227,7 @@ const MEMORY_GROUP_KEYS = [
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "operatorPrincipals", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
-    "principalJwtMaxTtlSec", "bindHost",
+    "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
     "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",

package/dist/elicitation.d.ts

@@ -25,9 +25,6 @@ export interface ElicitationRunContext {
     emit: (frame: ElicitationFrame) => void | Promise<void>;
     abortSignal?: AbortSignal;
 }
-/** @deprecated design/158 N22: the root word got truncated at naming time — `ElicitationFrame` / `ElicitationThrottle` /
- *  `ElicitationCoordinator` all spell it out; this alias was the odd one. Use {@link ElicitationRunContext}. */
-export type ElicitRunContext = ElicitationRunContext;
 export interface ElicitationThrottle {
     /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ decline. */
     maxConcurrentPerRun: number;
@@ -49,10 +46,6 @@ export declare function parseElicitationResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseElicitationResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export declare const parseElicitResponse: typeof parseElicitationResponse;
 /**
  * Coordinates inbound MCP elicitations for one server instance. Process-local + same-replica (the pending map is in
  * memory, like `steerableRuns`): a respond that lands on another replica finds nothing → 404. Present (passed into

package/dist/elicitation.js

@@ -65,10 +65,6 @@ export function parseElicitationResponse(body) {
     }
     return { ok: true, value: { action: b.action } };
 }
-/** @deprecated design/158 N22: renamed to {@link parseElicitationResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export const parseElicitResponse = parseElicitationResponse;
 /** redactDeep + size-bound an UNTRUSTED `requestedSchema` before it is persisted to the durable log / streamed
  *  (the same redact-at-write contract every other untrusted structured field honors, e.g. tool_end.output). A JSON
  *  Schema's free-text carriers (description/title/default/enum) can smuggle a secret. Over the byte cap ⇒ undefined

package/dist/fleet/fleet-bus.d.ts

@@ -16,7 +16,13 @@ export type FleetTaskStatus = "queued" | "running" | "waiting" | "stopping" | "a
  *  shell-local render state the renderer composes; the wire carries the data that TRANSITIONS). */
 export interface FleetTaskRow {
     id: string;
-    name: string;
+    /** 显示名。**缺席不铸**([2070]③ cli 定谳,server 3.5.1):没有真名时本键**不发**。
+     *  ⚠️ 两代语义留档 —— 3.5.0 及以前,三处在无真名时把**行 id** 顶到本位(匿名子代 tick 铸子代 uuid、
+     *  `onChildTerminal` 合成终帧铸 a\* handle、`publishTask` 懒铸底座铸行 id),于是人眼看到一串乱码
+     *  (clay 亲报的「子代名乱码」形),消费端也**分不清**「它就叫这个」与「我们不知道它叫什么」。
+     *  3.5.1 起后者 = 键缺席,显示占位归客户端渲(cli 已收敛 `'(unnamed)'`)。同一条纪律见 [2053]
+     *  costUSD:诚实缺席 > 编造。(SDK `FleetTaskRow.name` 同步放宽 —— 见发车工单。) */
+    name?: string;
     description?: string;
     /** §K-7 (shell ASK 2026-06-28; byte-aligned to `@sema-agent/sdk` 0.0.39 `FleetTaskRow.agentType`/`agentName`) — a
      *  SHORT agent-TYPE label so the picker renders like CC 187 (`Explore`/`general-purpose`/`code-review`) instead of

package/dist/fleet/fleet-bus.js

@@ -41,7 +41,9 @@ export class FleetEventBus {
     /** Upsert a task row (MERGE onto any existing row by `id`) + fan out the merged row. Publishers may send a
      *  partial `{ id, tokens }` etc.; the row keeps its other fields. */
     publishTask(delta) {
-        const merged = { ...(this.tasks.get(delta.id) ?? { id: delta.id, name: delta.id, status: "running" }), ...delta };
+        // [2070]③:懒铸底座**不带 name** —— 一条只有 `{id,…}` 的首帧此前会把行 id 铸成显示名,而这里
+        // 恰恰是「谁都没给过名字」的位置。真名后到时照常 MERGE 上行(见本文件末的 [2070]③ 第 4 条钉)。
+        const merged = { ...(this.tasks.get(delta.id) ?? { id: delta.id, status: "running" }), ...delta };
         this.tasks.set(delta.id, merged);
         this.emit({ type: "task", row: merged, ts: this.now() });
     }
@@ -157,16 +159,16 @@ export function fleetRunPublisher(bus, run) {
                 // core 1.147 subagent usage tick (per-turn, cumulative) → a CHILD fleet row nested under the run.
                 const cid = childId(ev.taskId);
                 children.add(cid);
-                // BC-2 (core 1.151): use the subagent's sanitized display `name` (taskName/agent-type) for the child row;
-                // fall back to the taskId when absent (an anonymous subagent — core deliberately omits name rather than leak
-                // the delegated objective). The row IDENTITY stays `cid` (runId+taskId); only the display label improves.
+                // BC-2 (core 1.151): use the subagent's sanitized display `name` (taskName/agent-type) for the child row.
+                // [2070]③:name 缺席时**不铸**(此前回落 taskId=子代 uuid,人眼乱码)——行 IDENTITY 一直是 `cid`
+                // (runId+taskId),显示名与身份是两件事,没有显示名就让客户端渲占位。
                 // [WF2-A] redact the subagent display name for PARITY with the top-level run name (fleetRunLabels): core
                 // sanitizes it for RENDERING (ANSI/NUL strip + truncate) but does NOT secret-redact, so a secret-shaped
                 // taskName would leak verbatim on the child row without this.
                 // §K-7: `ev.name` IS the subagent TYPE (BC-2: taskName / selected agent-type) → ALSO surface it as
                 // `agentType` (the picker's short-label field), not only the display `name`. Absent name (anonymous
-                // subagent) → no agentType (the row falls back to name=taskId). One redacted value (name === agentType).
-                const childName = redactSecrets(ev.name ?? ev.taskId);
+                // subagent) → 两位一起缺席(name/agentType 同源同命)。One redacted value (name === agentType).
+                const childName = ev.name !== undefined ? redactSecrets(ev.name) : undefined;
                 if (!childStartedAt.has(cid))
                     childStartedAt.set(cid, Date.now());
                 if (ev.parentToolCallId)
@@ -174,7 +176,7 @@ export function fleetRunPublisher(bus, run) {
                 // [1415]③ 点亮半场:core 1.354 起 settle 时补终态 tick(status 值域 additive 扩 completed|failed;
                 // 此前恒 "running"=行为逐位不变)——workflow 子的 uuid 行终于有完成态可见(running→removed 的
                 // [1414]#3 形就此闭)。
-                bus.publishTask({ id: cid, name: childName, ...(ev.name ? { agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+                bus.publishTask({ id: cid, ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
             }
             else if (ev.type === "tool_start" && ev.toolName) {
                 // BC-1 (clay 2026-06-27): the top-level run row's `description` = LIVE ACTIVITY (the tool now running), NOT
@@ -212,12 +214,13 @@ export function fleetRunPublisher(bus, run) {
             const parentId = ev.parentTaskId && ev.parentTaskId !== run.rootTaskId ? childId(ev.parentTaskId) : run.runId;
             // [WF2-A] redact the forwarded subagent name for parity with the top-level run name (see onEvent above).
             // §K-7: ev.name IS the subagent type → also surface it as `agentType` (picker short label). Reuse the value.
-            const fwdName = redactSecrets(ev.name ?? ev.taskId);
+            // [2070]③ 同 onEvent 臂:无 name ⇒ name/agentType 两位一起缺席(不拿 taskId 冒充显示名)。
+            const fwdName = ev.name !== undefined ? redactSecrets(ev.name) : undefined;
             if (!childStartedAt.has(cid))
                 childStartedAt.set(cid, Date.now());
             if (ev.parentToolCallId)
                 childByToolCall.set(ev.parentToolCallId, cid);
-            bus.publishTask({ id: cid, name: fwdName, ...(ev.name ? { agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) }); // [1415]③ 同上;[1748] toolUses 同 bg lane 口径
+            bus.publishTask({ id: cid, ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) }); // [1415]③ 同上;[1748] toolUses 同 bg lane 口径
         },
         onChildTerminal(taskId, status, altId, toolUseId) {
             // A background subagent/bash CHILD settles — task_progress never emits a terminal tick,
@@ -251,9 +254,11 @@ export function fleetRunPublisher(bus, run) {
             const liveCids = candidateCids.filter((c) => children.has(c));
             const hadRow = liveCids.length > 0;
             // 都没活行 = bash 无 tick 形:按首候选合成瞬态终帧(建即离,诚实且无害)。
+            // [2070]③:合成帧**不铸 name** —— 这条「瞬态」帧会被壳的终态留存池渲 60s,顶上去的 a\* handle
+            // 在那 60s 里就是用户看到的名字。父链接/租户/会话三位照发(它们是归属事实,不是显示名)。
             for (const cid of hadRow ? liveCids : [childId(taskId)]) {
                 const startedAtChild = childStartedAt.get(cid);
-                bus.publishTask({ id: cid, ...(children.has(cid) ? {} : { name: taskId, parentId: run.runId, scope: run.scope, ...sessionField }), status: fleetStatus, ...(startedAtChild !== undefined ? { elapsedMs: Date.now() - startedAtChild } : {}) });
+                bus.publishTask({ id: cid, ...(children.has(cid) ? {} : { parentId: run.runId, scope: run.scope, ...sessionField }), status: fleetStatus, ...(startedAtChild !== undefined ? { elapsedMs: Date.now() - startedAtChild } : {}) });
                 bus.removeTask(cid);
                 children.delete(cid);
                 childStartedAt.delete(cid);

package/dist/http/routes/approvals-assistant.js

@@ -1,6 +1,7 @@
 import { canonicalToolName } from "@sema-agent/core";
 import { principalFrom, verifyDirectDoorProof, MAX_APPROVAL_REASON_CHARS } from "../../security.js";
 import { redactedPreview } from "../../trace/redact.js";
+import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
 import { sleep } from "../sse-log.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator } from "../principal-gate.js";
@@ -227,7 +228,24 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 // ③ 补偿=(a) 行**不消失**——它仍在本列表里带真实 `status`,「所有还停着的任务」由 status 回答;
                 //    (b) failSuspendedWithExpiredCheckpoint 三个 run store 全实装、每 tick 无条件跑(不受
                 //    APPROVAL_TIMEOUT_SEC 开关),窗口由 REAP_INTERVAL_SEC 封顶后收敛成 failed。
-                return { taskId: r.taskId, sessionId: r.sessionId, status: r.status, needsAttention: !!gate, gate, createdAt: r.createdAt, updatedAt: r.updatedAt };
+                // [2069]④(cli 2026-07-30):additive 展示位。行此前只有 taskId/status/needsAttention,面板
+                // 渲不出「这是哪个任务」。源 = run 行自己的 `objectivePreview`(写入时已脱敏 + ~120 截断)——
+                // **不**走 §2 inbox 那套 per-row `getCtx`:本视图头注逐字承诺「ONE query, no N+1」,为两个
+                // 展示位把它变成 N+1 是拿契约换排版。
+                // · `name` 经 `fleetRunLabels()`,与 fleet 行**同一个函数** ⇒ 同一个 run 在两个面板里名字一致
+                //   (两处各写一遍必然漂),顺带白拿 [1414]④ 的控制帧形保护(`<task-notification…>` 给中性名)。
+                // · `description` = 未截断原值,**仅在与 name 不同时才发** —— 相同就是同一句话印两遍
+                //   (BC-1 在 fleet 行上杀掉的 objective-shown-twice)。
+                // · 两键 OMIT-when-absent(无 preview ⇒ 都不发,占位归客户端),同批 [2070]③ 同一条纪律。
+                //   钉:test/assistant-tasks-display-keys.test.ts。
+                const preview = r.objectivePreview?.trim() ? r.objectivePreview : undefined;
+                const label = preview !== undefined ? fleetRunLabels(preview).name : undefined;
+                return {
+                    taskId: r.taskId, sessionId: r.sessionId, status: r.status, needsAttention: !!gate, gate,
+                    ...(label !== undefined ? { name: label } : {}),
+                    ...(preview !== undefined && label !== preview ? { description: preview } : {}),
+                    createdAt: r.createdAt, updatedAt: r.updatedAt,
+                };
             })
                 .sort((a, b) => Number(b.needsAttention) - Number(a.needsAttention) || (b.gate?.severity ?? 0) - (a.gate?.severity ?? 0) || (b.gate?.spentMicroUsd ?? 0) - (a.gate?.spentMicroUsd ?? 0));
             sendJson(res, 200, { tasks });

package/dist/http/server.d.ts

@@ -466,4 +466,6 @@ export declare function clampVerifyRounds(v: unknown): number;
 export declare function createHttpServer(rawDeps: ServiceDeps): http.Server & {
     denyExpiredApprovals: (now: number) => Promise<void>;
 };
+/** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`). */
+export declare function routeLabel(_method: string, url: string): string;
 //# sourceMappingURL=server.d.ts.map

package/dist/http/server.js

@@ -35,15 +35,15 @@ import { handleFleet } from "./routes/fleet.js";
 import { handleTraceUsage } from "./routes/trace-usage.js";
 import { handleWorkflows, handleWorkflowAgentSteer } from "./routes/workflows.js";
 import { handleNotifyWake } from "./routes/notify-wake.js";
-import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_PREEMPT_RE, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
+import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
-import { handleRuns, handleRunVerbs, RUN_CANCEL_RE, RUN_STEER_RE, RUN_DETACH_RE, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
 import { handleSideQuery } from "./routes/side-query.js";
 import { handleTasks } from "./routes/tasks.js";
 import { handleLeader } from "./routes/leader.js";
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
-import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit, BAKE_ID_RE, BAKE_EVENTS_RE, BAKE_CANCEL_RE, BAKE_CLAIM_RE, BAKE_INGEST_RE } from "./routes/images.js";
+import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 // design/158 A9:装配器缝——发送器/身份门下沉到 http/ 叶子模块,routes/* 与 server.ts 共用同一实现
 // (routes/* 绝不可值 import server.ts:那条边会闭合运行时环,见 test/module-cycle-gate.test.ts)。
@@ -2452,50 +2452,65 @@ function isBillableSubmitPath(url) {
 // ⚠️ SSE 帧纪律(2026-07-12):center BFF 中继凭「data 无 type 字段」识别心跳帧并吞掉
 // (AgentEvent 是 closed oneof 全带 type,故可控)。**未来新增任何 SSE data 帧必须带 type 字段**,否则会被
 // 中继当心跳吞掉、永远到不了前端。heartbeat 帧(`event: heartbeat` + `data: {}`)是唯一豁免。
+/** 路由标签表(表驱动;[2061] 批1 层A 重写)。顺序=具体先于泛化。
+ *  🔴 本表由 `test/route-shape-roster.test.ts` 棘轮看守:门机器枚举源码全部路由模式并断言每条都映射到
+ *  非 "other"——新路由不补此表该门当场红(census 抓获本表曾漂掉 56 条模式:session-sync/workspace/
+ *  workflows/subagents/attachments/images/leader 等整族全折 "other",metrics 不可分桶)。 */
+const ROUTE_LABEL_PATTERNS = [
+    [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
+    [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
+    [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
+    [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
+    [/^\/v1\/runs\/[^/]+\/events$/, "/v1/runs/:id/events"],
+    [/^\/v1\/runs\/[^/]+\/subagents\/[^/]+\/(steer|resume|output|stream)$/, "/v1/runs/:id/subagents/:sub/*"],
+    [/^\/v1\/runs\/[^/]+\/tasks\/[^/]+\/(output|stop)$/, "/v1/runs/:id/tasks/:tid/*"],
+    [/^\/v1\/runs\/[^/]+$/, "/v1/runs/:id"],
+    [/^\/v1\/images\/bakes\/[^/]+\/events$/, "/v1/images/bakes/:id/events"],
+    [/^\/v1\/images\/bakes\/[^/]+\/cancel$/, "/v1/images/bakes/:id/cancel"],
+    [/^\/v1\/images\/bakes\/[^/]+\/claim$/, "/v1/images/bakes/:id/claim"],
+    [/^\/v1\/images\/bakes\/[^/]+\/ingest$/, "/v1/images/bakes/:id/ingest"],
+    [/^\/v1\/images\/bakes\/[^/]+$/, "/v1/images/bakes/:id"],
+    [/^\/v1\/images\/digests\/[^/]+$/, "/v1/images/digests/:digest"],
+    [/^\/v1\/images\/[^/]+$/, "/v1/images/:profile"],
+    [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
+    [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
+    [/^\/v1\/approvals\/[^/]+$/, "/v1/approvals/:id"],
+    [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|policy|settings)$/, "/v1/sessions/:id/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/snapshots\/[^/]+\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/snapshots/:key/blobs/:hash"],
+    [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
+    [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/resume$/, "/v1/assistant/tasks/:id/resume"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/plan_review$/, "/v1/assistant/tasks/:id/plan_review"],
+    [/^\/v1\/(elicitations|questions|tool-approvals)\/[^/]+\/respond$/, "/v1/$hitl/:id/respond"],
+    [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
+    [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
+    [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],
+    [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
+    [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
+    [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
+    [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
+    [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
+    [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
+];
+const ROUTE_LABEL_LITERALS = new Set([
+    "/health", "/metrics", "/metrics/summary", "/metrics/plan-cache",
+    "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/tasks/source-summary",
+    "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/approvals/stream",
+    "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities",
+    "/v1/images", "/v1/images/bakes", "/v1/images/bakes/claim", "/v1/images/select", "/v1/images/register",
+    "/v1/workflows", "/v1/attachments", "/v1/leader", "/v1/outcomes", "/v1/side-query",
+    "/v1/memory/export", "/v1/sendfile-links",
+]);
 /** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`). */
-function routeLabel(_method, url) {
-    if (RUN_STEER_RE.test(url))
-        return "/v1/runs/:id/steer";
-    if (RUN_DETACH_RE.test(url))
-        return "/v1/runs/:id/detach";
-    if (RUN_CANCEL_RE.test(url))
-        return "/v1/runs/:id/cancel";
-    if (/^\/v1\/runs\/[^/]+\/events$/.test(url))
-        return "/v1/runs/:id/events";
-    if (/^\/v1\/runs\/[^/]+$/.test(url))
-        return "/v1/runs/:id";
-    if (url === "/v1/images/bakes")
-        return "/v1/images/bakes";
-    if (BAKE_EVENTS_RE.test(url))
-        return "/v1/images/bakes/:id/events";
-    if (BAKE_CANCEL_RE.test(url))
-        return "/v1/images/bakes/:id/cancel";
-    if (BAKE_CLAIM_RE.test(url))
-        return "/v1/images/bakes/:id/claim";
-    if (BAKE_INGEST_RE.test(url))
-        return "/v1/images/bakes/:id/ingest";
-    if (BAKE_ID_RE.test(url))
-        return "/v1/images/bakes/:id";
-    if (url === "/v1/approvals/stream")
-        return "/v1/approvals/stream"; // native-push SSE — distinct from a /:id decide
-    if (/^\/v1\/approvals\/[^/]+$/.test(url))
-        return "/v1/approvals/:id";
-    if (/^\/v1\/sessions\/[^/]+\/wake$/.test(url))
-        return "/v1/sessions/:id/wake";
-    if (/^\/v1\/sessions\/[^/]+\/fork$/.test(url))
-        return "/v1/sessions/:id/fork";
-    if (/^\/v1\/sessions\/[^/]+\/init$/.test(url))
-        return "/v1/sessions/:id/init";
-    if (/^\/v1\/sessions\/[^/]+$/.test(url))
-        return "/v1/sessions/:id";
-    if (ASSISTANT_PREEMPT_RE.test(url))
-        return "/v1/assistant/tasks/:id/preempt";
-    if (ASSISTANT_RESUME_RE.test(url))
-        return "/v1/assistant/tasks/:id/resume";
-    if (ASSISTANT_PLAN_REVIEW_RE.test(url))
-        return "/v1/assistant/tasks/:id/plan_review";
-    const known = ["/health", "/metrics", "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities"];
-    if (known.includes(url))
+export function routeLabel(_method, url) {
+    for (const [re, label] of ROUTE_LABEL_PATTERNS)
+        if (re.test(url))
+            return label;
+    if (ROUTE_LABEL_LITERALS.has(url))
         return url;
     return "other";
 }

package/dist/lsp/types.d.ts

@@ -8,5 +8,5 @@
  * `LspTransport` IMPLEMENTATION (`WsLspTransport` in ws-transport.ts) — core has no WebSocket transport (raw TCP
  * doesn't traverse E2B's HTTP proxy; WS does). "1:1-copy-CC" is the protocol; the WS transport is ours.
  */
-export type { LspOperation, LspRequestParams, LspResult, LspLocation, LspSymbolInfo, LspServerManager, LspSession, LspTransport, LspReadText, } from "@sema-agent/core";
+export type { LspOperation, LspRequestParams, LspResult, LspServerManager, LspSession, LspTransport, LspReadText, } from "@sema-agent/core";
 //# sourceMappingURL=types.d.ts.map

package/dist/main.js

@@ -808,7 +808,34 @@ async function main() {
     runDenySweep = server.denyExpiredApprovals;
     // [1934]:绑址旋钮 + 无鉴权自收窄(理由见 resolveBindHost 顶注)。undefined = Node 默认全接口。
     const bindHost = resolveBindHost(config);
-    await new Promise((resolve) => (bindHost ? server.listen(config.port, bindHost, resolve) : server.listen(config.port, resolve)));
+    // [2062]③ HOST 继承暗通道告警:zsh 常把 HOST 设成机器名,`{...process.env}` 起底的壳会静默继承给
+    // 引擎——bind 面被 shell 环境暗配而部署者不知情(HOST=机器名解析到 LAN 口时=静默扩暴露面)。
+    // 🔴 [2067]③ 次序承重:必须在 listen **之前**打——HOST=不可解析名时 listen 直接 ENOTFOUND 崩溃,
+    // 恰是「继承 HOST 把 boot 弄崩」这个最需要解释的场景;warn 在 listen 后=诊断在崩溃里缺席,用户只见
+    // 裸 getaddrinfo 栈(cli 真机取证)。
+    if (config.bindHostSource === "HOST") {
+        logger.warn("bind_host_from_HOST_env", {
+            bindHost,
+            note: "the bind address came from the HOST env var (not BIND_HOST). Shells like zsh commonly set HOST to the machine name — if you did not set it yourself, this may be an inherited shell variable silently configuring the bind face. Set BIND_HOST explicitly to silence this warning.",
+        });
+    }
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject); // listen 失败(ENOTFOUND/EADDRINUSE…)不吊死这个 Promise
+            bindHost ? server.listen(config.port, bindHost, resolve) : server.listen(config.port, resolve);
+        });
+    }
+    catch (e) {
+        // [2067]③:崩溃路径自带来源诊断——不可解析的 HOST 继承名在这里最常见。
+        logger.error("listen_failed", {
+            port: config.port,
+            bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
+            ...(config.bindHostSource ? { bindHostSource: config.bindHostSource } : {}),
+            ...(config.bindHostSource === "HOST" ? { note: "bind failed for a host inherited from the HOST env var — set BIND_HOST explicitly (e.g. BIND_HOST=127.0.0.1)." } : {}),
+            error: e instanceof Error ? e.message : String(e),
+        });
+        throw e;
+    }
     logger.info("listening", {
         port: config.port,
         bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -62,8 +62,6 @@ export interface HardenedVmLimits {
      *  A script exceeding it OOMs the WORKER (killed), never the shared main process. Default 128. */
     maxHeapMb?: number;
 }
-/** Optional observability hook for contained script-realm rejections (e.g. wire to the deployment logger). */
-export declare function setScriptRealmRejectionObserver(observer: (summary: string) => void): void;
 export declare function installScriptRealmRejectionGuard(): void;
 /**
  * The membrane handed to a surface's `buildGlobals` callback to construct the CONTEXT-LOCAL bindings the

package/dist/orchestration/hardened-vm-runner.js

@@ -48,11 +48,6 @@ function scrubProtoDeep(value) {
  * their global posture, and only then is the hazard live. Idempotent.
  */
 let rejectionGuardInstalled = false;
-let onScriptRealmRejection;
-/** Optional observability hook for contained script-realm rejections (e.g. wire to the deployment logger). */
-export function setScriptRealmRejectionObserver(observer) {
-    onScriptRealmRejection = observer;
-}
 export function installScriptRealmRejectionGuard() {
     if (rejectionGuardInstalled)
         return;
@@ -62,7 +57,7 @@ export function installScriptRealmRejectionGuard() {
             // cross-realm ⇒ minted in a vm context ⇒ an un-awaited rejection inside an untrusted script. Contain.
             const summary = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
             try {
-                (onScriptRealmRejection ?? ((s) => console.warn(`hardened-vm: un-awaited script rejection contained: ${s}`)))(summary);
+                console.warn(`hardened-vm: un-awaited script rejection contained: ${summary}`);
             }
             catch {
                 /* the guard must never become a crash source itself */

package/dist/question.d.ts

@@ -39,10 +39,6 @@ export declare function parseQuestionResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseQuestionResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export declare const parseQuestionAnswer: typeof parseQuestionResponse;
 /**
  * Coordinates AskUserQuestion HITL for the singleton runner. Process-local + same-replica (the pending map is in memory,
  * like ElicitationCoordinator / steerableRuns): a respond that lands on another replica finds nothing → 404. Present

package/dist/question.js

@@ -63,10 +63,6 @@ export function parseQuestionResponse(body) {
     }
     return { ok: true, value: { answers: out } };
 }
-/** @deprecated design/158 N22: renamed to {@link parseQuestionResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"). Kept as a compat alias. */
-export const parseQuestionAnswer = parseQuestionResponse;
 /** redactDeep + size-bound the UNTRUSTED model-authored questions before they are persisted/streamed (a question's
  *  free-text — question/header/option label+description — can echo a secret from the model's context). Over the byte
  *  cap OR unserializable ⇒ undefined (drop; the ask headless-defaults). */

package/dist/tool-approval.d.ts

@@ -53,11 +53,6 @@ export declare function parseToolApprovalResponse(body: unknown): {
     ok: false;
     error: string;
 };
-/** @deprecated design/158 N22: renamed to {@link parseToolApprovalResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"; `ToolApprovalDecision` itself is unchanged — it names the allow/deny VALUE, not the
- *  parse function). Kept as a compat alias. */
-export declare const parseToolApprovalDecision: typeof parseToolApprovalResponse;
 /**
  * Coordinates the live tool-approval HITL for the singleton runner. Process-local + same-replica (the pending map is
  * in memory, like QuestionCoordinator): a respond that lands on another replica finds nothing → 404. Present (passed

package/dist/tool-approval.js

@@ -85,11 +85,6 @@ export function parseToolApprovalResponse(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
-/** @deprecated design/158 N22: renamed to {@link parseToolApprovalResponse} — unifies the HITL trio's parse-fn
- *  vocabulary (`parseQuestionResponse` / `parseElicitationResponse` / `parseToolApprovalResponse`, all "the
- *  human's reply body"; `ToolApprovalDecision` itself is unchanged — it names the allow/deny VALUE, not the
- *  parse function). Kept as a compat alias. */
-export const parseToolApprovalDecision = parseToolApprovalResponse;
 /** [1550] RB-39② 兑现:判别式换 core 1.378 显式键 `fromSubagent`(委派子代 gate 发起的 ask 恒带,受信
  *  internals 事实——worker 不可伪造/不可抑制)。取代 [1546] MED-1 的「在场 ∧ ≠ 宿主 sessionId」权宜式
  *  (旧判别式靠 ctx.sessionId 参与推导,sessionless adhoc 场景无法区分;显式键不依赖 ctx,恒定准确)。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.4.2",
+  "version": "3.5.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -67,7 +67,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^1.1.0",
+    "@sema-agent/sdk": "^2.1.1",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",