@sema-agent/server 3.6.0 → 3.6.1

package/dist/hooks/branch-transcript.d.ts

@@ -1,4 +1,24 @@
 import type { SessionTreeEntry } from "@sema-agent/core";
+/**
+ * ── [2092] 渲染臂的判据:**证据面与模型所见同进同出** ─────────────────────────────────────────────
+ * core 的 `SessionTreeEntry` 是 12 型联合,曾经这里只渲 message/compaction 两支 ⇒ 10 型静默丢弃。
+ * 其中 `custom_message` 正是非标准入口用户内容(steering)的落点:core `convertToLlm` 把它按
+ * `role:"user"` 送模型,而证据面渲没了 ⇒ 评估者如实判「证据不足」⇒ 拦停死循环直到 CAP(cli 带
+ * 最小复现的真缺陷)。所以分类规则不是「渲会话内容」,而是:**模型看得见的必须在,看不见的必须不在**。
+ *
+ * 两张表 = 对 core 型全集的**显式全分类**;test/branch-transcript.test.ts 里的闭合钉从 core d.ts
+ * 逐字取联合成员核对「型全集 = 渲染臂 ∪ 跳过表」—— core 加第 13 型 ⇒ 红,逼一次显式分类,
+ * 默认可见(下面循环的 default 臂做通用文本抽取)而不是默认失踪。
+ */
+export declare const RENDERED_ENTRY_TYPES: readonly ["message", "compaction", "custom_message"];
+/**
+ * 跳过的理由逐型给(「纯控制型」不是一句话,是逐个核过模型看不见):
+ * thinking_level_change / model_change / label / session_info / leaf / prompt_epoch /
+ * announced_listing / workspace_state —— 控制面元数据,core 折 messages 时不产出内容;
+ * custom —— data-only(session.js 折 messages 只认 message/custom_message 两型),模型看不见它的
+ * data;把它渲出来反而是把模型没见过的东西冒充成证据,与 [2092] 是同一判据的反方向。
+ */
+export declare const SKIPPED_ENTRY_TYPES: readonly ["thinking_level_change", "model_change", "label", "session_info", "leaf", "prompt_epoch", "announced_listing", "workspace_state", "custom"];
 /** 渲染结果。**判别式**:证据不足时调用方拿不到 `text`,想用也用不了(见顶注)。 */
 export type BranchTranscript = {
     sufficient: true;

package/dist/hooks/branch-transcript.js

@@ -22,14 +22,40 @@
  * ⇒ 截断时必须在文本里**明说截了**,让模型知道自己看到的是一个后缀,而不是全部。
  */
 import { redactSecrets } from "../trace/redact.js";
+/**
+ * ── [2092] 渲染臂的判据:**证据面与模型所见同进同出** ─────────────────────────────────────────────
+ * core 的 `SessionTreeEntry` 是 12 型联合,曾经这里只渲 message/compaction 两支 ⇒ 10 型静默丢弃。
+ * 其中 `custom_message` 正是非标准入口用户内容(steering)的落点:core `convertToLlm` 把它按
+ * `role:"user"` 送模型,而证据面渲没了 ⇒ 评估者如实判「证据不足」⇒ 拦停死循环直到 CAP(cli 带
+ * 最小复现的真缺陷)。所以分类规则不是「渲会话内容」,而是:**模型看得见的必须在,看不见的必须不在**。
+ *
+ * 两张表 = 对 core 型全集的**显式全分类**;test/branch-transcript.test.ts 里的闭合钉从 core d.ts
+ * 逐字取联合成员核对「型全集 = 渲染臂 ∪ 跳过表」—— core 加第 13 型 ⇒ 红,逼一次显式分类,
+ * 默认可见(下面循环的 default 臂做通用文本抽取)而不是默认失踪。
+ */
+export const RENDERED_ENTRY_TYPES = ["message", "compaction", "custom_message"];
+/**
+ * 跳过的理由逐型给(「纯控制型」不是一句话,是逐个核过模型看不见):
+ * thinking_level_change / model_change / label / session_info / leaf / prompt_epoch /
+ * announced_listing / workspace_state —— 控制面元数据,core 折 messages 时不产出内容;
+ * custom —— data-only(session.js 折 messages 只认 message/custom_message 两型),模型看不见它的
+ * data;把它渲出来反而是把模型没见过的东西冒充成证据,与 [2092] 是同一判据的反方向。
+ */
+export const SKIPPED_ENTRY_TYPES = [
+    "thinking_level_change",
+    "model_change",
+    "label",
+    "session_info",
+    "leaf",
+    "prompt_epoch",
+    "announced_listing",
+    "workspace_state",
+    "custom",
+];
 /** 单次评估送进模型的 transcript 字符上限。超出保留**尾部**(最近的对话对"条件是否已达成"更相关)。 */
 export const BRANCH_TRANSCRIPT_MAX_CHARS = 60_000;
-/** 从一条 message entry 里抽人类可读文本(只取 text 片段;工具结果等非文本片段不进 transcript)。 */
-function messageText(entry) {
-    const m = entry.message;
-    if (!m || typeof m.role !== "string")
-        return undefined;
-    const c = m.content;
+/** content(string | 片段数组)→ 可读文本。只取 text 片段;image/工具结果等非文本片段不进 transcript。 */
+function contentText(c) {
     const parts = [];
     if (typeof c === "string")
         parts.push(c);
@@ -40,7 +66,36 @@ function messageText(entry) {
                 parts.push(t);
         }
     }
-    const text = parts.join("\n").trim();
+    return parts.join("\n").trim();
+}
+/**
+ * `role:"bashExecution"` 消息(`!` 命令)→ 模型所见文本。镜像 core `bashExecutionToText`
+ * (dist/engine/harness/messages.js —— core 根不导出,本地镜像,锚在闭合钉+本注上):
+ * convertToLlm 把它按 `role:"user"` 送模型,除非 `excludeFromContext`(那时模型看不见 ⇒ 证据面也不该有)。
+ */
+function bashExecutionText(m) {
+    if (m["excludeFromContext"])
+        return undefined;
+    let text = `Ran \`${String(m["command"] ?? "")}\`\n`;
+    const out = m["output"];
+    text += typeof out === "string" && out ? `\`\`\`\n${out}\n\`\`\`` : "(no output)";
+    if (m["cancelled"])
+        text += "\n\n(command cancelled)";
+    else if (m["exitCode"] !== null && m["exitCode"] !== undefined && m["exitCode"] !== 0)
+        text += `\n\nCommand exited with code ${String(m["exitCode"])}`;
+    return text;
+}
+/** 从一条 message entry 里抽人类可读文本。 */
+function messageText(entry) {
+    const m = entry.message;
+    if (!m || typeof m.role !== "string")
+        return undefined;
+    if (m.role === "bashExecution") {
+        const text = bashExecutionText(m)?.trim();
+        // convertToLlm 对 bashExecution 的送模型 role 是 "user" —— 证据面同款,别让评估者猜生僻 role。
+        return text ? { role: "user", text } : undefined;
+    }
+    const text = contentText(m.content);
     return text ? { role: m.role, text } : undefined;
 }
 /**
@@ -64,7 +119,23 @@ export function renderBranchTranscript(entries, opts) {
             const sum = e.summary;
             if (typeof sum === "string" && sum.trim())
                 lines.push(`[earlier conversation, summarized] ${sum.trim()}`);
+            continue;
         }
+        if (e.type === "custom_message") {
+            // [2092] 真缺陷的落点:steering 等非标准入口的用户内容。core convertToLlm 把它按 role:"user"
+            // 送模型(display 只管 UI,不改模型可见性)—— 证据面同进同出,渲成 user 行。
+            const text = contentText(e.content);
+            if (text)
+                lines.push(`user: ${text}`);
+            continue;
+        }
+        if (SKIPPED_ENTRY_TYPES.includes(e.type))
+            continue;
+        // default 臂:比我们的分类表更新的型(core 加了第 13 型、部署窗里还没重新分类)——
+        // **默认可见而不是默认失踪**:通用文本抽取,能抽出来就带型标渲出;闭合钉会在 CI 红,逼显式分类。
+        const generic = contentText(e.content ?? e.text);
+        if (generic)
+            lines.push(`[${e.type}] ${generic}`);
     }
     if (lines.length === 0)
         return { sufficient: false, reason: "nothing-renderable" };

package/dist/plugins/worktree-isolation.js

@@ -65,6 +65,26 @@ function isWithin(root, child) {
     // (or absolute, on Windows drive change) path for an outside/sibling target.
     return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
 }
+/**
+ * SERIALIZE git worktree ADMIN ops per repo (MODULE-level, keyed by normalized repoRoot). `git worktree
+ * add`/`remove`/`prune` all mutate the same repo's `.git/worktrees` registry; running any two CONCURRENTLY
+ * against one repo races. Two callers share this registry:
+ *   - the isolation wrapper's mint (`add`) and teardown (`remove`) legs;
+ *   - the service reaper's `prune` leg (#62 svc3 race: prune used to bypass the wrapper's closure-local
+ *     lock entirely — the adverse arm is prune observing a mid-mint "registered, dir not yet populated"
+ *     window and DEREGISTERING the half-minted worktree, handing the task a dir git no longer tracks and
+ *     making its eventual `git worktree remove` fail loud on a healthy run).
+ * A promise-chain mutex per repoRoot: each op runs after the prior one SETTLES (success OR failure — never
+ * deadlock). Git ops are ~ms and serial-safe; agents still run fully parallel. The map is bounded by the
+ * number of distinct configured repoRoots (operator config, typically 1) — no eviction needed.
+ */
+const gitAdminLocks = new Map();
+function serializeGitAdmin(repoRoot, fn) {
+    const key = norm(repoRoot);
+    const run = (gitAdminLocks.get(key) ?? Promise.resolve()).then(fn, fn);
+    gitAdminLocks.set(key, run.then(() => undefined, () => undefined));
+    return run;
+}
 /**
  * Wrap a deployment's `executionEnvFactory` so an agent with `ctx.isolation === "worktree"` runs in its own
  * detached git worktree. See the file header for the full contract + trust gate + caveats.
@@ -80,19 +100,7 @@ export function withWorktreeIsolation(baseFactory, opts) {
     if (!allowedRoots.some((root) => isWithin(root, repoRoot))) {
         throw new Error(`withWorktreeIsolation: repoRoot ${repoRoot} is not within any allowedRoots [${allowedRoots.join(", ")}] — refusing to git-worktree an untrusted path`);
     }
-    // SERIALIZE git worktree ADMIN ops on this shared repo. `git worktree add`/`remove` mutate the repo's
-    // `.git/worktrees` registry under a repo-level lock; running them CONCURRENTLY against one repo races (a
-    // parallel fan-out finishing together → the Runner calls several `destroy()` at once → some
-    // `git worktree remove` lose the lock and leave the worktree dir+registration behind — an orphan the
-    // dir-only `pruneWorktrees` can't reap). A per-wrapper (= per-repoRoot) promise-chain mutex chains every
-    // add/remove so they apply one at a time (git ops are fast + serial-safe; the agents themselves still run
-    // fully in parallel — only the ~ms git bookkeeping serializes).
-    let gitLock = Promise.resolve();
-    const serialize = (fn) => {
-        const run = gitLock.then(fn, fn); // run after the prior op SETTLES (success OR failure — never deadlock)
-        gitLock = run.then(() => undefined, () => undefined);
-        return run;
-    };
+    const serialize = (fn) => serializeGitAdmin(repoRoot, fn);
     return async (ctx) => {
         // TRUST GATE: the ONLY trigger is core's RunInternals-sourced ctx.isolation. We read nothing else from ctx
         // (and never anything from a TaskSpec) to decide isolation — see file header.
@@ -162,7 +170,9 @@ export function withWorktreeIsolation(baseFactory, opts) {
  */
 export async function reapOrphanWorktrees(baseEnvForGit, repoRoot, logger) {
     try {
-        await pruneWorktrees(baseEnvForGit, norm(repoRoot));
+        // #62:prune 动的是与 add/remove 同一张 `.git/worktrees` 注册表 ⇒ 必须过同一把 per-repoRoot 锁
+        // (曾绕锁直跑;恶劣臂见 serializeGitAdmin 注)。
+        await serializeGitAdmin(repoRoot, () => pruneWorktrees(baseEnvForGit, norm(repoRoot)));
     }
     catch (e) {
         logger?.warn?.("worktree_prune_failed", { repoRoot: norm(repoRoot), error: e instanceof Error ? e.message : String(e) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.6.0",
+  "version": "3.6.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",