@sema-agent/server 4.2.0 → 5.0.0

package/dist/tool-approval.d.ts

@@ -1,4 +1,4 @@
-import { type AskRequest } from "@sema-agent/core";
+import { type AskRequest, type AskOutcome } from "@sema-agent/core";
 /** A live approval frame delivered to whoever tails this run's stream. `type` IS the SSE event name (named-event
  *  convention, same as question). The shell renders `tool_approval` as the CC three-choice card and dismisses on
  *  `tool_approval_complete`. */
@@ -103,7 +103,7 @@ export declare class ToolApprovalCoordinator {
      *  approverUnavailable 回路把这只 ask 交回 suspendAsk 走 durable park(park 设施缺席的部署 core 自己
      *  fail-closed deny)。1.199 的「durable 部署不 wire onAsk」止血就此撤除:恒 wire,park 与 live 卡两全。
      *  Arrow property so it can be passed as `onAsk: coordinator.ask` with `this` bound. */
-    ask: (req: AskRequest, signal?: AbortSignal) => Promise<boolean | "unavailable">;
+    ask: (req: AskRequest, signal?: AbortSignal) => Promise<AskOutcome>;
     /** [1535] server 半场(审批链战役,[1539] 定谳断点①的修;[1546] HIGH-1 broker 形):宿主 sync
      *  streaming 腿在装配点以本闭包挂 `spec.onAsk`;core 继承链(parentConstraints 冻结
      *  `spec.onAsk ?? deps.onAsk`,1.294 起)把它逐 ancestor 冻给每个委派子代——子代(bg/嵌套孙代)的
@@ -115,7 +115,7 @@ export declare class ToolApprovalCoordinator {
         owner: string | null;
         taskId: string;
         sessionId?: string;
-    }) => ((req: AskRequest, signal?: AbortSignal) => Promise<boolean | "unavailable">);
+    }) => ((req: AskRequest, signal?: AbortSignal) => Promise<AskOutcome>);
     /** 广播版裁决路径——`ask()`(ALS,恒单元素数组)与 `boundAsk`([1559]四多活集合,可能多元素)共用。
      *  全体 `ctxs` 保证同一 (owner, sessionId)(streamKey 分组不变式;单元素数组平凡成立)。
      *

package/dist/tool-approval.js

@@ -41,7 +41,7 @@
  * and asks are turn-blocking by construction — the TTL bounds the human-side exposure instead.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, canonicalToolName } from "@sema-agent/core";
+import { uuidv7 } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 /** Size bound on the redacted args payload in a `tool_approval` frame (parity with question's MAX_QUESTIONS_BYTES).
  *  Over the cap ⇒ the frame still goes out WITHOUT args (`argsOmitted: true`) — unlike a question (undisplayable ⇒
@@ -53,17 +53,17 @@ const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
 /** Bound on the remembered allow-all grants (insertion-order evict — a long-lived worker must not grow unbounded). */
 const MAX_ALLOW_SESSIONS = 4096;
 /** The fs-write tool family the session allow-all collapses into ONE capability bucket (canonical space — a
- *  legacy-alias rule or a durable-resume replay carrying a pre-rename toolName still matches; MultiEdit canonicalizes
- *  to Edit). Mirrors core's PATH_WRITE_TOOLS + NotebookEdit (the same set `createFsWriteGatePolicy` gates); NOT
- *  exported by core's index, so the names are pinned here deliberately. */
-const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"].map(canonicalToolName));
+ *  5.0.0 RB-476:折叠面退役,三名即 CC canonical(旧拼法在 core roster 层响亮 miss)。Mirrors core's
+ *  PATH_WRITE_TOOLS + NotebookEdit (the same set `createFsWriteGatePolicy` gates); NOT exported by core's
+ *  index, so the names are pinned here deliberately. */
+const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
 /** The session allow-all CAPABILITY CATEGORY for a tool (修2): the fs-write family shares one bucket ("fs-write" —
  *  a yes-to-edits covers Write/Edit/NotebookEdit alike, CC 207 semantics); every other tool is its OWN bucket
  *  ("tool:<canonical>") so an allow_session on it never grants anything beyond that same tool — a low-risk ask must
  *  not become a session-wide write unlock. Canonical space in, category out. */
 function sessionAllowCategory(toolName) {
-    const canonical = canonicalToolName(toolName);
-    return FS_WRITE_TOOLS.has(canonical) ? "fs-write" : `tool:${canonical}`;
+    // RAW(5.0.0):live 名恒 canonical;存量 grant 键当年也是 canonical 空间铸的,键空间不变。
+    return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
 /** The allow-all grant key (修2): owner + sessionId + capability category, JSON-tuple-encoded so no segment can
  *  ambiguate the boundary with the next (an owner or sessionId containing a separator can't forge another key).
@@ -396,9 +396,9 @@ export class ToolApprovalCoordinator {
         // 方法顶注。
         if (!emitSettled && lastOutcome === "expired")
             return "unavailable";
-        // [1458] updatedInput 前向兼容形:allow+编辑到位 → 以 `{allow:true, updatedInput}` 对象形返回——
-        // 旧 core(≤1.356 resolveAsk 折叠 `ok ? ALLOW`)把对象当 truthy=allow(行为=现状,编辑忽略,壳侧
-        // 版本门挡假 UI);core 放宽 OnAsk 认对象臂后(黑板转单)编辑即生效。deny 恒返 false(falsy 纪律)。
+        // [1458] 编辑放行对象臂:core AskOutcome 公开类型已含 `{allow, updatedInput?}`([1462])——
+        // 宽铸退役,真类型直返(core BAGGAGE #17 严格化前提=对象臂 allow 恒严格 true,我方满足)。
+        // deny 恒返 false(falsy 纪律)。
         if (settled.allowed && settled.updatedInput !== undefined) {
             return { allow: true, updatedInput: settled.updatedInput };
         }

package/dist/trace/artifacts.d.ts

@@ -1,3 +1,14 @@
+/**
+ * trace.artifacts (M2) — project "what the agent produced" from the durable event log.
+ *
+ * Deterministic projection, no new write path: artifacts are DERIVED from the already-persisted
+ * tool_start/tool_end pairs (S2 log), so they exist for every historical run and cannot drift from execution.
+ * v1 produces two kinds:
+ *  - `file`     — a successful `Write` / `Edit` call (deduped per path; the summary counts edits).
+ *  - `git-push` — a successful `bash` call whose command contains `git push` (ref = the parsed refspec tail).
+ * `diff` is declared in the wire schema but NOT produced in v1 (we don't capture patch bodies in the log) —
+ * consumers must treat kinds as an open set. Args in the log are already secret-redacted at persist time.
+ */
 import type { RunEvent } from "../plugins/store-contracts.js";
 export interface TraceArtifact {
     /** Stable within the task: `<taskId>:<n>` in first-seen order — safe as a UI key + dedupe handle. */

package/dist/trace/artifacts.js

@@ -1,24 +1,12 @@
-/**
- * trace.artifacts (M2) — project "what the agent produced" from the durable event log.
- *
- * Deterministic projection, no new write path: artifacts are DERIVED from the already-persisted
- * tool_start/tool_end pairs (S2 log), so they exist for every historical run and cannot drift from execution.
- * v1 produces two kinds:
- *  - `file`     — a successful `Write` / `Edit` call (deduped per path; the summary counts edits).
- *  - `git-push` — a successful `bash` call whose command contains `git push` (ref = the parsed refspec tail).
- * `diff` is declared in the wire schema but NOT produced in v1 (we don't capture patch bodies in the log) —
- * consumers must treat kinds as an open set. Args in the log are already secret-redacted at persist time.
- */
-import { canonicalToolName } from "@sema-agent/core";
 /** Line count of a tool-arg string ("" = 0; no trailing-newline inflation). */
 function lines(v) {
     if (typeof v !== "string" || v.length === 0)
         return 0;
     return v.split("\n").length;
 }
-// Q6 (core 1.161) CC names, CANONICAL only — this projection runs over HISTORICAL event logs, so `canonicalToolName`
-// folds persisted pre-rename rows (a 1.171-era "MultiEdit" start) onto their canonical spelling ("Edit") at read time.
-// core 1.202 retired MultiEdit into an Edit alias; Edit itself now carries an optional `edits[]` batch.
+// Q6 (core 1.161) CC names。5.0.0 RB-476:折叠面退役——本投影跑在历史事件日志上,pre-rename 旧行
+// (如 1.171 时代的 "MultiEdit")不再折到 canonical:旧名行按原名滑过 FILE_TOOLS 判定=不进 artifacts
+// 归类(诚实历史,读面不再兜旧名;耐久面按 [2364] 令牺牲)。
 const FILE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
 const GIT_PUSH_RE = /\bgit\b[^;|&]*\bpush\b\s*(.*)/;
 /** Project the durable event log into artifacts. Events must be in seq order (getEvents guarantees it). */
@@ -39,11 +27,12 @@ export function projectArtifacts(events, run) {
         if (!start)
             continue;
         starts.delete(d.toolCallId); // each call contributes at most once
-        const toolName = canonicalToolName(start.toolName); // fold persisted pre-rename rows (e.g. "MultiEdit") onto CC canonical
+        const toolName = start.toolName; // RAW(5.0.0):折叠面退役,历史旧名行按原名处理(见文件头注)
         if (FILE_TOOLS.has(toolName)) {
-            // Write/Edit key the write target on `file_path` (core 1.169 batch-B renamed `path`→`file_path`, dual-accept) —
-            // try it FIRST, fall back to `path` (a pre-1.169 emit or durable checkpoint still carries the old name), then
-            // NotebookEdit's `notebook_path` (core 1.163; unchanged by batch-B). Missing all three → not a path-bearing call.
+            // Write/Edit key the write target on `file_path`. core 5.1.0([2390])收窄 schema 为 `file_path` 单形,
+            // 但**门读侧 over-read 保留**是同批 KEEP 裁定(fail-closed 方向)——这里是耐久历史行的读侧([2373] D 类),
+            // pre-1.169 emit/旧 durable checkpoint 仍带 `path`,回落臂是对自己旧数据的容忍,不是对上游新帧的兼容。
+            // 再回落 NotebookEdit 的 `notebook_path`(core 1.163)。三键全缺 → 非带路径调用。
             const path = typeof start.args["file_path"] === "string" ? start.args["file_path"] : typeof start.args["path"] === "string" ? start.args["path"] : typeof start.args["notebook_path"] === "string" ? start.args["notebook_path"] : undefined;
             if (!path)
                 continue;

package/dist/trace/ledger-sink.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "./redact.js";
-import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, turnEndEventData, contextUsageEventData } from "./project.js";
+import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
 export function createLedgerSink(opts) {
     const keys = opts.notifiedKeys ?? new NotifiedKeys();
@@ -101,6 +101,12 @@ export function createLedgerSink(opts) {
                 await flush();
                 await append("steering_injected", steeringInjectedEventData(ev));
                 break;
+            case "compaction_outcome":
+                // [2373]A-2/C-2:此前 durable 双腿零 case ⇒ 回放即消失(与 [1622] label / [1611] workflowRunId
+                // 同族)。共享 builder(§E1 脱敏)三腿同源;差集门 durable-append-arm-parity 看守。
+                await flush();
+                await append("compaction_outcome", compactionOutcomeEventData(ev));
+                break;
             case "workspace_changed":
                 // [1559]二 core 裁定:design/99 §E13 旧臂,L1 门扩臂时首次撞见。durable 记账与其余内容型臂
                 // 同处置(轨迹回放时「何时 cd 到了哪」是合法历史事实,「不当持久态渲染」是 LIVE 消费端纪律,

package/dist/trace/project.d.ts

@@ -235,6 +235,17 @@ export declare function steeringInjectedEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;
+/** `compaction_outcome`(core 2.5.0 [2105]②:压缩非 compacted 结局——manual /compact 的 mooted/failed
+ *  两条真路)。[2373]A-2/C-2:此前它是**唯一**不走共享 builder、只在 live 腿 res.write 内联挑键的
+ *  内容帧 ⇒ 两条 durable 腿零 case、回放即消失、三方普查各自失明。收进共享白名单 builder,三腿同源。
+ *  outcome/trigger=闭枚举 verbatim;reason=引擎说明文本(可能引用配置值)→ redactSecrets;identity 同款。 */
+export declare function compactionOutcomeEventData(ev: {
+    outcome?: unknown;
+    trigger?: unknown;
+    reason?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown>;
 /** The `workspace_changed` payload([1559]二 core 裁定:design/99 §E13 旧臂,L1 门本车首次撞见——非新增,
  *  是本门扩 TaskEvent 臂集时第一次显式处置。语义 = bash `cd`/EnterWorktree 移动任务逻辑 cwd 后,在移动
  *  它的工具结算后发一帧,给 shell/宿主 UI 一个路径提示行。cwd 与已展示的工具 args 同信任级[UNTRUSTED,
@@ -347,6 +358,12 @@ export declare function turnEndEventData(ev: {
  *  `in` 落回旧值,读端零伤)。`uncachedIn` 只在**能确认自己踩在新契约帧上**(`totalInputTokens` 在场)时
  *  才发——旧帧的 `inputTokens` 是族依赖的旧语义,标成「uncachedIn(cache-MISS)」会是谎言。 */
 export declare function toContractTokens(usage: unknown): TraceTurn["tokens"] | undefined;
+/** [2373]C-13:tool_start/tool_end 的**共享挑键**——`projectEvents`(turns 面)与 `mapTraceEvent`
+ *  (trace SSE 面)对同一账本行的字段选择逐字同构,此前两处独立手写,structured/totalChars/label
+ *  三次扩字段各改两遍(见两处对偶注)。收一份:两面各自包装键名皮(id/name/input vs 同名),
+ *  字段集合从此单点演进。 */
+export declare function toolCallFieldsOf(d: Record<string, unknown>): Record<string, unknown>;
+export declare function toolResultFieldsOf(d: Record<string, unknown>): Record<string, unknown>;
 export interface ProjectOpts {
     /** Prepend the user turn (the objective is not in the event log; the endpoint supplies it). */
     objective?: string;

package/dist/trace/project.js

@@ -12,6 +12,8 @@ export async function appendModelUsageDelta(append, modelUsage, taskId) {
     const delta = modelUsage?.drain(taskId);
     if (delta) {
         const tagged = {};
+        // [2373]A-4 记账(2026-08-02):usageBasis(与 TraceTurn.tokens.uncachedIn 同族)五端+黑盒仓零运行时读者——
+        // 3.0.0 cache 语义翻转的诚实位,契约正确但暂无消费;web/desktop 接账单面时它是现成的。
         for (const [model, d] of Object.entries(delta))
             tagged[model] = { ...d, usageBasis: "uncached-components-v1" };
         await append("model_usage", { usage: tagged });
@@ -296,6 +298,19 @@ export function steeringInjectedEventData(ev) {
         ...identityFields(ev),
     };
 }
+/** `compaction_outcome`(core 2.5.0 [2105]②:压缩非 compacted 结局——manual /compact 的 mooted/failed
+ *  两条真路)。[2373]A-2/C-2:此前它是**唯一**不走共享 builder、只在 live 腿 res.write 内联挑键的
+ *  内容帧 ⇒ 两条 durable 腿零 case、回放即消失、三方普查各自失明。收进共享白名单 builder,三腿同源。
+ *  outcome/trigger=闭枚举 verbatim;reason=引擎说明文本(可能引用配置值)→ redactSecrets;identity 同款。 */
+export function compactionOutcomeEventData(ev) {
+    // 形参照 contextUsageEventData 先例:全可选 unknown + 内部窄化,call site 免宽铸型(棘轮零新增)。
+    return {
+        outcome: String(ev.outcome),
+        trigger: String(ev.trigger),
+        ...(ev.reason !== undefined ? { reason: redactSecrets(String(ev.reason)) } : {}),
+        ...identityFields(ev),
+    };
+}
 /** The `workspace_changed` payload([1559]二 core 裁定:design/99 §E13 旧臂,L1 门本车首次撞见——非新增,
  *  是本门扩 TaskEvent 臂集时第一次显式处置。语义 = bash `cd`/EnterWorktree 移动任务逻辑 cwd 后,在移动
  *  它的工具结算后发一帧,给 shell/宿主 UI 一个路径提示行。cwd 与已展示的工具 args 同信任级[UNTRUSTED,
@@ -395,6 +410,9 @@ export function compactedEventData(ev) {
  *    挂那儿会是"另一次更早的测量顶着同一个名字")。去 turn_end 找是找不到的。
  * 三个字段都是引擎派生的有限数标量 ⇒ 走 finite 门(与 compacted 的 1.289 标量同姿势),非有限即缺席。
  */
+// [2373]A-3 记账(2026-08-02):SDK 有臂、五端零读点(webC Composer 读的是本端自己的 state.context,
+// 非 wire 三键)——半死:契约面已就位、消费端一个都没接。头注下方的三条口径纪律警告的消费者还不存在;
+// 谁要做压缩面板,这是真正需要的量,先上黑板认领。
 export function contextUsageEventData(ev) {
     const n = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
     return {
@@ -442,6 +460,29 @@ export function toContractTokens(usage) {
         ...(u.cacheWriteTokens != null ? { cacheWrite: u.cacheWriteTokens } : {}),
     };
 }
+/** [2373]C-13:tool_start/tool_end 的**共享挑键**——`projectEvents`(turns 面)与 `mapTraceEvent`
+ *  (trace SSE 面)对同一账本行的字段选择逐字同构,此前两处独立手写,structured/totalChars/label
+ *  三次扩字段各改两遍(见两处对偶注)。收一份:两面各自包装键名皮(id/name/input vs 同名),
+ *  字段集合从此单点演进。 */
+export function toolCallFieldsOf(d) {
+    return {
+        id: String(d.toolCallId ?? ""),
+        name: String(d.toolName ?? ""),
+        ...(typeof d.label === "string" ? { label: d.label } : {}),
+        input: d.args,
+        ...identityFields(d),
+    };
+}
+export function toolResultFieldsOf(d) {
+    return {
+        callId: String(d.toolCallId ?? ""),
+        ...(typeof d.label === "string" ? { label: d.label } : {}),
+        ...(d.truncated ? { truncated: true } : {}),
+        ...(Number.isFinite(d.totalChars) ? { totalChars: d.totalChars } : {}),
+        ...(d.structured !== undefined ? { structured: d.structured } : {}),
+        ...identityFields(d),
+    };
+}
 /** Project a per-task event slice (seq-ascending) into ordered `TraceTurn[]`. Pure + total (never throws). */
 export function projectEvents(events, opts = {}) {
     const turns = [];
@@ -470,14 +511,14 @@ export function projectEvents(events, opts = {}) {
                 break;
             case "tool_start":
                 firstTs ??= ev.ts;
-                blocks.push({ type: "tool-call", id: String(d.toolCallId ?? ""), name: String(d.toolName ?? ""), ...(typeof d.label === "string" ? { label: d.label } : {}), input: d.args, ...identityFields(d) });
+                blocks.push({ type: "tool-call", ...toolCallFieldsOf(d) });
                 break;
             case "tool_end": {
                 const callId = String(d.toolCallId ?? "");
                 // E1: output is read straight off the (already-redacted-at-append) event — no session join. Absent ⇒ undefined.
                 // `structured` (core 1.203 CC card) was redacted at APPEND (toolEndEventData) — passthrough on the read
                 // path so a cold-replay/turns consumer renders the same rich card the live wire carried (additive field).
-                blocks.push({ type: "tool-result", callId, ...(typeof d.label === "string" ? { label: d.label } : {}), output: d.output, ...(d.isError ? { isError: true } : {}), ...(d.truncated ? { truncated: true } : {}), ...(Number.isFinite(d.totalChars) ? { totalChars: d.totalChars } : {}), ...(d.structured !== undefined ? { structured: d.structured } : {}), ...identityFields(d) });
+                blocks.push({ type: "tool-result", ...toolResultFieldsOf(d), output: d.output, ...(d.isError ? { isError: true } : {}) });
                 break;
             }
             case "prompt_assembled":
@@ -525,6 +566,8 @@ export function lastStep(latestEventType, status) {
 /** A run record → the cheap list summary (contract 2.1). Token/cost/turns come from the terminal result.stats;
  *  scenario isn't denormalized on the run row (omitted — a later push-index/column refinement). */
 export function taskSummary(run, latestEventType) {
+    // [2373]D-1(活 bug 修):core 2.0.0 起浮点 costUsd 族整删,stats 只有整数 costMicroUsd —— 旧读点
+    // (costUsd × 1e6)对现役 core 恒缺席,verbatim 透传才是唯一正确形。
     const stats = (run.result?.stats ?? {});
     const terminal = run.status !== "running";
     return {
@@ -538,7 +581,7 @@ export function taskSummary(run, latestEventType) {
         ...(terminal ? { endedAt: run.updatedAt } : {}),
         ...(stats.turns !== undefined ? { turns: stats.turns } : {}),
         ...(stats.tokens !== undefined ? { tokens: stats.tokens } : {}),
-        ...(stats.costUsd !== undefined ? { costMicroUsd: Math.round(stats.costUsd * 1e6) } : {}),
+        ...(stats.costMicroUsd !== undefined ? { costMicroUsd: stats.costMicroUsd } : {}),
         lastStep: lastStep(latestEventType, run.status),
     };
 }
@@ -560,16 +603,23 @@ export function normalizeRunEventType(type) {
 /** Map one durable event → a sema-registry SSE trace event (contract 2.3). null = not a client event. The
  *  durable log is block-grained, so each block ships as one "delta" the client appends (stream mode = "delta"). */
 export function mapTraceEvent(type, seq, data) {
+    const mapped = mapTraceEventInner(type, seq, data);
+    if (mapped === null)
+        return null;
+    // [2373]C-12:data 里补 `type`(=event 名)双发(fleet 流同批;error 帧 arm 自带 type 保持原值)。
+    return { event: mapped.event, data: { type: mapped.event, ...mapped.data } };
+}
+function mapTraceEventInner(type, seq, data) {
     switch (type) {
         case "reasoning":
             return { event: "block-thinking-delta", data: { seq, text: String(data.text ?? "") } };
         case "text":
             return { event: "block-content-delta", data: { seq, text: String(data.text ?? "") } };
         case "tool_start":
-            return { event: "tool-call", data: { seq, id: data.toolCallId, name: data.toolName, ...(typeof data.label === "string" ? { label: data.label } : {}), input: data.args, ...identityFields(data) } };
+            return { event: "tool-call", data: { seq, ...toolCallFieldsOf(data) } };
         case "tool_end":
             // E1: output/truncated are already redacted+bounded at append; pass through. E2: identity additive.
-            return { event: "tool-result", data: { seq, callId: data.toolCallId, ...(typeof data.label === "string" ? { label: data.label } : {}), isError: Boolean(data.isError), ...(data.output !== undefined ? { output: data.output } : {}), ...(data.truncated ? { truncated: true } : {}), ...(Number.isFinite(data.totalChars) ? { totalChars: data.totalChars } : {}), ...(data.structured !== undefined ? { structured: data.structured } : {}), ...identityFields(data) } };
+            return { event: "tool-result", data: { seq, ...toolResultFieldsOf(data), isError: Boolean(data.isError), ...(data.output !== undefined ? { output: data.output } : {}) } };
         case "turn_end": {
             const tokens = toContractTokens(data.usage);
             return { event: "turn", data: { seq, ...(tokens ? { tokens } : {}) } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "4.2.0",
+  "version": "5.0.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^4.0.0",
+    "@sema-agent/core": "^5.1.0",
     "@sema-agent/registry-core": "^0.13.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",

package/dist/capabilities/oa-tools.d.ts

@@ -1,15 +0,0 @@
-import type { ToolSpec } from "@sema-agent/core";
-/**
- * OA scenario — tools are thin HTTP clients to the OA backend's existing APIs (read = /api/v1/*,
- * write = /api/assets/*). The shared service token + the request's principal are forwarded so OA
- * enforces THAT end-user's RBAC + audit (the service never holds per-user creds). Decoupled: the
- * service knows no OA schema/DB — OA stays the source of truth (its /api/v1/meta is self-describing).
- */
-export interface OaCtx {
-    baseUrl: string;
-    token: string;
-    principal?: string;
-}
-export declare function oaTools(ctx: OaCtx): ToolSpec[];
-export declare const oaPrompt: import("@sema-agent/core").PromptProvider;
-//# sourceMappingURL=oa-tools.d.ts.map

package/dist/capabilities/oa-tools.js

@@ -1,54 +0,0 @@
-import { Type } from "typebox";
-import { stablePrompt } from "./prompt.js";
-async function oaFetch(ctx, path, init) {
-    if (!ctx.baseUrl || !ctx.token)
-        return "OA 后端未配置(OA_API_BASEURL / OA_SERVICE_TOKEN)";
-    try {
-        const res = await fetch(ctx.baseUrl + path, {
-            method: init?.method ?? "GET",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${ctx.token}`,
-                ...(ctx.principal ? { "x-agent-principal": ctx.principal } : {}),
-            },
-            body: init?.body !== undefined ? JSON.stringify(init.body) : undefined,
-        });
-        const text = await res.text();
-        if (!res.ok)
-            return `OA ${res.status}: ${text.slice(0, 600)}`;
-        return text.slice(0, 60_000);
-    }
-    catch (e) {
-        return `调用 OA 失败：${e.message}`;
-    }
-}
-const needWrite = (ctx) => (!ctx.principal ? "缺少身份(principal)，无法代表用户写库；请让调用方带上 x-agent-principal。" : null);
-export function oaTools(ctx) {
-    const obj = Type.Object({}, { additionalProperties: true });
-    return [
-        { name: "oa_schema", effect: "read", description: "取 OA 数据结构(每类资产的字段/必填/条件必填 requiredWhen/联动 showWhen/枚举、生命周期、表名)。建/改前先调它，别凭记忆。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/meta") },
-        { name: "oa_alerts", effect: "read", description: "派生告警：GP 闲置(已注册未变现) / APP 未上架(已接广告未 LIVE)。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/alerts") },
-        { name: "oa_list", effect: "read", description: "列出某类资产。type∈gp/package/ad-platform/ad-unit/email/environment/proxy。可选 q 关键字。", parameters: Type.Object({ type: Type.String(), q: Type.Optional(Type.String()) }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}${x.q ? `?q=${encodeURIComponent(x.q)}` : ""}`); } },
-        { name: "oa_get", effect: "read", description: "取某资产详情(敏感字段为掩码)。", parameters: Type.Object({ type: Type.String(), id: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`); } },
-        { name: "oa_lookup", effect: "read", description: "约定字段值反查(同手机/证件=同一实物)。field: phone|idCardNo|bizLicenseNo。", parameters: Type.Object({ field: Type.String(), value: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/lookup?field=${encodeURIComponent(x.field)}&value=${encodeURIComponent(x.value)}`); } },
-        { name: "oa_create", effect: "write", description: "创建实体(走 OA 校验+当前用户 RBAC+审计)。type + data(字段对象，参照 oa_schema)。失败会返回缺失/非法字段。", parameters: Type.Object({ type: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
-                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}`, { method: "POST", body: x.data ?? {} }); } },
-        { name: "oa_update", effect: "write", description: "改字段(敏感留空=保持原值；状态字段改不动，用 oa_transition)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
-                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`, { method: "PATCH", body: x.data ?? {} }); } },
-        { name: "oa_transition", effect: "write", description: "受控状态流转(先 oa_schema 看可用迁移；风险/弃用等需 note)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), to: Type.String(), note: Type.Optional(Type.String()) }), execute: (a) => { const e = needWrite(ctx); if (e)
-                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}/transition`, { method: "POST", body: { to: x.to, note: x.note ?? null } }); } },
-    ];
-}
-// OA business prompt MOVED OUT — migration complete (design/29, 2026-06-05). Persona / 工作准则 / UI
-// markers (::FORM:: / ::GOTO:: / ::SUGGEST:: / ::ISSUE_FORM::) / 分级确认 / 报bug流程 are OA's business,
-// and OA now injects the WHOLE thing per request via `request.systemPrompt` (it holds the service token,
-// content is stable per OA version → cacheable prefix; page context still rides `objective`). Keeping
-// any of it here would just DUPLICATE OA's prompt, so the base is EMPTY — single source of truth = OA.
-// The service stays business-agnostic: it provides the oa_* tools (referenced by NAME from OA's prompt;
-// they carry their own descriptions) and nothing else. `stablePrompt` keeps STABLE→VARIABLE order —
-// OA's systemPrompt is appended after this (empty) base, before core's <user_memory>.
-// (::ISSUE_FORM:: is parsed/rendered + submitted entirely by OA's frontend via OA /api/ai/issue — the
-//  service never touches it; `open_gitea_issue` remains only as the unattended/automated fallback.)
-const OA_SYSTEM = "";
-export const oaPrompt = stablePrompt(OA_SYSTEM);
-//# sourceMappingURL=oa-tools.js.map

package/dist/plugins/approval-store-sql.d.ts

@@ -1,116 +0,0 @@
-/**
- * Durable approval store for the human-in-the-loop write gate (F4) — SINGLE-FILE DUAL-DIALECT
- * (design/158 A12 定型半场). ONE implementation, TWO dialects; the historical `TiDBApprovalStore` /
- * `PgApprovalStore` class names survive as thin ctor subclasses so every consumer (store-backend.ts,
- * src/index.ts, the approval/audit/security-coverage suites) is untouched.
- *
- * When a gated tool call is about to run, a `pending` row is recorded here; the instance running the
- * task polls it for a decision. Because the row is durable and shared, an operator's approve/deny can
- * land on ANY instance — critical under async runs + a load balancer, where the deciding request and
- * the waiting run are usually on different instances.
- *
- * Unlike the run/checkpoint PG store (whose schema is owned centrally by pg-pool.ts), this file also
- * exports a self-contained PG schema (`PG_APPROVAL_SCHEMA` + `ensureSchema`) — the `approval` table is
- * DISJOINT from the other PG stores' tables, so a CREATE IF NOT EXISTS here shadows nothing. Central
- * aggregation into pg-pool.ts composes it alongside the others. Kept in lock-step with the TiDB store
- * by the shared real-DB integration suite (test/pg-approval-store-integration.test.ts).
- *
- * ── Dialect deltas, kept EXPLICIT ────────────────────────────────────────────────────────────────────
- *   - `?` placeholders vs `$n`
- *   - null-safe scope compare: `<=>` vs `IS NOT DISTINCT FROM` (a NULL scope row — legacy/untenanted
- *     run — is matched by a NULL scope arg; one tenant's scope NEVER matches another's — the
- *     single-DB fleet read guard, defense-in-depth)
- *   - JSON binding: TiDB `JSON.stringify` verbatim vs PG `pgProtocolJsonStringify` (codex R4-H2: the
- *     persisted approval `args` is the operator's REVIEW surface and must agree byte-for-byte with the
- *     policy-executed args — a lossy/rewriting envelope would let an operator approve one payload while
- *     a different one runs)
- *   - affectedRows vs rowCount (via SqlDriver)
- *   - schema ownership: TiDB DDL lives in tidb-pool.ts SCHEMA_STATEMENTS; PG DDL is this file's own
- *     self-contained `PG_APPROVAL_SCHEMA` (see the PG twin's original header — unlike the other PG
- *     stores, `approval` is NOT centrally owned by pg-pool.ts's DDL array, only aggregated into its
- *     `ensureSchema` composition).
- *   - `getStatus` result shape: `RowDataPacket[]` (mysql2 typed query) vs a plain-record `pg` query —
- *     normalized to `SqlRow` by the shared driver, so both arms read the same field names.
- */
-import type { Pool as MySqlPool } from "mysql2/promise";
-import type { Pool as PgPool, PoolClient } from "pg";
-import { type SqlDriver } from "./sql-driver.js";
-export type ApprovalStatus = "pending" | "approved" | "denied" | "expired";
-export interface ApprovalRow {
-    id: string;
-    taskId: string | null;
-    sessionId: string | null;
-    owner: string | null;
-    /** Single-DB fleet scope guard (defense-in-depth): the run's tenant identity, owner-sourced. Reads filter on it. */
-    scope: string | null;
-    toolName: string;
-    args: unknown;
-    status: ApprovalStatus;
-    reason: string | null;
-    decidedBy: string | null;
-    createdAt: string;
-    decidedAt: string | null;
-}
-/** PG translation of the `approval` DDL in tidb-pool.ts SCHEMA_STATEMENTS (JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3),
- *  inline KEY→separate CREATE INDEX).
- *
- *  SCHEMA POLICY: see the header of pg-pool.ts — the code is the single source of truth, schema changes are
- *  drop-and-recreate, and NO new `ALTER TABLE` seams are added here; fold into the CREATE instead. */
-export declare const PG_APPROVAL_SCHEMA: string[];
-/** Idempotent self-contained schema apply (for the integration test; central aggregation is done separately). */
-export declare function ensureSchema(pool: PgPool | PoolClient): Promise<void>;
-/** Dual-dialect durable approval store. See the file header for the dialect-delta ledger. */
-export declare class SqlApprovalStore {
-    protected readonly db: SqlDriver;
-    constructor(db: SqlDriver);
-    /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
-    private q;
-    /** JSON column binding: TiDB stores the string verbatim; PG goes through the LOSSLESS protocol envelope
-     *  (codex R4-H2 — the approval `args` is the operator's review surface and must agree with the
-     *  policy-executed args at the NUL position). */
-    private json;
-    createPending(id: string, scope: string | null, ctx: {
-        taskId?: string | null;
-        sessionId?: string | null;
-        owner?: string | null;
-        toolName: string;
-        args: unknown;
-    }): Promise<void>;
-    getStatus(id: string, scope: string | null): Promise<{
-        status: ApprovalStatus;
-        reason: string | null;
-        decidedBy: string | null;
-    } | undefined>;
-    /** Apply a terminal decision, but only to a still-pending row (CAS). Returns whether it applied. The scope
-     *  guard (null-safe) is carried on the operator path too for consistency with the read paths. */
-    decide(id: string, scope: string | null, decision: "approved" | "denied" | "expired", reason: string | null, decidedBy: string | null): Promise<boolean>;
-    /** Pending approvals (operator queue), scoped to one tenant (single-DB fleet read guard, null-safe), optionally
-     *  further filtered to one owner. */
-    listPending(scope: string | null, owner?: string): Promise<ApprovalRow[]>;
-    get(id: string, scope: string | null): Promise<ApprovalRow | undefined>;
-    /** Operator-only CROSS-tenant by-id read (no scope filter). The F4 operator queue serves/decides across
-     *  tenants by design; the HTTP layer gates this to an operator and then re-binds decide() to the row's OWN
-     *  scope. Tenants NEVER reach this — they use the scope-bound {@link get}. */
-    getById(id: string): Promise<ApprovalRow | undefined>;
-    /** Operator-only CROSS-tenant pending list (no scope filter) — the unfiltered operator queue across all
-     *  tenants. Tenants use the scope-bound {@link listPending}; this is HTTP-gated to an operator.
-     *  🔴 identical SQL text on both dialects (no placeholders, nothing dialect-specific) — kept as ONE literal
-     *  rather than a `q()` pair so a reader isn't misled into looking for a divergence that isn't there. */
-    listPendingAll(): Promise<ApprovalRow[]>;
-    /** Expire pending approvals older than `olderThanMs` (a never-answered operator request). Deliberately GLOBAL
-     *  (NOT scope-filtered): staleness expiry is fleet-level maintenance that protects the worker regardless of
-     *  tenant — a stale row in any scope must be reaped. Scope isolation applies to the per-tenant READ paths, not
-     *  to this maintenance sweep. */
-    expireStale(olderThanMs: number): Promise<number>;
-}
-/** approval row → {@link ApprovalRow} — shared by BOTH dialects. design/158 S8 归位 / A12 收编. */
-export declare function mapRow(r: Record<string, unknown>): ApprovalRow;
-/** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
-export declare class TiDBApprovalStore extends SqlApprovalStore {
-    constructor(pool: MySqlPool);
-}
-/** PostgreSQL binding — historical class name + ctor shape preserved. */
-export declare class PgApprovalStore extends SqlApprovalStore {
-    constructor(pool: PgPool);
-}
-//# sourceMappingURL=approval-store-sql.d.ts.map