@sema-agent/server 6.5.0 → 6.6.0

package/dist/boot/resolve-spec.js

@@ -280,6 +280,15 @@ export function createResolveSpec(ctx) {
         if (rawAddDirs !== undefined && !cwdHonored(config)) {
             logger.warn("task_additional_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
+        // core 5.11.0([2625] Added①,[2597] P0 案三决③A):`additionalReadDirectories` —— 只读围栏拓宽。
+        // 与 additionalDirectories 同门(host 单用户车道)、同形校验(parseAdditionalDirectories:绝对路径
+        // 数组 fail-loud)、同「忽略必留声」纪律;差异只在语义:只进 READ 面(classify 读边界 auto-allow +
+        // read_file/grep 等 containment),写面照旧拒——读授权永不静默变写授权(core 侧保证,我们只透传)。
+        const rawAddReadDirs = body.additionalReadDirectories;
+        const additionalReadDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddReadDirs) : undefined;
+        if (rawAddReadDirs !== undefined && !cwdHonored(config)) {
+            logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+        }
         // body.model (explicit /model picker or run --model) WINS over settings.model (the config default); both gate
         // against the catalog allow-list via resolveTaskModel (a settings.model not in the catalog is ignored, never injected).
         // 🔴 TOB 档位联跑曾 FAIL(坐标级):the gate must see the TIER-EXPANDED catalog — expandTiers
@@ -320,7 +329,7 @@ export function createResolveSpec(ctx) {
             metrics.inc("images_omitted_total", { model: picked.model });
             logger.warn("images_omitted_no_vision_model", { model: picked.model, count: body.images.length });
         }
-        return { taskHooks, additionalDirectories, wireCatalog, picked };
+        return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
     };
     /** 阶段③(anchors):吃 请求体 + auth,吐 两个历史锚解析后的 entryId(resumeAt / rewindFilesTo —— eventId→entryId
      *  过 anchor store,未知锚在此 4xx 而不是交给 core)与 142-S4 项目登记簿种子 s4DefaultScopes。 */
@@ -374,7 +383,7 @@ export function createResolveSpec(ctx) {
     /** 阶段④(spec 字面量):吃 请求体 + auth + `opts.leg` + 前三阶段的全部产出,吐**尚未过治理层**的 TaskSpec
      *  字面量 —— 部署方拥有的 body→TaskSpec 映射本体(compactionModel 的 fresh 腿 400 也在这一段)。 */
     const assembleSpecLiteral = (body, auth, opts, parts) => {
-        const { scenarioName, cap, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
+        const { scenarioName, cap, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
         const spec = {
             // D-1:附件告知随 objective 进 durable 流(只有名字/mime/尺寸——**内容永不进流**,这正是
             // 「拼进 objective 是伪方案」的账要划清的线;文件名已消毒为安全字符集,无注入面)。
@@ -464,6 +473,8 @@ export function createResolveSpec(ctx) {
             // design/119 (CC --add-dir): extra host dirs the FILE tools may access (core canonicalizes each into the
             // containment allowlist + lists them in the `# Environment` block). Single-user host lane only (gated above).
             additionalDirectories,
+            // core 5.11.0:只读围栏(见上方 parse 段注)。缺席=字节等价([2625] 自查③)。
+            additionalReadDirectories,
             // EnterPlanMode (core 1.167): MODEL-DRIVEN plan — `enablePlanMode:true` alone (writable
             // start, NO handsReadOnly) auto-mounts `enter_plan_mode`/`present_plan` so the model can self-enter read-only
             // plan AT ANY TIME it judges a task needs planning. 🆕 DEFAULT ON (clay: resident; PLAN_MODE_ENABLED=false opts

package/dist/http/server.js

@@ -691,6 +691,24 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
+        // core 5.11.0:additionalReadDirectories(只读围栏)—— 与 additionalDirectories 同形 fail-loud
+        // (绝对路径数组、无 `..`、同条数上限);语义差异(只进 READ 面)在 core,形校验在此对齐。
+        const addReadDirsRaw = body.additionalReadDirectories;
+        if (addReadDirsRaw !== undefined) {
+            if (!Array.isArray(addReadDirsRaw)) {
+                sendError(res, 400, "request.field_invalid", "additionalReadDirectories must be an array of absolute host paths");
+                return null;
+            }
+            if (addReadDirsRaw.length > MAX_ADDITIONAL_DIRS) {
+                sendError(res, 400, "request.field_invalid", `additionalReadDirectories must have at most ${MAX_ADDITIONAL_DIRS} entries`);
+                return null;
+            }
+            const badRead = addReadDirsRaw.find((d) => !isValidCwd(d));
+            if (badRead !== undefined) {
+                sendError(res, 400, "request.field_invalid", "each additionalReadDirectories entry must be a non-empty absolute host path (no '..' segments)");
+                return null;
+            }
+        }
         // body.settings (client SemaSettings stamp) — fail-loud shape/size caps on submit, matching the sibling
         // fields' posture (parseTaskSettings is also defensive on every path incl. resume; this 400s a bad submit early
         // rather than silently coercing — adversarial review). The semantic projection (tighten-only) happens in resolveSpec.

package/dist/leader/wire.d.ts

@@ -131,7 +131,11 @@ export declare function leaderResourceConfig(env?: NodeJS.ProcessEnv): {
     /** design/74 Slice 6: opt-in (LEADER_RESOURCE_SUSPEND=true) resource-slice suspend for workers. When set, a
      *  worker SUSPENDS at the per-slice window (`sliceMaxCostUsd`) instead of failing at the budget, and the
      *  leader auto-resumes (resumeWithVerification) until the TOTAL (`totalBudgetUsd` = workerBudgetUsd) is spent
-     *  — a budget overrun becomes a resumable pause, not a worker failure. `maxSuspends` is sized to the slice
+     *  — a budget overrun becomes a resumable pause, not a worker failure. ⚠️ 语义更新(core 5.11.0 B3,
+     *  2026-08-06):`maxSuspends` 现在只数「连续无进展」park(批准+执行后链基归零),不再是总 park 数上限
+     *  ——下面按预算切片总数放大的 sizing 公式因此从「必要」变「保守冗余」(合法的资源续跑链永不触 cap,
+     *  cap 只剩防空转环职责);公式保留是无害的(上限只会更松不误杀),别再按「总数预算」理解它。
+     *  原注:`maxSuspends` is sized to the slice
      *  count (+margin) so the suspend-loop cap doesn't fire before the budget is legitimately spent. */
     resourceSuspend?: {
         totalBudgetUsd: number;

package/dist/tool-approval.js

@@ -382,18 +382,19 @@ export class ToolApprovalCoordinator {
         // [1559]三:emit 完成 vs TTL/abort/respond 三选一落定——显式 race,不让挂死的 emit 独占执行权。
         await Promise.race([emitAllP, allowedP]);
         const settled = await allowedP;
-        // Completion breadcrumb (card dismiss) — fire-and-forget to every target that actually got the OPEN frame
-        // (aliveCtxs — a ctx filtered out at entry as already-dead never saw `tool_approval` in the first place, so
-        // it has nothing to dismiss), so a slow/hung emit never delays returning to core AND every connection in
-        // the set learns the card resolved elsewhere([1559]四「其余连接收 resolved/dismissed 通知」的直接落点——
-        // 单连接场景退化为原来的一次 emit)。**per-ctx 链在该 ctx 自己的 openP 之后**(F2 修的落点)——
-        // `openByCtx.get(c)!` 永不 reject(emitOne 内部已吸收),所以不需要额外 `.catch` 才能继续链下去;
-        // `.then(() => c.emit(...))` 包一层是必须的:该 ctx 的 complete emit 若同步 throw,要先转成
-        // rejection 才能被后面的 `.catch` 接住,否则会在此处同步抛出、跳过 catch。
+        // Completion breadcrumb (card dismiss) — fire-and-forget to every target that actually got the OPEN frame,
+        // so a slow/hung emit never delays returning to core AND every connection that saw the card learns it
+        // resolved elsewhere([1559]四「其余连接收 resolved/dismissed 通知」的直接落点——单连接场景退化为
+        // 原来的一次 emit)。**per-ctx 链在该 ctx 自己的 openP 之后且看它的布尔结果**([2557] 批3 F2 D1 修,
+        // 2026-08-06):emitOne 失败是 resolve(false) 不是 reject,旧形 `.then(() => emit(complete))` 对
+        // resolve 值全放行 ⇒ open 没送达的连接(瞬断型 emit 目标)也收 `tool_approval_complete` = 孤儿
+        // close,注释与代码曾不符(红先=wire-pairing-approval D1,修后翻正)。`delivered` 门后:
+        // `.then((delivered) => delivered ? c.emit(...) : undefined)` —— complete emit 若同步 throw,
+        // `.then` 回调内抛出转成 rejection 由尾部 `.catch` 吸收(链形不变)。
         for (const c of aliveCtxs) {
             void openByCtx
                 .get(c)
-                .then(() => c.emit({ type: "tool_approval_complete", approvalId: id, outcome: lastOutcome }))
+                .then((delivered) => (delivered ? c.emit({ type: "tool_approval_complete", approvalId: id, outcome: lastOutcome }) : undefined))
                 .catch(() => undefined);
         }
         // emit 全灭 = 卡从未送达任何人(≠人拒绝/TTL 走人)——同属「无活人可达」类 ⇒ "unavailable" 交 durable

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "6.5.0",
+  "version": "6.6.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.10.0",
+    "@sema-agent/core": "^5.11.0",
     "@sema-agent/registry-core": "^0.14.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.3.0",
+    "@sema-agent/sdk": "^6.4.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",