@sema-agent/server 7.1.0 → 7.3.0

package/dist/trace/core-keyset-guard.d.ts

@@ -26,9 +26,9 @@ type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, Bg
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation";
-type AskExcluded = "preview" | "principal" | "requiresRealApproval";
+type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 export type CoreKeysetGuards = [_GuardNotification, _GuardBgNotif, _GuardRoster, _GuardAsk, _GuardTaskEvent];
 export {};

package/dist/trace/ledger-sink.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "./redact.js";
-import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, turnEndEventData, contextUsageEventData } from "./project.js";
+import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
 export function createLedgerSink(opts) {
     const keys = opts.notifiedKeys ?? new NotifiedKeys();
@@ -114,6 +114,19 @@ export function createLedgerSink(opts) {
                 await flush();
                 await append("workspace_changed", workspaceChangedEventData(ev));
                 break;
+            case "wiring_manifest":
+                // 🔴 core 5.14.0 design/173:装配自证清单。账本行**同样**要剥 `governance` 段——durable 行可经
+                // `GET /v1/runs/:id/events` 重放给同一批租户订阅者,是与 sync 腿完全相同的泄露面,所以用**同一个**
+                // 构造器(两腿分头挑键就是下一次泄露的种子)。core 契约:no projection ⇒ do not disclose。
+                await flush();
+                await append("wiring_manifest", wiringManifestEventData(ev));
+                break;
+            case "human_input":
+                // core 5.14.0 design/171:人类输入生命周期账本(谁/经哪条载体/投递成没成)。落账是本臂的
+                // 正当用途——「这条 run 是谁喂的」正是事后对账要的历史事实;身份串的脱敏在共享构造器里。
+                await flush();
+                await append("human_input", humanInputEventData(ev));
+                break;
             case "task_progress":
                 // core breakpoint⑤: a subagent's live progress tick → an INLINE "subagent working" card for the tailing
                 // client (S2-a). Shared whitelist+redact builder (+ E2 identity for the exact concurrent-tick binding).

package/dist/trace/project.d.ts

@@ -142,6 +142,7 @@ export declare function toolEndEventData(ev: {
  *  exactly by them; the 1.72 whitelist dropped them, leaving a FIFO heuristic). */
 export declare function taskProgressEventData(ev: {
     taskId: string;
+    taskType?: string;
     parentTaskId?: string;
     name?: string;
     status?: string;
@@ -259,6 +260,60 @@ export declare function workspaceChangedEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;
+/**
+ * `wiring_manifest`(core 5.14.0 design/173 新 `TaskEvent` 臂)—— 每条腿(root/child/resume)在 prepare
+ * 时自证「我到底接了什么线」的清单帧。
+ *
+ * 🔴 **本构造器存在的唯一理由是剥掉 `governance` 段**。core 给该段盖了 `audience: "operator"` 并成文
+ * 了服务层义务:*a serving layer forwarding this event to a multi-tenant stream MUST project the governance
+ * section for operators only; **no projection ⇒ do not disclose***。我方的三条腿(sync SSE / durable 账本 /
+ * resume 账本)都是租户可读面,而 operator 投影是 #154 的独立大件——按 core 写死的失败方向,**没有投影
+ * 就不得披露**,所以本批先把整段剥掉止泄(此前 sync 腿的裸 catch-all 会把它连同 `lockedConfig` /
+ * `compliance` / `memoryAdmission` / `retention` 四个治理面在场位原样透传给任意订阅者)。
+ * 哪天 operator 投影落地,它是**另一个**构造器(按调用方身份分叉),不是往这里加键。
+ * ⚠️ 剥段还必须连**对该段取的哈希**一起剥:`configFingerprint` 同样不投影,理由见下方它那一行的旁注
+ * (无盐哈希 + 4 布尔 = 16 组合的谕示器,把「结构上藏起来」的段原样还原出来)。
+ *
+ * 其余段逐键挑(禁 `{...manifest}`:1.72 task_progress 教训——未来 core 加段必须由人显式处置,而不是
+ * 顺着 spread 裸上线,尤其当新段可能又是一个 audience 受限面时)。所有值都是引擎派生的闭枚举/布尔/
+ * 有限数/不透明摘要串,**非用户内容 ⇒ 不脱敏**;畸形值一律按缺席处理(不铸假值,与 compacted 同规)。
+ */
+export declare function wiringManifestEventData(ev: {
+    manifest?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown>;
+/**
+ * `human_input`(core 5.14.0 design/171 新 `TaskEvent` 臂)—— 「谁把什么喂进了这条 run」的生命周期账本
+ * 帧(objective / 实时 steer / nextTurn / parked-steer 续跑 / wake 五个载体共用一个投影点)。
+ *
+ * 信任划线(与 tool_approval 帧同族):
+ *  · `inputId` / `sessionSeq` / `carrier` / `source` / `delivery` / `entryId` —— 引擎铸的标识与枚举值,
+ *    **非用户内容** ⇒ verbatim。注意本帧**不带正文**(core 的臂里就没有 text 字段),所以没有内容脱敏面。
+ *  · `issuer` 与 `actor.id` / `actor.issuer` —— 宿主从入口凭据派生的**身份串**,自由文本形(`slack:U123`
+ *    这类命名空间串里可以嵌任何东西)⇒ 过 `redactSecrets`,与 `sourceAgentName` 同待遇。
+ *  · `actor.hostAsserted` —— 布尔,verbatim。**它是消费端唯一能判「这个署名可信吗」的位**(core 的
+ *    `[from …]` 渲染就是靠它决定加不加 `(unverified)`),剥掉它比剥掉 id 更坏:剩下一个看不出真假的名字。
+ *  · `principal` —— **刻意不投影**(与 ToolApprovalFrame 的 `principal` 同裁):帧本就经 owner-scoped 流
+ *    投递,租户身份不必再由帧自述。要它请先提消费需求,别顺手加。
+ *
+ * `actor` 逐键挑(禁 spread):core 已声明 `ActorAssertion` 是冻结三键形,但白名单的意义正是「core 加第
+ * 四键时由人处置」——身份对象上多出来的键裸上线是本文件反复登记的病族。
+ * 形参全可选 `unknown` 的理由同 {@link wiringManifestEventData}(两条 durable 腿手里只有 `{type:string}`)。
+ */
+export declare function humanInputEventData(ev: {
+    inputId?: unknown;
+    sessionSeq?: unknown;
+    carrier?: unknown;
+    source?: unknown;
+    delivery?: unknown;
+    issuer?: unknown;
+    actor?: unknown;
+    principal?: unknown;
+    entryId?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown>;
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
  *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open),

package/dist/trace/project.js

@@ -175,6 +175,12 @@ export function toolEndEventData(ev) {
 export function taskProgressEventData(ev) {
     return {
         taskId: ev.taskId,
+        // core 5.14.0([2854] 六车批②):委派种类判别键(core `DelegationTaskType` =
+        // "background_agent" | "workflow")—— 消费端据此路由一条 progress 帧,不必再从 id 形状猜。
+        // 形参取 `string` 而非闭枚举:该类型**没有**从 core 包根导出(亲验 index.d.ts 零命中,与发车帖
+        // 「新导出」的说法不符),抄一份闭集就是值拷贝漂移源;`stoppedBy` 先例同款——core 的开集串
+        // verbatim,消费端按契约容忍未知值。缺席=同步子代(无 fleet 行),缺席即不铸键。
+        ...(typeof ev.taskType === "string" && ev.taskType.length > 0 ? { taskType: ev.taskType } : {}),
         ...(ev.parentTaskId ? { parentTaskId: ev.parentTaskId } : {}),
         ...(ev.name ? { name: redactSecrets(ev.name) } : {}),
         // core [1414]#3 settle 终态 tick("completed"/"failed"——[1543]§三族B:此前被剥,消费方只见最后
@@ -333,6 +339,135 @@ export function workspaceChangedEventData(ev) {
         ...identityFields(ev),
     };
 }
+/**
+ * `wiring_manifest`(core 5.14.0 design/173 新 `TaskEvent` 臂)—— 每条腿(root/child/resume)在 prepare
+ * 时自证「我到底接了什么线」的清单帧。
+ *
+ * 🔴 **本构造器存在的唯一理由是剥掉 `governance` 段**。core 给该段盖了 `audience: "operator"` 并成文
+ * 了服务层义务:*a serving layer forwarding this event to a multi-tenant stream MUST project the governance
+ * section for operators only; **no projection ⇒ do not disclose***。我方的三条腿(sync SSE / durable 账本 /
+ * resume 账本)都是租户可读面,而 operator 投影是 #154 的独立大件——按 core 写死的失败方向,**没有投影
+ * 就不得披露**,所以本批先把整段剥掉止泄(此前 sync 腿的裸 catch-all 会把它连同 `lockedConfig` /
+ * `compliance` / `memoryAdmission` / `retention` 四个治理面在场位原样透传给任意订阅者)。
+ * 哪天 operator 投影落地,它是**另一个**构造器(按调用方身份分叉),不是往这里加键。
+ * ⚠️ 剥段还必须连**对该段取的哈希**一起剥:`configFingerprint` 同样不投影,理由见下方它那一行的旁注
+ * (无盐哈希 + 4 布尔 = 16 组合的谕示器,把「结构上藏起来」的段原样还原出来)。
+ *
+ * 其余段逐键挑(禁 `{...manifest}`:1.72 task_progress 教训——未来 core 加段必须由人显式处置,而不是
+ * 顺着 spread 裸上线,尤其当新段可能又是一个 audience 受限面时)。所有值都是引擎派生的闭枚举/布尔/
+ * 有限数/不透明摘要串,**非用户内容 ⇒ 不脱敏**;畸形值一律按缺席处理(不铸假值,与 compacted 同规)。
+ */
+export function wiringManifestEventData(ev) {
+    // 形参照 `compactionOutcomeEventData` / `contextUsageEventData` 先例:全可选 `unknown` + 内部逐层窄化。
+    // 两个理由,不是风格:①三条腿里有两条(ledger-sink.onEvent / resume switch)手里只有 `{type:string}`,
+    // 窄形参会逼出 `as unknown as` 双铸型(类型卫生棘轮门当场红);②窄化在这里做,账本回放/第三方 producer
+    // 送来的畸形段也走同一道门,而不是只保护 live 腿。
+    const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+    const bool = (v) => (typeof v === "boolean" ? v : undefined);
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    /** 段读:非对象即缺席(不铸空段)。 */
+    const sec = (v) => (typeof v === "object" && v !== null && !Array.isArray(v) ? { ...v } : undefined);
+    const nonEmpty = (o) => (Object.keys(o).length > 0 ? o : undefined);
+    const m = sec(ev.manifest) ?? {};
+    const askIn = sec(m.ask) ?? {};
+    const questionIn = sec(m.question) ?? {};
+    const elicitIn = sec(m.elicit) ?? {};
+    const parkIn = sec(m.parkLane) ?? {};
+    const sessionIn = sec(m.session) ?? {};
+    const fleetIn = sec(m.fleet) ?? {};
+    const legIn = sec(m.leg) ?? {};
+    const interactionIn = sec(m.interaction) ?? {};
+    const ask = nonEmpty({
+        ...(str(askIn.form) !== undefined ? { form: askIn.form } : {}),
+        ...(str(askIn.provenance) !== undefined ? { provenance: askIn.provenance } : {}),
+        ...(str(askIn.effective) !== undefined ? { effective: askIn.effective } : {}),
+    });
+    const question = nonEmpty({
+        ...(str(questionIn.wired) !== undefined ? { wired: questionIn.wired } : {}),
+        ...(str(questionIn.provenance) !== undefined ? { provenance: questionIn.provenance } : {}),
+        // 组装谎言标(交互工具在场却没有投递面)——只在 core 真铸时带,缺席不折 false。
+        ...(questionIn.interactiveToolsWithoutDeliveryFace === true ? { interactiveToolsWithoutDeliveryFace: true } : {}),
+    });
+    const elicit = nonEmpty({
+        ...(bool(elicitIn.seamWired) !== undefined ? { seamWired: elicitIn.seamWired } : {}),
+        ...(num(elicitIn.serversOptedIn) !== undefined ? { serversOptedIn: elicitIn.serversOptedIn } : {}),
+    });
+    const parkLane = nonEmpty({
+        ...(bool(parkIn.capable) !== undefined ? { capable: parkIn.capable } : {}),
+        // `effective` 是三态(true / false / "unresolved")——布尔与字符串两支都得过。折成布尔会把
+        // 「还没定」谎报成「不能 park」,而那正是这个字段被造出来要区分的那一格。
+        ...(bool(parkIn.effective) !== undefined || str(parkIn.effective) !== undefined ? { effective: parkIn.effective } : {}),
+        ...(Array.isArray(parkIn.reasons) ? { reasons: parkIn.reasons.filter((r) => typeof r === "string") } : {}),
+        ...(str(parkIn.checkpointDurability) !== undefined ? { checkpointDurability: parkIn.checkpointDurability } : {}),
+    });
+    const fleet = nonEmpty({
+        ...(bool(fleetIn.backgroundAgentStore) !== undefined ? { backgroundAgentStore: fleetIn.backgroundAgentStore } : {}),
+        ...(bool(fleetIn.hostChildEventSink) !== undefined ? { hostChildEventSink: fleetIn.hostChildEventSink } : {}),
+    });
+    return {
+        ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
+        ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
+        ...(ask !== undefined ? { ask } : {}),
+        ...(question !== undefined ? { question } : {}),
+        ...(str(interactionIn.posture) !== undefined ? { interaction: { posture: interactionIn.posture } } : {}),
+        ...(elicit !== undefined ? { elicit } : {}),
+        ...(parkLane !== undefined ? { parkLane } : {}),
+        ...(str(sessionIn.store) !== undefined ? { session: { store: sessionIn.store } } : {}),
+        ...(fleet !== undefined ? { fleet } : {}),
+        // governance —— **刻意不在此**(见头注:受众标 operator,无投影不披露)。
+        // configFingerprint —— **也刻意不在此**(codex 复审 2026-08-06 F1,验真后采纳)。剥掉一个段却把
+        // **对它取的哈希**发出去,等于没剥:core 的算法是
+        // `sha256(canonicalize(manifest 去掉 leg 与两个 provenance))` 取前 16 hex —— 无盐、输入里含整个
+        // governance 段,而 governance 只有 4 个布尔(audience 是常量)⇒ **16 种组合**。租户手里已经有其余
+        // 全部哈希输入(它们正是我们投影出去的那些段),把 16 种组合逐个拼进去重算一遍即可比中,
+        // lockedConfig / compliance / memoryAdmission / retention 四位当场还原。
+        // 「结构上藏起来、经哈希谕示器泄出去」仍然是泄出去,core 写死的失败方向(no projection ⇒ do not
+        // disclose)对侧信道一样适用。它的广告用途(判两条腿是不是同一套装配)在本仓与 SDK **今天零消费端**,
+        // 所以直接不发,而不是另铸一个「只对已投影字段取哈希」的服务端自造值(那是新 wire 语义,要跨仓对表)。
+        // 回补点:#154 的 operator 投影按调用方身份分叉,那条腿才带 core 的真 fingerprint。
+        ...identityFields(ev),
+    };
+}
+/**
+ * `human_input`(core 5.14.0 design/171 新 `TaskEvent` 臂)—— 「谁把什么喂进了这条 run」的生命周期账本
+ * 帧(objective / 实时 steer / nextTurn / parked-steer 续跑 / wake 五个载体共用一个投影点)。
+ *
+ * 信任划线(与 tool_approval 帧同族):
+ *  · `inputId` / `sessionSeq` / `carrier` / `source` / `delivery` / `entryId` —— 引擎铸的标识与枚举值,
+ *    **非用户内容** ⇒ verbatim。注意本帧**不带正文**(core 的臂里就没有 text 字段),所以没有内容脱敏面。
+ *  · `issuer` 与 `actor.id` / `actor.issuer` —— 宿主从入口凭据派生的**身份串**,自由文本形(`slack:U123`
+ *    这类命名空间串里可以嵌任何东西)⇒ 过 `redactSecrets`,与 `sourceAgentName` 同待遇。
+ *  · `actor.hostAsserted` —— 布尔,verbatim。**它是消费端唯一能判「这个署名可信吗」的位**(core 的
+ *    `[from …]` 渲染就是靠它决定加不加 `(unverified)`),剥掉它比剥掉 id 更坏:剩下一个看不出真假的名字。
+ *  · `principal` —— **刻意不投影**(与 ToolApprovalFrame 的 `principal` 同裁):帧本就经 owner-scoped 流
+ *    投递,租户身份不必再由帧自述。要它请先提消费需求,别顺手加。
+ *
+ * `actor` 逐键挑(禁 spread):core 已声明 `ActorAssertion` 是冻结三键形,但白名单的意义正是「core 加第
+ * 四键时由人处置」——身份对象上多出来的键裸上线是本文件反复登记的病族。
+ * 形参全可选 `unknown` 的理由同 {@link wiringManifestEventData}(两条 durable 腿手里只有 `{type:string}`)。
+ */
+export function humanInputEventData(ev) {
+    const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+    const a = typeof ev.actor === "object" && ev.actor !== null && !Array.isArray(ev.actor) ? { ...ev.actor } : {};
+    const actor = {
+        ...(str(a.id) !== undefined ? { id: redactSecrets(String(a.id)) } : {}),
+        ...(typeof a.hostAsserted === "boolean" ? { hostAsserted: a.hostAsserted } : {}),
+        ...(str(a.issuer) !== undefined ? { issuer: redactSecrets(String(a.issuer)) } : {}),
+    };
+    return {
+        // 缺键守卫同 compactionOutcomeEventData:无条件 String() 会把缺席铸成字面 "undefined" 落进 durable 行,
+        // 回放端读到一个看起来合法的 id/枚举值,比缺席更难发现。
+        ...(str(ev.inputId) !== undefined ? { inputId: ev.inputId } : {}),
+        ...(typeof ev.sessionSeq === "number" && Number.isFinite(ev.sessionSeq) ? { sessionSeq: ev.sessionSeq } : {}),
+        ...(str(ev.carrier) !== undefined ? { carrier: ev.carrier } : {}),
+        ...(str(ev.source) !== undefined ? { source: ev.source } : {}),
+        ...(str(ev.delivery) !== undefined ? { delivery: ev.delivery } : {}),
+        ...(str(ev.issuer) !== undefined ? { issuer: redactSecrets(String(ev.issuer)) } : {}),
+        ...(Object.keys(actor).length > 0 ? { actor } : {}),
+        ...(str(ev.entryId) !== undefined ? { entryId: ev.entryId } : {}),
+        ...identityFields(ev),
+    };
+}
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
  *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.1.0",
+  "version": "7.3.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.13.0",
+    "@sema-agent/core": "^5.14.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -62,7 +62,8 @@
     "pg": "^8.22.0",
     "ssh2": "^1.17.0",
     "typebox": "1.1.39",
-    "ws": "^8.21.0"
+    "ws": "^8.21.0",
+    "zod": "^4.4.3"
   },
   "optionalDependencies": {
     "sharp": "^0.35.3"