@sema-agent/server 7.10.0 → 7.11.0

package/dist/tool-approval.js

@@ -44,7 +44,7 @@
  * and asks are turn-blocking by construction — the TTL bounds the human-side exposure instead.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7 } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { createLogger } from "./observability/logger.js";
 import { deriveAskId, deriveBatchId } from "./approval-ask-machine.js";
@@ -145,7 +145,21 @@ export function parseToolApprovalResponse(body) {
         // [1458] ctrl+g 编辑放行:allow 族可带 updatedInput(编辑后的 args 整体替换形,durable /decide 腿
         // 同名位既有语义);deny 带=无意义,忽略不 400(宽收)。
         const u = body.updatedInput;
-        return { ok: true, value: d, ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}) };
+        // #154 车二:「不再询问」的回决位。**只带候选的文本**,不是自由规则 —— 服务端拿它在引擎铸出的
+        // 候选表里定位下标(对不上就拒),于是「点一次某条无害命令换来一条别的规则」在这条路上不可拼写。
+        // deny 带 = 无意义(人拒了这次操作,谈不上持久化同意),忽略不 400(同 updatedInput 的宽收姿势)。
+        const pr = body.persistRule;
+        let persistRule;
+        if (d !== "deny" && pr !== undefined) {
+            if (pr === null || typeof pr !== "object" || Array.isArray(pr))
+                return { ok: false, error: "persistRule must be an object" };
+            const rule = pr.rule;
+            if (typeof rule !== "string" || rule === "" || rule.length > MAX_RULE_TEXT_CHARS) {
+                return { ok: false, error: `persistRule.rule must be a non-empty string of at most ${MAX_RULE_TEXT_CHARS} characters` };
+            }
+            persistRule = rule;
+        }
+        return { ok: true, value: d, ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}), ...(persistRule !== undefined ? { persistRule } : {}) };
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
@@ -349,7 +363,12 @@ export class ToolApprovalCoordinator {
      *  缺席(生产形)⇒ 每条 run 腿由 {@link runWithContext} 现铸一张、经 ALS 与写侧共享;在场 ⇒ 测试注入的
      *  固定表(此时不进 ALS 作用域,读写都走这一张)。作用域理由见 `governance-ask-marks.ts` 顶注。 */
     governanceAskMarks;
+    /** #154 车二:持久化权限规则的**同意车道**。在场 ⇔ 规则店真装配(main.ts 与 core 的
+     *  `RunnerDeps.permissionRuleStore` 同源于一个对象)⇒ ①ask 帧投 `ruleSuggestions`;②回决带
+     *  `persistRule` 时兑付进店。缺席 ⇒ 两件都不做(诚实缺席,不发无处可兑的候选)。 */
+    ruleConsent;
     constructor(opts) {
+        this.ruleConsent = opts?.ruleConsent;
         this.governanceAskMarks = opts?.governanceAskMarks;
         this.ttlMs = opts?.ttlMs ?? DEFAULT_APPROVAL_TTL_MS;
         this.askStore = opts?.askStore;
@@ -404,6 +423,33 @@ export class ToolApprovalCoordinator {
                 this.admitByOwner.set(ownerKey, o);
         };
     }
+    /**
+     * #154 车二:一只 ask 的**规则车道素材**,或 `undefined`(= 本 ask 不投候选、不接受 `persistRule`)。
+     *
+     * 三个合取项(缺一即 `undefined`,理由逐字见调用点上方注):①店在场 ②引擎铸了候选 ③命令原字节可读。
+     * `req.args` 是 `unknown` ⇒ 窄读,**禁裸 as-cast**(宪法 [2704]:一个形状漂了的 args 若被 cast,
+     * 会把 `undefined` 当命令送进 `prepareCardApproval`,那是放宽面上的静默垃圾)。
+     */
+    buildRuleLaneMaterial(req) {
+        if (this.ruleConsent === undefined)
+            return undefined;
+        const suggestions = req.ruleSuggestions;
+        if (!Array.isArray(suggestions) || suggestions.length === 0)
+            return undefined;
+        const args = req.args;
+        if (args === null || typeof args !== "object" || Array.isArray(args))
+            return undefined;
+        const command = args.command;
+        if (typeof command !== "string" || command === "")
+            return undefined;
+        const boundInputHash = readBoundInputHash(req);
+        return {
+            command,
+            suggestions,
+            ...(typeof req.toolCallId === "string" && req.toolCallId !== "" ? { toolCallId: req.toolCallId } : {}),
+            ...(boundInputHash !== null ? { boundInputHash } : {}),
+        };
+    }
     /** 测试/可观测性钩子(X-2):某 (taskId) 维当前占用的准入名额数。 */
     admittedCount(taskId) {
         return this.admitByTask.get(taskId) ?? 0;
@@ -704,6 +750,12 @@ export class ToolApprovalCoordinator {
         const id = uuidv7();
         const child = isChildAsk(req);
         const bounded = boundArgs(req.args);
+        // #154 车二:规则候选的投影素材。**三个合取项**,缺一不投:
+        //  ① 规则店真装配(`this.ruleConsent` 在场)—— 店缺席仍投 = 无处可兑的「不再询问」= wire 谎言;
+        //  ② 引擎真铸了候选(`req.ruleSuggestions` 非空)—— 命令不可匹配(复合/重定向/替换)时 core 交空数组;
+        //  ③ 命令原字节读得出(回决时**引擎**要拿它重铸候选;读不出就没有可兑付的路,投候选等于骗人)。
+        // 读 `req.args.command` 走窄读:`args` 是 `unknown`,禁裸 as-cast(宪法 [2704])。
+        const ruleLaneMaterial = this.buildRuleLaneMaterial(req);
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -736,6 +788,8 @@ export class ToolApprovalCoordinator {
             ...((this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(primary.owner, primary.sessionId, origin.taskId))).isMarked(req.toolCallId)
                 ? { governanceForced: true }
                 : {}),
+            // #154 车二:候选逐字透传(条件见 `ruleLaneMaterial` 上方注)。
+            ...(ruleLaneMaterial !== undefined ? { ruleSuggestions: ruleLaneMaterial.suggestions } : {}),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
         };
         // #151 车2(design/172 §3.3 D3 窗长三元):有效窗——legDeadlineMonotonic 缺席时退化成 ttlMs(D1 零
@@ -1237,6 +1291,9 @@ export class ToolApprovalCoordinator {
             ...(child ? { originTaskId: req.sourceTaskId } : { targetCtxs: new Set(aliveCtxs), onTargetGone }),
             ...(primary.sessionId ? { sessionId: primary.sessionId } : {}),
             toolName: req.toolName,
+            // #154 车二:规则车道素材 —— 与帧上的 `ruleSuggestions` **同一个条件**(店在场 ∧ 引擎真铸了候选 ∧
+            // 命令原字节读得出)。三者任一不成立 ⇒ 不登记,回决带 `persistRule` 时如实拒(不猜命令)。
+            ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
             ...(askId !== undefined && batchId !== undefined ? { askId, batchId } : {}),
         };
         selfEntry = pendingEntry; // 供 settle() 结算时把自己从 pendingByAskId 的 Set 里摘除(上方顶注)
@@ -1418,10 +1475,72 @@ export class ToolApprovalCoordinator {
         // #151 车2 D2(回决竞争者):askStore 缺席 ⇒ finishRespond 同步收尾,逐字不变(D1)。在场 ⇒ 先打一把
         // decideAsk CAS,赢了才 finishRespond;输(某个其他竞争者已经决定了这只 ask 的终局)⇒ 不 settle,照旧
         // 回现有 404 形(响应体的 409/410 分化是车4 的活,本车只保证「输者绝不覆盖赢者」)。
-        if (this.askStore && entry.askId !== undefined && entry.batchId !== undefined) {
-            return this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed);
+        const settled = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
+            ? this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed)
+            : this.finishRespond(id, entry, parsed);
+        // #154 车二:「不再询问」的兑付口。**在裁决落定之后**(顺序是硬的:规则是「这次同意的持久化」,
+        // 一次没有生效的裁决不该留下一条永久规则),且只在 200 那一支 —— 404(CAS 输/条目已被别人结算)
+        // 意味着这次回决不是有效终局,连带的规则确认也就不成立。
+        if (parsed.persistRule === undefined)
+            return settled;
+        return this.persistRuleAfterDecision(settled, entry, parsed.persistRule, parsed.updatedInput !== undefined);
+    }
+    /**
+     * #154 车二:回决携规则确认 ⇒ prepare→confirm→redeem(实现在 `rules-consent.ts`,本方法只做门与回显)。
+     *
+     * 三道门,每道都是**拒绝**而不是降级:
+     *  ① 裁决必须真落定(200)—— 见调用点注;
+     *  ② 必须有已验明的 owner —— 规则是**某个人**的持久同意,一条 `owner === null` 的 ask 没有归属人可写;
+     *  ③ 本 ask 必须登记过规则车道素材(店在场 ∧ 引擎铸过候选 ∧ 命令可读)。
+     *
+     * 失败**不翻转裁决**:人的「允许这次」已经生效并且已经交给引擎了,把整个回决改判成 4xx 会让一次真实的
+     * 放行凭空消失。诚实的形是 200 + `rulePersisted:false`(壳据它告诉人「这次放行了,但『不再询问』没存上」)。
+     */
+    async persistRuleAfterDecision(settled, entry, ruleText, inputWasEdited) {
+        const result = await settled;
+        if (result.status !== 200)
+            return result;
+        const lane = this.ruleConsent;
+        const material = entry.ruleLane;
+        const owner = entry.owner;
+        const withFlag = (rulePersisted, ruleRefusal) => ({
+            status: result.status,
+            body: { ...result.body, rulePersisted, ...(ruleRefusal !== undefined ? { ruleRefusal } : {}) },
+        });
+        if (lane === undefined || material === undefined || owner === null)
+            return withFlag(false, "rule_lane_unavailable");
+        // 🔴 codex 交叉复审 round3 [high] 二(验真后修,**真扩权面**):`updatedInput`(ctrl+g 编辑放行)
+        // 与 `persistRule` 同时在场时,**生效的**调用是编辑后的那一份,而候选是引擎从**原始**命令铸的 ——
+        // 于是「把一条危险命令改安全 + 勾上不再询问」会给原始那条危险命令装上一条常驻放行规则。
+        // v1 处置 = **拒绝这次持久化**(裁决本身照常生效;人只是这一次没能顺手存下规则)。
+        // 不选「从编辑后的输入重铸候选」:`updatedInput` 是 `unknown` 的整体替换形,它与这只 ask 上引擎
+        // 铸的候选之间没有任何等式可对 —— 那条路要先给编辑面立形,是另一件事(登记为后续件)。
+        if (inputWasEdited)
+            return withFlag(false, "rule_input_edited");
+        // 报出的文本必须**在引擎铸的候选里**(等式一道)。对不上 ⇒ 拒,不猜:一条不在候选里的文本要么是
+        // 旧卡的残留,要么是有人在试着自铸规则,两种都不该落库。
+        if (!material.suggestions.some((s) => s.rule === ruleText))
+            return withFlag(false, "rule_not_offered");
+        try {
+            const persisted = await lane.persistCardRule({
+                principal: owner,
+                toolName: entry.toolName,
+                command: material.command,
+                ruleText,
+                ...(material.toolCallId !== undefined ? { toolCallId: material.toolCallId } : {}),
+                ...(material.boundInputHash !== undefined ? { boundInputHash: material.boundInputHash } : {}),
+            });
+            if (!persisted.ok) {
+                defaultLogger.warn("permission rule was not persisted after an approval", { reason: persisted.reason, detail: persisted.detail });
+                return withFlag(false, persisted.reason);
+            }
+            return withFlag(true);
+        }
+        catch (err) {
+            // D5 同族姿势:店抖动不改判人的裁决,只如实报「没存上」。
+            this.noteStoreError(err, "persistCardRule");
+            return withFlag(false, "rule_store_error");
         }
-        return this.finishRespond(id, entry, parsed);
     }
     /** store 在场时的回决 CAS 门(D2)——`respond()` 的异步分支,拆出以保持 `respond()` 本身在 store 缺席
      *  时仍是纯同步函数(D1)。`askStore`/`askId`/`batchId` 由调用方在已窄化的分支里传入(避免非空断言）。 */

package/dist/trace/core-keyset-guard.d.ts

@@ -26,8 +26,8 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation";
-type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash" | "ruleSuggestions";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleSuggestions";
+type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;

package/dist/trace/project.d.ts

@@ -369,6 +369,7 @@ export declare function brainStatusEventData(ev: {
     attempt?: number;
     maxRetries?: number;
     retryInMs?: number;
+    errClass?: string;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -561,6 +561,7 @@ export function brainStatusEventData(ev) {
         ...(num(ev.attempt) ? { attempt: ev.attempt } : {}),
         ...(num(ev.maxRetries) ? { maxRetries: ev.maxRetries } : {}),
         ...(num(ev.retryInMs) ? { retryInMs: ev.retryInMs } : {}),
+        ...(typeof ev.errClass === "string" && ev.errClass.length > 0 ? { errClass: ev.errClass } : {}),
         ...identityFields(ev),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.10.0",
+  "version": "7.11.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.21.0",
+    "@sema-agent/core": "^5.22.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.12.0",
+    "@sema-agent/sdk": "^6.13.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",