@sema-agent/server 7.102.0 → 7.103.0

package/dist/server-secret-env.js

@@ -1,5 +1,7 @@
 import { scrubSecretEnv } from "@sema-agent/core";
 import { CONFIG_CATALOG } from "./config-catalog.js";
+import { ENV_NAME_ALLOWLIST_KNOB_NAMES } from "./env-name-allowlist-knobs.js";
+import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
 export const CATALOG_SECRET_ENV_NAMES = new Set(CONFIG_CATALOG.filter((spec) => spec.type === "secret").map((spec) => spec.name.toUpperCase()));
 export function scrubServerSecrets(env, findings) {
     const shapeFindings = [];
@@ -7,14 +9,48 @@ export function scrubServerSecrets(env, findings) {
     findings.push(...shapeFindings);
     const out = {};
     for (const key of Object.keys(shaped)) {
-        if (CATALOG_SECRET_ENV_NAMES.has(key.toUpperCase())) {
+        const upper = key.toUpperCase();
+        if (CATALOG_SECRET_ENV_NAMES.has(upper)) {
             findings.push({ key, kind: "config-catalog", confidence: "high", source: "server-config-catalog" });
             continue;
         }
+        if (ENV_NAME_ALLOWLIST_KNOB_NAMES.has(upper)) {
+            findings.push({ key, kind: "name-list-knob", confidence: "high", source: "server-name-list-knob" });
+            continue;
+        }
         out[key] = shaped[key];
     }
     return out;
 }
+export function hostSubprocessEnv(o) {
+    const scrubFindings = [];
+    const composed = { ...scrubServerSecrets(process.env, scrubFindings), ...allowlistedEnv(o.allow, process.env) };
+    const stripped = scrubFindings.filter((f) => composed[f.key] === undefined);
+    const grouped = withholdBrokenGitConfigGroup(process.env, composed).map((key) => ({ key, kind: "git-config-group", confidence: "high", source: "server-git-config-group" }));
+    recordSecretEnvScrub(o.site, [...stripped, ...grouped], o.allow);
+    return composed;
+}
+const GIT_CONFIG_GROUP_MEMBER_RE = /^GIT_CONFIG_(?:COUNT|(?:KEY|VALUE)_\d+)$/;
+function withholdBrokenGitConfigGroup(source, composed) {
+    const isMember = (k) => GIT_CONFIG_GROUP_MEMBER_RE.test(k.toUpperCase());
+    const sourceMembers = new Set(Object.keys(source).filter(isMember).map((k) => k.toUpperCase()));
+    if (!sourceMembers.has("GIT_CONFIG_COUNT"))
+        return [];
+    const composedMembers = Object.keys(composed).filter(isMember);
+    const present = new Set(composedMembers.map((k) => k.toUpperCase()));
+    if ([...sourceMembers].every((m) => present.has(m)))
+        return [];
+    for (const k of composedMembers)
+        delete composed[k];
+    return composedMembers;
+}
+export function gitSubprocessEnv(o) {
+    return {
+        ...hostSubprocessEnv({ site: o.site, allow: [] }),
+        GIT_TERMINAL_PROMPT: "0",
+        ...(o.isolateConfig ? { GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } : {}),
+    };
+}
 export function allowlistedEnv(names, env) {
     const out = {};
     for (const name of names) {

package/dist/trace/core-keyset-guard.d.ts

@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection" | "teamRole";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole";
 type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence" | "fileHistory";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -104,6 +104,9 @@ type _GuardWiringMcpLivenessReverse = AssertAllKeysHandled<Exclude<WiringMcpLive
 type WiringRulesHandled = "storeWired" | "syncWired" | "orgGoverned";
 type _GuardWiringRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"permissionRules">, WiringRulesHandled>>;
 type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled, keyof WiringSection<"permissionRules">>>;
+type WiringHandsHandled = "mounted" | "reason";
+type _GuardWiringHands = AssertAllKeysHandled<Exclude<keyof WiringSection<"hands">, WiringHandsHandled>>;
+type _GuardWiringHandsReverse = AssertAllKeysHandled<Exclude<WiringHandsHandled, keyof WiringSection<"hands">>>;
 type WiringWriteProtectionHandled = "targetView";
 type _GuardWiringWriteProtection = AssertAllKeysHandled<Exclude<keyof WiringSection<"writeProtection">, WiringWriteProtectionHandled>>;
 type _GuardWiringWriteProtectionReverse = AssertAllKeysHandled<Exclude<WiringWriteProtectionHandled, keyof WiringSection<"writeProtection">>>;
@@ -236,6 +239,8 @@ export type CoreKeysetGuards = [
     _GuardWiringSections,
     _GuardWiringWriteProtection,
     _GuardWiringWriteProtectionReverse,
+    _GuardWiringHands,
+    _GuardWiringHandsReverse,
     _GuardWiringReadDeny,
     _GuardWiringReadDenyReverse,
     _GuardWiringAutoConsolidation,

package/dist/trace/project.js

@@ -521,6 +521,18 @@ export function wiringManifestEventData(ev) {
         const lane = str(lspIn.lane);
         return { mounted, ...(lane === undefined ? {} : { lane }) };
     })();
+    const handsIn = sec(m.hands);
+    const hands = (() => {
+        if (m.hands === undefined)
+            return undefined;
+        if (handsIn === undefined)
+            return dropProjectedFace("wiring_manifest.hands is not an object");
+        const mounted = bool(handsIn.mounted);
+        if (mounted === undefined)
+            return dropProjectedFace("wiring_manifest.hands.mounted is not a boolean");
+        const reason = str(handsIn.reason);
+        return { mounted, ...(reason === undefined ? {} : { reason }) };
+    })();
     const wpIn = sec(m.writeProtection);
     const writeProtection = (() => {
         if (m.writeProtection === undefined)
@@ -560,6 +572,7 @@ export function wiringManifestEventData(ev) {
         ...(mcp !== undefined ? { mcp } : {}),
         ...(hooks !== undefined ? { hooks } : {}),
         ...(lsp !== undefined ? { lsp } : {}),
+        ...(hands !== undefined ? { hands } : {}),
         ...(writeProtection !== undefined ? { writeProtection } : {}),
         ...identityFields(ev),
     };

package/dist/trace/redact.d.ts

@@ -61,6 +61,17 @@ export declare function armPoolBudgetForTest(): {
     ssh2ScanBytes: number;
 };
 export declare function resetArmPoolBudgetForTest(): void;
+/** 本模块会写进文本的全部替换 token(`«…»` 字面),从三张表现算 —— 表改这里自动跟,不另抄一份。
+ *  🔴 **S-223 v2 修复轮起它只剩一个语义:闭形闭集的加载期校验**。运行期「这一段是不是一枚记号」已经由
+ *  {@link credentialSpans} 的闭**形**那一支一处答完({@link opaqueUnitEnd}),按闭**集**再认一遍的
+ *  `redactionTokenEndAt` 与它同义而更窄,已删 —— 两只「什么算记号」的判别器就是两个定义。 */
+/** {@link buildDisplaySafeUrl} 解析不动一个配置型 URL 时的**占位**(S-475 件B)——fail-closed:输出**不含原串的
+ *  任何字节**(连 host 都不留),不许回落成原值。它不是任何一条臂的产物,所以要在这里**显式**进闭集
+ *  {@link REDACTION_TOKENS}(闭形的加载期校验对它同样成立),消费端按契约 §5.1 的闭形逐枚解析时认得它。 */
+declare const DISPLAY_SAFE_URL_TOKEN = "\u00ABredacted:url\u00BB";
+/** S-776:出网代理 URL 的回显尺(`outbound-dispatcher.ts` `displayProxyUrl`)形不干净时整只用**同一枚**占位 —— 单独一行导出,
+ *  上面那行字面量保持 `const NAME = "…";` 形(`test/api-notice-text-freeze.test.ts` §6 的冻结扫描按这一形认替换 token)。 */
+export { DISPLAY_SAFE_URL_TOKEN };
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;

package/dist/trace/redact.js

@@ -1091,6 +1091,7 @@ const FRAGMENT_SECRET_PATTERNS = [
     [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
 ];
 const DISPLAY_SAFE_URL_TOKEN = "«redacted:url»";
+export { DISPLAY_SAFE_URL_TOKEN };
 const WITHHELD_VALUE_TOKEN = "«redacted»";
 const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, DISPLAY_SAFE_URL_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.102.0",
+  "version": "7.103.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -61,14 +61,15 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.32.1",
-    "@sema-agent/settings-schema": "6.1.0",
+    "@sema-agent/core": "7.33.4",
+    "@sema-agent/settings-schema": "6.2.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
     "pg": "^8.22.0",
     "ssh2": "^1.17.0",
     "typebox": "1.1.39",
+    "undici": "7.30.0",
     "ws": "^8.21.0",
     "zod": "^4.4.3"
   },