@sema-agent/server 7.103.1 → 7.104.0

package/dist/session-incarnation.d.ts

@@ -0,0 +1,61 @@
+/** 会话元数据的一次读:属主 + 化身(同一行、同一次读)。 */
+export interface SessionFace {
+    /** `null` = 登记为无主的会话。 */
+    readonly owner: string | null;
+    /** 这一位住客的化身令牌(非空;空值在读口就响亮拒了)。 */
+    readonly incarnation: string;
+}
+/** 读口的形(三只会话店 + 缓存包装层同一个签名)。 */
+export type SessionFaceReader = (sessionId: string) => Promise<SessionFace | undefined>;
+/** 铸一只新化身(铸点见头注,只在新建行)。 */
+export declare function mintSessionIncarnation(): string;
+/** 日志里点名一只化身时唯一允许的形:前 8 位。完整令牌不进任何日志正文。 */
+export declare function incarnationLogPrefix(incarnation: string): string;
+/**
+ * 把一段**不归本仓撰写**的文本(典型:core 记忆引擎的事故披露句 —— `memory.session_incarnation_mismatch` 逐字带着两只令牌)落日志之前,
+ * 把其中每一只化身形的串截成 {@link incarnationLogPrefix}(前 8 位 + `…`)。规则只有一条:完整令牌不进日志正文;前 8 位留着对账。
+ */
+export declare function redactIncarnations(text: string): string;
+/**
+ * 两次读是不是**同一位住客**:都在、化身逐字相等。任一次读不到(会话不在)⇒ 不是 —— 没有「读不到就当相同」的臂。
+ * 属主是否等于某个身份是调用方自己的判据(赎回面比的是卡的权威 principal),不在这里。
+ */
+export declare function sameSessionOccupant(before: SessionFace | undefined, after: SessionFace | undefined): boolean;
+/**
+ * 会话行在、化身却是空的 —— 响亮拒(头注「读到空化身」一条)。具名类型:调用方按类型认它,不按文案。
+ * 文案不带任何令牌(本来就是空的),只点名会话 id 与出路。
+ */
+export declare class SessionIncarnationMissingError extends Error {
+    readonly sessionId: string;
+    readonly code = "session.incarnation_missing";
+    constructor(sessionId: string);
+}
+/**
+ * 店把一行原始列读成 {@link SessionFace} 的唯一口(三只店共用 —— 空值判据只写这一处)。
+ * `incarnation` 不是非空字符串 ⇒ {@link SessionIncarnationMissingError}。
+ */
+export declare function sessionFaceFromRow(sessionId: string, owner: string | null, incarnation: unknown): SessionFace;
+/**
+ * session-sync **整段换装**(replace)时化身的去留 —— 三只店共用的一句判据:换装删掉再插回的是**同一位住客**的那一行
+ * (删除带属主门),所以行在、属主相同、化身非空 ⇒ 沿用;行不在(这是一次新建)或还是空的存量形 ⇒ 铸一只新的。
+ */
+export declare function carriedIncarnation(prior: {
+    owner?: unknown;
+    incarnation?: unknown;
+} | undefined, owner: string | null): string;
+/**
+ * `session_meta.incarnation` 的列定义 —— 两方言各一句,**唯一属主**:中央 DDL(`tidb-pool.ts` / `pg-session-storage.ts` 的
+ * `CREATE TABLE session_meta`)与一次性迁移 M5 的 `ADD COLUMN`(`plugins/one-time-migrations.ts`)都内插这同一串,
+ * 于是「新库建出来的列」与「存量库补上的列」逐字同形(S-547 起服列册探针比的是列名,形由这里保证)。
+ *
+ * `NOT NULL DEFAULT ''`:空串就是「没铸过」的唯一表示 —— 读口对它响亮拒({@link SessionIncarnationMissingError})。
+ * 缺省值只为两件事存在:①存量表 `ADD COLUMN` 在两方言上一句成立(PG 对非空表加无缺省的 NOT NULL 列直接拒);
+ * ②一条漏铸的写腿落下的是**读得出来的错**(读口拒),而不是一条插入期的 500 —— 两形都 fail-closed,前者还能被迁移补上。
+ * 宽度 64:`randomUUID()` 是 36 字符,留出余量但不给任意长串留位。
+ */
+export declare const SESSION_META_INCARNATION_COLUMN: {
+    readonly name: "incarnation";
+    readonly tidb: "incarnation VARCHAR(64) NOT NULL DEFAULT ''";
+    readonly pg: "incarnation VARCHAR(64) COLLATE \"C\" NOT NULL DEFAULT ''";
+};
+//# sourceMappingURL=session-incarnation.d.ts.map

package/dist/session-incarnation.js

@@ -0,0 +1,43 @@
+import { randomUUID } from "node:crypto";
+export function mintSessionIncarnation() {
+    return randomUUID();
+}
+export function incarnationLogPrefix(incarnation) {
+    return incarnation.slice(0, 8);
+}
+const INCARNATION_TOKEN_SHAPE = /[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/gi;
+export function redactIncarnations(text) {
+    return text.replace(INCARNATION_TOKEN_SHAPE, (token) => `${incarnationLogPrefix(token)}…`);
+}
+export function sameSessionOccupant(before, after) {
+    return before !== undefined && after !== undefined && before.incarnation === after.incarnation;
+}
+export class SessionIncarnationMissingError extends Error {
+    sessionId;
+    code = "session.incarnation_missing";
+    constructor(sessionId) {
+        super(`session ${sessionId} has no incarnation token: every session row is minted one when it is created, and rows written before ` +
+            `7.104.0 get one from the one-time migration that runs at boot (plugins/one-time-migrations.ts, entry M5). An empty value ` +
+            `after that means a write path that did not mint one, or a hand-edited row — it is refused rather than read as "matches anyone". ` +
+            `Restart a 7.104.0+ replica so the migration backfills it, or delete the session.`);
+        this.sessionId = sessionId;
+        this.name = "SessionIncarnationMissingError";
+    }
+}
+export function sessionFaceFromRow(sessionId, owner, incarnation) {
+    if (typeof incarnation !== "string" || incarnation === "")
+        throw new SessionIncarnationMissingError(sessionId);
+    return { owner, incarnation };
+}
+export function carriedIncarnation(prior, owner) {
+    if (prior !== undefined && (prior.owner ?? null) === owner && typeof prior.incarnation === "string" && prior.incarnation !== "") {
+        return prior.incarnation;
+    }
+    return mintSessionIncarnation();
+}
+export const SESSION_META_INCARNATION_COLUMN = {
+    name: "incarnation",
+    tidb: "incarnation VARCHAR(64) NOT NULL DEFAULT ''",
+    pg: `incarnation VARCHAR(64) COLLATE "C" NOT NULL DEFAULT ''`,
+};
+//# sourceMappingURL=session-incarnation.js.map

package/dist/session-records-skipped-notice.d.ts

@@ -0,0 +1,20 @@
+import type { FileStorageCorruptReadInfo, SessionRepo } from "@sema-agent/core";
+import { type EngineNoticeRouter, type ServerNoticeCode } from "./trace/engine-notice-wire.js";
+export declare const SESSION_RECORDS_SKIPPED: ServerNoticeCode;
+/**
+ * 披露座上的「作用域在场则记」腿(装配点 = `plugins/store-backend.ts` 里喂给 `LocalSessionStore` 的那只
+ * `FileSessionRepo` 的 `onCorruptRead`)。只认 `kind:"replay"` 这一级(`record` 由它汇总,`file` 没有会话归属)。
+ * 作用域外 ⇒ 什么都不做(那一次披露照旧只进运维日志)。纯内存赋值,不抛。
+ */
+export declare function noteReplayInSessionOpenScope(info: FileStorageCorruptReadInfo): void;
+/** 一次打开的产物(core `SessionRepo.open` 的返回型,派生不手抄)。 */
+type OpenedSession = Awaited<ReturnType<SessionRepo["open"]>>;
+/**
+ * **唯一铸点**:为 `sessionId` 打开它自己的存档(`open` = 那一次 `repo.open(...)`),打开成功且这次回放跳过了记录 ⇒
+ * 数出幸存条目、铸一帧投出。打开失败原样上抛,不铸。
+ *
+ * 计数与投递都不抛(`getEntries()` 是存储内存条目的拷贝;`route()` 按口隔离、口的失败走 F 类留痕),所以这里没有降级臂。
+ */
+export declare function openSessionForItself(sessionId: string, open: () => Promise<OpenedSession>, router?: EngineNoticeRouter): Promise<OpenedSession>;
+export {};
+//# sourceMappingURL=session-records-skipped-notice.d.ts.map

package/dist/session-records-skipped-notice.js

@@ -0,0 +1,27 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { defaultEngineNoticeRouter } from "./trace/engine-notice-wire.js";
+export const SESSION_RECORDS_SKIPPED = "session.records_skipped";
+const openScope = new AsyncLocalStorage();
+export function noteReplayInSessionOpenScope(info) {
+    if (info.kind !== "replay")
+        return;
+    const scope = openScope.getStore();
+    if (scope !== undefined)
+        scope.dropped = info.dropped;
+}
+export async function openSessionForItself(sessionId, open, router = defaultEngineNoticeRouter) {
+    const scope = { sessionId };
+    const session = await openScope.run(scope, open);
+    const dropped = scope.dropped;
+    if (dropped !== undefined && dropped > 0) {
+        const entriesKept = (await session.getEntries()).length;
+        router.route({
+            code: SESSION_RECORDS_SKIPPED,
+            message: `Part of this session's saved history could not be read: ${dropped} record(s) were skipped when it was reopened, and this turn continues from the ${entriesKept} entries that remain.`,
+            detail: { dropped, entriesKept, sessionId },
+            sessionId,
+        });
+    }
+    return session;
+}
+//# sourceMappingURL=session-records-skipped-notice.js.map

package/dist/tool-approval.d.ts

@@ -717,7 +717,67 @@ export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOffe
  * `persistRule.rule` / `persistRule.edited` 三道既有形门**同族**(那三道在,只有本格没有 = 本格才是特例)。
  */
 export declare const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string \u2014 the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+/**
+ * #1016 / S-558 —— **live 座的那一次边界 cast,全仓只此一处**(耐久座的那一次在 `hostDecisionFacts` 里,
+ * 一座一次)。它说的是「我把一个**未判词**的串放到只收词的座上」:判词的是 core —— `resolveAsk` 对词表外
+ * 是 `approver_contract` 的响亮 fail-closed deny,不是静默当人拒(实测三形同判,特征钉在
+ * `test/tool-approval.test.ts` 的 #1016 组)。本层判过的只有**形**(是个串、只与 deny 同行,见
+ * {@link SETTLED_BY_MUST_BE_STRING} / {@link SETTLED_BY_DENY_ONLY}),而形不是词。
+ *
+ * 两个座位读它:这次回决的**即时结算**(`entry.settle` 的自报参)与**持久行**(`decideAsk` 的
+ * `settledBy` 列)。S-558 之前只有前者 —— 于是同一个事实在「当次」与「重放」上是两个答案。
+ * S-843:耐久 ask 回决口(`POST /v1/tasks/:taskId/asks/:askId/decision`)写的是**同一个座**(同一列,经
+ * `outcomeOfDecidedRow` 交给同一个 `AskOutcome.settledBy`),所以它也走这一只 —— cast 仍是一座一次。
+ */
+export declare function respondSettledBy(parsed: Pick<ParsedApprovalResponse, "settledBy">): HostSettledBy | undefined;
 export declare const SETTLED_BY_DENY_ONLY = "settledBy is only meaningful with decision \"deny\" \u2014 only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door's own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision";
+/**
+ * S-843 / 车QK F7 —— `settledBy` 的**宽**拒句(三条回决腿共用一份文本,与 {@link SETTLED_BY_DENY_ONLY} 同姿势)。句子逐字是 S-843 在
+ * 耐久 ask 回决口路由里写下的那一句(车QK F7 起搬到判官旁,路由不再自己写),尺 = 店的同一个常量({@link MAX_SETTLED_BY_CHARS})。
+ */
+export declare const SETTLED_BY_TOO_WIDE = "settledBy must be 1-16 characters \u2014 the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row";
+/**
+ * S-843 —— 决议体上 `settledBy` 的判据,**一处成形**。三条 HTTP 回决腿共读:
+ * `POST /v1/approvals/:sessionId/decide`(耐久 park 腿)、`POST /v1/tasks/:taskId/asks/:askId/decision`(耐久 ask 腿)与
+ * live `POST /v1/tool-approvals/:id/respond`(经 {@link parseToolApprovalResponse};车QK F7 起 —— 此前那只 parser 手写了 ②③ 两臂、
+ * 没有 ④,是这条判据的第二个写者)。
+ *
+ * 次序即契约(①–③ = decide 腿修前那三道 if 的原序,逐字搬来,不是新判据):
+ *  ① 直连门在场 ⇒ `not_in_proof` —— 键不在决策证明的签名载荷里(§6.3 同族第四条,理由在 approvals-assistant 的
+ *     `DECIDE_NOT_IN_PROOF_KEYS` 注);
+ *  ② 不是 deny ⇒ `deny_only` —— {@link SETTLED_BY_DENY_ONLY};
+ *  ③ 不是串 ⇒ `not_string` —— {@link SETTLED_BY_MUST_BE_STRING};
+ *  ④ 长度不在 1..{@link MAX_SETTLED_BY_CHARS} ⇒ `too_wide` —— {@link SETTLED_BY_TOO_WIDE}(车QK F7 / A3,7.104.0 合并复审)。
+ *     尺与店门口的形门同一只谓词({@link settledByFitsColumn}):`/respond` 与耐久 ask 口写的是**同一列**
+ *     (`approval_ask.settled_by`,`VARCHAR(16)`),列宽是列的事实,不是某一条腿的事实。修前这一道只长在耐久 ask 口的路由里:
+ *     `/respond` 上一只超宽 / 空串的来源位要到 CAS 里才被店门抛,落进 D5「店抖动不挡真实回决」臂 —— 行没决,决议照样交给了引擎,200。
+ *     `/decide` 的来源位不落这一列(交给 core 的 checkpoint,core 在 CAS 之前按词表拒),这一道对它同样成立:core 的闭集词
+ *     (`human` / `timeout` / `policy`)都远短于这把尺,尺外的串不可能是一个词 ⇒ 三条口对同一个体同判同句,不为一条腿开特例。
+ * 判的是**键在不在 / 配不配这个决议 / 形**,**从不判词**(词表属主是 core;三条腿的词都由引擎响亮拒)。
+ *
+ * 返回判决而不是直接回 400:各条腿在调用点按自己的码约定发出(错误文案冻结门按字面站点采集,码是 wire 契约);
+ * 调用点对判决做穷举 `switch` + `never` 兜底(加一臂 = 编译红,[ref])。`accepted` 臂带着已证形的串 —— 调用点拿它往下传,
+ * 不再对 `body.settledBy` 做第二次窄化。第三参给字面 `false` 的调用点(live `/respond`:那条口没有直连门证明)拿到的判决型里
+ * **没有** `not_in_proof` 臂(重载),不必为一条结构上不可达的臂写兜底。
+ */
+export type SettledByBodyVerdict = {
+    kind: "absent";
+} | {
+    kind: "accepted";
+    settledBy: string;
+} | {
+    kind: "not_in_proof";
+} | {
+    kind: "deny_only";
+} | {
+    kind: "not_string";
+} | {
+    kind: "too_wide";
+};
+export declare function judgeSettledByBody(settledBy: unknown, decision: string, directDoorActive: false): Exclude<SettledByBodyVerdict, {
+    kind: "not_in_proof";
+}>;
+export declare function judgeSettledByBody(settledBy: unknown, decision: string, directDoorActive: boolean): SettledByBodyVerdict;
 /** S-720(core 7.32.0 #1093)—— `readRootGrant` 只随 `decision:"allow"`(CC 卡的第三选项「Yes, and add directory」= 放行这一次
  *  + 加目录;`allow_session` 不是那一个选项,`deny` 上它没有意义)。裁决之前响亮拒,不静默丢。 */
 export declare const READ_ROOT_GRANT_ALLOW_ONLY = "readRootGrant is only meaningful with decision \"allow\" \u2014 it is the card's \"Yes, and add directory\" answer (allow this call and add the card's readRootCandidate.dir to this run's read directories)";
@@ -737,6 +797,11 @@ export declare function parseToolApprovalResponse(body: unknown): {
     ok: false;
     error: string;
 };
+/** [ref] 车2:`parseToolApprovalResponse` 的成功分支形——`respond()` 拆分出的私有收尾方法(`finishRespond`/
+ *  `respondWithCas`)复用,避免裸内联匿名类型重复三处。 */
+type ParsedApprovalResponse = Extract<ReturnType<typeof parseToolApprovalResponse>, {
+    ok: true;
+}>;
 /**
  * #1016 —— wire 上**开给调用方**的那一个词,从 core 的两只闭集里取**交集**。
  *

package/dist/tool-approval.js

@@ -9,7 +9,7 @@ import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
 import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
+import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
@@ -107,10 +107,24 @@ export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a bool
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
 export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
-function respondSettledBy(parsed) {
+export function respondSettledBy(parsed) {
     return parsed.settledBy;
 }
 export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
+export const SETTLED_BY_TOO_WIDE = `settledBy must be 1-${MAX_SETTLED_BY_CHARS} characters — the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row`;
+export function judgeSettledByBody(settledBy, decision, directDoorActive) {
+    if (settledBy === undefined)
+        return { kind: "absent" };
+    if (directDoorActive)
+        return { kind: "not_in_proof" };
+    if (decision !== "deny")
+        return { kind: "deny_only" };
+    if (typeof settledBy !== "string")
+        return { kind: "not_string" };
+    if (!settledByFitsColumn(settledBy))
+        return { kind: "too_wide" };
+    return { kind: "accepted", settledBy };
+}
 export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
@@ -157,12 +171,25 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
-        const rawSettledBy = body.settledBy;
-        if (rawSettledBy !== undefined && d !== "deny")
-            return { ok: false, error: SETTLED_BY_DENY_ONLY };
-        if (rawSettledBy !== undefined && typeof rawSettledBy !== "string")
-            return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
-        const settledBy = rawSettledBy;
+        const settledByVerdict = judgeSettledByBody(body.settledBy, d, false);
+        let settledBy;
+        switch (settledByVerdict.kind) {
+            case "deny_only":
+                return { ok: false, error: SETTLED_BY_DENY_ONLY };
+            case "not_string":
+                return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
+            case "too_wide":
+                return { ok: false, error: SETTLED_BY_TOO_WIDE };
+            case "absent":
+                break;
+            case "accepted":
+                settledBy = settledByVerdict.settledBy;
+                break;
+            default: {
+                const unreachable = settledByVerdict;
+                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+            }
+        }
         const rawGrant = body.readRootGrant;
         if (rawGrant !== undefined && d !== "allow")
             return { ok: false, error: READ_ROOT_GRANT_ALLOW_ONLY };
@@ -175,7 +202,7 @@ export function parseToolApprovalResponse(body) {
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
-            ...(rawSettledBy !== undefined ? { settledBy } : {}),
+            ...(settledBy !== undefined ? { settledBy } : {}),
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }

package/dist/trace/core-keyset-guard.d.ts

@@ -59,8 +59,8 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole";
-type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence" | "fileHistory";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
+type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
@@ -145,8 +145,8 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "fileHistory";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -213,8 +213,9 @@ type LspOptionsUnwired = "onNotice" | "servers" | "spawn" | "readText" | "resolv
 type _GuardLspOptions = AssertAllKeysHandled<Exclude<keyof NodeLspManagerOptions, LspOptionsWired | LspOptionsUnwired>>;
 type _GuardLspOptionsReverse = AssertAllKeysHandled<Exclude<LspOptionsWired | LspOptionsUnwired, keyof NodeLspManagerOptions>>;
 type _NoDoubleBookLspOptions = AssertAllKeysHandled<Extract<LspOptionsWired, LspOptionsUnwired>>;
-type RunnerDepsDroppedPendingS724 = "fileHistoryCapture";
-type _GuardFacelessRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsDroppedPendingS724, keyof RunnerDeps>>;
+/** ⑯ 账上记过、已接线的 `RunnerDeps` 席(S-724 起 `fileHistoryCapture`)。反向钉:core 改名 / 退役 ⇒ 红。 */
+type RunnerDepsLedgerWired = "fileHistoryCapture";
+type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardNotificationReverse,
@@ -321,7 +322,7 @@ export type CoreKeysetGuards = [
     _GuardLspOptions,
     _NoDoubleBookLspOptions,
     _GuardLspOptionsReverse,
-    _GuardFacelessRunnerDepsReverse
+    _GuardLedgerRunnerDepsReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /**
  * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。
@@ -40,6 +40,8 @@ export declare const SERVER_NOTICE_AUDIENCE: {
      * `detail: { layers, remedy }` —— 层名(挂载面的直接子目录名)与那一句补救;条目名 / 内容不进。
      */
     readonly "memory.layer_locked_legacy": "operator";
+    /** S-612 —— 会话存档部分记录被跳过(唯一铸点 `src/session-records-skipped-notice.ts`);受众 user,理由见白名单键注。 */
+    readonly "session.records_skipped": "user";
 };
 export type ServerNoticeCode = keyof typeof SERVER_NOTICE_AUDIENCE;
 /** 该码是否本仓自铸(属主判据单点:门与投递面都读这一个)。 */

package/dist/trace/engine-notice-wire.js

@@ -26,10 +26,12 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "approval.read_root_granted",
     "approval.read_root_grant_rejected",
     "instructions.source_changed",
+    "session.records_skipped",
 ];
 export const SERVER_NOTICE_AUDIENCE = {
     "instructions.source_changed": "user",
     "memory.layer_locked_legacy": "operator",
+    "session.records_skipped": "user",
 };
 export function isServerNoticeCode(code) {
     return Object.hasOwn(SERVER_NOTICE_AUDIENCE, code);

package/dist/trace/project.d.ts

@@ -188,7 +188,7 @@ export declare function screenedGate(v: unknown): GateOutcome | undefined;
  * ## 读腿与写腿现在是**同一只**筛(7.74.0 起,零双读)
  * 7.72.0–7.73.0 期间读腿多一步「认本服务上一版写下的退役词旧拼法」(`unresolvable` → `ancestor_marked`),
  * 那是一条**长期双读臂**:同一份字节在写腿与读腿上有两种理解,而且没有到期日。7.74.0 把它换成**一次性
- * 迁移**(启动期把存量字节原地改名,`plugins/one-time-migrations.ts`,随 7.75.0 删)⇒ 读腿退回写腿那只
+ * 迁移**(启动期把存量字节原地改名,`plugins/one-time-migrations.ts` 的 M3;窗口见 `plugins/one-time-migrations.ts` 登记表)⇒ 读腿退回写腿那只
  * 严格筛子,集外词一律整条 withhold + 计数,不再有第二种读法。
  *
  * ## 与写腿脱敏汇点的关系(别再走回头路)

package/dist/trace/project.js

@@ -554,10 +554,19 @@ export function wiringManifestEventData(ev) {
             return dropProjectedFace("wiring_manifest.teamRole is outside core TEAM_ROLES");
         return m.teamRole;
     })();
+    const fileHistory = (() => {
+        if (m.fileHistory === undefined)
+            return undefined;
+        const word = str(m.fileHistory);
+        if (word === undefined)
+            return dropProjectedFace("wiring_manifest.fileHistory is not a non-empty string");
+        return word;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
         ...(teamRole !== undefined ? { teamRole } : {}),
+        ...(fileHistory !== undefined ? { fileHistory } : {}),
         ...(ask !== undefined ? { ask } : {}),
         ...(question !== undefined ? { question } : {}),
         ...(str(interactionIn.posture) !== undefined ? { interaction: { posture: interactionIn.posture } } : {}),

package/dist/trace/wire-projection-faces.d.ts

@@ -16,7 +16,8 @@
  * `NotificationExcluded` 直接读成本表这一行的 `excluded`,于是「哪几个键有意不上 wire」全仓**只有一个写者**。
  * 旧形是两个:守卫文件一簿、`test/wire-whitelist-exhaustiveness.test.ts` 的 `KnownExcluded` 一簿,那份门注
  * 自己写着「两处必须同时改」—— 而「必须同时改」正是 [ref] 要下线的东西(对账门不算替代,单写者才算)。
- * 本表是纯数据、无行为,被守卫文件以 `typeof import(...)` 的**类型查询**读取(编译期擦除,零运行期边)。
+ * 本表是纯数据、无行为(唯一的派生是 `wiring_manifest_operator` 行的 `excluded` 取值器 = 租户行减具名常量,S-724),
+ * 被守卫文件以 `typeof import(...)` 的**类型查询**读取(编译期擦除,零运行期边)。
  *
  * ## 门在哪里
  * `test/wire-whitelist-exhaustiveness.test.ts`:对每一行喂一枚 core 型全键 fixture,真的跑一遍构造器,
@@ -54,6 +55,12 @@ export interface WireProjectionFace {
 export declare const FRAME_ENVELOPE_KEYS: readonly ["type", "sourceTaskId", "bgAgentId"];
 /** 探针文件要从 `@sema-agent/core` 具名导入的类型(`coreType` 表达式里用到的全部名字)。 */
 export declare const WIRE_PROJECTION_CORE_IMPORTS: readonly ["TaskEvent", "TaskNotificationPayload", "WiringManifest", "EngineNotice", "MemoryImportReport", "OriginClearanceRow", "OriginClearanceEvent", "MemoryEntryOrigin"];
+/**
+ * `wiring_manifest` 的 **operator 面多投的那几段**(`wiringManifestOperatorEventData` 在租户形之上加的段)。
+ * operator 行的 `excluded` = 租户行减本常量(派生);四段各自的受众裁定在 `core-keyset-guard.ts` ⑥b。
+ * operator 构造器新投一段 ⇒ 同批加进本常量(否则 operator 行会把它登记成「不投」,键集等式门当场红)。
+ */
+export declare const WIRING_MANIFEST_OPERATOR_ONLY_SECTIONS: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny"];
 /**
  * 全部帧投影面。键 = 面名(门的报错文案与负控都按它称呼这一行)。
  *
@@ -161,14 +168,14 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly wiring_manifest_tenant: {
         readonly projector: "wiringManifestEventData";
         readonly coreType: `WiringManifest & ${string}`;
-        readonly excluded: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence", "fileHistory"];
+        readonly excluded: readonly ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence"];
         readonly unwrapped: readonly ["manifest"];
         readonly minted: readonly [];
     };
     readonly wiring_manifest_operator: {
         readonly projector: "wiringManifestOperatorEventData";
         readonly coreType: `WiringManifest & ${string}`;
-        readonly excluded: readonly ["peerPresence", "fileHistory"];
+        readonly excluded: readonly string[];
         readonly unwrapped: readonly ["manifest"];
         readonly minted: readonly [];
     };

package/dist/trace/wire-projection-faces.js

@@ -10,6 +10,10 @@ export const WIRE_PROJECTION_CORE_IMPORTS = [
     "MemoryEntryOrigin",
 ];
 const arm = (name) => `Extract<TaskEvent, { type: "${name}" }>`;
+export const WIRING_MANIFEST_OPERATOR_ONLY_SECTIONS = ["governance", "configFingerprint", "autoConsolidation", "readDeny"];
+function withoutSections(all, drop) {
+    return all.filter((k) => !drop.includes(k));
+}
 export const WIRE_PROJECTION_FACES = {
     task_progress: { projector: "taskProgressEventData", coreType: arm("task_progress"), excluded: [], minted: [] },
     tool_start: { projector: "toolStartEventData", coreType: arm("tool_start"), excluded: [], minted: [] },
@@ -36,14 +40,16 @@ export const WIRE_PROJECTION_FACES = {
     wiring_manifest_tenant: {
         projector: "wiringManifestEventData",
         coreType: `WiringManifest & ${arm("wiring_manifest")}`,
-        excluded: ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence", "fileHistory"],
+        excluded: ["governance", "configFingerprint", "autoConsolidation", "readDeny", "peerPresence"],
         unwrapped: ["manifest"],
         minted: [],
     },
     wiring_manifest_operator: {
         projector: "wiringManifestOperatorEventData",
         coreType: `WiringManifest & ${arm("wiring_manifest")}`,
-        excluded: ["peerPresence", "fileHistory"],
+        get excluded() {
+            return withoutSections(WIRE_PROJECTION_FACES.wiring_manifest_tenant.excluded, WIRING_MANIFEST_OPERATOR_ONLY_SECTIONS);
+        },
         unwrapped: ["manifest"],
         minted: [],
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.103.1",
+  "version": "7.104.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -61,7 +61,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.33.6",
+    "@sema-agent/core": "7.33.8",
     "@sema-agent/settings-schema": "6.3.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -77,7 +77,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "11.3.0",
+    "@sema-agent/sdk": "12.0.1",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",