@sema-agent/server 7.103.2 → 7.105.0

package/dist/session-policy-wire.js

@@ -1,11 +1,24 @@
-const RULE_FIELD_PRESENCE = {
-    toolAllow: true,
-    toolDeny: true,
-    allowDirs: true,
-    commandAllow: true,
-    commandDeny: true,
+import { PROTOCOL_TABLE, RETIRED_TOOL_NAMES, protocolOf } from "@sema-agent/core";
+const RULE_FIELD_ROLE = {
+    toolAllow: "tool-name",
+    toolDeny: "tool-name",
+    allowDirs: "path",
+    commandAllow: "command",
+    commandDeny: "command",
 };
-export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_PRESENCE);
+export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_ROLE);
+const TOOL_NAME_RULE_FIELDS = SESSION_PERMISSION_RULE_FIELDS.filter((f) => RULE_FIELD_ROLE[f] === "tool-name");
+export function legacyToolNameOf(name) {
+    const guidance = RETIRED_TOOL_NAMES.get(name);
+    if (guidance !== undefined)
+        return { why: "retired", guidance };
+    if (name.includes("__") && protocolOf(name) === undefined)
+        return { why: "unprefixed-namespace" };
+    return undefined;
+}
+function protocolToolNameShapes() {
+    return PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(" or ");
+}
 export function readSessionPermissionRules(raw) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw))
         return { problem: { kind: "not-an-object" } };
@@ -21,6 +34,19 @@ export function readSessionPermissionRules(raw) {
     }
     return { rules };
 }
+export function readWritableSessionPermissionRules(raw) {
+    const read = readSessionPermissionRules(raw);
+    if (read.problem !== undefined)
+        return read;
+    for (const field of TOOL_NAME_RULE_FIELDS) {
+        for (const name of read.rules[field] ?? []) {
+            const legacy = legacyToolNameOf(name);
+            if (legacy !== undefined)
+                return { problem: { kind: "legacy-tool-name", field, name, legacy } };
+        }
+    }
+    return read;
+}
 export function readSessionRulesRecords(raw) {
     if (!Array.isArray(raw))
         return { problem: { kind: "not-an-array" } };
@@ -32,7 +58,7 @@ export function readSessionRulesRecords(raw) {
         const { principal, rules, rev } = e;
         if (principal !== undefined && typeof principal !== "string")
             return { problem: { kind: "principal-not-a-string", index } };
-        const read = readSessionPermissionRules(rules);
+        const read = readWritableSessionPermissionRules(rules);
         if (read.problem !== undefined)
             return { problem: { kind: "rules", index, problem: read.problem } };
         const innerRev = rules?.rev;
@@ -45,12 +71,49 @@ export function describeSessionPermissionRulesProblem(p) {
     switch (p.kind) {
         case "not-an-object": return "rules must be a SessionPermissionRules object";
         case "field-not-string-array": return `${p.field} must be an array of strings`;
+        case "legacy-tool-name": return describeLegacyToolName(p.field, p.name, p.legacy);
         default: {
             const unhandled = p;
             throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
         }
     }
 }
+function describeLegacyToolName(field, name, legacy) {
+    switch (legacy.why) {
+        case "retired":
+            return `${field} names "${name}", a retired tool name (${legacy.guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name`;
+        case "unprefixed-namespace":
+            return `${field} names "${name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
+        default: {
+            const unhandled = legacy;
+            throw new Error(`unhandled legacy tool name arm: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function legacyToolNameProblemOf(p) {
+    switch (p.kind) {
+        case "not-an-array":
+        case "record-not-an-object":
+        case "principal-not-a-string":
+            return undefined;
+        case "rules":
+            switch (p.problem.kind) {
+                case "not-an-object":
+                case "field-not-string-array":
+                    return undefined;
+                case "legacy-tool-name":
+                    return { field: p.problem.field, name: p.problem.name };
+                default: {
+                    const unhandled = p.problem;
+                    throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        default: {
+            const unhandled = p;
+            throw new Error(`unhandled SessionRulesRecord problem: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export function describeSessionRulesRecordProblem(p) {
     switch (p.kind) {
         case "not-an-array": return "must be an array of {principal, rules} records";

package/dist/session-records-skipped-notice.d.ts

@@ -0,0 +1,20 @@
+import type { FileStorageCorruptReadInfo, SessionRepo } from "@sema-agent/core";
+import { type EngineNoticeRouter, type ServerNoticeCode } from "./trace/engine-notice-wire.js";
+export declare const SESSION_RECORDS_SKIPPED: ServerNoticeCode;
+/**
+ * 披露座上的「作用域在场则记」腿(装配点 = `plugins/store-backend.ts` 里喂给 `LocalSessionStore` 的那只
+ * `FileSessionRepo` 的 `onCorruptRead`)。只认 `kind:"replay"` 这一级(`record` 由它汇总,`file` 没有会话归属)。
+ * 作用域外 ⇒ 什么都不做(那一次披露照旧只进运维日志)。纯内存赋值,不抛。
+ */
+export declare function noteReplayInSessionOpenScope(info: FileStorageCorruptReadInfo): void;
+/** 一次打开的产物(core `SessionRepo.open` 的返回型,派生不手抄)。 */
+type OpenedSession = Awaited<ReturnType<SessionRepo["open"]>>;
+/**
+ * **唯一铸点**:为 `sessionId` 打开它自己的存档(`open` = 那一次 `repo.open(...)`),打开成功且这次回放跳过了记录 ⇒
+ * 数出幸存条目、铸一帧投出。打开失败原样上抛,不铸。
+ *
+ * 计数与投递都不抛(`getEntries()` 是存储内存条目的拷贝;`route()` 按口隔离、口的失败走 F 类留痕),所以这里没有降级臂。
+ */
+export declare function openSessionForItself(sessionId: string, open: () => Promise<OpenedSession>, router?: EngineNoticeRouter): Promise<OpenedSession>;
+export {};
+//# sourceMappingURL=session-records-skipped-notice.d.ts.map

package/dist/session-records-skipped-notice.js

@@ -0,0 +1,27 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { defaultEngineNoticeRouter } from "./trace/engine-notice-wire.js";
+export const SESSION_RECORDS_SKIPPED = "session.records_skipped";
+const openScope = new AsyncLocalStorage();
+export function noteReplayInSessionOpenScope(info) {
+    if (info.kind !== "replay")
+        return;
+    const scope = openScope.getStore();
+    if (scope !== undefined)
+        scope.dropped = info.dropped;
+}
+export async function openSessionForItself(sessionId, open, router = defaultEngineNoticeRouter) {
+    const scope = { sessionId };
+    const session = await openScope.run(scope, open);
+    const dropped = scope.dropped;
+    if (dropped !== undefined && dropped > 0) {
+        const entriesKept = (await session.getEntries()).length;
+        router.route({
+            code: SESSION_RECORDS_SKIPPED,
+            message: `Part of this session's saved history could not be read: ${dropped} record(s) were skipped when it was reopened, and this turn continues from the ${entriesKept} entries that remain.`,
+            detail: { dropped, entriesKept, sessionId },
+            sessionId,
+        });
+    }
+    return session;
+}
+//# sourceMappingURL=session-records-skipped-notice.js.map

package/dist/tool-approval.d.ts

@@ -717,7 +717,67 @@ export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOffe
  * `persistRule.rule` / `persistRule.edited` 三道既有形门**同族**(那三道在,只有本格没有 = 本格才是特例)。
  */
 export declare const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string \u2014 the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+/**
+ * #1016 / S-558 —— **live 座的那一次边界 cast,全仓只此一处**(耐久座的那一次在 `hostDecisionFacts` 里,
+ * 一座一次)。它说的是「我把一个**未判词**的串放到只收词的座上」:判词的是 core —— `resolveAsk` 对词表外
+ * 是 `approver_contract` 的响亮 fail-closed deny,不是静默当人拒(实测三形同判,特征钉在
+ * `test/tool-approval.test.ts` 的 #1016 组)。本层判过的只有**形**(是个串、只与 deny 同行,见
+ * {@link SETTLED_BY_MUST_BE_STRING} / {@link SETTLED_BY_DENY_ONLY}),而形不是词。
+ *
+ * 两个座位读它:这次回决的**即时结算**(`entry.settle` 的自报参)与**持久行**(`decideAsk` 的
+ * `settledBy` 列)。S-558 之前只有前者 —— 于是同一个事实在「当次」与「重放」上是两个答案。
+ * S-843:耐久 ask 回决口(`POST /v1/tasks/:taskId/asks/:askId/decision`)写的是**同一个座**(同一列,经
+ * `outcomeOfDecidedRow` 交给同一个 `AskOutcome.settledBy`),所以它也走这一只 —— cast 仍是一座一次。
+ */
+export declare function respondSettledBy(parsed: Pick<ParsedApprovalResponse, "settledBy">): HostSettledBy | undefined;
 export declare const SETTLED_BY_DENY_ONLY = "settledBy is only meaningful with decision \"deny\" \u2014 only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door's own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision";
+/**
+ * S-843 / 车QK F7 —— `settledBy` 的**宽**拒句(三条回决腿共用一份文本,与 {@link SETTLED_BY_DENY_ONLY} 同姿势)。句子逐字是 S-843 在
+ * 耐久 ask 回决口路由里写下的那一句(车QK F7 起搬到判官旁,路由不再自己写),尺 = 店的同一个常量({@link MAX_SETTLED_BY_CHARS})。
+ */
+export declare const SETTLED_BY_TOO_WIDE = "settledBy must be 1-16 characters \u2014 the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row";
+/**
+ * S-843 —— 决议体上 `settledBy` 的判据,**一处成形**。三条 HTTP 回决腿共读:
+ * `POST /v1/approvals/:sessionId/decide`(耐久 park 腿)、`POST /v1/tasks/:taskId/asks/:askId/decision`(耐久 ask 腿)与
+ * live `POST /v1/tool-approvals/:id/respond`(经 {@link parseToolApprovalResponse};车QK F7 起 —— 此前那只 parser 手写了 ②③ 两臂、
+ * 没有 ④,是这条判据的第二个写者)。
+ *
+ * 次序即契约(①–③ = decide 腿修前那三道 if 的原序,逐字搬来,不是新判据):
+ *  ① 直连门在场 ⇒ `not_in_proof` —— 键不在决策证明的签名载荷里(§6.3 同族第四条,理由在 approvals-assistant 的
+ *     `DECIDE_NOT_IN_PROOF_KEYS` 注);
+ *  ② 不是 deny ⇒ `deny_only` —— {@link SETTLED_BY_DENY_ONLY};
+ *  ③ 不是串 ⇒ `not_string` —— {@link SETTLED_BY_MUST_BE_STRING};
+ *  ④ 长度不在 1..{@link MAX_SETTLED_BY_CHARS} ⇒ `too_wide` —— {@link SETTLED_BY_TOO_WIDE}(车QK F7 / A3,7.104.0 合并复审)。
+ *     尺与店门口的形门同一只谓词({@link settledByFitsColumn}):`/respond` 与耐久 ask 口写的是**同一列**
+ *     (`approval_ask.settled_by`,`VARCHAR(16)`),列宽是列的事实,不是某一条腿的事实。修前这一道只长在耐久 ask 口的路由里:
+ *     `/respond` 上一只超宽 / 空串的来源位要到 CAS 里才被店门抛,落进 D5「店抖动不挡真实回决」臂 —— 行没决,决议照样交给了引擎,200。
+ *     `/decide` 的来源位不落这一列(交给 core 的 checkpoint,core 在 CAS 之前按词表拒),这一道对它同样成立:core 的闭集词
+ *     (`human` / `timeout` / `policy`)都远短于这把尺,尺外的串不可能是一个词 ⇒ 三条口对同一个体同判同句,不为一条腿开特例。
+ * 判的是**键在不在 / 配不配这个决议 / 形**,**从不判词**(词表属主是 core;三条腿的词都由引擎响亮拒)。
+ *
+ * 返回判决而不是直接回 400:各条腿在调用点按自己的码约定发出(错误文案冻结门按字面站点采集,码是 wire 契约);
+ * 调用点对判决做穷举 `switch` + `never` 兜底(加一臂 = 编译红,[ref])。`accepted` 臂带着已证形的串 —— 调用点拿它往下传,
+ * 不再对 `body.settledBy` 做第二次窄化。第三参给字面 `false` 的调用点(live `/respond`:那条口没有直连门证明)拿到的判决型里
+ * **没有** `not_in_proof` 臂(重载),不必为一条结构上不可达的臂写兜底。
+ */
+export type SettledByBodyVerdict = {
+    kind: "absent";
+} | {
+    kind: "accepted";
+    settledBy: string;
+} | {
+    kind: "not_in_proof";
+} | {
+    kind: "deny_only";
+} | {
+    kind: "not_string";
+} | {
+    kind: "too_wide";
+};
+export declare function judgeSettledByBody(settledBy: unknown, decision: string, directDoorActive: false): Exclude<SettledByBodyVerdict, {
+    kind: "not_in_proof";
+}>;
+export declare function judgeSettledByBody(settledBy: unknown, decision: string, directDoorActive: boolean): SettledByBodyVerdict;
 /** S-720(core 7.32.0 #1093)—— `readRootGrant` 只随 `decision:"allow"`(CC 卡的第三选项「Yes, and add directory」= 放行这一次
  *  + 加目录;`allow_session` 不是那一个选项,`deny` 上它没有意义)。裁决之前响亮拒,不静默丢。 */
 export declare const READ_ROOT_GRANT_ALLOW_ONLY = "readRootGrant is only meaningful with decision \"allow\" \u2014 it is the card's \"Yes, and add directory\" answer (allow this call and add the card's readRootCandidate.dir to this run's read directories)";
@@ -737,6 +797,11 @@ export declare function parseToolApprovalResponse(body: unknown): {
     ok: false;
     error: string;
 };
+/** [ref] 车2:`parseToolApprovalResponse` 的成功分支形——`respond()` 拆分出的私有收尾方法(`finishRespond`/
+ *  `respondWithCas`)复用,避免裸内联匿名类型重复三处。 */
+type ParsedApprovalResponse = Extract<ReturnType<typeof parseToolApprovalResponse>, {
+    ok: true;
+}>;
 /**
  * #1016 —— wire 上**开给调用方**的那一个词,从 core 的两只闭集里取**交集**。
  *

package/dist/tool-approval.js

@@ -9,7 +9,7 @@ import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
 import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
+import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
@@ -107,10 +107,24 @@ export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a bool
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
 export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
-function respondSettledBy(parsed) {
+export function respondSettledBy(parsed) {
     return parsed.settledBy;
 }
 export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
+export const SETTLED_BY_TOO_WIDE = `settledBy must be 1-${MAX_SETTLED_BY_CHARS} characters — the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row`;
+export function judgeSettledByBody(settledBy, decision, directDoorActive) {
+    if (settledBy === undefined)
+        return { kind: "absent" };
+    if (directDoorActive)
+        return { kind: "not_in_proof" };
+    if (decision !== "deny")
+        return { kind: "deny_only" };
+    if (typeof settledBy !== "string")
+        return { kind: "not_string" };
+    if (!settledByFitsColumn(settledBy))
+        return { kind: "too_wide" };
+    return { kind: "accepted", settledBy };
+}
 export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
@@ -157,12 +171,25 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
-        const rawSettledBy = body.settledBy;
-        if (rawSettledBy !== undefined && d !== "deny")
-            return { ok: false, error: SETTLED_BY_DENY_ONLY };
-        if (rawSettledBy !== undefined && typeof rawSettledBy !== "string")
-            return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
-        const settledBy = rawSettledBy;
+        const settledByVerdict = judgeSettledByBody(body.settledBy, d, false);
+        let settledBy;
+        switch (settledByVerdict.kind) {
+            case "deny_only":
+                return { ok: false, error: SETTLED_BY_DENY_ONLY };
+            case "not_string":
+                return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
+            case "too_wide":
+                return { ok: false, error: SETTLED_BY_TOO_WIDE };
+            case "absent":
+                break;
+            case "accepted":
+                settledBy = settledByVerdict.settledBy;
+                break;
+            default: {
+                const unreachable = settledByVerdict;
+                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+            }
+        }
         const rawGrant = body.readRootGrant;
         if (rawGrant !== undefined && d !== "allow")
             return { ok: false, error: READ_ROOT_GRANT_ALLOW_ONLY };
@@ -175,7 +202,7 @@ export function parseToolApprovalResponse(body) {
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
-            ...(rawSettledBy !== undefined ? { settledBy } : {}),
+            ...(settledBy !== undefined ? { settledBy } : {}),
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }

package/dist/trace/core-keyset-guard.d.ts

@@ -59,8 +59,8 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole";
-type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence" | "fileHistory";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
+type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
@@ -145,8 +145,8 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "fileHistory";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -213,8 +213,9 @@ type LspOptionsUnwired = "onNotice" | "servers" | "spawn" | "readText" | "resolv
 type _GuardLspOptions = AssertAllKeysHandled<Exclude<keyof NodeLspManagerOptions, LspOptionsWired | LspOptionsUnwired>>;
 type _GuardLspOptionsReverse = AssertAllKeysHandled<Exclude<LspOptionsWired | LspOptionsUnwired, keyof NodeLspManagerOptions>>;
 type _NoDoubleBookLspOptions = AssertAllKeysHandled<Extract<LspOptionsWired, LspOptionsUnwired>>;
-type RunnerDepsDroppedPendingS724 = "fileHistoryCapture";
-type _GuardFacelessRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsDroppedPendingS724, keyof RunnerDeps>>;
+/** ⑯ 账上记过、已接线的 `RunnerDeps` 席(S-724 起 `fileHistoryCapture`)。反向钉:core 改名 / 退役 ⇒ 红。 */
+type RunnerDepsLedgerWired = "fileHistoryCapture";
+type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardNotificationReverse,
@@ -321,7 +322,7 @@ export type CoreKeysetGuards = [
     _GuardLspOptions,
     _NoDoubleBookLspOptions,
     _GuardLspOptionsReverse,
-    _GuardFacelessRunnerDepsReverse
+    _GuardLedgerRunnerDepsReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /**
  * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。
@@ -40,6 +40,8 @@ export declare const SERVER_NOTICE_AUDIENCE: {
      * `detail: { layers, remedy }` —— 层名(挂载面的直接子目录名)与那一句补救;条目名 / 内容不进。
      */
     readonly "memory.layer_locked_legacy": "operator";
+    /** S-612 —— 会话存档部分记录被跳过(唯一铸点 `src/session-records-skipped-notice.ts`);受众 user,理由见白名单键注。 */
+    readonly "session.records_skipped": "user";
 };
 export type ServerNoticeCode = keyof typeof SERVER_NOTICE_AUDIENCE;
 /** 该码是否本仓自铸(属主判据单点:门与投递面都读这一个)。 */

package/dist/trace/engine-notice-wire.js

@@ -26,10 +26,12 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "approval.read_root_granted",
     "approval.read_root_grant_rejected",
     "instructions.source_changed",
+    "session.records_skipped",
 ];
 export const SERVER_NOTICE_AUDIENCE = {
     "instructions.source_changed": "user",
     "memory.layer_locked_legacy": "operator",
+    "session.records_skipped": "user",
 };
 export function isServerNoticeCode(code) {
     return Object.hasOwn(SERVER_NOTICE_AUDIENCE, code);

package/dist/trace/project.d.ts

@@ -156,8 +156,9 @@ export declare function toolStartEventData(ev: {
  * 🔴 **筛子是一只总函数**(S-239,codex 对抗复审 r1 [medium] 亲核复现后修)—— 上面纪律②许诺的
  * 「坏形 ⇒ report + withhold,**不抛**」此前是靠**逐条枚举**坏形兑现的,枚举不到的那些照样抛:
  * `projectSettlement` 对 `note` / `who.approver` 先 `redactSecrets` 再截断,而 `redactSecrets` 会在
- * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,仍能抛的是 JSON 秘密字段臂的
- * 转义对循环,S-102/S-106 登记的既有上界,见 `redact.ts` 该行顶注),两条叶各能抛一次。
+ * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,JSON 秘密字段臂的转义对循环与
+ * PEM 栅栏臂的标签交替循环由 S-265 换成手写扫描器闭掉 —— 已知形全部闭掉,本段写的是「当时为什么要总函数化」),
+ * 两条叶各能抛一次。总函数化照留:它兑现的是「坏字节一律 withhold」这条**结构**,不依赖脱敏器今天抛不抛。
  *
  * 抛出去的代价按腿算,而且一条比一条重:写腿落账那处的 `.catch` 看不到**同步**投影期的异常;读腿上它
  * 直接逃出 `formatEvent` / 投影函数 —— 账本裸回放腿的那一次会当场断流(那一行不上帧、游标不前进、后面的
@@ -188,7 +189,7 @@ export declare function screenedGate(v: unknown): GateOutcome | undefined;
  * ## 读腿与写腿现在是**同一只**筛(7.74.0 起,零双读)
  * 7.72.0–7.73.0 期间读腿多一步「认本服务上一版写下的退役词旧拼法」(`unresolvable` → `ancestor_marked`),
  * 那是一条**长期双读臂**:同一份字节在写腿与读腿上有两种理解,而且没有到期日。7.74.0 把它换成**一次性
- * 迁移**(启动期把存量字节原地改名,`plugins/one-time-migrations.ts`,随 7.75.0 删)⇒ 读腿退回写腿那只
+ * 迁移**(启动期把存量字节原地改名,`plugins/one-time-migrations.ts` 的 M3;窗口见 `plugins/one-time-migrations.ts` 登记表)⇒ 读腿退回写腿那只
  * 严格筛子,集外词一律整条 withhold + 计数,不再有第二种读法。
  *
  * ## 与写腿脱敏汇点的关系(别再走回头路)
@@ -295,7 +296,9 @@ export declare function toolEndEventData(ev: {
  * **不等于** `tool_end` 的 duration)。
  *
  * ## 信任划线
- *  · `toolCallId` / `toolName` —— 引擎铸的 id 与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。
+ *  · `toolCallId` / `toolName` —— 调用 id(🔴 S-283 订正:**服务商**在 tool_use / tool_calls 里给的,引擎只在缺席时自铸兜底 ——
+ *    此前写「引擎铸」不实)与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。调用 id 这一族在**逐帧面**上的形状闸
+ *    不在 S-283 射程(它是全 wire 的 join 键,要闸得所有面一起闸,见 run-terminal `admitProviderEcho` 顶注与车QO 收车档)。
  *  · `elapsedTimeSeconds` —— 引擎铸的整秒,单调、一 call 一个原点 ⇒ 有限数才铸键。
  *  · `output` —— 🔴 **UNTRUSTED RAW**,core 逐字「exactly as `tool_end.output`: process output that may
  *    carry secrets, paths or PII; core bounds only its SIZE, and a consumer MUST redact before persisting
@@ -925,8 +928,10 @@ export declare function contextUsageEventData(ev: {
  *
  * `responseModel`(core 7.29.0 #1029):**供应商自己**报的、回答这一 turn 的模型名,**只在**它 ≠ 请求所带 id
  * 时在场。缺席 = 「报了同名」或「没报」,**一个读法**(请求 id 读 `TaskResult.model`)。值是供应商铸的名字
- * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 逐字;非串 / 空串 ⇒ 缺席(core 的读律
- * `providerReportedModel` 对空串答「没报」,本仓不铸一个看起来合法的空名)。
+ * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 🔴 **S-283 起过 provider 回声的形状闸**
+ * ({@link admitProviderEcho}:长度 1–128 的可见 ASCII 原样,越界 ⇒ 不铸键 + 计数,与 core #1204 源头闸同一条;不过脱敏器),
+ * 与结果面的孪生 `TaskResult.responseModel` 同一只闸 —— 同一个名字在两张脸上不许两种待遇。非串 / 空串同样不铸键(空串在
+ * 那条谓词的长度下界之外;core 的读律 `providerReportedModel` 对空串也答「没报」)。
  */
 export declare function turnEndEventData(ev: {
     usage?: unknown;

package/dist/trace/project.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
+import { admitProviderEcho, redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
 import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -300,7 +300,7 @@ export function taskNotificationEventData(ev) {
             ? {
                 apiFailure: {
                     ...(typeof n.apiFailure.status === "number" ? { status: n.apiFailure.status } : {}),
-                    ...(typeof n.apiFailure.requestId === "string" ? { requestId: n.apiFailure.requestId } : {}),
+                    ...(admitProviderEcho(n.apiFailure.requestId, "task_notification.apiFailure.requestId") ? { requestId: n.apiFailure.requestId } : {}),
                 },
             }
             : {}),
@@ -554,10 +554,19 @@ export function wiringManifestEventData(ev) {
             return dropProjectedFace("wiring_manifest.teamRole is outside core TEAM_ROLES");
         return m.teamRole;
     })();
+    const fileHistory = (() => {
+        if (m.fileHistory === undefined)
+            return undefined;
+        const word = str(m.fileHistory);
+        if (word === undefined)
+            return dropProjectedFace("wiring_manifest.fileHistory is not a non-empty string");
+        return word;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
         ...(teamRole !== undefined ? { teamRole } : {}),
+        ...(fileHistory !== undefined ? { fileHistory } : {}),
         ...(ask !== undefined ? { ask } : {}),
         ...(question !== undefined ? { question } : {}),
         ...(str(interactionIn.posture) !== undefined ? { interaction: { posture: interactionIn.posture } } : {}),
@@ -747,7 +756,7 @@ export function turnEndEventData(ev) {
         ...(ev.usage ? { usage: ev.usage } : {}),
         ...(ev.usageMissing === true ? { usageMissing: true } : {}),
         ...(typeof ev.stopReason === "string" ? { stopReason: ev.stopReason } : {}),
-        ...(typeof ev.responseModel === "string" && ev.responseModel !== "" ? { responseModel: ev.responseModel } : {}),
+        ...(admitProviderEcho(ev.responseModel, "turn_end.responseModel") ? { responseModel: ev.responseModel } : {}),
         ...identityFields(ev),
     };
 }

package/dist/trace/redact.d.ts

@@ -72,6 +72,13 @@ declare const DISPLAY_SAFE_URL_TOKEN = "\u00ABredacted:url\u00BB";
 /** S-776:出网代理 URL 的回显尺(`outbound-dispatcher.ts` `displayProxyUrl`)形不干净时整只用**同一枚**占位 —— 单独一行导出,
  *  上面那行字面量保持 `const NAME = "…";` 形(`test/api-notice-text-freeze.test.ts` §6 的冻结扫描按这一形认替换 token)。 */
 export { DISPLAY_SAFE_URL_TOKEN };
+/** 测试可见(S-265 真值表的两半):结构段里**表行只作声明、实现是手写扫描器**的臂 —— 声明正则的**新拷贝**
+ *  (`lastIndex` 不与模块内那一枚共享)+ 扫描器在一份原文上产的候选跨度 `[起, 止)`。臂名是闭集 ⇒ 穷尽 `switch`
+ *  (少一个 `case` = 缺返回 = 编译红)。 */
+export declare function structuralScannerForTest(arm: "json-secret-field" | "pem-fence"): {
+    declared: RegExp;
+    spans: (text: string) => Array<[number, number]>;
+};
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;