@sema-agent/server 7.104.0 → 7.105.0

package/dist/session-policy-wire.js

@@ -1,11 +1,24 @@
-const RULE_FIELD_PRESENCE = {
-    toolAllow: true,
-    toolDeny: true,
-    allowDirs: true,
-    commandAllow: true,
-    commandDeny: true,
+import { PROTOCOL_TABLE, RETIRED_TOOL_NAMES, protocolOf } from "@sema-agent/core";
+const RULE_FIELD_ROLE = {
+    toolAllow: "tool-name",
+    toolDeny: "tool-name",
+    allowDirs: "path",
+    commandAllow: "command",
+    commandDeny: "command",
 };
-export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_PRESENCE);
+export const SESSION_PERMISSION_RULE_FIELDS = Object.keys(RULE_FIELD_ROLE);
+const TOOL_NAME_RULE_FIELDS = SESSION_PERMISSION_RULE_FIELDS.filter((f) => RULE_FIELD_ROLE[f] === "tool-name");
+export function legacyToolNameOf(name) {
+    const guidance = RETIRED_TOOL_NAMES.get(name);
+    if (guidance !== undefined)
+        return { why: "retired", guidance };
+    if (name.includes("__") && protocolOf(name) === undefined)
+        return { why: "unprefixed-namespace" };
+    return undefined;
+}
+function protocolToolNameShapes() {
+    return PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(" or ");
+}
 export function readSessionPermissionRules(raw) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw))
         return { problem: { kind: "not-an-object" } };
@@ -21,6 +34,19 @@ export function readSessionPermissionRules(raw) {
     }
     return { rules };
 }
+export function readWritableSessionPermissionRules(raw) {
+    const read = readSessionPermissionRules(raw);
+    if (read.problem !== undefined)
+        return read;
+    for (const field of TOOL_NAME_RULE_FIELDS) {
+        for (const name of read.rules[field] ?? []) {
+            const legacy = legacyToolNameOf(name);
+            if (legacy !== undefined)
+                return { problem: { kind: "legacy-tool-name", field, name, legacy } };
+        }
+    }
+    return read;
+}
 export function readSessionRulesRecords(raw) {
     if (!Array.isArray(raw))
         return { problem: { kind: "not-an-array" } };
@@ -32,7 +58,7 @@ export function readSessionRulesRecords(raw) {
         const { principal, rules, rev } = e;
         if (principal !== undefined && typeof principal !== "string")
             return { problem: { kind: "principal-not-a-string", index } };
-        const read = readSessionPermissionRules(rules);
+        const read = readWritableSessionPermissionRules(rules);
         if (read.problem !== undefined)
             return { problem: { kind: "rules", index, problem: read.problem } };
         const innerRev = rules?.rev;
@@ -45,12 +71,49 @@ export function describeSessionPermissionRulesProblem(p) {
     switch (p.kind) {
         case "not-an-object": return "rules must be a SessionPermissionRules object";
         case "field-not-string-array": return `${p.field} must be an array of strings`;
+        case "legacy-tool-name": return describeLegacyToolName(p.field, p.name, p.legacy);
         default: {
             const unhandled = p;
             throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
         }
     }
 }
+function describeLegacyToolName(field, name, legacy) {
+    switch (legacy.why) {
+        case "retired":
+            return `${field} names "${name}", a retired tool name (${legacy.guidance}); with that rule in place this session could not start another run, so nothing was written — use the current tool name`;
+        case "unprefixed-namespace":
+            return `${field} names "${name}", which contains "__" but no protocol prefix; with that rule in place this session could not start another run, so nothing was written — a protocol tool is named ${protocolToolNameShapes()}`;
+        default: {
+            const unhandled = legacy;
+            throw new Error(`unhandled legacy tool name arm: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+export function legacyToolNameProblemOf(p) {
+    switch (p.kind) {
+        case "not-an-array":
+        case "record-not-an-object":
+        case "principal-not-a-string":
+            return undefined;
+        case "rules":
+            switch (p.problem.kind) {
+                case "not-an-object":
+                case "field-not-string-array":
+                    return undefined;
+                case "legacy-tool-name":
+                    return { field: p.problem.field, name: p.problem.name };
+                default: {
+                    const unhandled = p.problem;
+                    throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        default: {
+            const unhandled = p;
+            throw new Error(`unhandled SessionRulesRecord problem: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export function describeSessionRulesRecordProblem(p) {
     switch (p.kind) {
         case "not-an-array": return "must be an array of {principal, rules} records";

package/dist/trace/project.d.ts

@@ -156,8 +156,9 @@ export declare function toolStartEventData(ev: {
  * 🔴 **筛子是一只总函数**(S-239,codex 对抗复审 r1 [medium] 亲核复现后修)—— 上面纪律②许诺的
  * 「坏形 ⇒ report + withhold,**不抛**」此前是靠**逐条枚举**坏形兑现的,枚举不到的那些照样抛:
  * `projectSettlement` 对 `note` / `who.approver` 先 `redactSecrets` 再截断,而 `redactSecrets` 会在
- * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,仍能抛的是 JSON 秘密字段臂的
- * 转义对循环,S-102/S-106 登记的既有上界,见 `redact.ts` 该行顶注),两条叶各能抛一次。
+ * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,JSON 秘密字段臂的转义对循环与
+ * PEM 栅栏臂的标签交替循环由 S-265 换成手写扫描器闭掉 —— 已知形全部闭掉,本段写的是「当时为什么要总函数化」),
+ * 两条叶各能抛一次。总函数化照留:它兑现的是「坏字节一律 withhold」这条**结构**,不依赖脱敏器今天抛不抛。
  *
  * 抛出去的代价按腿算,而且一条比一条重:写腿落账那处的 `.catch` 看不到**同步**投影期的异常;读腿上它
  * 直接逃出 `formatEvent` / 投影函数 —— 账本裸回放腿的那一次会当场断流(那一行不上帧、游标不前进、后面的
@@ -295,7 +296,9 @@ export declare function toolEndEventData(ev: {
  * **不等于** `tool_end` 的 duration)。
  *
  * ## 信任划线
- *  · `toolCallId` / `toolName` —— 引擎铸的 id 与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。
+ *  · `toolCallId` / `toolName` —— 调用 id(🔴 S-283 订正:**服务商**在 tool_use / tool_calls 里给的,引擎只在缺席时自铸兜底 ——
+ *    此前写「引擎铸」不实)与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。调用 id 这一族在**逐帧面**上的形状闸
+ *    不在 S-283 射程(它是全 wire 的 join 键,要闸得所有面一起闸,见 run-terminal `admitProviderEcho` 顶注与车QO 收车档)。
  *  · `elapsedTimeSeconds` —— 引擎铸的整秒,单调、一 call 一个原点 ⇒ 有限数才铸键。
  *  · `output` —— 🔴 **UNTRUSTED RAW**,core 逐字「exactly as `tool_end.output`: process output that may
  *    carry secrets, paths or PII; core bounds only its SIZE, and a consumer MUST redact before persisting
@@ -925,8 +928,10 @@ export declare function contextUsageEventData(ev: {
  *
  * `responseModel`(core 7.29.0 #1029):**供应商自己**报的、回答这一 turn 的模型名,**只在**它 ≠ 请求所带 id
  * 时在场。缺席 = 「报了同名」或「没报」,**一个读法**(请求 id 读 `TaskResult.model`)。值是供应商铸的名字
- * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 逐字;非串 / 空串 ⇒ 缺席(core 的读律
- * `providerReportedModel` 对空串答「没报」,本仓不铸一个看起来合法的空名)。
+ * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 🔴 **S-283 起过 provider 回声的形状闸**
+ * ({@link admitProviderEcho}:长度 1–128 的可见 ASCII 原样,越界 ⇒ 不铸键 + 计数,与 core #1204 源头闸同一条;不过脱敏器),
+ * 与结果面的孪生 `TaskResult.responseModel` 同一只闸 —— 同一个名字在两张脸上不许两种待遇。非串 / 空串同样不铸键(空串在
+ * 那条谓词的长度下界之外;core 的读律 `providerReportedModel` 对空串也答「没报」)。
  */
 export declare function turnEndEventData(ev: {
     usage?: unknown;

package/dist/trace/project.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
+import { admitProviderEcho, redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
 import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -300,7 +300,7 @@ export function taskNotificationEventData(ev) {
             ? {
                 apiFailure: {
                     ...(typeof n.apiFailure.status === "number" ? { status: n.apiFailure.status } : {}),
-                    ...(typeof n.apiFailure.requestId === "string" ? { requestId: n.apiFailure.requestId } : {}),
+                    ...(admitProviderEcho(n.apiFailure.requestId, "task_notification.apiFailure.requestId") ? { requestId: n.apiFailure.requestId } : {}),
                 },
             }
             : {}),
@@ -756,7 +756,7 @@ export function turnEndEventData(ev) {
         ...(ev.usage ? { usage: ev.usage } : {}),
         ...(ev.usageMissing === true ? { usageMissing: true } : {}),
         ...(typeof ev.stopReason === "string" ? { stopReason: ev.stopReason } : {}),
-        ...(typeof ev.responseModel === "string" && ev.responseModel !== "" ? { responseModel: ev.responseModel } : {}),
+        ...(admitProviderEcho(ev.responseModel, "turn_end.responseModel") ? { responseModel: ev.responseModel } : {}),
         ...identityFields(ev),
     };
 }

package/dist/trace/redact.d.ts

@@ -72,6 +72,13 @@ declare const DISPLAY_SAFE_URL_TOKEN = "\u00ABredacted:url\u00BB";
 /** S-776:出网代理 URL 的回显尺(`outbound-dispatcher.ts` `displayProxyUrl`)形不干净时整只用**同一枚**占位 —— 单独一行导出,
  *  上面那行字面量保持 `const NAME = "…";` 形(`test/api-notice-text-freeze.test.ts` §6 的冻结扫描按这一形认替换 token)。 */
 export { DISPLAY_SAFE_URL_TOKEN };
+/** 测试可见(S-265 真值表的两半):结构段里**表行只作声明、实现是手写扫描器**的臂 —— 声明正则的**新拷贝**
+ *  (`lastIndex` 不与模块内那一枚共享)+ 扫描器在一份原文上产的候选跨度 `[起, 止)`。臂名是闭集 ⇒ 穷尽 `switch`
+ *  (少一个 `case` = 缺返回 = 编译红)。 */
+export declare function structuralScannerForTest(arm: "json-secret-field" | "pem-fence"): {
+    declared: RegExp;
+    spans: (text: string) => Array<[number, number]>;
+};
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;

package/dist/trace/redact.js

@@ -486,13 +486,12 @@ function deriveLiteralHead(re) {
 function scanResumeAfterHit(start, end, back) {
     return Math.max(start + 1, end - back);
 }
-const spanOffset = (a, m) => (a.outside === 1 ? m[1].length : 0);
 function collectRegexSpans(a, text, out) {
     const g = a.g;
     g.lastIndex = 0;
     for (let m = g.exec(text); m !== null; m = g.exec(text)) {
         const end = m.index + m[0].length;
-        out.push({ start: m.index + spanOffset(a, m), end, repl: a.repl, rank: a.rank, order: a.order });
+        out.push({ start: m.index, end, repl: a.repl, rank: a.rank, order: a.order });
         g.lastIndex = scanResumeAfterHit(m.index, end, a.back);
     }
 }
@@ -585,7 +584,7 @@ function collectStickySpans(a, text, at, out) {
         if (m === null)
             continue;
         const end = p + m[0].length;
-        out.push({ start: p + spanOffset(a, m), end, repl, rank, order });
+        out.push({ start: p, end, repl, rank, order });
         pos = scanResumeAfterHit(p, end, back);
     }
 }
@@ -935,6 +934,47 @@ function collectSsh2FenceSpans(text, span) {
         from = scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length);
     }
 }
+const PEM_END_OPEN = "-----END";
+const PEM_FENCE_BODY_MAX = 8192;
+function pemFenceLineEnd(text, labelFrom) {
+    const close = text.indexOf(PEM_FENCE_CLOSE, labelFrom);
+    return close >= 0 && isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : -1;
+}
+function collectPemFenceSpans(text, span) {
+    let endFrom = -1;
+    let endAt = -1;
+    let endAfter = -1;
+    const earliestEndFence = (from) => {
+        if (endFrom >= 0 && from >= endFrom && (endAt < 0 || endAt >= from))
+            return;
+        let b = text.indexOf(PEM_END_OPEN, from);
+        let after = -1;
+        while (b >= 0 && (after = pemFenceLineEnd(text, b + PEM_END_OPEN.length)) < 0)
+            b = text.indexOf(PEM_END_OPEN, b + 1);
+        endFrom = from;
+        endAt = b;
+        endAfter = after;
+    };
+    for (let from = 0;;) {
+        const fence = text.indexOf(PEM_FENCE_OPEN, from);
+        if (fence < 0)
+            return;
+        const bodyFrom = pemFenceLineEnd(text, fence + PEM_FENCE_OPEN.length);
+        if (bodyFrom < 0) {
+            from = fence + 1;
+            continue;
+        }
+        earliestEndFence(bodyFrom);
+        if (endAt < 0)
+            return;
+        if (endAt - bodyFrom > PEM_FENCE_BODY_MAX) {
+            from = fence + 1;
+            continue;
+        }
+        span(fence, endAfter);
+        from = scanResumeAfterHit(fence, endAfter, PEM_FENCE_OPEN.length);
+    }
+}
 function collectPemFragmentSpans(text, json, span) {
     let cur = findPemFence(text, 0);
     let inherited = false;
@@ -1145,6 +1185,18 @@ const SSH2_FENCE_PATTERN = (() => {
         throw new Error("redact: SSH2 fence rule missing from FULL_ARM_PATTERNS");
     return row;
 })();
+const PEM_FENCE_PATTERN = (() => {
+    const row = FULL_ARM_PATTERNS.find(([re]) => re.source.startsWith(PEM_FENCE_OPEN));
+    if (row === undefined)
+        throw new Error("redact: PEM fence rule missing from FULL_ARM_PATTERNS");
+    return row;
+})();
+const JSON_SECRET_FIELD_PATTERN = (() => {
+    const rows = FULL_ARM_PATTERNS.filter(([, repl]) => repl === '$1"«redacted»"');
+    if (rows.length !== 1)
+        throw new Error(`redact: expected exactly one JSON secret-field rule (replacement '$1"«redacted»"') in FULL_ARM_PATTERNS, found ${rows.length}`);
+    return rows[0];
+})();
 const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 || c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff;
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
 const isControlCode = (c) => c < 0x20 || c === 0x7f;
@@ -1360,6 +1412,78 @@ function collectUrlCredentialSpans(text, json, span) {
         i = valueEnd - 1;
     }
 }
+const JSON_FIELD_ANCHOR = '"';
+const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_NAME_WORDS.map((w) => w.length));
+function jsonSecretFieldValueQuoteAt(text, p) {
+    const n = text.length;
+    let name = "";
+    let i = p + 1;
+    for (; i < n; i++) {
+        let c = text.charCodeAt(i);
+        if (c === CH_QUOTE)
+            break;
+        if (i - p > CREDENTIAL_NAME_MAX)
+            return -1;
+        if (c >= CH_A && c <= CH_Z)
+            c += 32;
+        if (!((c >= CH_a && c <= CH_z) || (c >= CH_0 && c <= CH_9) || c === CH_UNDERSCORE || c === CH_MINUS))
+            return -1;
+        name += String.fromCharCode(c);
+    }
+    if (i >= n || !CREDENTIAL_NAME_SET.has(name))
+        return -1;
+    i += 1;
+    while (i < n && isRegexSpace(text.charCodeAt(i)))
+        i += 1;
+    if (text.charCodeAt(i) !== CH_COLON)
+        return -1;
+    i += 1;
+    while (i < n && isRegexSpace(text.charCodeAt(i)))
+        i += 1;
+    return text.charCodeAt(i) === CH_QUOTE ? i : -1;
+}
+function jsonStringEndAt(text, q) {
+    const n = text.length;
+    for (let i = q + 1; i < n;) {
+        const c = text.charCodeAt(i);
+        if (c === CH_QUOTE)
+            return i + 1;
+        if (c === CH_BACKSLASH) {
+            if (i + 1 < n && !isLineTerminator(text.charCodeAt(i + 1))) {
+                i += 2;
+                continue;
+            }
+            return -1;
+        }
+        i += 1;
+    }
+    return -1;
+}
+function collectJsonSecretFieldSpans(text, span) {
+    for (let p = text.indexOf(JSON_FIELD_ANCHOR); p >= 0;) {
+        const q = jsonSecretFieldValueQuoteAt(text, p);
+        const end = q < 0 ? -1 : jsonStringEndAt(text, q);
+        if (end < 0) {
+            p = text.indexOf(JSON_FIELD_ANCHOR, p + 1);
+            continue;
+        }
+        span(q, end);
+        p = text.indexOf(JSON_FIELD_ANCHOR, scanResumeAfterHit(p, end, JSON_FIELD_ANCHOR.length));
+    }
+}
+export function structuralScannerForTest(arm) {
+    const collect = (scan) => (text) => {
+        const out = [];
+        scan(text, (start, end) => out.push([start, end]));
+        return out;
+    };
+    switch (arm) {
+        case "json-secret-field":
+            return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect(collectJsonSecretFieldSpans) };
+        case "pem-fence":
+            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect(collectPemFenceSpans) };
+    }
+}
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
@@ -1462,56 +1586,19 @@ const armPool = (() => {
             throw new Error(`redact: arm-pool replacement ${JSON.stringify(token)} may only use a leading $1 (the run kept outside the span)`);
         return body;
     };
-    const literalAnchorHead = (re) => {
-        const src = re.source;
-        let i = src.startsWith("(") && !src.startsWith("(?") ? 1 : 0;
-        let out = "";
-        for (; i < src.length; i++) {
-            const c = src[i];
-            if (c === "\\") {
-                const e = src[i + 1];
-                if (e === undefined || !HEAD_LITERAL_ESCAPES.has(e))
-                    break;
-                if ("*+?{".includes(src[i + 2] ?? ""))
-                    break;
-                out += src.slice(i, i + 2);
-                i += 1;
-                continue;
-            }
-            if ("([{|).^$*+?".includes(c))
-                break;
-            if ("*+?{".includes(src[i + 1] ?? ""))
-                break;
-            out += c;
-        }
-        if (out.length === 0)
-            throw new Error(`redact: structural arm /${src}/ has no literal anchor head — its same-arm rewind amount cannot be derived`);
-        return out;
-    };
-    const regexMember = ([re, token], rank, order, structural) => {
+    const regexMember = ([re, token], rank, order) => {
+        if (token.startsWith("$1"))
+            throw new Error(`redact: regex arm /${re.source}/ cannot carry an outside-span $1 prefix — that form belongs to the structural scanners`);
         const repl = spanRepl(token);
-        const outside = token.startsWith("$1") ? 1 : 0;
         const y = VALUE_ARM_STICKY.get(re);
-        let back;
-        let headSrc;
-        let headFirst;
-        if (structural) {
-            back = literalAnchorHead(re).length;
-            headSrc = undefined;
-            headFirst = undefined;
-        }
-        else {
-            const d = deriveLiteralHead(re);
-            back = Math.max(d.len - 1, 0);
-            headSrc = d.src;
-            headFirst = d.first;
-            if (y !== undefined && (d.len === 0 || headSrc === undefined || headFirst === undefined)) {
-                throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
-            }
+        const d = deriveLiteralHead(re);
+        const back = Math.max(d.len - 1, 0);
+        const headSrc = d.src;
+        const headFirst = d.first;
+        if (y !== undefined && (d.len === 0 || headSrc === undefined || headFirst === undefined)) {
+            throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the bounded head screen would admit every candidate position`);
         }
-        if (y !== undefined && outside === 1)
-            throw new Error(`redact: value arm /${re.source}/ cannot carry an outside-span $1 prefix`);
-        const arm = { g: re, y, back, headSrc, headFirst, repl, rank, order, outside };
+        const arm = { g: re, y, back, headSrc, headFirst, repl, rank, order };
         const boundary = y === undefined || headSrc === undefined || headFirst === undefined ? undefined : { ...arm, y, headSrc, headFirst };
         return {
             token,
@@ -1541,24 +1628,29 @@ const armPool = (() => {
             headFirst: undefined,
         };
     };
+    const structuralScannerMember = (row, order) => {
+        if (row === PEM_FENCE_PATTERN)
+            return scannerMember(row[1], order, 1, (text, _json, _observe, span) => collectPemFenceSpans(text, span));
+        if (row === SSH2_FENCE_PATTERN)
+            return scannerMember(row[1], order, 2, (text, _json, _observe, span) => collectSsh2FenceSpans(text, span));
+        if (row === URL_CREDENTIAL_PATTERN)
+            return scannerMember(row[1], order, 2, (text, json, _observe, span) => collectUrlCredentialSpans(text, json, span));
+        if (row === JSON_SECRET_FIELD_PATTERN)
+            return scannerMember(row[1], order, 1, (text, _json, _observe, span) => collectJsonSecretFieldSpans(text, span));
+        throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
+    };
     const members = [];
-    for (const row of STRUCTURAL_SECRET_PATTERNS) {
-        const order = members.length;
-        members.push(row === URL_CREDENTIAL_PATTERN
-            ? scannerMember(row[1], order, 2, (text, json, _observe, span) => collectUrlCredentialSpans(text, json, span))
-            : row === SSH2_FENCE_PATTERN
-                ? scannerMember(row[1], order, 2, (text, _json, _observe, span) => collectSsh2FenceSpans(text, span))
-                : regexMember(row, ARM_RANK.structural, order, true));
-    }
+    for (const row of STRUCTURAL_SECRET_PATTERNS)
+        members.push(structuralScannerMember(row, members.length));
     members.push(scannerMember(PPK_CONTAINER_TOKEN, members.length, 2, (text, _json, observe, span) => collectPpkContainerSpans(text, observe, span)));
     members.push(scannerMember(PEM_FRAGMENT_TOKEN, members.length, 2, (text, json, _observe, span) => collectPemFragmentSpans(text, json, span)));
     members.push(scannerMember(HEADLESS_PPK_TOKEN, members.length, 2, (text, _json, _observe, span) => collectHeadlessPpkSpans(text, span)));
     for (const row of KEYWORD_SECRET_PATTERNS)
-        members.push(regexMember(row, ARM_RANK.keyword, members.length, false));
+        members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
-        members.push(regexMember(row, ARM_RANK.shape, members.length, false));
+        members.push(regexMember(row, ARM_RANK.shape, members.length));
     for (const row of FRAGMENT_SECRET_PATTERNS)
-        members.push(regexMember(row, ARM_RANK.fragment, members.length, false));
+        members.push(regexMember(row, ARM_RANK.fragment, members.length));
     for (const [re] of KEYWORD_SECRET_PATTERNS) {
         if (!LEXICAL_KEYWORD_ARMS.has(re))
             throw new Error(`redact: keyword arm /${re.source}/ is not registered as lexical — build it with keywordArm() so the bounded-unit scope can exclude it`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.104.0",
+  "version": "7.105.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",

package/dist/plugins/memory-session-policy-store.d.ts

@@ -1,46 +0,0 @@
-/**
- * In-memory SessionPolicyStore + the service's `deleteBySession` extension (E21 purge / 2c overwrite-dst wipe).
- *
- * WHY THIS EXISTS (and not core's `InMemorySessionPolicyStore`): core's in-memory/file policy stores implement only
- * the core interface (getRules/putRules/listBySession) — they have NO deletion seam, so neither the E21 session purge
- * nor the 2c `overwrite-dst` subsystem wipe can remove policy rows on a backend that uses them (the SQL twins carry
- * `deleteBySession` as a service extension; see session-policy-store-sql.ts). This store is the delete-capable
- * in-memory twin. The seam itself is also requested upstream (core: optional `deleteBySession?` on the interface +
- * the File/InMemory impls) — if core lands it, this class can retire in favor of core's.
- *
- * BYTE-MATCH DISCIPLINE: getRules/putRules/listBySession replicate core's `InMemorySessionPolicyStore` semantics
- * exactly (same key shape, same CAS `conflict` on expectedRev mismatch, same tighten-only `loosen_forbidden` gate via
- * core's exported `normalizeRules`/`loosenReasons`/`stripRev`, same rev start/bump). Any divergence is a bug here.
- * S-529 起同样钉住 `@contract session_policy.rev_survives_delete`:`deleteBySession` 保留每把键的 rev 高水位
- * **并给那把键的世代(`gen`)+1**(见 {@link MemorySessionPolicyStore.deleteBySession});共用试剂盒
- * `test/helpers/session-policy-rev-line-contract.ts` 与 SQL 双生、以及 core 自己的 `InMemorySessionPolicyStore`
- * (7.25.0 起带这条契约,已作为第三只引擎接进同一只试剂盒当 oracle)跑同一段剧本。
- */
-import { type PutRulesOptions, type SessionPermissionRules, type SessionPolicyStore, type SessionRulesRecord, type StoredSessionRules } from "@sema-agent/core";
-export declare class MemorySessionPolicyStore implements SessionPolicyStore {
-    private readonly map;
-    /** S-529 —— 每把键的 rev **高水位 + 世代**(`@contract session_policy.rev_survives_delete`):`deleteBySession`
-     *  抹掉规则行时把它那条 rev 线的终点留在这里,于是删后首写 stamp 的是 `max(当前行 rev, 记号.rev) + 1`,
-     *  而不是从 1 重来;同时把 `gen` +1 —— **抹除终结的是那一行的血统**,下一次写开的是新世代,读侧因此能把
-     *  「重建的行」与「它正在执行的那一行的延续」分开,无论新行的 rev 有多大(core 7.25.0 [ref] 判词:
-     *  没有世代时读侧只能靠「亲眼看见行消失」那条弱守卫,于是两道门之间未被观察到的 erase+重建抓不住,
-     *  而一次瞬时读 null 会把该腿永久闩在旧行上)。
-     *  与 SQL 双生的 `session_policy_rev_mark` 表、core File 店的 `<stem>.hwm.json` 侧车是同一条律的三个实现体
-     *  (SQL 那边的表注写了为什么不留墓碑行)。本表只增不减、条目是两个整数 —— 与 `map` 同为进程内结构,
-     *  随进程亡;跨副本的持久面在 SQL 双生那半。 */
-    private readonly marks;
-    private key;
-    getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
-    putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
-    listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
-    /** Purge ALL policy rows for a session, across every principal — KEEPING each key's rev high-water mark.
-     *  Scoped by session_id alone — the caller (E21 route / importSession overwrite-dst) already proved ownership.
-     *  Shape = core 1.423's optional `SessionPolicyStore.deleteBySession?` seam (`Promise<void>` — the count was
-     *  incidental; nothing consumed it).
-     *
-     *  S-529:规则本身死,rev 线不死(`@contract session_policy.rev_survives_delete`)。记号只升不降(`Math.max`),
-     *  所以反复抹除不会把线走回头;从没写过的键不留记号(没有线就不凭空抬)。**抹除同时终结那一行的血统**:
-     *  `gen` +1,于是下一次写开的是新世代 —— 数字继续爬,但读侧按世代判「这不是我在执行的那一行的延续」。 */
-    deleteBySession(sessionId: string): Promise<void>;
-}
-//# sourceMappingURL=memory-session-policy-store.d.ts.map

package/dist/plugins/memory-session-policy-store.js

@@ -1,52 +0,0 @@
-import { normalizeRules, loosenReasons, stripRev, SessionPolicyError, } from "@sema-agent/core";
-export class MemorySessionPolicyStore {
-    map = new Map();
-    marks = new Map();
-    key(sessionId, principal) {
-        return JSON.stringify([sessionId, principal ?? null]);
-    }
-    async getRules(sessionId, principal) {
-        const r = this.map.get(this.key(sessionId, principal));
-        return r ? structuredClone(r) : null;
-    }
-    async putRules(sessionId, principal, rules, opts) {
-        const key = this.key(sessionId, principal);
-        const prior = this.map.get(key);
-        if (opts?.expectedRev !== undefined && (prior?.rev ?? 0) !== opts.expectedRev) {
-            throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts.expectedRev}, have ${prior?.rev ?? 0})`);
-        }
-        const clean = normalizeRules(stripRev(rules));
-        if (prior && opts?.operator !== true) {
-            const loosens = loosenReasons(prior, clean);
-            if (loosens.length > 0) {
-                throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
-            }
-        }
-        const mark = this.marks.get(key) ?? { rev: 0, gen: 0 };
-        const gen = prior?.gen ?? mark.gen;
-        const next = { ...structuredClone(clean), rev: Math.max(prior?.rev ?? 0, mark.rev) + 1, gen };
-        this.map.set(key, next);
-        this.marks.set(key, { rev: next.rev, gen });
-        return structuredClone(next);
-    }
-    async listBySession(sessionId) {
-        const out = [];
-        for (const [k, rules] of this.map) {
-            const [sid, principal] = JSON.parse(k);
-            if (sid === sessionId)
-                out.push({ principal: principal ?? undefined, rules: structuredClone(rules) });
-        }
-        return out;
-    }
-    async deleteBySession(sessionId) {
-        for (const [k, rules] of [...this.map]) {
-            const [sid] = JSON.parse(k);
-            if (sid !== sessionId)
-                continue;
-            const mark = this.marks.get(k) ?? { rev: 0, gen: 0 };
-            this.marks.set(k, { rev: Math.max(mark.rev, rules.rev), gen: mark.gen + 1 });
-            this.map.delete(k);
-        }
-    }
-}
-//# sourceMappingURL=memory-session-policy-store.js.map