@sema-agent/server 7.104.0 → 7.106.0

package/dist/observability/run-terminal.d.ts

@@ -78,10 +78,12 @@ export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
 /** S-105(test [ref] 旁生):终态**持久化**的 `errorMessage` 与日志副本同一脱敏口——provider 错误体(403 体带回显请求头/
  *  订阅链接)里的密钥形不得原文落 run 行再由 `GET /v1/runs/:id` 直出。三 run store 的 `setTerminal` 写入前同调此函数;
  *  `undefined` 透传(缺席仍缺席),不截断(日志上限是日志的事,行上保留全文供取证)。 */
-/** r4 最终轮 [medium]:`redactSecrets` 会抛 `RangeError`(关键字/前缀臂那一形已由 S-219 的 `atLeast` 铸点闭掉;仍能抛的是
- *  JSON 秘密字段臂的转义对循环,既有未闭,S-106 登记);S-105 把脱敏
+/** r4 最终轮 [medium]:`redactSecrets` 曾会抛 `RangeError`(关键字/前缀臂那一形由 S-219 的 `atLeast` 铸点闭掉;JSON 秘密字段臂的
+ *  转义对循环与 PEM 栅栏臂的标签交替循环由 S-265 换成手写线性扫描器闭掉 —— 已知形全部闭掉);S-105 把脱敏
  *  挪到 `setTerminal` **入口**后,这个抛会先于 CAS/claim 释放 ⇒ run 卡 `running`、会话 claim 悬挂到 reaper。这里 **fail-closed
- *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。 */
+ *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。
+ *  🔴 S-265 之后这条 throw 臂**照留**(结构性兜底,不依赖「脱敏器今天抛不抛」):它守的是「终态翻转不被一次脱敏异常拦下」,
+ *  而脱敏器是一张会长新臂的表 —— 计数 `server.run-terminal.redact-threw` 恒零是证据,不归零就是新形,运维按 detail 回溯。 */
 export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";
 /** S-107 窄范围重扫 [medium]:`redactSecrets` 对 PEM 起始栅栏密集的多 MB 文案**不抛但慢**(实测 1MB 1.4s / 8MB 7.9s 同步阻塞
  *  事件循环),而终态座每次写要扫两遍(appendEvent + setTerminal 入口)、每次读再扫一遍。超过本上限的自由文本**整段**换占位
@@ -111,20 +113,63 @@ export declare function redactErrorMessage(raw: string | undefined): string | un
  *    ⚠️ **命中那一次仍然给剥后文本**(S-103 的「先扫描后渲染」不动摇):把零宽字符塞进密钥中间的那条文本,
  *    渲染的必须是剥后那份,否则消费端把残片拼回原钥。
  * ② **扫描器抛 ⇒ 登记过的占位(fail-closed),不把整条 run 拖下水**(codex r1 [high],亲核实测后修)。
- *    `redactSecrets` 的 JSON 秘密字段臂仍含多字符循环体(S-106 既有未闭:`(?:\\.[^"\\]*)*`),实测
+ *    立案时 `redactSecrets` 的 JSON 秘密字段臂含多字符循环体(`(?:\\.[^"\\]*)*`),实测
  *    `{"password":"<400 万个 \\n 转义对>"}`(8MB)抛 `RangeError`。`result` 接进来之前这条路不存在;接进来之后,
  *    裸调用会让异常穿过 `redactTerminalResult` → 三孪生 `setTerminal`,**一条跑成功的 run 落成 failed + result:null**
  *    (实测读数)。⇒ 与本文件既有的 {@link redactErrorMessage} / `redactDiagnosticText` / `redactArtifactText`
  *    三座**同一条**处置:抛就换占位、计数、留痕([ref] 的 loud,不是静默 fail-open)。丢的是这一条病态文本,
- *    不是这条 run。根因(那条正则)是 S-106 的独立车,本函数不在复审轮里改它。
+ *    不是这条 run。根因(那条正则)由 S-265(7.105.0)换成手写线性扫描器闭掉(同批闭掉同类第二例 PEM 栅栏标签循环);
+ *    本处置**照留** —— 理由同 {@link OVERSIZED_REDACTION_PLACEHOLDER} 顶注末句。
  * ③ **不设体量上限**(裁定):`result` 住在 `result` JSON/JSONB 列(亲核 `plugins/tidb-pool.ts` 与
  *    `plugins/pg-pool.ts` 的 DDL),数 MB 终稿是正常形 —— {@link redactErrorMessage} 的两道上限是为
  *    `task_run.error` 那一列 `TEXT(65 535 字节)` 定的,套到这里等于用静默的数据损坏换一次脱敏。
  */
 export declare function redactModelText(raw: string): string;
-/** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形的 `"redacted"` 行 ∪ 旧形平面键;
- *  `memoRedactTerminalResult` 的记忆键由它派生(两处同源,见 `RESULT_KEY_TREATMENT` 顶注)。 */
-export declare const REDACTABLE_RESULT_LEAVES: readonly string[];
+/**
+ * 🔴 **provider 回声字段的形状闸 —— 唯一铸点**(S-283,7.105.0;test [ref] 附带;动作经 S-889 与 core 源头闸归一)。
+ *
+ * **回声字段是什么**:模型服务商(上游模型 API / 中间网关)在响应里给、引擎**逐字转交**的不透明标识 ——
+ * `apiFailure.requestId`(响应头 `request-id` / `x-request-id`,core `brain/errors.js` 的 `readProviderRequestId`)、
+ * `responseModel`(服务商自报的模型名,与账本 `turn_end.responseModel` 是孪生)、工具调用 id(`strandedHumanAnswers[].toolCallId` /
+ * `stats.humanReview.gates[].toolCallId`;core `brain/openai.js` / `brain/anthropic.js` 取 `tc.id` / `cb.id`,只在缺席时
+ * `mintFallbackToolCallId` 自铸兜底)。字节由**部署方接的那个端点**决定,本栈一个都没铸 ⇒ **不可信**。
+ *
+ * 🔴 **本闸只施加在「这个值出现的每一张脸都被覆盖到」的回声上**(codex r1 F1,实测成立的回归后改判):工具调用 id 是
+ * **跨面 join 键** —— 同一枚 id 同时逐字出现在 `tool_start` / `tool_end` / 审批卡等逐帧面上。只在结果面动它 ⇒ 结果面与逐帧面
+ * join 不上。所以它的处置词是 `"provider-join-key"`:信任类仍是 provider 回声,但形状闸只能在**全部面的共同入口**一次施加
+ * (独立一车,已登记为债),本面逐字。`requestId` / `responseModel` 的每一张脸(结果面四处 + 账本孪生 + 子代通告 + `POST /v1/side-query` 200 体的 `responseModel`,
+ * 后者 7.105.0 合并复审 X1 补上 —— `http/routes/side-query.ts` 的 `shapeSideQueryEcho`)本闸都覆盖到了。
+ *
+ * **只做形状校验,不过脱敏器**(本车裁,与 S-270 / clay [ref] ② 的 `structuredOutput` 逐字回声面同一方向):回声值
+ * 语义上是**不透明 id**(工单号 / join 键),脱敏器的值臂会把形似密钥的 id 改坏(`sk-…` 形的 id 整段成 `«redacted:key»`),
+ * 而 id 被改坏 = 下游 join / 支持工单对不上;该防的是**形**(超长串撑爆终局体与日志、控制字符 / 终端转义序列改写
+ * 显示、bidi / 非 ASCII 冒充),不是「里面像不像密钥」。
+ *
+ * 🔴 **形状与动作 = core 源头闸同一条规则**(S-889,主会话裁;core **#1204**,原排 7.34.1、随 7.35.0 到货,包根导出 `PROVIDER_ECHO_SHAPE` +
+ * `isProviderEchoShape(value: string): boolean`,字母表采本仓提出的这一张):
+ *  · **形内** = 字符串、长度 1–128、每个码元都是可见 ASCII(0x21–0x7E;空格、空串与一切控制 / 非 ASCII 码元都在外)⇒ 原样;
+ *  · **越界**(含非串值)⇒ **缺席**(键删掉 / 不铸)+ 计数 `server.run-terminal.provider-echo-shaped`(detail 只带座位与原长 / 类型,
+ *    **不带值**)。不截断、不带记号 —— 首版的「截成 127 + `…`」与 core 的「越界 ⇒ 缺席」是同一个键上两种处置,那一形 7.105.0 不发;
+ *    截断记号、「截过的形是不动点」那套逻辑随之删除(规则变少)。缺席本来就是这几个键在 wire 上的一等状态(`apiFailure` 留下
+ *    `{}` = 「provider 故障、无可补充标签」,core 契约原句),消费端不需要新读法。
+ *  · `undefined` 与**空串** = 缺席本身(服务商什么都没说),不计数、不铸键 —— 空串一臂是 S-877 / core 7.35.0 #1204 的读法
+ *    (`brain/errors.d.ts` 的 `providerEchoReading` 逐字「a non-string or the empty string states nothing (`absent` — no field,
+ *    nothing counted)」;修前本仓把空串算越界计一次)。非串值本仓**照旧计数**:core 那句说的是 brain 读服务商原始响应,本口读的是
+ *    持久行 / 非 core 的 Runner 给的形,一个非串的回声座是坏行,响亮([ref])。
+ * ✅ 谓词 = core 包根导出的 `isProviderEchoShape`(S-877 起换调;本地那两行定义已删 —— 字母表同源,本仓不留第二份)。
+ * 🔴 **core 7.35.0 起 core 的 brain 在写侧先判一次**(`brain/stream-shared.js` `noteResponseModel` / `brain/errors.js`
+ *    `readProviderRequestId`:越界 ⇒ 不写、run 里发 trace `brain.echo_dropped {field}`)⇒ 真 brain 链上越界值到不了本口,本口的
+ *    计数只剩「不经 core brain 写侧」的 producer(存量行、宿主自己的 Brain / 自接 `sideQuery` 席)。
+ * **不进模型上下文**:本仓没有任何一处把这几片回声喂进提示词(它们只上 wire / 落库 / 进日志)——这一闸管的就是那几面。
+ */
+/** 回声座上的值留不留:形内 ⇒ `true`(原样留);`undefined` / 空串 ⇒ `false`(缺席本身,不计数);其余越界 ⇒ `false` + 计数。
+ *  调用方按 `false` 删键 / 不铸键 —— 本函数是全部回声座(结果面 / 账本孪生 / 子代通告 / side-query 200 体)的**唯一**判决口。 */
+export declare function admitProviderEcho(value: unknown, seat: string): value is string;
+/** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形里**不是** `"verbatim"` 的行(`"redacted"` ∪ S-283 的
+ *  `"provider-echo"`)∪ 旧形平面键;`memoRedactTerminalResult` 的记忆键由它派生(两处同源,见 `RESULT_KEY_TREATMENT` 顶注)。
+ *  🔴 S-283 起改名(原 `REDACTABLE_RESULT_LEAVES`):回声键不脱敏但**会被改**(越界 ⇒ 删键),漏进记忆键集 = 读面记忆腿对存量行
+ *  O(1) 原样直返,读面纵深对那几片恒不生效([ref] 立案时 `editedFiles` 那一格的同一个病)。 */
+export declare const TREATED_RESULT_LEAVES: readonly string[];
 export declare function redactTerminalResult<T extends {
     terminal?: unknown;
     /** 旧形(≤7.63.0)的三个顶层座;形上取 `unknown` —— 读盘面对盘上字节不作假设。 */
@@ -144,6 +189,10 @@ export declare function redactTerminalResult<T extends {
     editedFiles?: unknown;
     /** S-394:形上同样 `unknown` —— 本函数是读盘面,`stats` 的树形逐层现判(见 {@link redactStats})。 */
     stats?: unknown;
+    /** S-283:provider 回声三键(形上 `unknown`,读盘面纪律同上;处置见 {@link PROVIDER_ECHO_SHAPERS})。 */
+    apiFailure?: unknown;
+    strandedHumanAnswers?: unknown;
+    responseModel?: unknown;
 } | null | undefined>(result: T): T;
 /**
  * 🔴 **S-173 —— run 行 `result` 列的唯一入口**:先过出口封口({@link sealResultForExit}:摘恢复凭据 + 折域外码),
@@ -202,7 +251,7 @@ export declare function redactLeaderResultWithFlag(result: unknown): {
     changed: boolean;
 };
 export declare function memoRedactedRead<T>(seat: string, raw: T, redact: (v: T) => T): T;
-/** run 终态 result 的读面记忆只按**可脱敏的那几叶**({@link REDACTABLE_RESULT_LEAVES},属主是
+/** run 终态 result 的读面记忆只按**本函数会改字节的那几叶**({@link TREATED_RESULT_LEAVES}:脱敏叶 ∪ S-283 回声叶 ∪ 旧形平面键,属主是
  *  `RESULT_KEY_TREATMENT`)做键与留体——
  *  第十六轮重扫:按整块 result 摘要每次轮询要 stringify 一份可能数 MB 的 result,且大 result 的脏行永远存不进去。叶全缺席
  *  ⇒ O(1) 直返(`redactTerminalResult` 本就同引用)。
@@ -215,6 +264,30 @@ export declare function memoRedactedRead<T>(seat: string, raw: T, redact: (v: T)
  *  `editedFiles` 那一格的病)。读数:8MB result 的一次摘要 ~10ms 量级,远小于一次全扫;干净行仍只摘要
  *  一次即进 clean 集,脏行超过 {@link READ_MEMO_DIRTY_MAX_ENTRY_BYTES} 时退化为每次重扫(既有形)。 */
 export declare function memoRedactTerminalResult<T extends Parameters<typeof redactTerminalResult>[0]>(seat: string, result: T): T;
+/**
+ * 🔴 **账本行的读面口 —— 全部耐久读腿共用这一只**(S-269,7.105.0)。
+ *
+ * 脱敏的**属主**仍是 {@link redactLedgerEventData}(写读共用的唯一汇点,规则一张:哪些行型有自由文本座、怎么脱);
+ * 本函数**不是第二只脱敏器**,只在汇点外面加一层**按型记忆**(读面每次轮询 / 每个观看者 / 每次重连都重放同一批
+ * 不可变的行):
+ *  · `done` 行 —— 只按 `result` 的可脱敏叶记忆({@link memoRedactTerminalResult};整块 result 可能数 MB);
+ *  · `failed` 行与模型自由文本两行(`text` / `reasoning`,词表属主 `trace/ledger-events.ts`)—— 按内容摘要记忆({@link memoRedactedRead});
+ *  · 其余行型 —— 直调汇点(park 行只有一个小 gate,扫一次的代价远低于摘要 + 记忆表位;其余型汇点逐字透传)。
+ *
+ * **三条耐久读腿同调**:`GET /v1/runs/:id/events`(账本裸回放)、`GET /v1/tasks/:id/turns`(`projectEvents`)、
+ * trace SSE `GET /v1/tasks/:id/stream`(`mapTraceEvent`)。此前只有第一条在 `formatEvent` 里手写了这段分派,后两条
+ * **直吃原行** —— 新行在三孪生 `appendEvent` 落库前已脱,所以只打在**存量行**上:7.75.1(B-106)之前 `text` 行的写口
+ * 不脱,那批行在两条 trace 腿上原字节回放(S-269,车EC U-2)。分派收进本函数、三条腿同调 ⇒ 读面纵深一条规则。
+ *
+ * **性能取舍(读实现后定)**:汇点对已脱行在**输出**上幂等(`redactModelText` 认不出凭据形就回同一引用),但**代价不是
+ * 空过** —— 每次都整段重扫(`redactSecrets` 全池一遍)。所以读面走记忆:同一行第二次起只付一次 sha256 摘要 + 集合查找
+ * (车QO 本机实测,8.6MB 散文 min-of-5:整段重扫 112ms vs 摘要〔含 `JSON.stringify`〕31ms,约 3.6×);记忆表有界(干净 8192 条 / 脏 512 条且总字节封顶,见 {@link memoRedactedRead})。
+ * **没**选「行上打已脱标记 ⇒ 跳过」:那要在三孪生写口加一个持久字段,而需要读面纵深的恰恰是**没有**标记的存量行 ——
+ * 标记只能省新行的扫描;记忆对新旧行一视同仁,且不新开一张持久面。
+ * trace 两腿对 `done` 行只投 `seq`(不投 `result`),它的摘要是**白付**的那一份;**刻意**不按「这条腿投哪些键」裁掉 ——
+ * 那等于在读腿里手抄一份汇点的行型表([ref]),汇点将来加一种带自由文本的行型时读腿静默漏。
+ */
+export declare function redactLedgerEventForRead(type: string, data: unknown): unknown;
 export declare function diffScanShadowCountForTest(): number;
 export declare function resetDiffScanShadowCountForTest(): void;
 export declare function resetReadRedactionMemoForTest(): void;

package/dist/observability/run-terminal.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { redactSecrets, normalizeForRedaction } from "../trace/redact.js";
+import { isProviderEchoShape } from "@sema-agent/core";
 import { isModelTextLedgerEventType, isParkLedgerEventType } from "../trace/ledger-events.js";
 import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
 import { sealResultForExit } from "../terminal.js";
@@ -97,28 +98,68 @@ export function redactModelText(raw) {
         return OVERSIZED_REDACTION_PLACEHOLDER;
     }
 }
+export function admitProviderEcho(value, seat) {
+    if (value === undefined || value === "")
+        return false;
+    if (typeof value === "string" && isProviderEchoShape(value))
+        return true;
+    const what = typeof value === "string" ? `len=${value.length}` : `type=${value === null ? "null" : typeof value}`;
+    recordFailOpen("server.run-terminal.provider-echo-shaped", `seat=${seat} ${what}`);
+    return false;
+}
+function shapeEchoMembers(node, table, seat) {
+    if (node === null || typeof node !== "object" || Array.isArray(node))
+        return node;
+    const n = node;
+    let out;
+    for (const [key, treatment] of Object.entries(table)) {
+        const v = n[key];
+        if (v === undefined)
+            continue;
+        switch (treatment) {
+            case "verbatim":
+            case "provider-join-key":
+                break;
+            case "provider-echo":
+                if (!admitProviderEcho(v, `${seat}.${key}`))
+                    delete (out ??= { ...n })[key];
+                break;
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled echo-member treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return out ?? node;
+}
+function shapeEchoRows(rows, table, seat) {
+    if (!Array.isArray(rows))
+        return rows;
+    const next = rows.map((row) => shapeEchoMembers(row, table, seat));
+    return next.every((x, i) => x === rows[i]) ? rows : next;
+}
 const MAX_EDITED_FILES = 1000;
 const RESULT_KEY_TREATMENT = {
     terminal: "redacted",
     remoteEnvFailures: "redacted",
     editedFiles: "redacted",
+    responseModel: "provider-echo",
+    apiFailure: "provider-echo",
+    strandedHumanAnswers: "provider-echo",
     taskId: "verbatim",
     runId: "verbatim",
     sessionId: "verbatim",
     model: "verbatim",
-    responseModel: "verbatim",
     compaction: "verbatim",
     effectiveReasoning: "verbatim",
     result: "redacted",
     salvagedOutput: "redacted",
-    apiFailure: "verbatim",
     retryAfterMs: "verbatim",
     degraded: "verbatim",
     structuredOutput: "verbatim",
     rewindNotes: "redacted",
     haltedOnUserRejection: "verbatim",
     haltedByUser: "verbatim",
-    strandedHumanAnswers: "verbatim",
     pendingApproval: "verbatim",
     approvalWaitedMs: "verbatim",
     effectiveReadFace: "verbatim",
@@ -127,9 +168,28 @@ const RESULT_KEY_TREATMENT = {
     effectiveMemoryScopes: "verbatim",
     stats: "redacted",
 };
+const API_FAILURE_TREATMENT = {
+    status: "verbatim",
+    requestId: "provider-echo",
+};
+const STRANDED_ANSWER_TREATMENT = {
+    deliveryId: "verbatim",
+    toolCallId: "provider-join-key",
+};
+const PROVIDER_ECHO_SHAPERS = {
+    responseModel: (v) => (admitProviderEcho(v, "responseModel") ? v : undefined),
+    apiFailure: (v) => shapeEchoMembers(v, API_FAILURE_TREATMENT, "apiFailure"),
+    strandedHumanAnswers: (v) => shapeEchoRows(v, STRANDED_ANSWER_TREATMENT, "strandedHumanAnswers[]"),
+};
+{
+    const judged = Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "provider-echo").map(([k]) => k).sort();
+    const wired = Object.keys(PROVIDER_ECHO_SHAPERS).sort();
+    if (judged.join(",") !== wired.join(","))
+        throw new Error(`run-terminal: provider-echo classification [${judged.join(",")}] ≠ shaper table [${wired.join(",")}]`);
+}
 const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
-export const REDACTABLE_RESULT_LEAVES = [
-    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "redacted").map(([k]) => k),
+export const TREATED_RESULT_LEAVES = [
+    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t !== "verbatim").map(([k]) => k),
     ...LEGACY_RESULT_LEAVES,
 ];
 export function redactTerminalResult(result) {
@@ -235,6 +295,20 @@ export function redactTerminalResult(result) {
             changed = true;
         }
     }
+    const rr = result;
+    for (const [key, shape] of Object.entries(PROVIDER_ECHO_SHAPERS)) {
+        const v = rr[key];
+        if (v === undefined || shape === undefined)
+            continue;
+        const next = shape(v);
+        if (next === v)
+            continue;
+        if (next === undefined)
+            delete out[key];
+        else
+            out[key] = next;
+        changed = true;
+    }
     return changed ? out : result;
 }
 export function sealRunRowResult(result) {
@@ -267,8 +341,18 @@ export function redactLedgerEventData(type, data) {
         const next = redactCheckpointGate(gate);
         return next === gate ? data : { ...data, gate: next };
     }
+    if (type === "turn_end")
+        return shapeEchoMembers(data, TURN_END_ECHO_TREATMENT, "turn_end");
+    if (type === "task_notification") {
+        const af = data.apiFailure;
+        if (af === undefined)
+            return data;
+        const next = shapeEchoMembers(af, API_FAILURE_TREATMENT, "task_notification.apiFailure");
+        return next === af ? data : { ...data, apiFailure: next };
+    }
     return data;
 }
+const TURN_END_ECHO_TREATMENT = { responseModel: "provider-echo" };
 export function redactWorkerReportError(report) {
     const gate = redactCheckpointGate(report.checkpointGate);
     const error = report.error === undefined ? undefined : (redactErrorMessage(report.error) ?? "");
@@ -389,7 +473,7 @@ const STATS_GATE_ROW_TREATMENT = {
     decision: "verbatim",
     toolName: "verbatim",
     toolArg: "model-text",
-    toolCallId: "verbatim",
+    toolCallId: "provider-join-key",
 };
 const STATS_REPETITION_EVENT_TREATMENT = {
     turn: "verbatim",
@@ -420,6 +504,8 @@ function redactStatsNode(node, table) {
         switch (treatment) {
             case "verbatim":
                 break;
+            case "provider-join-key":
+                break;
             case "model-text":
                 if (typeof v === "string")
                     next = redactModelText(v);
@@ -674,15 +760,32 @@ export function memoRedactTerminalResult(seat, result) {
     if (result === undefined || result === null)
         return result;
     const r = result;
-    if (REDACTABLE_RESULT_LEAVES.every((k) => r[k] === undefined))
+    if (TREATED_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;
     const leaves = {};
-    for (const k of REDACTABLE_RESULT_LEAVES)
+    for (const k of TREATED_RESULT_LEAVES)
         leaves[k] = r[k];
     const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
     if (redacted === leaves)
         return result;
-    return { ...result, ...redacted };
+    const merged = { ...result, ...redacted };
+    for (const k of TREATED_RESULT_LEAVES)
+        if (!Object.hasOwn(redacted, k))
+            delete merged[k];
+    return merged;
+}
+export function redactLedgerEventForRead(type, data) {
+    if (type === "done" && data !== null && typeof data === "object") {
+        const result = data.result;
+        if (result && typeof result === "object") {
+            return { ...data, result: memoRedactTerminalResult("ev.done.result", result) };
+        }
+    }
+    if (type === "failed")
+        return memoRedactedRead("ev.failed", data, (d) => redactLedgerEventData(type, d));
+    if (isModelTextLedgerEventType(type))
+        return memoRedactedRead("ev.model-text", data, (d) => redactLedgerEventData(type, d));
+    return redactLedgerEventData(type, data);
 }
 let shadowScans = 0;
 export function diffScanShadowCountForTest() { return shadowScans; }

package/dist/observability/secret-env-scrub.js

@@ -27,7 +27,7 @@ export const SECRET_ENV_SCRUB_SITES = {
     },
 };
 const SCRUB_COUNTER = "secret_env_scrubbed_total";
-const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped or replaced in place) to a spawned child process, by site/kind/confidence (core scrubSecretEnv rules + server config-catalog secret names + name-list knobs)";
+const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped) to a spawned child process, by site/kind/confidence (core scrubSecretEnv rules + server config-catalog secret names + name-list knobs)";
 const DISCLOSED_CAP = 512;
 const SEP = "=";
 let sink = {};

package/dist/observability/tool-trace.d.ts

@@ -14,6 +14,8 @@ import type { Metrics } from "./metrics.js";
  * 🔴 BREAKING(server 7.64.0,core 7.6.0 提货):标签名 `source` → `deniedBy`,词表从七词
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
  * (`policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution`)。仪表盘/告警规则要改。
+ * 🔁 server 7.106.0(S-877 / core 7.34.0 [ref]):`plan_mode` 这个词退役,换成 `mode`(模式自己拒的那一形:`dontAsk` 拒每一只非授权 ask、
+ *    `bypassPermissions` 拒判不出保护的写)—— 标签值原样取 core 的 `isDeniedBy`,按 `deniedBy="plan_mode"` 写的告警规则改 `mode`。
  *
  * 🔴 **第二个计数器 `auto_mode_classifier_deny_cause_total{cause}`(server 7.70.0 生为
  * `auto_mode_classifier_unavailable_total`,core 7.12.0 [ref];**7.72.0 / core 7.14.0 [ref] 改名、换座、换词**,见本段末)**

package/dist/operator-ask.d.ts

@@ -34,6 +34,10 @@
  *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
  */
 import type { PermissionResult } from "@sema-agent/core";
+/** 本文件两只铸点的返回形 = core `PermissionResult` 的 ask 臂(窄型:`authoredBy` 只长在这一臂上)。 */
+export type OperatorAskResult = Extract<PermissionResult, {
+    action: "ask";
+}>;
 /**
  * 铸一条**运维声明产生的** `ask`。
  *
@@ -42,5 +46,29 @@ import type { PermissionResult } from "@sema-agent/core";
  *   request」,所以它既不上 wire、也不进卡,写的必须是**真实的那条声明**而不是一句好看的话。
  * @param message 给人看的那句话(照旧上卡)。
  */
-export declare function operatorAsk(rule: string, message: string): PermissionResult;
+export declare function operatorAsk(rule: string, message: string): OperatorAskResult;
+/**
+ * 🔴 **S-877 候裁 16 —— 运维声明的「恒问人」**(`APPROVAL_NEVER_AUTO` 的「always human」、耐久资源预算耗尽的「human approval required」):
+ * 在 {@link operatorAsk} 之上再盖部署出身 `authoredBy: "deployment"` ⇒ core 类读 `operator_forced`(`ruleClearanceOf`:
+ * 「a deployment-authored ask」进强制门 ⇒ `mandated`)—— bypassPermissions 放不掉、**任何**站着的答案(持久规则、会话授权,
+ * 任何 scope)退不掉,只有**这一次**的应答能答它。
+ *
+ * **为什么现在需要**:修前这两类 ask 挡住会话授权靠的是策略层的**次序**(`createDurableAskPolicy` 先判 neverAuto / 预算耗尽,再查
+ * 豁免探针)。候裁 16 把会话授权的兑现位收到**审批席**(协调器 `standingGrantSettles`,判据 = `standingAnswerMayRetire`),而审批席
+ * 读不到 `matchedAskRule`(core 刻意不上卡)—— 不盖出身,一条 `remember:"session"` 就会在审批席上退役「恒问人」。盖了之后
+ * 席的同一只判据按 `mandated` 挡住它,耐久 `/decide` 腿的可记性(park 行 `mandated` 孪生位)同判 ⇒ 回执 `rememberApplied:false`。
+ * live 腿修前这里本就是个洞(进程内 `allow_session` 授权可退役 neverAuto 卡),随类收掉。
+ *
+ * ⚠️ **只**这两类:普通 `APPROVAL_REQUIRE` 仍只经 {@link operatorAsk}(候裁 8 裁 A —— 用户「本会话放行」退役它们是产品设计,不收紧)。
+ */
+export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
+/**
+ * core 部署出身位 `authoredBy:"deployment"` 的**唯一**盖位函数(S-897 起收成一处):给一只**部署自己的声明**产的 ask 盖上出身 ⇒
+ * core 类读 `operator_forced`、`mandated`、不铸 `mandate` 词(表外的门;缺词 = 另有门在)⇒ bypassPermissions 放不掉、站着的答案
+ * 退不掉、壳也不会按单个强制词替人答。三个调用者:{@link operatorAlwaysHumanAsk}(`APPROVAL_NEVER_AUTO` / 预算耗尽)、
+ * 治理层包装(`runtime-governance.ts` 的 `createGovernanceAskMarkingPolicy`)、SUP 路由姿态(`router/route-orchestration.ts`,
+ * 经 {@link operatorAlwaysHumanAsk})。修前前两处各写一份 `{ ...d, authoredBy: "deployment" }`(两个写者),S-897 若再抄就是第三份。
+ * 只作用于 ask 臂(类型上就只收 ask);其余键逐字透传。
+ */
+export declare function withDeploymentAuthorship<A extends OperatorAskResult>(ask: A): A;
 //# sourceMappingURL=operator-ask.d.ts.map

package/dist/operator-ask.js

@@ -1,4 +1,10 @@
 export function operatorAsk(rule, message) {
     return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
 }
+export function operatorAlwaysHumanAsk(rule, message) {
+    return withDeploymentAuthorship(operatorAsk(rule, message));
+}
+export function withDeploymentAuthorship(ask) {
+    return { ...ask, authoredBy: "deployment" };
+}
 //# sourceMappingURL=operator-ask.js.map

package/dist/parked-decide.d.ts

@@ -9,7 +9,7 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
@@ -142,6 +142,19 @@ export interface ParkedDecideDeps {
     rebuildInheritedGate?: (row: BackgroundAgentRecord, identity: {
         principal: string | undefined;
     }) => Promise<RebuiltInheritedGate | undefined>;
+    /**
+     * 🔴 S-877 四续 ⑪ —— 复活子代**自己的**审批席(`ToolExecuteContext.onAsk`:core 的委派工具把它转给子代,子代自己的引擎问 —— 模式写门 /
+     * 形状层 —— 在这里答)。本腿直接调 `execute`,不经 Runner,ctx 由本腿铸;不给 ⇒ 子代自己的问落 subRunner 的 `deps.onAsk`(协调器
+     * `ask()` 的无 ALS 上下文臂,没有会话身份 ⇒ 读不了会话授权 ⇒ 每条非只读命令 / 每次写都再 park,`remember:"session"` 对复活子代无效;
+     * 子代活着时同一问落父的席、带身份、读得到授权 —— 同一个子代两种答案)。生产 = 协调器的窗 0 席 `boundUnattendedAsk`(与 bg run 腿给父任务
+     * 装的同一只):身份 = 行的根会话(与 remember 的授权锚同键 {@link grantRootOf})+ 权威 principal;授权读不中 ⇒ 无人值守政策口(park),
+     * 不放宽。缺席(协调器未装的部署)⇒ ctx 不带座,逐字今天。
+     */
+    approverSeatFor?: (identity: {
+        owner: string | null;
+        taskId: string;
+        sessionId: string;
+    }) => NonNullable<ToolExecuteContext["onAsk"]>;
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
 export interface ParkedDecideRequest {

package/dist/parked-decide.js

@@ -62,6 +62,9 @@ export async function findParkedAgentForCheckpoint(agentStore, cp) {
     }
     return undefined;
 }
+function grantRootOf(row) {
+    return row.rootSessionId ?? row.parentSessionId;
+}
 function mintReviveArgs(row, knownAgentTypes) {
     return {
         prompt: row.description ?? "resume parked agent",
@@ -148,7 +151,7 @@ function sessionGone(taskId) {
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
-    const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
+    const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
         return { status: 400, body: { error: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", errorCode: "decide.parked_remember_unsupported", taskId: match.handle } };
     }
@@ -234,9 +237,13 @@ export async function decideParkedAgent(deps, req, match) {
         }
     }
     const outcome = buildParkedResumeOutcome(req);
+    const seatRoot = grantRootOf(row);
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,
         ...(surface.mountsCallerTool !== undefined ? { mountsCallerTool: surface.mountsCallerTool } : {}),
+        ...(deps.approverSeatFor !== undefined && seatRoot !== undefined
+            ? { onAsk: deps.approverSeatFor({ owner: decodeCheckpointScope(req.scope) ?? null, taskId: match.handle, sessionId: seatRoot }) }
+            : {}),
         reviveClaim: {
             row: { ...ticket.row, parkClaimId: ticket.claimId },
             rev: ticket.reservedRev,

package/dist/plugins/image-bake-store-sql.d.ts

@@ -122,8 +122,6 @@ export declare class SqlImageBake {
     private lineOrdExists;
     /** Highest event seq for a bake (0 if none) — the ++seq allocator + the resume cursor head. */
     maxSeq(bakeId: string): Promise<number>;
-    /** Earliest retained event seq (0 if none) → the SSE 416 boundary (a resume below this was evicted, P2.9). */
-    retainedFrom(bakeId: string): Promise<number>;
     /** Events with seq strictly greater than `afterSeq` (0 for the whole stream), ascending. */
     getEvents(bakeId: string, afterSeq: number): Promise<BakeEvent[]>;
     /**

package/dist/plugins/image-bake-store-sql.js

@@ -379,11 +379,6 @@ export class SqlImageBake {
         const m = rows[0]?.m;
         return m == null ? 0 : Number(m);
     }
-    async retainedFrom(bakeId) {
-        const { rows } = await this.db.query(this.q("SELECT MIN(seq) AS m FROM image_bake_event WHERE bake_id = ?", "SELECT MIN(seq) AS m FROM image_bake_event WHERE bake_id = $1"), [bakeId]);
-        const m = rows[0]?.m;
-        return m == null ? 0 : Number(m);
-    }
     async getEvents(bakeId, afterSeq) {
         const { rows } = await this.db.query(this.q(`SELECT seq, line_ord, kind, level, ${jsonColumnText("tidb", "data")}, ts FROM image_bake_event WHERE bake_id = ? AND seq > ? ORDER BY seq ASC`, `SELECT seq, line_ord, kind, level, ${jsonColumnText("pg", "data")}, ts FROM image_bake_event WHERE bake_id = $1 AND seq > $2 ORDER BY seq ASC`), [bakeId, afterSeq]);
         return rows.map((r) => ({

package/dist/plugins/retention-store-sql.js

@@ -380,6 +380,7 @@ export class SqlRetentionStore {
             ["resume_anchor", "session_id"],
             ["approval_exemption", "session_id"],
             ["session_policy", "session_id"],
+            ["session_policy_rev_mark", "session_id"],
             ...(this.opts.taskAttachmentTable ? [["task_attachment", "session_id"]] : []),
             ["file_history_tracked", "scope"],
             ["file_history_version", "scope"],

package/dist/plugins/run-store-sql.d.ts

@@ -248,8 +248,9 @@ export declare class SqlRunStore {
         rows: UsageRow[];
         truncated: boolean;
     }>;
-    /** Earliest retained event seq for a task (0 if none) → `retainedFrom` for /turns and the 416 boundary for
-     *  /stream (a resume point below this has been evicted past retention). */
+    /** Earliest retained event seq for a task (0 if none) → the `retainedFrom` field of `GET /v1/tasks/:id/turns`.
+     *  Not an eviction boundary: the ledger has no partial head trim (the only deletion takes the whole session tree),
+     *  so a value > 1 means head rows whose write failed after consuming their seq (S-211 ①). */
     retainedFrom(taskId: string): Promise<number>;
     /** Events with seq strictly greater than `afterSeq` (use 0 for the whole stream). */
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;

package/dist/plugins/schema-indexes.js

@@ -10,6 +10,7 @@ export const CENTRAL_SCHEMA_INDEXES = [
     { table: "approval_nonce", name: "idx_approval_nonce_expires", columns: ["expires_at_ms"] },
     { table: "sendfile_link", name: "idx_sendfile_link_scope", columns: ["scope", "id"] },
     { table: "session_policy", name: "idx_session_policy_session", columns: ["session_id"] },
+    { table: "session_policy_rev_mark", name: "idx_session_policy_rev_mark_session", columns: ["session_id"] },
     { table: "snapshot_blob", name: "idx_snapshot_blob_created", columns: ["created_at"] },
     { table: "file_history_version", name: "idx_file_history_version_blob", columns: ["blob_hash"] },
     { table: "file_history_boundary_file", name: "idx_file_history_bf_key", columns: ["scope", "key_hash"] },

package/dist/plugins/session-policy-store-sql.d.ts

@@ -3,6 +3,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type JsonColumnShape } from "./sql-json-column.js";
 import { type SqlDriver } from "./sql-driver.js";
+import type { Logger } from "../observability/logger.js";
 /** `session_policy.policy_key` 的**唯一铸造点**(core 复合键的 sha256)。
  *
  *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):[ref] form b 的身份重绑要
@@ -32,20 +33,26 @@ export declare const policyKeyFor: (sessionId: string, principal: string | undef
  * + 恰好解一次 `decodeJsonColumn` + 折码 `foldJsonColumn`);本店只留「形判据是哪一只」与「坏体折成哪个码」。
  */
 export declare function readSessionRulesBody(body: unknown): JsonColumnShape<SessionPermissionRules>;
+/** 本店唯一的日志口:抹除封键那一臂(S-891)的点名。缺席 ⇒ 退回 `console.warn`(不静默)。 */
+export type SessionPolicyStoreLogger = Pick<Logger, "warn">;
 /** Dual-dialect durable SessionPolicyStore. See the file header for the dialect-delta ledger. */
 export declare class SqlSessionPolicyStore implements SessionPolicyStore {
     private readonly db;
-    constructor(db: SqlDriver);
+    private readonly logger?;
+    constructor(db: SqlDriver, logger?: SessionPolicyStoreLogger | undefined);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     /** 判据属主 = `sql-errors.ts`([ref] P1-①;本站点旧形已是并集形,收编后语义不变)。 */
     private isDupKey;
-    /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory). */
+    /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory).
+     *  🔴 S-891(codex r1 [high] ①):同一条语句带上这把键的**封键记号** —— 封着 ⇒ `corrupt`,不答「没有规则」(见 {@link sealedKeyError})。 */
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     /** 2c session-sync: every (principal, rules) record for a session across ALL principals — getRules is
      *  per-(session,principal), but a cross-backend session EXPORT must bundle the WHOLE session's policy (the importer
      *  replays each via putRules). principal is read from the DENORMALIZED column (the sha256 policy_key is one-way);
-     *  NULL → undefined = the session-wide row (parity with core's InMemory `principal ?? undefined`). Rules carry rev. */
+     *  NULL → undefined = the session-wide row (parity with core's InMemory `principal ?? undefined`). Rules carry rev.
+     *  🔴 S-891:会话里有**封着的键** ⇒ 整只枚举 `corrupt`(与一行读不出形时整只枚举拒同一口径 —— 导出一份缺了那把键的规则,
+     *  导入方就会把「状态未知」当成「这个 principal 没有规则」)。 */
     listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
     /** Operator/owner write: CAS + tighten-only (unless operator) + rev bump, atomic in one txn; first-write race retried. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
@@ -91,7 +98,8 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
      *      against a CURRENT read (PG is pinned to READ COMMITTED, TiDB's DML is a current read), so a row for a
      *      DIFFERENT principal that a concurrent putRules commits BETWEEN ① and ③ would be deleted by a session-wide
      *      DELETE while ② never marked it — a silently reset rev line, exactly the defect this batch exists to close.
-     *      Scoped to the key set, the invariant is exact and checkable: **every row this seam deletes leaves a mark**.
+     *      Scoped to the key set, the invariant is exact and checkable: **every row this seam deletes leaves a mark** —
+     *      a readable row's mark continues its rev line and ends its lineage; an unreadable row's mark SEALS its key (S-891, below).
      *      A row born after ① is simply not part of this erase (same as one born a microsecond after ③ — the caller
      *      that needs "and nothing came back" re-issues; the seam is idempotent).
      *  No rows ⇒ return early: an erase of a session that never had rules writes NO mark (no line, nothing to keep),
@@ -99,8 +107,31 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
      *  Why the mark is a separate table and not a tombstone row: see the DDL comment in tidb-pool.ts — a tombstone
      *  would keep `session_id` + the DENORMALIZED plaintext `principal` in the table after an E21 purge, i.e. the
      *  right-to-delete would degrade to buy rev ordering. The mark keeps only the one-way hash, the session id and
-     *  an integer. */
+     *  an integer.
+     *
+     *  🔴 **S-891(7.106.0)—— 抹除恒删行;计数读不出的行留「封键记号」**。一行的计数读不出(三个读点的同一只判词
+     *  {@link readRowCounters} 判坏:`rev` 不是 ≥ 1 的安全整数 / `gen` 不是 ≥ 0 的安全整数;或下一代的号 `gen + 1` 已出安全整数)
+     *  ⇒ 这一行**照删**,它的记号元组写 `(键, 会话, {@link SEALED_MARK_REV}, 0, 时刻)`、走**同一句** `GREATEST` 合并:rev 落上界,
+     *  世代 = `GREATEST(旧记号.gen + 1, 0)`(有旧记号照抬,没有就是 0)。于是这把键的下一次 `putRules` 算出 `上界 + 1`,被写前那道
+     *  **同一只** {@link isStoredCounter} 拒(`corrupt`,零写);读面同答 `corrupt`({@link sealedKeyError})—— **封键**,直到运营方
+     *  显式解封(USAGE §9.11:原地把记号的 `rev` 归 0、`gen` + 1;不删记号,删了会交回世代)。
+     *  两条都不许丢,所以是这个形:
+     *   · **删得掉** —— 抹除是运营方清坏行的出路(E21 `DELETE /v1/sessions/:id`、2c overwrite-dst 都经这里)。7.105.0 的「拒,一条写
+     *     都不发」让一行坏计数把整个会话的删除半程停住、重试恒败;
+     *   · **不许同世代** —— 修复车 QS 的「照删、不写记号」被 codex 真复现:这把键的血统没在本次抹除上结束,重建行从旧记号起号、
+     *     与持有**旧快照**的活读者同世代 ⇒ 读者把重建的宽松行读成延续(deny → allow)。读不出的号不能拿来结束血统,
+     *     那就不让这把键再有下一行,直到有人看过。
+     *  响亮面:提交**之后**一条 warn(`session_policy_erase_sealed_keys`,点名会话与被封的键 + 两个计数的原文;回滚了就什么都没封,
+     *  死锁重试也不重复报)。这**不是** fail-open(没有放行任何东西,方向是 fail-closed),所以不走 `recordFailOpen`;普查登记 P 类终态。
+     *  残余(如实):记号里**已有**的世代若被列外改到 BIGINT 上界,冲突臂的 `记号.gen + 1` 在库里溢出 ⇒ 这次抹除响亮失败
+     *  (驱动错误;那只记号本来就读不回,`putRules` 同样拒)—— 抹除不读记号,这一形不在本判词射程内。 */
     deleteBySession(sessionId: string): Promise<void>;
+    /**
+     * S-891 封键的响亮面:一次抹除至多一条 warn。日志座**抛** ⇒ 退回 `console.warn` 带原句 —— 走到这里删除已经提交,
+     * 一次日志故障不许把它报成失败(E21 会因此 500、overwrite-dst 会因此中止;codex 7.105.0 修复验证轮 [medium] 同形)。
+     * 缺日志座(直接 `new` 本店的工具 / 测试)⇒ `console.warn`,不静默。
+     */
+    private discloseSealed;
     /**
      * The store's one read-check-write transaction. Its load-bearing read is line ~106's
      * `SELECT rules, rev … FOR UPDATE` — a LOCKING read, therefore a CURRENT read on both engines, which is
@@ -114,10 +145,10 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
 }
 /** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
 export declare class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, logger?: SessionPolicyStoreLogger);
 }
 /** PostgreSQL binding — historical class name + ctor shape preserved. */
 export declare class PgSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, logger?: SessionPolicyStoreLogger);
 }
 //# sourceMappingURL=session-policy-store-sql.d.ts.map