@sema-agent/server 7.106.0 → 7.108.0

package/dist/tool-approval.d.ts

@@ -5,6 +5,7 @@ import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js
 import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
+import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
 /** [ref]:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
@@ -1126,6 +1127,15 @@ export declare class ToolApprovalCoordinator {
     /** S-877 候裁 16 → A:耐久会话授权店的**读面**(`/decide` 的 `remember:"session"` 写、本席读)。在场 ⇔ 部署有 store backend
      *  (装配点 `boot/coordinators.ts`,与 `/decide` 写的是**同一只**店)。读口唯一 = {@link standingGrantSettles}。 */
     private readonly sessionGrants;
+    /** S-929:有序关停已开始(`drainForShutdown` 锁存,不复位 —— 进程正在退出)。之后登记的每一张卡在登记那一刻按关停收场。 */
+    private shutdownDraining;
+    /** S-929:此刻在 `askBroadcast` 里的 ask 数(进出成对,见那里的 try/finally)—— 关停等待「还没登记进 `pending` 的卡」的计数。 */
+    private asksInFlight;
+    /** S-929 F1:park 提交的观察面(checkpoint 店的装饰层;在场 ⇔ 本部署有 park 设施,装配点 `boot/stage-06-runners.ts`)。 */
+    private readonly parkCommits;
+    /** S-929 F1:有序关停下路由到 park、**处置尚未被观察到**的卡 —— 审计 settle 行在这里候着({@link settleParksAwaitingCommit})。
+     *  只在关停期有成员(进程随后退出,不需要回收)。 */
+    private readonly parksAwaitingCommit;
     constructor(opts?: {
         ttlMs?: number;
         /** [ref](案A):零活流铸造的 ask 的窗(见 {@link unreachedTtlMs})。装配点在协议**上场**时才传
@@ -1155,6 +1165,8 @@ export declare class ToolApprovalCoordinator {
         askAudit?: ApprovalAskAuditSink;
         /** S-877 候裁 16:耐久会话授权店的读面(见 {@link ToolApprovalCoordinator.sessionGrants})。 */
         sessionGrants?: SessionGrantReader;
+        /** S-929 F1:park 提交的观察面(见 {@link ToolApprovalCoordinator.parkCommits})。 */
+        parkCommits?: ParkCommitWatch;
     });
     /**
      * [ref] R-13 C —— 「**无人可答**」这一类终局的**唯一**成形口(park 路由 vs deny 政策)。
@@ -1309,6 +1321,54 @@ export declare class ToolApprovalCoordinator {
      *  流没了,值相等即目标集;极端复用形下多转的那条也只是从流内卡变 durable 卡,方向保守。
      *  返回触发条数(0 = 无流内未决 ask,调用方照旧 abort)。幂等:已结算条目跳过,重复调用无害。 */
     parkOpenAsksForTask(wireTaskId: string): number;
+    /**
+     * 🔴 **S-929 —— 有序关停的审批面收尾(一只;`boot/shutdown.ts` 的 `hardShutdown` 起点调,SIGTERM / SIGINT / SIGHUP 三条停止路同一处)。**
+     *
+     * 病(cli [ref] S7):修前关停序不碰协调器 ⇒ 本进程握着的活卡在下一次 boot 被审计收敛器标成 `crashed_before_park`,
+     * 用户屏上看到「crashed」而实为有序重启。
+     *
+     * 三步:
+     *  ① 本进程握着的**每一张**未决卡(可达 / 悬挂 / 委派子代,不挑)按**断连同路**收场 —— {@link PendingApproval.forceParkNow}(park 路由;
+     *     `deny` 政策下是部署政策拒;有持久 ask 店时走同一把终局 claim)。有序关停与断连是同一件事:投递面要没了,**不是**有人拒了
+     *     (不交裸 `false`,S-689 同律)。审计 settle 行携 `cause:"shutdown_before_park"`(成因在 `settle` 咽喉读锁存位,F10);
+     *  ② 在 `deadlineMs` 之前等:未决卡结清、在飞腿闭合(闭了的腿照常落 `leg_closed`)、**本次路由到 park 的卡全部结清**
+     *     (F1:观察到 core 已处置这次调用 —— 停车行提交或承载它的腿退场 ⇒ 那张卡的审计 settle 行此刻才写,见 {@link settleParksAwaitingCommit})、
+     *     店里在飞的 `put` 静默;
+     *  ③ 到期:仍未闭的腿 ⇒ 审计落 `interrupted_by_shutdown` 记号(下一次 boot 收敛照样列出它,decided 臂的 `resumeSafe:false` 提醒不丢);
+     *     仍未提交的 park ⇒ settle 行**不写**(账本上仍是 pending 孤儿 ⇒ 下一次 boot 与崩溃同路收敛,证据不丢),交回调用方
+     *     (`uncommittedParks`,运维 warn `approval_park_uncommitted_at_shutdown` 由关停序落 —— 它握 logger)。之后才观察到的照样写 settle 行
+     *     (观察到就是结清,迟到也是)。
+     * **一条规则覆盖先后两批卡**(codex r1 F2):收尾一开始就锁存 {@link shutdownDraining};此后**登记**的卡(收尾开始时还在 `ensureAsk`
+     * 的 await 里 —— 零活流的后台 / 委派子代也在内)在登记那一刻按同一条路收场(`askBroadcast` 的铸造审计点之后读这一位)。等待条件
+     * 因此数「在飞的 ask」({@link asksInFlight},`askBroadcast` 进出计数)而不只是 `pending` —— 尚未登记的卡不在 `pending` 里。
+     * `deadlineMs` 是绝对时刻(`Date.now()` 域):关停序对审批面与店 quiesce 读**同一个**到期点(一个宽限窗,不是两个)。
+     * 从不抛错(关停序不许被审计面卡住);再调一次 = 再等一次(记号有去重集,零重写)。
+     */
+    drainForShutdown(deadlineMs: number): Promise<{
+        uncommittedParks: Array<{
+            approvalId: string;
+            taskId: string;
+        }>;
+    }>;
+    /**
+     * S-929 F1:checkpoint 店的观察层报「一只审批停车行提交了」({@link CommittedParkCalls}:行自己陈述的会话与握着的调用)⇒ 候着的
+     * **同一次调用**结清:执行会话**相等**(候者记的是 ask 自己陈述的发起会话,行陈述的是它停住的会话 —— core 同一个变量)∧ 调用 id ∈ 行握着的调用。
+     * 不做「会话相交」:调用 id 只在 run 内唯一(父子各自的第一只调用常同名),宿主会话若作子代的等价别名,宿主停车行一提交就会冒充子代的提交(车 SO)。
+     * 只在关停期有候者;非关停期的提交一个不碰。
+     * 🔴 观察层的订阅者契约是**不得抛**(它跑在 `put` 已提交之后、返回 core 之前 —— 抛了会把一次已提交的 park 报成失败),见下面的写行口。
+     */
+    private noteParkCommitted;
+    /**
+     * S-929 F1 的**结清口**(一处):有序关停下 park 路由的卡,在**观察到 core 已处置这次调用**时写它的审计 settle 行 —— 两种观察,同一件事实:
+     *  · `park-committed` —— 停车行提交了(观察层看到 `put` 落定,或 core 回读确认的那一次 `get` 读到了行);
+     *  · `leg-closed`     —— **承载它的那条腿**退场了(`runWithContext` finally 按 ctx 身份配 {@link ParkAwaitingCommit.carrierLeg}:core 已走完这条腿 ——
+     *                        停靠了,或拒了停靠 fail-closed 继续)。
+     * 两者都没观察到就退出 ⇒ 这行不写,与崩溃同路(下一次 boot 列 pending 孤儿)。委派 / 后台子代与零活流的卡没有被追踪的承载腿,只有第一种观察
+     * (子代的出处是宿主:宿主腿退场不是子代这次调用的处置 —— 车 SO)。
+     * 写行的 sink 自吞失败;sink 实现**自身**抛的那一形在这里兜住并按 [ref] 留痕,同 tag 扩射程(`http/server.ts` `noteLateSettleIfAccepted`
+     * 同一先例):丢的只是这一条审计行 —— 下一次 boot 它被当 pending 孤儿列出(证据方向),park 行本身不受影响。
+     */
+    private settleParksAwaitingCommit;
     /** 测试/可观测性钩子(X-2):某 (taskId) 维当前占用的准入名额数。 */
     admittedCount(taskId: string): number;
     /** [ref] 车2(D5 store 故障姿势):任何 store 调用 throw ⇒ fail-open 到进程内机械照旧(store 是记账/
@@ -1570,6 +1630,8 @@ export declare class ToolApprovalCoordinator {
      *  送达某个客户端之后发生(respond 需要客户端手上有这个 id),这是 outcome==="allowed"/"denied" 与
      *  "expired"(TTL/abort/run-exit-cleanup/emit 广播全灭四类共用)的天然分野。 */
     private askBroadcast;
+    /** {@link askBroadcast} 的本体(计数在外层,一处进出)。 */
+    private askBroadcastCounted;
     /** `POST /v1/tool-approvals/:id/respond` — settle a parked approval with the shell's decision. Owner-gated with a
      *  404 (no existence oracle), body validated first (400 is existence-independent) — question/steer parity. The HTTP
      *  layer owns auth (gatedPrincipal + REQUIRE_PRINCIPAL) before calling.

package/dist/tool-approval.js

@@ -26,6 +26,8 @@ const SUSPENDED_POLL_MAX_PER_TICK = 64;
 const SUSPENDED_POLL_BUDGET_MS = 5_000;
 const EDITED_DECISION_MARK_CAP_MS = 10_000;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
+const SHUTDOWN_DRAIN_POLL_MS = 50;
+const SHUTDOWN_BEFORE_PARK = "shutdown_before_park";
 const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
 const DEFAULT_ADMIT_MAX_PER_OWNER = 256;
@@ -364,6 +366,10 @@ export class ToolApprovalCoordinator {
     parkedRedeem;
     askAudit;
     sessionGrants;
+    shutdownDraining = false;
+    asksInFlight = 0;
+    parkCommits;
+    parksAwaitingCommit = new Set();
     constructor(opts) {
         this.ruleConsent = opts?.ruleConsent;
         this.ruleScopeRootFor = opts?.ruleScopeRootFor;
@@ -381,6 +387,8 @@ export class ToolApprovalCoordinator {
         this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
         this.askAudit = opts?.askAudit;
         this.sessionGrants = opts?.sessionGrants;
+        this.parkCommits = opts?.parkCommits;
+        this.parkCommits?.onParkCommitted((calls) => this.noteParkCommitted(calls));
     }
     unattendedOutcome(site) {
         let outcome;
@@ -644,6 +652,34 @@ export class ToolApprovalCoordinator {
         }
         return n;
     }
+    async drainForShutdown(deadlineMs) {
+        this.shutdownDraining = true;
+        for (const e of [...this.pending.values()])
+            if (e.settledOutcome === undefined)
+                e.forceParkNow();
+        while ((this.asksInFlight > 0 || this.pending.size > 0 || this.streams.size > 0 || this.parksAwaitingCommit.size > 0) && Date.now() < deadlineMs) {
+            await new Promise((r) => setTimeout(r, SHUTDOWN_DRAIN_POLL_MS));
+        }
+        await this.parkCommits?.quiesce(deadlineMs);
+        this.askAudit?.noteLegsInterruptedByShutdown();
+        return { uncommittedParks: [...this.parksAwaitingCommit].map((p) => ({ approvalId: p.approvalId, taskId: p.taskId })) };
+    }
+    noteParkCommitted(calls) {
+        this.settleParksAwaitingCommit((p) => p.executingSessionId === calls.sessionId && calls.toolCallIds.includes(p.toolCallId), "park-committed");
+    }
+    settleParksAwaitingCommit(match, site) {
+        for (const p of [...this.parksAwaitingCommit]) {
+            if (!match(p))
+                continue;
+            this.parksAwaitingCommit.delete(p);
+            try {
+                this.askAudit?.recordSettle(p.settleRecord());
+            }
+            catch (err) {
+                recordFailOpen("server.approval-ask-audit.append-failed", `kind=settle site=${site} err=${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
     admittedCount(taskId) {
         return this.admitByTask.get(taskId) ?? 0;
     }
@@ -950,6 +986,7 @@ export class ToolApprovalCoordinator {
                     if (p.targetCtxs?.has(ctx))
                         p.onTargetGone?.(ctx);
                 }
+                this.settleParksAwaitingCommit((p) => p.carrierLeg === ctx, "leg-closed");
                 this.askAudit?.noteLegClosed(ctx.taskId);
             }
         }));
@@ -983,6 +1020,15 @@ export class ToolApprovalCoordinator {
         };
     };
     async askBroadcast(origin, ctxs, req, signal) {
+        this.asksInFlight++;
+        try {
+            return await this.askBroadcastCounted(origin, ctxs, req, signal);
+        }
+        finally {
+            this.asksInFlight--;
+        }
+    }
+    async askBroadcastCounted(origin, ctxs, req, signal) {
         if (signal?.aborted)
             return false;
         const governanceForced = this.governanceForcedOf(origin, req);
@@ -1008,6 +1054,7 @@ export class ToolApprovalCoordinator {
         }
         const id = uuidv7();
         const child = isChildAsk(req);
+        const carrierLeg = child ? undefined : aliveCtxs.find((c) => c.taskId === origin.taskId);
         const bounded = boundArgs(req.args);
         let effectiveGovernanceForced = governanceForced;
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
@@ -1282,13 +1329,28 @@ export class ToolApprovalCoordinator {
             releaseAdmission();
             if (selfEntry)
                 selfEntry.settledOutcome = outcome;
-            this.askAudit?.recordSettle({
+            const shutdownEnded = this.shutdownDraining && outcome === "expired";
+            const settleRecord = () => ({
                 approvalId: wireApprovalId,
                 outcome,
                 ...(windowRouteUnavailable ? { parkRouted: true } : {}),
                 ...(hostSettledBy !== undefined ? { settledBy: hostSettledBy } : {}),
+                ...(shutdownEnded ? { cause: SHUTDOWN_BEFORE_PARK } : {}),
                 settledAtMs: Date.now(),
             });
+            if (shutdownEnded && windowRouteUnavailable && this.unattendedRoutesToPark && this.parkCommits !== undefined) {
+                this.parksAwaitingCommit.add({
+                    approvalId: wireApprovalId,
+                    taskId: origin.taskId,
+                    carrierLeg,
+                    executingSessionId: req.sourceTaskId,
+                    toolCallId: req.toolCallId,
+                    settleRecord,
+                });
+            }
+            else {
+                this.askAudit?.recordSettle(settleRecord());
+            }
             resolveAllowed({ allowed, ...(allowed && updatedInput !== undefined ? { updatedInput } : {}), ...(allowed && readRootGrant !== undefined ? { readRootGrant } : {}) });
         };
         const broadcastClaimTruth = (read) => {
@@ -1471,7 +1533,7 @@ export class ToolApprovalCoordinator {
             if (done)
                 return;
             if (!this.askStore || askId === undefined || batchId === undefined) {
-                settleParkRouteIfUnsettled();
+                settleParkRouteIfUnsettled(undefined);
                 return;
             }
             windowExpired(undefined);
@@ -1586,10 +1648,12 @@ export class ToolApprovalCoordinator {
             owner: origin.owner,
             toolName: req.toolName,
             toolCallId: req.toolCallId,
-            legTracked: !child && aliveCtxs.some((c) => c.taskId === origin.taskId),
+            legTracked: carrierLeg !== undefined,
             expiresAtMs: persistedExpiresAtMs,
             mintedAtMs: Date.now(),
         });
+        if (this.shutdownDraining)
+            forceParkNow();
         const cardFrame = askId !== undefined && cardForFrame !== undefined
             ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now() })
             : undefined;

package/dist/tool-rule-names.d.ts

@@ -0,0 +1,25 @@
+/**
+ * S-919(安全轴,八病审计 SG H2-a)—— 本仓**收紧方向**按引擎工具名匹配的策略臂的**唯一**名字读法。
+ *
+ * ## 规则(一条,与 core 7.36.0 [ref] `NAME_READINGS` 同判)
+ * 一个调用可以答好几个名字:嵌入方工具声明别名(`MyShell{aliases:["Bash"]}`)后,模型按哪个名调它、它的 wire 名、
+ * 解到同一行的其余别名,都是这次调用的名字。core 把**收紧**方向的名单(`policy.nameLists` / `policy.shellToolsList` /
+ * `policy.durableQuestion` / `policy.sensitivePathGuardedByName`)读成 `any` —— 调用答得上的**任何**一个名字在名单里就算
+ * 命中;**授权 / 路由**方向的座(会话放行、审批卡分型、停车行)读 `wire`(`req.toolName`)。core 给宿主的读法端口是包根
+ * `ruleNamesOf(req)`(`dist/core/tool-name-readings.js`,亲读实现:`face.names` 含调用名时取它,否则只有调用名;拼写在先)。
+ *
+ * 本仓照此分两边:
+ *  · **收紧臂**(`APPROVAL_DENY` / `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO`、commandPolicy 的 ask 表、治理 shell 标、
+ *    durable 问题门、supervisor 危险门、workflow 问 / 拒)一律经本函数读全集;
+ *  · **授权 / 路由臂**(会话豁免探针、会话放行键、审批卡分型、停车行的 AskUserQuestion 判别)读 `req.toolName`,不经这里 ——
+ *    用户对 `Bash` 说过的「本会话不再询问」不许替一只叫 `MyShell` 的工具放行(放宽臂不因别名放宽)。
+ *
+ * 修前(≤7.107.0)本仓自写的这些臂只比 `req.toolName`:模型按别名调嵌入方工具时,运维名单一个都不拦(core 同族策略判 deny、
+ * 本仓判 allow)。本仓自身不声明带别名的工具,所以只有经 `resolveSpec` 席挂别名工具的嵌入方走得到。
+ *
+ * 返回**命中的那个名字**(调用答得上的名字里第一个被规则够到的,拼写在先)—— 规则归因(`matchedAskRule`)写运维名单里的那个名,
+ * 不写一个名单里查不到的 wire 名;够不到 ⇒ `undefined`。判定式(精确集 / covering 规则)由调用方给,本函数只管「读哪些名字」。
+ */
+import { type ToolCallRequest } from "@sema-agent/core";
+export declare function heldRuleName(req: Pick<ToolCallRequest, "toolName" | "face">, holds: (name: string) => boolean): string | undefined;
+//# sourceMappingURL=tool-rule-names.d.ts.map

package/dist/tool-rule-names.js

@@ -0,0 +1,5 @@
+import { ruleNamesOf } from "@sema-agent/core";
+export function heldRuleName(req, holds) {
+    return ruleNamesOf(req).find(holds);
+}
+//# sourceMappingURL=tool-rule-names.js.map

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -157,6 +157,14 @@ type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode";
 type PausedCauseStripped = "token";
 type _GuardPausedCause = AssertAllKeysHandled<Exclude<keyof PausedCause, PausedCauseForwarded | PausedCauseStripped>>;
 type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarded | PausedCauseStripped, keyof PausedCause>>;
+type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage";
+type SideQueryResultStripped = never;
+type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
+type _GuardSideQueryResultReverse = AssertAllKeysHandled<Exclude<SideQueryResultForwarded | SideQueryResultStripped, keyof SideQueryResult>>;
+type SideQueryToolCallForwarded = "id" | "wireId" | "name" | "args";
+type SideQueryToolCallStripped = never;
+type _GuardSideQueryToolCall = AssertAllKeysHandled<Exclude<keyof SideQueryResult["toolCalls"][number], SideQueryToolCallForwarded | SideQueryToolCallStripped>>;
+type _GuardSideQueryToolCallReverse = AssertAllKeysHandled<Exclude<SideQueryToolCallForwarded | SideQueryToolCallStripped, keyof SideQueryResult["toolCalls"][number]>>;
 type SettlementKeys = Settlement extends infer S ? (S extends object ? keyof S : never) : never;
 type SettlementWhoKeys = Settlement["who"] extends infer W ? (W extends object ? keyof W : never) : never;
 type GateOutcomeProjected = "disposition" | "settlement" | "origin";
@@ -289,6 +297,10 @@ export type CoreKeysetGuards = [
     _GuardTaskResultReverse,
     _GuardPausedCause,
     _GuardPausedCauseReverse,
+    _GuardSideQueryResult,
+    _GuardSideQueryResultReverse,
+    _GuardSideQueryToolCall,
+    _GuardSideQueryToolCallReverse,
     _GuardGateOutcome,
     _GuardGateOutcomeReverse,
     _GuardGateDisposition,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /**
  * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。
@@ -42,6 +42,8 @@ export declare const SERVER_NOTICE_AUDIENCE: {
     readonly "memory.layer_locked_legacy": "operator";
     /** S-612 —— 会话存档部分记录被跳过(唯一铸点 `src/session-records-skipped-notice.ts`);受众 user,理由见白名单键注。 */
     readonly "session.records_skipped": "user";
+    /** S-925 —— 模型调用因建连失败终态(唯一铸点 `src/model-unreachable-notice.ts`);受众 user,理由见白名单键注。 */
+    readonly "server.model_unreachable": "user";
 };
 export type ServerNoticeCode = keyof typeof SERVER_NOTICE_AUDIENCE;
 /** 该码是否本仓自铸(属主判据单点:门与投递面都读这一个)。 */

package/dist/trace/engine-notice-wire.js

@@ -27,6 +27,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "approval.read_root_grant_rejected",
     "instructions.source_changed",
     "session.records_skipped",
+    "server.model_unreachable",
     "classifier.unavailable",
     "config.permission_mode_unavailable",
     "permission.ask_released_by_mode",
@@ -37,6 +38,7 @@ export const SERVER_NOTICE_AUDIENCE = {
     "instructions.source_changed": "user",
     "memory.layer_locked_legacy": "operator",
     "session.records_skipped": "user",
+    "server.model_unreachable": "user",
 };
 export function isServerNoticeCode(code) {
     return Object.hasOwn(SERVER_NOTICE_AUDIENCE, code);

package/dist/trace/project.d.ts

@@ -296,9 +296,12 @@ export declare function toolEndEventData(ev: {
  * **不等于** `tool_end` 的 duration)。
  *
  * ## 信任划线
- *  · `toolCallId` / `toolName` —— 调用 id(🔴 S-283 订正:**服务商**在 tool_use / tool_calls 里给的,引擎只在缺席时自铸兜底 ——
- *    此前写「引擎铸」不实)与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。调用 id 这一族在**逐帧面**上的形状闸
- *    不在 S-283 射程(它是全 wire 的 join 键,要闸得所有面一起闸,见 run-terminal `admitProviderEcho` 顶注与车QO 收车档)。
+ *  · `toolCallId` / `toolName` —— 调用 id(🔴 S-283 订正:出身是**服务商**在 tool_use / tool_calls 里给的,引擎缺席时自铸兜底、越界时折叠 ——
+ *    此前写「引擎铸」不实)与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。调用 id 这一族的形状在**全部面的共同入口**一次施加 ——
+ *    core 7.36.0(#1207)brain 建调用那一行的准入(在形原样 / 越界单射折叠,原字节只在转录 `ToolCall.wireId`),一方 brain 新铸的调用在逐帧面上
+ *    恒是在形的引擎 id(残余两条 S-921:≤7.106.0 写下的存量行 resume 出来的帧是服务商原串逐字;宿主 Brain 不准入 KL-1207-a —— 详见
+ *    run-terminal `admitProviderEcho` 顶注);
+ *    本仓不设第二道闸(见 run-terminal `admitProviderEcho` 顶注;S-890 关)。
  *  · `elapsedTimeSeconds` —— 引擎铸的整秒,单调、一 call 一个原点 ⇒ 有限数才铸键。
  *  · `output` —— 🔴 **UNTRUSTED RAW**,core 逐字「exactly as `tool_end.output`: process output that may
  *    carry secrets, paths or PII; core bounds only its SIZE, and a consumer MUST redact before persisting

package/dist/trace/self-minted-wire.d.ts

@@ -0,0 +1,71 @@
+/** 一个自铸 wire 值成员的登记。 */
+export interface SelfMintedWireMember {
+    readonly attr: string | number;
+    readonly since: string;
+}
+export declare const SELF_MINTED_WIRE: {
+    /** [ref](7.55.0)起的终态成因注;S-929(7.108.0)+`shutdown_before_park`。 */
+    readonly crashConvergedCause: {
+        readonly at: "GET /v1/approvals crashConverged[].cause";
+        readonly members: {
+            crashed_before_park: {
+                attr: string;
+                since: string;
+            };
+            shutdown_before_park: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /**
+     * 会话所有者自助抹除面的**已分类拒** → HTTP 状态(S-930 起与 operator 面 `POST /v1/memory/erase` 同一只映射;`since` 记的是**本面**
+     * 自哪一版起这样答 —— 7.107.0 及以前本面只认前两只,其余落 500 `internal.error`)。
+     */
+    readonly sessionMemoryEraseStatus: {
+        readonly at: "POST /v1/sessions/:id/memory/erase(已分类拒 errorCode → HTTP 状态)";
+        readonly members: {
+            readonly "config.memory_erasure_request": {
+                readonly attr: 400;
+                readonly since: "7.52.0";
+            };
+            readonly "memory.target_outside_store": {
+                readonly attr: 409;
+                readonly since: "7.101.0";
+            };
+            readonly "memory.erasure_evidence_unavailable": {
+                readonly attr: 409;
+                readonly since: "7.108.0";
+            };
+            readonly "memory.erasure_selector_mismatch": {
+                readonly attr: 409;
+                readonly since: "7.108.0";
+            };
+            readonly "memory.erasure_census_incomplete": {
+                readonly attr: 409;
+                readonly since: "7.108.0";
+            };
+            readonly "internal.memory_control_plane_corrupt": {
+                readonly attr: 500;
+                readonly since: "7.108.0";
+            };
+        };
+    };
+    /** 本仓在出口对 core 值做的变换(值变、键不变)。 */
+    readonly wireValueRule: {
+        readonly at: "出口值变换(<端点>#<键> → 变换)";
+        readonly members: {
+            /** S-105(7.57.0):run 读面的终态错误文案脱敏(钉 test/run-failure-visibility.test.ts)。 */
+            readonly "GET /v1/runs/:id#result.errorMessage": {
+                readonly attr: "redactErrorMessage";
+                readonly since: "7.57.0";
+            };
+            /** S-922(7.108.0):side-query 200 体 `errorMessage` 与任务面同一只脱敏口(钉 test/side-query-provider-echo.test.ts)。 */
+            readonly "POST /v1/side-query#errorMessage": {
+                readonly attr: "redactErrorMessage";
+                readonly since: "7.108.0";
+            };
+        };
+    };
+};
+//# sourceMappingURL=self-minted-wire.d.ts.map

package/dist/trace/self-minted-wire.js

@@ -0,0 +1,28 @@
+export const SELF_MINTED_WIRE = {
+    crashConvergedCause: {
+        at: "GET /v1/approvals crashConverged[].cause",
+        members: {
+            crashed_before_park: { attr: "-", since: "7.55.0" },
+            shutdown_before_park: { attr: "-", since: "7.108.0" },
+        },
+    },
+    sessionMemoryEraseStatus: {
+        at: "POST /v1/sessions/:id/memory/erase(已分类拒 errorCode → HTTP 状态)",
+        members: {
+            "config.memory_erasure_request": { attr: 400, since: "7.52.0" },
+            "memory.target_outside_store": { attr: 409, since: "7.101.0" },
+            "memory.erasure_evidence_unavailable": { attr: 409, since: "7.108.0" },
+            "memory.erasure_selector_mismatch": { attr: 409, since: "7.108.0" },
+            "memory.erasure_census_incomplete": { attr: 409, since: "7.108.0" },
+            "internal.memory_control_plane_corrupt": { attr: 500, since: "7.108.0" },
+        },
+    },
+    wireValueRule: {
+        at: "出口值变换(<端点>#<键> → 变换)",
+        members: {
+            "GET /v1/runs/:id#result.errorMessage": { attr: "redactErrorMessage", since: "7.57.0" },
+            "POST /v1/side-query#errorMessage": { attr: "redactErrorMessage", since: "7.108.0" },
+        },
+    },
+};
+//# sourceMappingURL=self-minted-wire.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.106.0",
+  "version": "7.108.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -61,7 +61,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.35.2",
+    "@sema-agent/core": "7.36.0",
     "@sema-agent/settings-schema": "6.3.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",