@sema-agent/server 7.12.0 → 7.13.0

package/dist/tool-approval.js

@@ -814,6 +814,15 @@ export class ToolApprovalCoordinator {
             // [2942]/[2943]:治理来源标(additive,只在为真时在场——缺席绝不编 false,见字段顶注)。
             // 值来自上方那一次**非消费式** peek(同一 toolCallId 的重播/failover 再入必须拿到同一份判定)。
             ...(governanceForced ? { governanceForced: true } : {}),
+            // #144(core 5.25.0):被越级的持久规则原文。**逐字透传 core 的判定**(是不是"命中但清不掉"由引擎
+            // 的消音谓词裁,server 不重判);内容族 ⇒ `redactSecrets` 后上帧,空串不铸键(见字段顶注)。
+            // 🔴 **脱敏后当场截到卡的上限**(codex 对抗复审 R2-[medium],验真后修):`redactSecrets` 会**变长**
+            // (一条 `password=…` 换成更长的遮蔽标记),于是一条 ≤512 的规则脱敏后可能超 512 ——而卡面
+            // (`buildApprovalCard` 的 `clip`)会截、活卡帧不截 ⇒ **同一个 approvalId 的两族帧带着两份不同的文本**
+            // (live 长的、`card_json`/呈卡/重放短的)。修法是「先脱敏再截,一次算定」,两面从此同源同值。
+            ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
+                ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
+                : {}),
             // #154 车二:候选逐字透传(条件见 `ruleLaneMaterial` 上方注)。
             ...(ruleLaneMaterial !== undefined ? { ruleSuggestions: ruleLaneMaterial.suggestions } : {}),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
@@ -978,6 +987,17 @@ export class ToolApprovalCoordinator {
                     frame.governanceForced = true;
                 else
                     delete frame.governanceForced;
+                // 🔴 #209 件4:`persistedRuleShadowed` 同归「行 = 真源」的 F2 家族,姿势与上一行**逐字同形**。
+                // 它比 `governanceForced` 更需要这一步:那个键的本地判据(进程内标记表)在重入时恒空,而本键的
+                // 本地判据是 **core 交来的 `req`** —— 幂等命中一条既有行时,这一次的 `req` 是**新一腿**的 ask 请求,
+                // 它带的规则命中判定可能与落库那一刻**不同**(规则在两腿之间被撤销 / 新加了一条命中的规则)。
+                // 两族帧若各读各的,同一个 `approvalId` 会带着互相矛盾的规则解释上 wire(旧帧说"你的规则被越级"、
+                // 呈卡帧说"没有规则",或反向)。采信行 —— 人看到的解释必须是**这张卡落库那一刻**的那一份。
+                // 缺席也要**如实同步**(删键,不是留着本地这一腿的真值)。
+                if (typeof cardForFrame.persistedRuleShadowed === "string")
+                    frame.persistedRuleShadowed = cardForFrame.persistedRuleShadowed;
+                else
+                    delete frame.persistedRuleShadowed;
                 // 🔴 #204 件7(codex 对抗复审 R1-中,验真后修):行说这是治理门 ⇒ **规则车道当场撤回**。
                 // 上面那行只同步了帧上的出处键;素材、两族帧上的候选、以及回决侧第二道门的输入都还是按**本地**
                 // 表算的,而本地表在 failover / 重启后恒空。不撤就正是本件要防的形:一张卡同时带着

package/dist/trace/core-keyset-guard.d.ts

@@ -26,7 +26,7 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleSuggestions";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleSuggestions" | "persistedRuleShadowed";
 type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.23.0",
+    "@sema-agent/core": "^5.25.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.13.0",
+    "@sema-agent/sdk": "^6.14.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",