@sema-agent/server 7.124.0 → 7.124.1

package/MIGRATION.md

@@ -7,6 +7,12 @@
 > ⚠️ 完整清单在仓库根 `CHANGELOG.md`——它**不随 npm tarball 出包**(本文件随包)。看完整迁移窗的
 > 权威姿势是源码 tag diff:`git diff v<旧>..v<新>`(每版都推 `v<版本>` tag);npm 包页也镜像 CHANGELOG。
 
+## Unreleased
+
+1. **订正 7.124.0 节「升级前必读」一句**(文字订正,行为不变):那句写决断口 409「新增一码」—— 7.124.0 **没有**新增任何决断口 409 码(复审中整退);决断口的变化只有:`field:"answer"` 的 409 由 `approval_binding_mismatch` 挪到 `resume_outcome_invalid`,以及 `409 checkpoint.unsupported_version` 体多出 additive 的 `writerVersion` / `readerVersion` 两键。第 14 条正文是对的,以第 14 条为准。
+2. **订正契约 §0.4 一句**(文字订正,行为不变):扁平布尔对 `draining` / `drainingSince` 在 7.124.0 **仍照发**,删发随提货 settings-schema 12.0.0 的那一版(届时发车帖点名);消费方现在就可改读 `engineSignal.draining`。
+3. **订正 7.124.0 节第 14 条的 `field:"answer"` 一句**(文字订正,行为不变):「`field:"answer"` 改发 `resume_outcome_invalid`」描述的是本服务对 core 闭集词 `answer` 的**映射表项**,不是 7.124.0 决断口上可观察到的行为变化 —— 在 core 7.48.0 下,引擎铸 `field:"answer"` 的三种形(答案不是规范数组 / 答案配在 deny 或非问题卡上 / 批准问题卡却无答案)在 `POST /v1/approvals/:sessionId/decide` 上都先被本服务的请求/状态守卫以 `400 request.field_conflict` 或 `400 request.body_shape` 拒掉,普通停驻卡上**没有**一种请求能拿到那条 409;唯一能让引擎抛出它的是 parked 子代行上「deny 带 answer / 非问题卡带 answer」,而那条腿把它作 `422 parked_resume.startup_failed` 透传(引擎原句,无 `field`)。消费端不需要为这一句改任何码;两腿投影不一致本身已登记为待收口项。
+
 ## 7.124.0 —— `@sema-agent/settings-schema` 11.2.0(major):升级序硬约束 · `models.atMention` 取代 `atModelAllowlist` · 盘上 LKG / 本地 `config.d` / 调度店的一次性迁移(升级零动作,回滚有条件)· 缺省模型只有 `roles.default` 一位 · web-admin 连接 env 整组改名(旧名在场即拒启)· web 基址与中心身份起服互证 · 日志键 `sema_registry_*` → `web_admin_*` · 排空口动作号是标识符 · 审批「结局成因」一张闭集(410 `deniedReason` → `cause`,晚答 404 旧词退役,决断口 409 按成因分码;`checkpoint.unsupported_version` 体带写者 / 读者两个版本键)
 
 **升级前必读**:升级序按中心视图分两种(第 1 条)—— 视图里没有退役形(`models.atModelAllowlist` / `models.default` / 带限额的 `runtime` 域)⇒ 先把所有引擎升到本版,再让 web-admin 升到 settings-schema 11.x;视图里有退役形 ⇒ 先把 web-admin 升到 11.x、在中心上把数据改成新形,再滚引擎;两种窗口里都别重启 7.123.0 引擎(重启后 `@` 限制静默放开)。接 web-admin 的部署把全部连接 env 改写成 `SEMA_WEB_ADMIN_*`(第 7 条:旧名在场即拒启;由 web-admin 编排器渲染 env 的车队(web-admin 0.1.x 渲染)只能**停机换代三步**:① 停引擎;② 把中心换到带「按目标引擎版本写名」渲染器的 web-admin 版本(随 settings-schema 11.x 换岛同车到),或由运维手改 env 成 `SEMA_WEB_ADMIN_*` 十键;③ 起新引擎 —— 不存在零停机顺序);设了 web 基址的部署核一眼它与 issuer 是同一台 web-admin(第 11 条);按日志键告警的规则改前缀(第 12 条);有本地 `config.d` 的部署升级前备份它(第 3 条,回滚要还原它);按 `410 gone.ask` 体的 `deniedReason` 键、按晚答 `404` 的 `cause === "voided" | "denied"`、或按 `approval_binding_mismatch` 一码处理所有决断口 409 的壳核第 14 条(键名与旧词退役,`answer` 席改码,新增一码)。

package/dist/trace/redact.js

@@ -210,19 +210,24 @@ function forgetEscapedSeparatorTails() {
     escapedTailsText = undefined;
     escapedTailsValue = undefined;
 }
+const UUID_SHAPE = "[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}";
+const UUID_ALPHABET = "0123456789abcdefABCDEF-";
+const notWholeUuid = (valueClass) => new RegExp(`^${valueClass}+$`).test(UUID_ALPHABET) ? `(?!${UUID_SHAPE}(?!${valueClass}))` : "";
 const VALUE_ARM_STICKY = new Map();
 const VALUE_ARM_BODIES = [];
 const valueArm = (prefixSrc, valueClass, min, evidence) => {
-    const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
-    VALUE_ARM_BODIES.push(body);
-    const g = (() => {
+    const tail = `${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
+    const [body, g] = (() => {
         switch (evidence) {
-            case "self-evident":
-                return new RegExp(body, "g");
+            case "self-evident": {
+                const b = `${prefixSrc}${notWholeUuid(valueClass)}${tail}`;
+                return [b, new RegExp(b, "g")];
+            }
             case "needs-left-boundary": {
-                const re = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
-                VALUE_ARM_STICKY.set(re, new RegExp(body, "y"));
-                return re;
+                const b = `${prefixSrc}${tail}`;
+                const re = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${b}`, "g");
+                VALUE_ARM_STICKY.set(re, new RegExp(b, "y"));
+                return [b, re];
             }
             default: {
                 const unhandled = evidence;
@@ -230,6 +235,7 @@ const valueArm = (prefixSrc, valueClass, min, evidence) => {
             }
         }
     })();
+    VALUE_ARM_BODIES.push(body);
     return g;
 };
 let anyValueArm;
@@ -628,6 +634,7 @@ const KEYWORD_SECRET_PATTERNS = [
     [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}"), "Basic «redacted»"],
     [keywordArm("[Tt]oken", "[A-Za-z0-9._~+/-]", 20), "token «redacted»"],
 ];
+const SK_FULL_ARM_MIN = 20;
 const SHAPE_SECRET_PATTERNS = [
     [new RegExp(String.raw `(?:ghp|gho|ghu|ghs|ghr)_${atLeast("[A-Za-z0-9]", 20)}`, "g"), "«redacted:gh-token»"],
     [new RegExp(String.raw `github_pat_[A-Za-z0-9]{22}_${atLeast("[A-Za-z0-9]", 59)}`, "g"), "«redacted:gh-token»"],
@@ -636,7 +643,7 @@ const SHAPE_SECRET_PATTERNS = [
     [new RegExp(String.raw `ASIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
     [new RegExp(String.raw `(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-${atLeast("[A-Za-z0-9_-]", 20)}|(?:sk|rk)_(?:live|test|org)_${atLeast("[A-Za-z0-9]", 24)}|pypi-${atLeast("[A-Za-z0-9_-]", 85)})`, "g"), "«redacted:key»"],
     [new RegExp(String.raw `xapp-\d-${atLeast("[A-Za-z0-9-]", 20)}`, "g"), "«redacted:slack-token»"],
-    [valueArm("sk-", "[A-Za-z0-9_-]", 16, "self-evident"), "«redacted:key»"],
+    [valueArm("sk-", "[A-Za-z0-9_-]", SK_FULL_ARM_MIN, "self-evident"), "«redacted:key»"],
 ];
 const FULL_ARM_PATTERNS = [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS];
 const PEM_HEADER_IDENT_MAX = 31;

package/dist/trace/self-minted-wire.d.ts

@@ -234,19 +234,6 @@ export declare const SELF_MINTED_WIRE: {
                 since: string;
             };
         };
-        /** 7.124.0 退役:被具体成因词取代的两个旧词(7.40.0 起在 wire 上;从未进过登记表,清单靠本格记 removed)。 */
-        readonly retired: {
-            readonly voided: {
-                readonly attr: "-";
-                readonly since: "7.40.0";
-                readonly until: "7.124.0";
-            };
-            readonly denied: {
-                readonly attr: "-";
-                readonly since: "7.40.0";
-                readonly until: "7.124.0";
-            };
-        };
     };
     /**
      * 活卡结局帧 `tool_approval_complete` 的 additive `cause`(7.124.0):**非人结局在场、人答缺席**。值 = 审计 settle 行 `cause` 的同一个词(一个事实一个读法);

package/dist/trace/self-minted-wire.js

@@ -77,10 +77,6 @@ export const SELF_MINTED_WIRE = {
             shutdown_before_park: { attr: "-", since: "7.124.0" },
             unknown_or_other_replica: { attr: "-", since: "7.40.0" },
         },
-        retired: {
-            voided: { attr: "-", since: "7.40.0", until: "7.124.0" },
-            denied: { attr: "-", since: "7.40.0", until: "7.124.0" },
-        },
     },
     toolApprovalCompleteCause: {
         at: "tool_approval_complete frame cause",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.124.0",
+  "version": "7.124.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",