@sema-agent/server 7.126.0 → 7.127.1

package/dist/trace/project.js

@@ -3,6 +3,7 @@ import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, isPersi
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
+import { projectToolOutput } from "./tool-output-media.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
 import { semaProvenanceOrAbsent } from "./sema-provenance.js";
 import { resupplyFields, terminalFrameFacetFields } from "./task-notification-facets.js";
@@ -133,22 +134,34 @@ function modeLedgerDefect(d) {
         return "disposition.released.origin is outside the closed set";
     if (o.mandate !== undefined && !isPersistedRuleMandate(o.mandate))
         return "disposition.released.mandate is outside the closed set";
-    if (o.reason !== undefined && !isModeReleaseReason(o.reason))
-        return "disposition.released.reason is outside the closed set";
     return false;
 }
+function withReleaseReasonTheEngineReads(g) {
+    const d = g.disposition;
+    if (d.kind !== "allowed" || d.released === undefined)
+        return g;
+    const r = d.released;
+    if (r === null || typeof r !== "object")
+        return g;
+    const reason = d.released.reason;
+    if (typeof reason !== "string" || isModeReleaseReason(reason))
+        return g;
+    const { reason: _unread, ...kept } = d.released;
+    return { ...g, disposition: { ...d, released: kept } };
+}
 function screenedGateOrThrow(v) {
     if (v === null || typeof v !== "object") {
         if (v !== undefined)
             recordFailOpen("server.trace.gate-outcome-defective", "gate is not an object");
         return undefined;
     }
-    const g = v;
-    const d = g.disposition;
-    if (d === null || typeof d !== "object" || (d.kind !== "allowed" && d.kind !== "denied")) {
+    const stored = v;
+    if (stored.disposition === null || typeof stored.disposition !== "object" || (stored.disposition.kind !== "allowed" && stored.disposition.kind !== "denied")) {
         recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
         return undefined;
     }
+    const g = withReleaseReasonTheEngineReads(stored);
+    const d = g.disposition;
     const classifierFallbackRaw = d.classifier !== null && typeof d.classifier === "object" ? d.classifier.fallback : undefined;
     const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
         (d.kind === "denied" && d.cause !== undefined && typeof d.cause !== "string" && "disposition.cause is not a string") ||
@@ -273,7 +286,7 @@ export function toolEndEventData(ev) {
         toolName: ev.toolName,
         ...(ev.label !== undefined ? { label: ev.label } : {}),
         isError: ev.isError,
-        ...(ev.output !== undefined ? { output: redactDeep(ev.output) } : {}),
+        ...(ev.output !== undefined ? { output: projectToolOutput(ev.output) } : {}),
         ...(ev.truncated ? { truncated: true } : {}),
         ...(Number.isFinite(ev.totalChars) ? { totalChars: ev.totalChars } : {}),
         ...(ev.structured !== undefined ? { structured: redactDeep(ev.structured) } : {}),
@@ -297,7 +310,7 @@ export function toolProgressEventData(ev) {
         toolCallId: id,
         toolName: name,
         ...(n(ev.elapsedTimeSeconds) !== undefined ? { elapsedTimeSeconds: n(ev.elapsedTimeSeconds) } : {}),
-        ...(hasOutput ? { output: redactDeep(ev.output) } : {}),
+        ...(hasOutput ? { output: projectToolOutput(ev.output) } : {}),
         ...(hasOutput && n(ev.totalLines) !== undefined ? { totalLines: n(ev.totalLines) } : {}),
         ...(hasOutput && n(ev.totalBytes) !== undefined ? { totalBytes: n(ev.totalBytes) } : {}),
         ...identityFields(ev),
@@ -336,6 +349,25 @@ export function taskProgressEventData(ev) {
         ...identityFields(ev),
     };
 }
+export function taskStartedEventData(ev) {
+    return {
+        taskId: ev.taskId,
+        sessionId: ev.sessionId,
+        ...(typeof ev.taskType === "string" && ev.taskType.length > 0 ? { taskType: ev.taskType } : {}),
+        ...(typeof ev.seq === "number" ? { seq: ev.seq } : {}),
+        ...(ev.workflowRunId ? { workflowRunId: ev.workflowRunId } : {}),
+        ...(ev.workflowAgentLabel ? { workflowAgentLabel: redactSecrets(ev.workflowAgentLabel) } : {}),
+        ...(ev.parentTaskId ? { parentTaskId: ev.parentTaskId } : {}),
+        ...(ev.parentSessionId ? { parentSessionId: ev.parentSessionId } : {}),
+        ...(ev.rootSessionId ? { rootSessionId: ev.rootSessionId } : {}),
+        ...(ev.name ? { name: redactSecrets(ev.name) } : {}),
+        ...(ev.spawnName ? { spawnName: ev.spawnName } : {}),
+        ...(ev.agentType ? { agentType: ev.agentType } : {}),
+        model: ev.model,
+        ...(typeof ev.startedAt === "number" && Number.isFinite(ev.startedAt) ? { startedAt: ev.startedAt } : {}),
+        ...identityFields(ev),
+    };
+}
 export function taskNotificationEventData(ev) {
     const n = ev.notification;
     return {

package/dist/trace/self-minted-wire.d.ts

@@ -418,13 +418,6 @@ export declare const SELF_MINTED_WIRE: {
                 since: string;
             };
         };
-        readonly retired: {
-            readonly discuss: {
-                readonly attr: "-";
-                readonly since: "7.28.0";
-                readonly until: "7.126.0";
-            };
-        };
     };
     /**
      * 提交体的场景透传键(受理门放行;`ScenarioRequest` 索引签名读)。7.126.0 只喂 discuss 场景与 code-review council 腿的四键退出 wire
@@ -438,28 +431,6 @@ export declare const SELF_MINTED_WIRE: {
                 since: string;
             };
         };
-        readonly retired: {
-            readonly businessContext: {
-                readonly attr: "-";
-                readonly since: "1.214.2";
-                readonly until: "7.126.0";
-            };
-            readonly lenses: {
-                readonly attr: "-";
-                readonly since: "1.214.2";
-                readonly until: "7.126.0";
-            };
-            readonly rounds: {
-                readonly attr: "-";
-                readonly since: "1.214.2";
-                readonly until: "7.126.0";
-            };
-            readonly team: {
-                readonly attr: "-";
-                readonly since: "1.214.2";
-                readonly until: "7.126.0";
-            };
-        };
     };
     /**
      * `GET /v1/models` 应答体的顶层键(闭集;`src/http/routes/capabilities.ts` 的 `sendJson(res, 200, {…})` 字面量)。属性 = 在场律:`always` 恒在场(零条也出键),`present-iff` 条件成立才出键
@@ -519,6 +490,25 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: "redactListEntry";
                 readonly since: "7.120.0";
             };
+            /**
+             * 7.127.0(引擎 7.50.0:`tool_end.output` 按块带已准入的图像 / 文档):媒体块(image / document 且 `data` 是串)的 `data` 是字节编码 ——
+             * 活面 SSE 逐字过境,不跑文本脱敏(`trace/tool-output-media.ts` `projectToolOutput`;钉 test/tool-end-media-durable.test.ts);
+             * 唯一例外 = 连接积压:本帧媒体 + 这条连接 / 订阅者未送出的字节 > 64 MiB ⇒ 本帧媒体降描述符(`liveToolEndForBacklog`;钉 test/live-media-backlog.test.ts)。
+             */
+            readonly "SSE tool_end#output[].data(\u5A92\u4F53\u5757)": {
+                readonly attr: "verbatim-bytes;backlog>64MiB⇒descriptor+totalChars";
+                readonly since: "7.127.0";
+            };
+            /**
+             * 7.127.0:同一媒体块在**持久面**(账本行与 `GET /v1/runs/:id/events` 回放)只存描述符 `{ type, mimeType?, bytes, truncated: true }`,
+             * 帧级 `truncated` 随之为真、帧级 `totalChars` 随之在场(core 不变量「Present iff truncated」:帧上已有 core 的值 ⇒ 原样保留,
+             * 没有 ⇒ 逐块真实大小求和;活面积压降级同一只函数)(账本汇点一处剥:`observability/run-terminal.ts` `redactLedgerEventData` →
+             * `toolEndMediaAsDescriptors`;钉同上)。
+             */
+            readonly "GET /v1/runs/:id/events#tool_end.output[](\u5A92\u4F53\u5757)": {
+                readonly attr: "durableMediaDescriptor+totalChars";
+                readonly since: "7.127.0";
+            };
         };
     };
 };

package/dist/trace/self-minted-wire.js

@@ -145,21 +145,12 @@ export const SELF_MINTED_WIRE = {
             "code-review": { attr: "-", since: "1.214.2" },
             scan: { attr: "-", since: "1.214.2" },
         },
-        retired: {
-            discuss: { attr: "-", since: "7.28.0", until: "7.126.0" },
-        },
     },
     scenarioBodyKey: {
         at: "POST /v1/tasks|/v1/tasks/stream|/v1/runs 体的场景透传键",
         members: {
             repo: { attr: "-", since: "1.214.2" },
         },
-        retired: {
-            businessContext: { attr: "-", since: "1.214.2", until: "7.126.0" },
-            lenses: { attr: "-", since: "1.214.2", until: "7.126.0" },
-            rounds: { attr: "-", since: "1.214.2", until: "7.126.0" },
-            team: { attr: "-", since: "1.214.2", until: "7.126.0" },
-        },
     },
     modelsResponseKey: {
         at: "GET /v1/models 应答体顶层键(<键> → 在场律)",
@@ -178,6 +169,8 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/side-query#errorMessage": { attr: "redactErrorMessage", since: "7.108.0" },
             "engine_notice permission.allowed_tool_not_granted#detail.entries[].entry": { attr: "redactListEntry", since: "7.120.0" },
             "engine_notice permission.rule_row_dropped#detail.rows[].rule": { attr: "redactListEntry", since: "7.120.0" },
+            "SSE tool_end#output[].data(媒体块)": { attr: "verbatim-bytes;backlog>64MiB⇒descriptor+totalChars", since: "7.127.0" },
+            "GET /v1/runs/:id/events#tool_end.output[](媒体块)": { attr: "durableMediaDescriptor+totalChars", since: "7.127.0" },
         },
     },
 };

package/dist/trace/tool-output-media.d.ts

@@ -0,0 +1,26 @@
+/**
+ * 两面共用的 `output` 投影:串 / 文本块 / 其它块整只过 `redactDeep`;媒体块逐成员过,`data` 逐字。
+ * 保键序(逐键映射),不改入参。
+ */
+export declare function projectToolOutput(output: unknown): unknown;
+/**
+ * `tool_end` 载荷的媒体降级(持久面恒用;活面只在连接积压时用):带 `data` 的媒体块换成描述符,有任何一块被换 ⇒ 帧级 `truncated: true`
+ * 且帧级 `totalChars` 在场 —— core 不变量「Present iff truncated」:被界之前那个值的真实大小。帧上已有 `totalChars`(core 已截断:
+ * 文本被切而媒体留着)⇒ **原样保留**(它说的是更早的原值,本仓手里的已是切过的值,重算只会低报);没有 ⇒ 按 {@link trueSizeOf}
+ * 逐块求和(core 没截,`output` 就是原值 —— 文本块是本服务脱敏后的字节,即本服务交付的内容)。
+ * 没有媒体块 ⇒ 原样返回同一引用(纯文本 / 串形 output 一个字节不变);已是描述符的块(无 `data`)原样 ⇒ 幂等。
+ */
+export declare function toolEndMediaAsDescriptors(data: Record<string, unknown>): Record<string, unknown>;
+/** 活面一条连接允许压住的待发字节上界(含本帧媒体)。一帧媒体最大约为部署媒体预算的 4/3(缺省约 40 MiB),
+ *  上界取它之上一点:空闲连接上一整帧最大的图照样整块过,第二帧起只在读者跟上之后才整块。 */
+export declare const LIVE_MEDIA_BACKLOG_BYTES: number;
+/** 一帧 `tool_end` 载荷里媒体块 `data` 的字节数(base64 串长;没有媒体 = 0)。 */
+export declare function liveMediaBytesOf(frame: Record<string, unknown>): number;
+/**
+ * 活面的积压判据(一只):`backlogBytes` = 这条连接 / 这个订阅者此刻还没送出去的字节。本帧媒体 + 积压 > 上界 ⇒ 媒体降描述符,
+ * 否则原样(同一引用)。非 `tool_end` 载荷由调用方不送进来;没有媒体的 `tool_end` 恒原样。
+ * 降级是 F 类兜底(观众少见一张图),每降一帧在**这里**记一次 `server.tool-end-media.live-backlog-degraded` —— 三处写口都经这一只函数,
+ * 留痕因此只有一处;帧上它与引擎的媒体预算降级同形,计数是运维看出「多少观众丢了图」的唯一位。
+ */
+export declare function liveToolEndForBacklog(frame: Record<string, unknown>, backlogBytes: number): Record<string, unknown>;
+//# sourceMappingURL=tool-output-media.d.ts.map

package/dist/trace/tool-output-media.js

@@ -0,0 +1,57 @@
+import { redactDeep } from "./redact.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+function isMediaBlock(b) {
+    if (b === null || typeof b !== "object" || Array.isArray(b))
+        return false;
+    const block = b;
+    return (block.type === "image" || block.type === "document") && typeof block.data === "string";
+}
+const MIME_ECHO_MAX = 255;
+export function projectToolOutput(output) {
+    if (!Array.isArray(output))
+        return redactDeep(output);
+    return output.map((b) => (isMediaBlock(b) ? Object.fromEntries(Object.entries(b).map(([k, v]) => [k, k === "data" ? v : redactDeep(v)])) : redactDeep(b)));
+}
+function trueSizeOf(b) {
+    if (isMediaBlock(b))
+        return b.data.length;
+    if (b !== null && typeof b === "object" && !Array.isArray(b) && b.type === "text" && typeof b.text === "string") {
+        const { type: _type, text, ...rest } = b;
+        return text.length + Math.max(0, (JSON.stringify(rest)?.length ?? 2) - 2);
+    }
+    return JSON.stringify(b)?.length ?? 0;
+}
+export function toolEndMediaAsDescriptors(data) {
+    const output = data.output;
+    if (!Array.isArray(output) || !output.some(isMediaBlock))
+        return data;
+    const totalChars = typeof data.totalChars === "number" && Number.isFinite(data.totalChars) ? data.totalChars : output.reduce((n, b) => n + trueSizeOf(b), 0);
+    const stripped = output.map((b) => isMediaBlock(b)
+        ? {
+            type: b.type,
+            ...(typeof b.mimeType === "string" && b.mimeType.length <= MIME_ECHO_MAX ? { mimeType: b.mimeType } : {}),
+            bytes: Math.floor((b.data.length * 3) / 4),
+            truncated: true,
+        }
+        : b);
+    return { ...data, output: stripped, truncated: true, totalChars };
+}
+export const LIVE_MEDIA_BACKLOG_BYTES = 64 * 1024 * 1024;
+export function liveMediaBytesOf(frame) {
+    const output = frame.output;
+    if (!Array.isArray(output))
+        return 0;
+    let n = 0;
+    for (const b of output)
+        if (isMediaBlock(b))
+            n += b.data.length;
+    return n;
+}
+export function liveToolEndForBacklog(frame, backlogBytes) {
+    const media = liveMediaBytesOf(frame);
+    if (media === 0 || backlogBytes + media <= LIVE_MEDIA_BACKLOG_BYTES)
+        return frame;
+    recordFailOpen("server.tool-end-media.live-backlog-degraded", `backlog=${backlogBytes} media=${media}`);
+    return toolEndMediaAsDescriptors(frame);
+}
+//# sourceMappingURL=tool-output-media.js.map

package/dist/trace/wire-projection-faces.d.ts

@@ -74,6 +74,12 @@ export declare const WIRE_PROJECTION_FACES: {
         readonly excluded: readonly [];
         readonly minted: readonly [];
     };
+    readonly task_started: {
+        readonly projector: "taskStartedEventData";
+        readonly coreType: string;
+        readonly excluded: readonly [];
+        readonly minted: readonly [];
+    };
     readonly tool_start: {
         readonly projector: "toolStartEventData";
         readonly coreType: string;
@@ -155,7 +161,7 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly human_input: {
         readonly projector: "humanInputEventData";
         readonly coreType: string;
-        readonly excluded: readonly ["principal"];
+        readonly excluded: readonly ["principal", "attachments"];
         readonly minted: readonly [];
     };
     readonly task_notification: {

package/dist/trace/wire-projection-faces.js

@@ -16,6 +16,7 @@ function withoutSections(all, drop) {
 }
 export const WIRE_PROJECTION_FACES = {
     task_progress: { projector: "taskProgressEventData", coreType: arm("task_progress"), excluded: [], minted: [] },
+    task_started: { projector: "taskStartedEventData", coreType: arm("task_started"), excluded: [], minted: [] },
     tool_start: { projector: "toolStartEventData", coreType: arm("tool_start"), excluded: [], minted: [] },
     tool_end: { projector: "toolEndEventData", coreType: arm("tool_end"), excluded: [], minted: [] },
     tool_progress: { projector: "toolProgressEventData", coreType: arm("tool_progress"), excluded: [], minted: [] },
@@ -29,7 +30,7 @@ export const WIRE_PROJECTION_FACES = {
     context_usage: { projector: "contextUsageEventData", coreType: arm("context_usage"), excluded: [], minted: [] },
     turn_end: { projector: "turnEndEventData", coreType: arm("turn_end"), excluded: [], minted: [] },
     compaction_outcome: { projector: "compactionOutcomeEventData", coreType: arm("compaction_outcome"), excluded: [], minted: [] },
-    human_input: { projector: "humanInputEventData", coreType: arm("human_input"), excluded: ["principal"], minted: [] },
+    human_input: { projector: "humanInputEventData", coreType: arm("human_input"), excluded: ["principal", "attachments"], minted: [] },
     task_notification: {
         projector: "taskNotificationEventData",
         coreType: `TaskNotificationPayload & ${arm("task_notification")}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.126.0",
+  "version": "7.127.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -64,7 +64,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.49.5",
+    "@sema-agent/core": "7.50.2",
     "@sema-agent/settings-schema": "12.2.1",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -80,7 +80,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "21.0.0",
+    "@sema-agent/sdk": "21.1.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",