@sema-agent/server 7.131.0 → 7.133.0

package/dist/observability/prompt-manifest.d.ts

@@ -1,85 +1,35 @@
-/** The whitelisted projection of core's `prompt.assembled` trace event ([ref]② web observability slice A:
- *  the manifest reaches the durable run event log + turns/stream). Built FIELD-BY-FIELD at record time
- *  (never a spread — the 1.72 task_progress lesson: a future core field must not ride the durable wire raw).
- *  Carries ONLY ids/digests/counts by core's manifest contract (no prompt bodies; hashes are core-salted) —
- *  so the projection legs have zero redact burden. */
-export interface PromptManifestRecord {
-    constitution: string;
-    blocks: Array<{
-        id: string;
-        chars: number;
-        hash: string;
-    }>;
-    /** `contentHash`(core 1.315 [ref]①):operator 声明 section 的**非盐化**对账锚(core 已对 text 校验
-     *  后透传)——盐化 `hash` 恒在旁;端到端对账链(center 发布→manifest)经本投影,必须透传不可吞。 */
-    sections?: Array<{
-        id: string;
-        slot: string;
-        carrier: string;
-        cadence: string;
-        cacheClass: string;
-        chars: number;
-        hash: string;
-        contentHash?: string;
-    }>;
-    tools?: Array<{
-        wireName: string;
-        aliases: string[];
-        contractId: string;
-        implementationRevision: string;
-        cardId: string;
-        shapeDigest: string;
-        wireSchemaDigest: string;
-    }>;
-    /** core 5.15.0([ref]):deferred 披露策略自证三键(诊断值,零内容)。缺席=core <5.15 或无 deferred。 */
-    toolDisclosure?: {
-        deferredTools: number;
-        strategy: string;
-        source: string;
-    };
-    totalChars: number;
-}
-/** Whitelist one `prompt.assembled` trace event into a {@link PromptManifestRecord} (v1 face required,
- *  v2 `sections`/`tools` additive — absent stays absent). */
-export declare function promptManifestRecordOf(e: {
-    constitution: string;
-    blocks: Array<{
-        id: string;
-        chars: number;
-        hash: string;
-    }>;
-    sections?: Array<{
-        id: string;
-        slot: string;
-        carrier: string;
-        cadence: string;
-        cacheClass: string;
-        chars: number;
-        hash: string;
-        contentHash?: string;
-    }>;
-    tools?: Array<{
-        wireName: string;
-        aliases: string[];
-        contractId: string;
-        implementationRevision: string;
-        cardId: string;
-        shapeDigest: string;
-        wireSchemaDigest: string;
-    }>;
-    /** core 5.15.0([ref],[ref] 提货②):deferred 工具的披露策略自证——{deferredTools(数), strategy
-     *  ("static"|"swap"), source(四值:`spec` / `env` / `default` / `degraded_no_direct_lane`)}。
-     *  诊断三键(数 + 两闭集词,零内容)。词表属主是 core(`core/trace.d.ts` 的 `source` 联合),本仓宽收
-     *  ⇒ 词错不会红,所以照抄时务必对表:`degraded_no_direct_lane` = 直呼车道联锁把 `static` 请求收窄成
-     *  `swap` 的那一格,正是运维最需要认出来的一格(本注上一版把它写成了不存在的 `api-default`,下游看板
-     *  照抄就会把真实的 degraded 读成未知词)。 */
-    toolDisclosure?: {
-        deferredTools: number;
-        strategy: string;
-        source: string;
-    };
-    totalChars: number;
-}): PromptManifestRecord;
+import type { TraceEvent } from "@sema-agent/core";
+import { WIRE_PROJECTION_FACES } from "../trace/wire-projection-faces.js";
+/**
+ * 引擎的清单帧 `prompt.assembled`(引擎 7.52.0 起 `version: 3`):这条腿的提示**是哪一份**(`identity` + 它的选择器值 `selectors`)、
+ * 由哪些块与段组成、每一段的文本从哪里来(`chain`,被取代的 overlay 另在 `superseded`)。只有 id / 尺寸 / 摘要,没有提示正文。
+ */
+export type PromptAssembledEvent = Extract<TraceEvent, {
+    kind: "prompt.assembled";
+}>;
+/** 帧上**不上行**的键。唯一一簿在 `trace/wire-projection-faces.ts` 的 `prompt_manifest` 行(逐键理由在那里);这里只做类型查询。 */
+type NotOnTheRow = (typeof WIRE_PROJECTION_FACES)["prompt_manifest"]["excluded"][number];
+/** 引擎的型,**词读成开集串**:投影判形,不判词表(档名、激活方式、来源类、渲染器……每一张词表的属主都是引擎,新词原样过境)。 */
+type OpenWords<T> = T extends string ? string : T extends readonly (infer U)[] ? OpenWords<U>[] : T extends object ? {
+    [K in keyof T]: OpenWords<T[K]>;
+} : T;
+/**
+ * 耐久 `prompt_assembled` 行(turns 的 `prompt-assembled` 块与 trace SSE 的同名帧按它原样交出)= **引擎帧减不上行的键**,
+ * 由引擎的型派生,本仓不另写成员表。每个成员都可能缺席:引擎型里可选的成员缺席即缺席;在场却读不出的成员被丢并计数。
+ */
+export type PromptManifestRecord = {
+    [K in Exclude<keyof PromptAssembledEvent, NotOnTheRow>]?: OpenWords<PromptAssembledEvent[K]>;
+};
+/** 投影器的入参:引擎帧的键,值一律当未知读 —— 逐层判形在投影器里做,第三方 producer / 坏世代的帧走同一道门。 */
+export type PromptManifestInput = {
+    readonly [K in keyof PromptAssembledEvent]?: unknown;
+};
+/**
+ * 把一帧 `prompt.assembled` 读成耐久行(记录时白名单:tracer 同步、无 IO,未来的引擎键不随帧上行)。
+ * 规则一句:**只挑登记表声明的键,逐层判形;在场却读不出 ⇒ 计一次 `server.trace.projection-input-malformed` 并丢;缺席从不计数**。
+ * 词原样过境(不判词表);`identity` 是这条腿的提示身份的唯一读法 —— 本仓不另铸第二种(v2 的 `constitution` 随引擎退役)。
+ */
+export declare function promptManifestRecordOf(e: PromptManifestInput): PromptManifestRecord;
 /**
  * [ref]② per-task prompt-manifest accumulator — the `ModelUsageTracker`(budget.ts)pattern: the
  * `prompt.assembled` tracer hook is SYNC/no-IO, so it cannot persist; it RECORDS here (registered
@@ -126,4 +76,5 @@ export declare class PromptManifestTracker {
      *  a stale leg's teardown after a fast re-register is a no-op (the new leg owns it now). */
     clear(taskId: string, lease: number): void;
 }
+export {};
 //# sourceMappingURL=prompt-manifest.d.ts.map

package/dist/observability/prompt-manifest.js

@@ -1,22 +1,127 @@
-export function promptManifestRecordOf(e) {
-    return {
-        constitution: String(e.constitution),
-        blocks: (Array.isArray(e.blocks) ? e.blocks : []).map((b) => ({ id: String(b.id), chars: b.chars, hash: String(b.hash) })),
-        ...(Array.isArray(e.sections)
-            ? { sections: e.sections.map((s) => ({ id: String(s.id), slot: String(s.slot), carrier: String(s.carrier), cadence: String(s.cadence), cacheClass: String(s.cacheClass), chars: s.chars, hash: String(s.hash), ...(typeof s.contentHash === "string" ? { contentHash: s.contentHash } : {}) })) }
-            : {}),
-        ...(Array.isArray(e.tools)
-            ? { tools: e.tools.map((t) => ({ wireName: String(t.wireName), aliases: (Array.isArray(t.aliases) ? t.aliases : []).map(String), contractId: String(t.contractId), implementationRevision: String(t.implementationRevision), cardId: String(t.cardId), shapeDigest: String(t.shapeDigest), wireSchemaDigest: String(t.wireSchemaDigest) })) }
-            : {}),
-        ...(typeof e.toolDisclosure === "object" && e.toolDisclosure !== null &&
-            typeof e.toolDisclosure.deferredTools === "number" && Number.isFinite(e.toolDisclosure.deferredTools) &&
-            typeof e.toolDisclosure.strategy === "string" && e.toolDisclosure.strategy.length > 0 &&
-            typeof e.toolDisclosure.source === "string" && e.toolDisclosure.source.length > 0
-            ? { toolDisclosure: { deferredTools: e.toolDisclosure.deferredTools, strategy: e.toolDisclosure.strategy, source: e.toolDisclosure.source } }
-            : {}),
-        totalChars: e.totalChars,
+import { dropProjectedFace } from "../trace/projection-drop.js";
+import { WIRE_PROJECTION_FACES } from "../trace/wire-projection-faces.js";
+const ABSENT = Symbol("absent");
+const text = (v) => (typeof v === "string" ? v : undefined);
+const finite = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+const flag = (v) => (typeof v === "boolean" ? v : undefined);
+const onlyTrue = (v) => (v === true ? true : undefined);
+const plainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
+function optional(read) {
+    return (v) => (v === undefined ? ABSENT : read(v));
+}
+function objectOf(cells) {
+    return (v) => {
+        const o = plainObject(v);
+        if (o === undefined)
+            return undefined;
+        const out = {};
+        for (const [key, read] of cells) {
+            const r = read(o[key]);
+            if (r === undefined)
+                return undefined;
+            if (r !== ABSENT)
+                out[key] = r;
+        }
+        return out;
+    };
+}
+function listOf(read) {
+    return (v) => {
+        if (!Array.isArray(v))
+            return undefined;
+        const out = [];
+        for (const x of v) {
+            const r = read(x);
+            if (r === undefined)
+                return undefined;
+            out.push(r);
+        }
+        return out;
+    };
+}
+function entriesOf(read) {
+    return (v) => {
+        const o = plainObject(v);
+        if (o === undefined)
+            return undefined;
+        const out = [];
+        for (const [k, x] of Object.entries(o)) {
+            const r = read(x);
+            if (r === undefined)
+                return undefined;
+            out.push([k, r]);
+        }
+        return Object.fromEntries(out);
+    };
+}
+function drop(member, why) {
+    return dropProjectedFace("prompt_assembled." + member + " " + why);
+}
+function rowsOf(member, read) {
+    return (v) => {
+        if (!Array.isArray(v))
+            return undefined;
+        const out = [];
+        for (const x of v) {
+            const r = read(x);
+            if (r === undefined)
+                drop(`${member}[]`, "element does not read as the engine's type");
+            else
+                out.push(r);
+        }
+        return v.length > 0 && out.length === 0 ? ABSENT : out;
     };
 }
+const FACES = WIRE_PROJECTION_FACES;
+function exhausted(shape) {
+    throw new Error("清单行声明里有不认得的值形:" + JSON.stringify(shape));
+}
+function readerOfShape(shape, member, building) {
+    switch (shape.is) {
+        case "text":
+            return text;
+        case "count":
+            return finite;
+        case "flag":
+            return flag;
+        case "true":
+            return onlyTrue;
+        case "object":
+            return objectOf(cellsOfFace(shape.face, building));
+        case "list":
+            return listOf(readerOfShape(shape.of, member, building));
+        case "rows":
+            return rowsOf(member, readerOfShape(shape.of, member, building));
+        case "entries":
+            return entriesOf(readerOfShape(shape.of, member, building));
+        default:
+            return exhausted(shape);
+    }
+}
+function cellsOfFace(face, building) {
+    if (building.includes(face))
+        throw new Error("清单行声明成环:" + [...building, face].join(" → "));
+    const keys = FACES[face]?.keys;
+    if (keys === undefined)
+        throw new Error("清单行声明引用了没有 keys 的面:" + face);
+    return Object.entries(keys).map(([key, declared]) => {
+        const read = readerOfShape(declared, key, [...building, face]);
+        return [key, declared.optional === true ? optional(read) : read];
+    });
+}
+const ROW = cellsOfFace("prompt_manifest", []);
+export function promptManifestRecordOf(e) {
+    const frame = e;
+    const out = {};
+    for (const [member, read] of ROW) {
+        const r = read(frame[member]);
+        if (r === undefined)
+            drop(member, "does not read as the engine's type");
+        else if (r !== ABSENT)
+            out[member] = r;
+    }
+    return out;
+}
 export function configAssembledRecordOf(e) {
     const rec = {
         catalogVersion: e.catalogVersion,

package/dist/observability/run-terminal.js

@@ -206,19 +206,20 @@ function redactStringLeaves(node, depth = 0) {
     }
     return out ?? node;
 }
+const OFF_ARM_MEMBER_TREATMENT = "free-text-tree";
+const redactDetailMember = (v) => redactStringLeaves(v, 1);
 function shapeTerminalFailureDetail(detail) {
     if (detail === null || typeof detail !== "object" || Array.isArray(detail))
         return detail;
     const d = detail;
     const kind = d.kind;
-    const table = typeof kind === "string" && Object.hasOwn(TERMINAL_FAILURE_DETAIL_TREATMENT, kind) ? TERMINAL_FAILURE_DETAIL_TREATMENT[kind] : undefined;
-    if (table === undefined)
-        return redactStringLeaves(d);
+    const arm = typeof kind === "string" && Object.hasOwn(TERMINAL_FAILURE_DETAIL_TREATMENT, kind) ? TERMINAL_FAILURE_DETAIL_TREATMENT[kind] : {};
     let out;
-    for (const [key, treatment] of Object.entries(table)) {
+    for (const key of Object.keys(d)) {
         const v = d[key];
         if (v === undefined)
             continue;
+        const treatment = Object.hasOwn(arm, key) ? arm[key] : OFF_ARM_MEMBER_TREATMENT;
         switch (treatment) {
             case "verbatim":
             case "provider-join-key":
@@ -228,7 +229,7 @@ function shapeTerminalFailureDetail(detail) {
                     delete (out ??= { ...d })[key];
                 break;
             case "free-text-tree": {
-                const nv = redactStringLeaves(v);
+                const nv = redactDetailMember(v);
                 if (nv !== v)
                     (out ??= { ...d })[key] = nv;
                 break;
@@ -251,10 +252,11 @@ function shapeTerminalBlockedDetail(detail) {
         return detail;
     const d = detail;
     let out;
-    for (const [key, treatment] of Object.entries(TERMINAL_BLOCKED_DETAIL_TREATMENT)) {
+    for (const key of Object.keys(d)) {
         const v = d[key];
         if (v === undefined)
             continue;
+        const treatment = Object.hasOwn(TERMINAL_BLOCKED_DETAIL_TREATMENT, key) ? TERMINAL_BLOCKED_DETAIL_TREATMENT[key] : OFF_ARM_MEMBER_TREATMENT;
         switch (treatment) {
             case "verbatim":
                 break;
@@ -265,6 +267,12 @@ function shapeTerminalBlockedDetail(detail) {
                         (out ??= { ...d })[key] = next;
                 }
                 break;
+            case "free-text-tree": {
+                const nv = redactDetailMember(v);
+                if (nv !== v)
+                    (out ??= { ...d })[key] = nv;
+                break;
+            }
             default: {
                 const unhandled = treatment;
                 throw new Error(`unhandled blocked-detail treatment: ${String(unhandled)}`);

package/dist/observability/secret-env-scrub.d.ts

@@ -49,10 +49,22 @@ export interface SecretEnvScrubSiteSpec {
 }
 /** 登记过的剥除现场。闭集:未登记的 site 传不进 {@link recordSecretEnvScrub}(编译期拒,同 FAIL_OPEN_TAGS 纪律)。 */
 export declare const SECRET_ENV_SCRUB_SITES: {
-    readonly "server.remote-env-host.inherit-scrub": {
+    readonly "server.remote-env-host.spawn-env": {
         readonly note: "模型可驱动的 host shell 继承 env(`inheritEnv` 三词任一,缺省 `\"scrub\"`;`\"all\"` 词下扣的只有本服务自己的凭据名)——这条腿上的一次泄漏等于把编排器的脑钥/仓库令牌交给模型选的命令";
         readonly remedy: null;
     };
+    readonly "server.remote-env-local-docker.spawn-env": {
+        readonly note: "local-docker 车道交给宿主 `docker` CLI 的 env(它拉起的凭据助手 / CLI 插件同读)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据交给宿主上的第三方助手";
+        readonly remedy: null;
+    };
+    readonly "server.remote-env-adb.spawn-env": {
+        readonly note: "adb 车道交给宿主 `adb` CLI 的 env(首次调用起的常驻 adb server 继承同一份并一直活着)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据留在一只常驻进程的环境里";
+        readonly remedy: null;
+    };
+    readonly "server.hooks.spawn-env": {
+        readonly note: "settings hooks 的命令腿(请求带来的命令跑在宿主上)的 env —— 严格名单(`PATH` / `HOME` / 终端 / locale 等十二名)经引擎组合,名单外一律不交;请求显式给的 `settings.env` 另叠在上面";
+        readonly remedy: null;
+    };
     readonly "server.project-memory.git-subprocess": {
         readonly note: "project-memory 读仓叙事时的 git 子进程 env —— 仓内的钩子/凭证助手会以本进程身份运行";
         readonly remedy: null;

package/dist/observability/secret-env-scrub.js

@@ -1,10 +1,22 @@
 import { summarizeRedactions } from "@sema-agent/core";
 import { describeAllowlistPostures } from "../env-name-allowlist-knobs.js";
 export const SECRET_ENV_SCRUB_SITES = {
-    "server.remote-env-host.inherit-scrub": {
+    "server.remote-env-host.spawn-env": {
         note: "模型可驱动的 host shell 继承 env(`inheritEnv` 三词任一,缺省 `\"scrub\"`;`\"all\"` 词下扣的只有本服务自己的凭据名)——这条腿上的一次泄漏等于把编排器的脑钥/仓库令牌交给模型选的命令",
         remedy: null,
     },
+    "server.remote-env-local-docker.spawn-env": {
+        note: "local-docker 车道交给宿主 `docker` CLI 的 env(它拉起的凭据助手 / CLI 插件同读)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据交给宿主上的第三方助手",
+        remedy: null,
+    },
+    "server.remote-env-adb.spawn-env": {
+        note: "adb 车道交给宿主 `adb` CLI 的 env(首次调用起的常驻 adb server 继承同一份并一直活着)—— 继承词 `\"all\"`,扣的只有本服务自己的凭据;一次泄漏等于把本服务凭据留在一只常驻进程的环境里",
+        remedy: null,
+    },
+    "server.hooks.spawn-env": {
+        note: "settings hooks 的命令腿(请求带来的命令跑在宿主上)的 env —— 严格名单(`PATH` / `HOME` / 终端 / locale 等十二名)经引擎组合,名单外一律不交;请求显式给的 `settings.env` 另叠在上面",
+        remedy: null,
+    },
     "server.project-memory.git-subprocess": {
         note: "project-memory 读仓叙事时的 git 子进程 env —— 仓内的钩子/凭证助手会以本进程身份运行",
         remedy: null,

package/dist/observability/tool-trace.d.ts

@@ -1,15 +1,18 @@
-import { type Hooks } from "@sema-agent/core";
+import { type EngineDollar, type ModRegistration } from "@sema-agent/core";
 import type { Logger } from "./logger.js";
 import type { Metrics } from "./metrics.js";
+/** 两张部署注册的名字 —— wire 可见(`wiring_manifest.mods[].name`);名字中性、稳定、不含部署信息。 */
+export declare const PERMISSION_DENIED_METER_REGISTRATION = "server.permission-denied-meter";
+export declare const TOOL_TRACE_REGISTRATION = "server.tool-trace";
 /**
  * ALWAYS-ON gate-deny meter (goal B4, 2026-07-08): `permission_denied_total{deniedBy}` — how often the
  * adjudicate chain DENIES a tool call, by the LAYER whose verdict is the deny. Deliberately SEPARATE from
  * {@link createToolTracer}: the tracer is a default-OFF diagnostic (TOOL_TRACE=true), but deny frequency is an
  * operational/security signal that must reach /metrics on every deployment — a spike in `deniedBy="policy"`
  * means a task keeps asking for something the operator forbids; `deniedBy="org"` is the organization layer
- * refusing, the one class an operator most wants to see on its own. main.ts composes this UNDER the tracer via
- * composeHooks (both are void observers on the permissionDenied slot, which composeHooks double-runs
- * deployment-first).
+ * refusing, the one class an operator most wants to see on its own. It is the deployment seat's first registration
+ * (`createDeploymentMods`, `boot/deployment-mods.ts`): an observer on `classic.PermissionDenied`, run before the tracer's observer on the same
+ * event (the engine runs observers by tier, then deployment before task, then each seat's own order).
  *
  * 🔴 BREAKING(server 7.64.0,core 7.6.0 提货):标签名 `source` → `deniedBy`,词表从七词
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
@@ -46,7 +49,7 @@ import type { Metrics } from "./metrics.js";
  *  · **计数总量方向**:新座只在「分类器那一轮没有裁决」时在场(`<block>yes` 的真裁决恒缺席),与旧座的
  *    「分类器停摆」同向;多出来的那一格是 `parse_error`,它也确实是「分类器没正常工作」的一种。
  */
-export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc">): Hooks;
+export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc">): ModRegistration<EngineDollar>;
 /**
  * prove-before-scale stopgap ([ref]): a no-op observer hook that logs every tool call (pre + post)
  * to the worker log — INCLUDING resumed legs that `GET /v1/runs/:id/events` does NOT surface (the
@@ -59,21 +62,13 @@ export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc"
  * the full sequence: a repeated `write_file path=X contentLen=Y` across resumes ⇒ restart-loop;
  * write X → write Y → bash ⇒ iteration.
  *
- * Pure observation: every hook returns `undefined`, so it never rewrites args, never gates, never alters
- * the result (and per core's hooks invariant a hook's `allow` can't bypass the policy gate anyway).
- *
- * 🔴 core 5.20.0 起这条「纯观察」性质必须**声明**出来(`preToolUseObservational`),不能只写在注释里:
- * core 5.19.0 的委派折叠按「PreToolUse 席位在不在」把父的 screening 面折进子代的祖先约束链——它分不出
- * 诊断 tracer 与真裁决者。后果是**这个默认关的诊断旋钮**一开,该部署所有 hook-wired 父的 parked 子代
- * checkpoint 就记 `parentConstraintCount=2`,而跨副本赎回腿(`boot/parked-revive-gate.ts`)恒供 1 ⇒
- * core pre-CAS 响亮拒、行永久 pending(层数 park 时写死,事后关旋钮/重批/回滚都不改)。
- * 声明之后该面不铸链条目,count 回到 1,病路消灭。
- * ⛔ 打这个标的前提是**真的一条裁决都不出**:core 对声明了却返回判词的面是「拒绝采纳 + onError 告警」
- * (classification `observational-hook-verdict-ignored`),即判词被静默丢弃——把标打到会裁决的面上比原
- * 缺陷更坏。本文件三个 pre/post 回调恒返 `undefined`,`permissionDenied` 本就是 void 观察槽。
- * 📎 连带的**可观测**变化(不是回归):core 的「可写工具面无 effect-aware 门」启动告警此前把本 tracer
- * 算作一道门而被抑制;声明之后它不再算,于是「没配任何 policy 层 + 开着 TOOL_TRACE」的部署升级后会
- * 多出那行告警。方向正确——tracer 从来没有门住任何东西,原先的抑制本身就是一次静默 fail-open。
+ * Pure observation: every handler is an observer (`{ observe: true }`, via {@link observeClassic}) — a detached copy of
+ * the event, outside the chain, its answer never adopted — so it never rewrites args, never gates, never alters the result.
+ * Being an observer is also what keeps it out of a delegated child's inherited constraint: the engine mints a screening
+ * entry only from a chain that JUDGES, so turning this diagnostic switch on adds no `parentConstraintCount` to a parked
+ * child of a hook-wired parent (the cross-replica revive leg, `boot/parked-revive-gate.ts`, supplies the caller policy only).
+ * 📎 Not a gate either for the engine's "writable tool face without an effect-aware gate" startup warning: a deployment with
+ * no policy layer and `TOOL_TRACE` on still gets that warning — the tracer never gated anything.
  */
-export declare function createToolTracer(logger: Logger): Hooks;
+export declare function createToolTracer(logger: Logger): ModRegistration<EngineDollar>;
 //# sourceMappingURL=tool-trace.d.ts.map

package/dist/observability/tool-trace.js

@@ -1,85 +1,94 @@
 import { isClassifierDenyCause, isDeniedBy } from "@sema-agent/core";
+import { observeClassic } from "../hooks/classic-stations.js";
 import { redactSecrets } from "../trace/redact.js";
+import { echoCallerText } from "../caller-text-echo.js";
+export const PERMISSION_DENIED_METER_REGISTRATION = "server.permission-denied-meter";
+export const TOOL_TRACE_REGISTRATION = "server.tool-trace";
 function deniedByLabel(gate) {
     const d = gate.disposition;
     return d.kind === "denied" && isDeniedBy(d.deniedBy) ? d.deniedBy : "other";
 }
 export function createPermissionDeniedMeter(metrics) {
     return {
-        permissionDenied(payload) {
-            metrics.inc("permission_denied_total", { deniedBy: deniedByLabel(payload.gate) });
-            const disposition = payload.gate?.disposition;
-            const cause = disposition?.kind === "denied" ? disposition.cause : undefined;
-            if (cause !== undefined) {
-                metrics.inc("auto_mode_classifier_deny_cause_total", { cause: isClassifierDenyCause(cause) ? cause : "other" });
-            }
+        name: PERMISSION_DENIED_METER_REGISTRATION,
+        tier: "prepend",
+        uses: { events: ["classic.PermissionDenied"], calls: [] },
+        register(on) {
+            observeClassic(on, "classic.PermissionDenied", (payload) => {
+                metrics.inc("permission_denied_total", { deniedBy: deniedByLabel(payload.gate) });
+                const disposition = payload.gate?.disposition;
+                const cause = disposition?.kind === "denied" ? disposition.cause : undefined;
+                if (cause !== undefined) {
+                    metrics.inc("auto_mode_classifier_deny_cause_total", { cause: isClassifierDenyCause(cause) ? cause : "other" });
+                }
+            });
         },
     };
 }
 export function createToolTracer(logger) {
     return {
-        preToolUseObservational: true,
-        preToolUse(toolName, input, ctx) {
-            logger.info("tool_trace", { phase: "pre", id: ctx.toolCallId, tool: toolName, arg: summarize(input) });
-            return undefined;
-        },
-        postToolUse(toolName, _input, output, ctx) {
-            logger.info("tool_trace", {
-                phase: "post",
-                id: ctx.toolCallId,
-                tool: toolName,
-                isError: output.isError,
-                out: textOf(output.content),
+        name: TOOL_TRACE_REGISTRATION,
+        tier: "prepend",
+        uses: { events: ["classic.PreToolUse", "classic.PostToolUse", "classic.PostToolUseFailure", "classic.PermissionDenied"], calls: [] },
+        register(on) {
+            observeClassic(on, "classic.PreToolUse", (e) => {
+                logger.info("tool_trace", { phase: "pre", id: e.tool_use_id, tool: e.tool, arg: summarize(e.input) });
             });
-            return undefined;
-        },
-        postToolUseFailure(toolName, _input, failure, ctx) {
-            logger.info("tool_trace", {
-                phase: "post",
-                id: ctx.toolCallId,
-                tool: toolName,
-                isError: true,
-                isInterrupt: failure.isInterrupt,
-                ...(failure.durationMs !== undefined ? { durationMs: failure.durationMs } : {}),
-                out: clip(redactSecrets(failure.error), 200),
+            observeClassic(on, "classic.PostToolUse", (e) => {
+                logger.info("tool_trace", {
+                    phase: "post",
+                    id: e.tool_use_id,
+                    tool: e.tool,
+                    isError: e.output.isError,
+                    out: textOf(e.output.content),
+                });
             });
-            return undefined;
-        },
-        permissionDenied(payload) {
-            logger.info("tool_trace", {
-                phase: "denied",
-                id: payload.toolCallId,
-                tool: payload.toolName,
-                deniedBy: deniedByLabel(payload.gate),
-                ...(payload.gate.origin === undefined ? {} : { origin: payload.gate.origin }),
-                ...(payload.gate.settlement === undefined ? {} : { settlement: payload.gate.settlement.kind }),
-                reason: clip(redactSecrets(payload.reason), 200),
-                arg: summarize(payload.input),
+            observeClassic(on, "classic.PostToolUseFailure", (e) => {
+                logger.info("tool_trace", {
+                    phase: "post",
+                    id: e.tool_use_id,
+                    tool: e.tool,
+                    isError: true,
+                    isInterrupt: e.failure.isInterrupt,
+                    ...(e.failure.durationMs !== undefined ? { durationMs: e.failure.durationMs } : {}),
+                    out: echoCallerText(redactSecrets(e.failure.error), { maxChars: TRACE_OUT_ECHO_CHARS }),
+                });
+            });
+            observeClassic(on, "classic.PermissionDenied", (payload) => {
+                logger.info("tool_trace", {
+                    phase: "denied",
+                    id: payload.toolCallId,
+                    tool: payload.toolName,
+                    deniedBy: deniedByLabel(payload.gate),
+                    ...(payload.gate.origin === undefined ? {} : { origin: payload.gate.origin }),
+                    ...(payload.gate.settlement === undefined ? {} : { settlement: payload.gate.settlement.kind }),
+                    reason: echoCallerText(redactSecrets(payload.reason), { maxChars: TRACE_OUT_ECHO_CHARS }),
+                    arg: summarize(payload.input),
+                });
             });
         },
     };
 }
+const TRACE_ARG_ECHO_CHARS = 120;
+const TRACE_OUT_ECHO_CHARS = 200;
 function summarize(input) {
     if (!input || typeof input !== "object")
-        return { v: clip(String(input), 120) };
+        return { v: echoCallerText(redactSecrets(String(input)), { maxChars: TRACE_ARG_ECHO_CHARS }) };
     const o = input;
     const s = {};
     for (const k of ["path", "file_path", "command", "cmd", "pattern", "glob", "old_string", "new_string"]) {
         if (typeof o[k] === "string")
-            s[k] = clip(redactSecrets(o[k]), 120);
+            s[k] = echoCallerText(redactSecrets(o[k]), { maxChars: TRACE_ARG_ECHO_CHARS });
     }
     if (typeof o.content === "string")
         s.contentLen = o.content.length;
-    return Object.keys(s).length ? s : { keys: Object.keys(o) };
+    return Object.keys(s).length ? s : { keys: Object.keys(o).map((k) => echoCallerText(k, { maxChars: TRACE_ARG_ECHO_CHARS })) };
 }
 function textOf(content) {
     const text = content
         .map((c) => (c && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
         .join("")
         .trim();
-    return clip(redactSecrets(text), 200);
-}
-function clip(s, n) {
-    return s.length > n ? `${s.slice(0, n)}…(${s.length})` : s;
+    return echoCallerText(redactSecrets(text), { maxChars: TRACE_OUT_ECHO_CHARS });
 }
 //# sourceMappingURL=tool-trace.js.map

package/dist/operator-ask.d.ts

@@ -66,6 +66,16 @@ export declare function operatorAsk(rule: string, message: string): OperatorAskR
  * 名单卡要带「本会话放行」,而强制卡上没有。「恒问人」两类盖出身 ⇒ core 读 `operator_forced`、盖 `mandated`,站着的答案在哪一层都退不掉它们。
  */
 export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
+/**
+ * 🔴 **S-1351 —— 请求写下的「恒问人」**(`settings.permissions.neverAuto`):在 {@link operatorAsk} 之上再盖 `requiresRealApproval: true`(core 的治理位 ——
+ * 「只有判断能清它」:空白的 `onAsk: "allow"`、任何站着的答案(持久规则、会话授权)、auto 分类器都清不掉,只有**这一次**的真人应答能答),不盖部署出身。
+ *
+ * 为什么不盖 `authoredBy: "deployment"`:出身位说的是「部署自己的治理层写的」,请求里的声明不是部署写的 —— 盖了就是在审计面冒名。`requiresRealApproval` 是 core 明文开给
+ * 策略自报的位(顶注:自报只会把**自己的** ask 退出自动裁决,方向是收紧、冒报安全),它把这一问推进「只有判断能清」的那一门(`ruleClearanceOf` 的治理门),
+ * 效果与部署的 `APPROVAL_NEVER_AUTO` 同级 —— 每个权限模式词下的仲裁读数逐位相同(`test/tighten-only-seats-assembly.test.ts` 逐词钉住)。
+ * 出处串(`rule` 写 `settings.permissions.neverAuto(<命中的名>)`,不写成 `APPROVAL_NEVER_AUTO(…)`)进 `matchedAskRule`:引擎闸内部消费、不上卡(同部署那一条),审计 / 单测读它区分来源。
+ */
+export declare function requestAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
 /**
  * 🔴 **S-958 —— 治理层的叶策略包装**:`leaf` 产的每一只 ask 盖部署出身(经 {@link withDeploymentAuthorship}),allow / deny 原物交回;
  * 成员(`projection` / `pathRules` / `writeTargetGuard` / `nameSets`)经 core `wrapToolPolicy` 随行(契约「包装至少拒内层所拒」:

package/dist/operator-ask.js

@@ -5,6 +5,9 @@ export function operatorAsk(rule, message) {
 export function operatorAlwaysHumanAsk(rule, message) {
     return withDeploymentAuthorship(operatorAsk(rule, message));
 }
+export function requestAlwaysHumanAsk(rule, message) {
+    return { ...operatorAsk(rule, message), requiresRealApproval: true };
+}
 function withDeploymentAuthorship(ask) {
     return { ...ask, authoredBy: "deployment" };
 }