@sema-agent/server 7.132.0 → 7.134.0

package/dist/tool-rule-names.d.ts

@@ -17,6 +17,12 @@
  * 修前(≤7.107.0)本仓自写的这些臂只比 `req.toolName`:模型按别名调嵌入方工具时,运维名单一个都不拦(core 同族策略判 deny、
  * 本仓判 allow)。本仓自身不声明带别名的工具,所以只有经 `resolveSpec` 席挂别名工具的嵌入方走得到。
  *
+ * ⚠️ **别名只是名字,不是标记的载体**(core 7.54.0 #2105,[ref] 已定案):上面这条读法只回答「这次调用答得上哪些名字」;嵌入方工具自己的
+ * 安全标记(`egress`、不可逆层级 `irreversibility`、可逆探针)**不再**因别名恰是引擎工具名(`MyShell{aliases:["Bash"]}`)而镜像到引擎 shell 上 ——
+ * 7.53.x 及以前,`MyShell` 的 `egress: true` / `irreversibility: "always"` 会让引擎 `Bash` 的调用多问一次(收紧),它的恒可逆探针会让引擎 `Bash` 的
+ * `touch` 不问就跑(放宽);7.54.0 起两者都不再作用于引擎 shell。要收紧引擎 shell:给**正名**叫 `Bash` 的工具声明标记(同名标记仍作用),或请求
+ * `TaskSpec.shellGate: "always"`(本仓的入口 `MANUAL_MODE_SHELL_GATE` / 请求 `shellGate`)。
+ *
  * 返回**命中的那个名字**(调用答得上的名字里第一个被规则够到的,拼写在先)—— 规则归因(`matchedAskRule`)写运维名单里的那个名,
  * 不写一个名单里查不到的 wire 名;够不到 ⇒ `undefined`。判定式(精确集 / covering 规则)由调用方给,本函数只管「读哪些名字」。
  */

package/dist/trace/core-keyset-guard.d.ts

@@ -17,8 +17,9 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
+import type { TableCoreKeys } from "./projection-table.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
  *  `observability/run-terminal.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
@@ -59,7 +60,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory" | "permissionMode";
 type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -132,6 +133,9 @@ type _GuardWiringAutoConsolidationReverse = AssertAllKeysHandled<Exclude<WiringA
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
+type WiringPermissionModeHandled = "requested" | "effective" | "foldedBy";
+type _GuardWiringPermissionMode = AssertAllKeysHandled<Exclude<keyof PermissionModeReceipt, WiringPermissionModeHandled>>;
+type _GuardWiringPermissionModeReverse = AssertAllKeysHandled<Exclude<WiringPermissionModeHandled, keyof PermissionModeReceipt>>;
 type WiringAutoModeHandled = "armed" | "reason" | "deniedSource";
 type _GuardWiringAutoMode = AssertAllKeysHandled<Exclude<keyof WiringSection<"autoMode">, WiringAutoModeHandled>>;
 type _GuardWiringAutoModeReverse = AssertAllKeysHandled<Exclude<WiringAutoModeHandled, keyof WiringSection<"autoMode">>>;
@@ -141,31 +145,84 @@ type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernan
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
 export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed" | "permission.allowed_tools_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
-type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
-type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
+type PermissionTraceRunEvent = "permission.cross_boundary_taint";
+type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped | PermissionTraceRunEvent>>;
+type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped | PermissionTraceRunEvent, PermissionTraceKind>>;
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
 type PromptAssembledFrame = Extract<TraceEvent, {
     kind: "prompt.assembled";
 }>;
-type PromptManifestNotOnRow = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["prompt_manifest"]["excluded"][number];
-type _GuardPromptManifestNotOnRowReverse = AssertAllKeysHandled<Exclude<PromptManifestNotOnRow, keyof PromptAssembledFrame>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
+type ManifestFaces = typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES;
+type ManifestDeclared<F, N extends keyof F> = F[N] extends {
+    readonly keys: infer K;
+} ? keyof K : never;
+type ManifestDeclaredOptional<F, N extends keyof F> = F[N] extends {
+    readonly keys: infer K;
+} ? {
+    [P in keyof K]: K[P] extends {
+        readonly optional: true;
+    } ? P : never;
+}[keyof K] : never;
+type ManifestNotOnRow<F, N extends keyof F> = F[N] extends {
+    readonly excluded: readonly (infer E)[];
+} ? E : never;
+/** 引擎型上带 `?` 的键。 */
+type OptionalKeysOf<T> = {
+    [P in keyof T]-?: {} extends Pick<T, P> ? P : never;
+}[keyof T];
+/**
+ * 一层的正向残余:引擎型有、声明里没有也没登记不上行的键;以及可选性不对的键 —— 非行层:声明为可选的键 ≠ 引擎型上带 `?` 的键;
+ * 行层:声明里每个键都得是可选(行的成员一律可缺席;少写一个 `optional`,解释器会把「引擎没发这个成员」读成读不出并计一次丢弃)。
+ * 全收敛到 `never` 才过。`Row` = 这一层是不是行。
+ */
+type ManifestLevelForward<F, N extends keyof F, Core, Row extends boolean> = Exclude<keyof Core, ManifestDeclared<F, N> | ManifestNotOnRow<F, N>> | (Row extends true ? Exclude<ManifestDeclared<F, N>, ManifestDeclaredOptional<F, N>> : Exclude<OptionalKeysOf<Core>, ManifestDeclaredOptional<F, N>> | Exclude<ManifestDeclaredOptional<F, N>, OptionalKeysOf<Core>>);
+/** 一层的反向残余:声明过或登记为不上行、而引擎型里已经没有的键(引擎退役它而簿里留着残条目)。 */
+type ManifestLevelReverse<F, N extends keyof F, Core> = Exclude<ManifestDeclared<F, N> | ManifestNotOnRow<F, N>, keyof Core>;
+/** 十二层的引擎型(层名 = 登记表里的面名)。 */
+type ManifestCore = {
+    prompt_manifest: PromptAssembledFrame;
+    prompt_manifest_identity: PromptManifestIdentity;
+    prompt_manifest_identity_layers: PromptIdentityLayers;
+    prompt_manifest_selectors: PromptManifestSelectors;
+    prompt_manifest_selectors_host: PromptManifestSelectors["host"];
+    prompt_manifest_block: PromptAssembledFrame["blocks"][number];
+    prompt_manifest_section: PromptManifestSection;
+    prompt_manifest_section_renderer: NonNullable<PromptManifestSection["renderer"]>;
+    prompt_manifest_chain_link: PromptChainLink;
+    prompt_manifest_superseded: SupersededOverlay;
+    prompt_manifest_tool: NonNullable<PromptAssembledFrame["tools"]>[number];
+    prompt_manifest_tool_disclosure: ToolDisclosureManifest;
+};
+/** 残余非空的层,按 `<层>.<残余键>` 点名(tsc 的报错里直接看见是哪一层的哪一个键)。 */
+/** 十二层的残余汇总:每层的正向残余(见 {@link ManifestLevelForward})按 `<层>.<残余键>` 点名;`F` = 登记表的形。全收敛到 `never` 才过。 */
+type ManifestForwardResidue<F extends Record<keyof ManifestCore, unknown>> = {
+    [L in keyof ManifestCore]: [ManifestLevelForward<F, L, ManifestCore[L], L extends "prompt_manifest" ? true : false>] extends [never] ? never : `${L}.${ManifestLevelForward<F, L, ManifestCore[L], L extends "prompt_manifest" ? true : false> & string}`;
+}[keyof ManifestCore];
+type _GuardPromptManifestKeys = AssertAllKeysHandled<ManifestForwardResidue<ManifestFaces>>;
+type _GuardPromptManifestKeysReverse = AssertAllKeysHandled<{
+    [L in keyof ManifestCore]: [ManifestLevelReverse<ManifestFaces, L, ManifestCore[L]>] extends [never] ? never : `${L}.${ManifestLevelReverse<ManifestFaces, L, ManifestCore[L]> & string}`;
+}[keyof ManifestCore]>;
+/** 非空 —— 十二层的声明都在(层名拼错 / 声明被整行删掉 ⇒ `ManifestDeclared` 坍成 `never`,上面的反向钉恒绿,这一条补上)。 */
+type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
+    [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
+}[keyof ManifestCore]>;
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "targets" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "promptForm";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -210,16 +267,25 @@ type _GuardSettlementReverse = AssertAllKeysHandled<Exclude<SettlementProjected,
 type SettlementWhoProjected = "party" | "approver" | "window";
 type _GuardSettlementWho = AssertAllKeysHandled<Exclude<SettlementWhoKeys, SettlementWhoProjected>>;
 type _GuardSettlementWhoReverse = AssertAllKeysHandled<Exclude<SettlementWhoProjected, SettlementWhoKeys>>;
-type WorkflowRunForwarded = "id" | "scope" | "status" | "startedAt" | "endedAt" | "createdAt" | "rev" | "parks" | "name" | "description" | "result" | "error" | "errorCode" | "agentFailures" | "stats" | "phases" | "agents" | "groups" | "resumeAdmissionIncomplete";
-type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveArgs" | "budgetOvershoot" | "timeoutInterruption" | "resultFull" | "completionId" | "resume" | "journalSkips";
-type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
-type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
-type ParkRowKeys = keyof NonNullable<WorkflowRun["parks"]>[number];
-type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed" | "parkedBy" | "generation";
-type ParkRowWithheld = "token";
-type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
-type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;
-type _GuardParkRowReverse = AssertAllKeysHandled<Exclude<ParkRowProjected | ParkRowWithheld, ParkRowKeys>>;
+type WorkflowTables = typeof import("../http/routes/workflows.js");
+type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, TableCoreKeys<WorkflowTables["WORKFLOW_RUN_DISPOSITIONS"]>>>;
+type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_DISPOSITIONS"]>, keyof WorkflowRun>>;
+type _GuardWorkflowParkRow = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["parks"]>[number], TableCoreKeys<WorkflowTables["WORKFLOW_PARK_ROW_DISPOSITIONS"]>>>;
+type _GuardWorkflowParkRowReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_PARK_ROW_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["parks"]>[number]>>;
+type _GuardWorkflowPhase = AssertAllKeysHandled<Exclude<keyof WorkflowRun["phases"][number], TableCoreKeys<WorkflowTables["WORKFLOW_PHASE_DISPOSITIONS"]>>>;
+type _GuardWorkflowPhaseReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_PHASE_DISPOSITIONS"]>, keyof WorkflowRun["phases"][number]>>;
+type _GuardWorkflowAgent = AssertAllKeysHandled<Exclude<keyof WorkflowRun["agents"][number], TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_DISPOSITIONS"]>>>;
+type _GuardWorkflowAgentReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_DISPOSITIONS"]>, keyof WorkflowRun["agents"][number]>>;
+type _GuardWorkflowAgentActivity = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["agents"][number]["activity"]>[number], TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_ACTIVITY_DISPOSITIONS"]>>>;
+type _GuardWorkflowAgentActivityReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_ACTIVITY_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["agents"][number]["activity"]>[number]>>;
+type _GuardWorkflowAgentPendingApproval = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["agents"][number]["pendingApproval"]>, TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_PENDING_APPROVAL_DISPOSITIONS"]>>>;
+type _GuardWorkflowAgentPendingApprovalReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_AGENT_PENDING_APPROVAL_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["agents"][number]["pendingApproval"]>>>;
+type _GuardWorkflowGroup = AssertAllKeysHandled<Exclude<keyof WorkflowRun["groups"][number], TableCoreKeys<WorkflowTables["WORKFLOW_GROUP_DISPOSITIONS"]>>>;
+type _GuardWorkflowGroupReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_GROUP_DISPOSITIONS"]>, keyof WorkflowRun["groups"][number]>>;
+type _GuardWorkflowRunStats = AssertAllKeysHandled<Exclude<keyof WorkflowRun["stats"], TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_DISPOSITIONS"]>>>;
+type _GuardWorkflowRunStatsReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_DISPOSITIONS"]>, keyof WorkflowRun["stats"]>>;
+type _GuardWorkflowRunStatsNested = AssertAllKeysHandled<Exclude<keyof WorkflowRun["stats"]["nested"], TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>>>;
+type _GuardWorkflowRunStatsNestedReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>, keyof WorkflowRun["stats"]["nested"]>>;
 type ReadRootCandidateProjected = "dir" | "clearsThisAsk" | "covers";
 type _GuardReadRootCandidate = AssertAllKeysHandled<Exclude<keyof ReadRootGrantCandidate, ReadRootCandidateProjected>>;
 type _GuardReadRootCandidateReverse = AssertAllKeysHandled<Exclude<ReadRootCandidateProjected, keyof ReadRootGrantCandidate>>;
@@ -321,11 +387,15 @@ export type CoreKeysetGuards = [
     _GuardWiringModelGateReverse,
     _GuardWiringAutoMode,
     _GuardWiringAutoModeReverse,
+    _GuardWiringPermissionMode,
+    _GuardWiringPermissionModeReverse,
     _GuardWiringGovernance,
     _GuardWiringGovernanceReverse,
     _GuardPermissionTrace,
     _GuardPermissionTraceReverse,
-    _GuardPromptManifestNotOnRowReverse,
+    _GuardPromptManifestKeys,
+    _GuardPromptManifestKeysReverse,
+    _GuardPromptManifestKeysNonEmpty,
     _GuardPermissionTraceNonEmpty,
     _GuardInboxSummary,
     _GuardInboxSummaryReverse,
@@ -352,9 +422,22 @@ export type CoreKeysetGuards = [
     _GuardSettlementWhoReverse,
     _GuardWorkflowRun,
     _GuardWorkflowRunReverse,
-    _GuardParkRow,
-    _NoDoubleBookParkRow,
-    _GuardParkRowReverse,
+    _GuardWorkflowParkRow,
+    _GuardWorkflowParkRowReverse,
+    _GuardWorkflowPhase,
+    _GuardWorkflowPhaseReverse,
+    _GuardWorkflowAgent,
+    _GuardWorkflowAgentReverse,
+    _GuardWorkflowAgentActivity,
+    _GuardWorkflowAgentActivityReverse,
+    _GuardWorkflowAgentPendingApproval,
+    _GuardWorkflowAgentPendingApprovalReverse,
+    _GuardWorkflowGroup,
+    _GuardWorkflowGroupReverse,
+    _GuardWorkflowRunStats,
+    _GuardWorkflowRunStatsReverse,
+    _GuardWorkflowRunStatsNested,
+    _GuardWorkflowRunStatsNestedReverse,
     _GuardReadRootCandidate,
     _GuardReadRootCandidateReverse,
     _GuardRiskAxes,

package/dist/trace/exit-seat.d.ts

@@ -0,0 +1,40 @@
+/** 品牌键:模块私有的 `unique symbol` —— 别处写不出这个键,于是写不出一个 `SafeText` 字面量;断言伪造由普查门在语法树上拦。 */
+declare const SAFE_TEXT: unique symbol;
+/** 经出口座的文本。是 `string` 的子型:读者零改;写进出口位只能用 {@link seatText} 铸的值。 */
+export type SafeText = string & {
+    readonly [SAFE_TEXT]: true;
+};
+/**
+ * **座表(闭集;一行 = 一类出口)**。加一类出口 = 加一行;表外的座名是编译错误。
+ *  · `trace-frame-text`:trace 帧的自由文本位(子代名 / 动作行 / 通告正文与结果 / 诊断 / 注入摘录 / 压缩说明 / 人类输入的署名与附件标签 …),不设界;
+ *  · `trace-frame-line`:trace 帧里一行宽的展示位(`workspace_changed.cwd` / `brain_status.detail`),界 300 码元;
+ *  · `operator-log-text`:运维日志字段里的一句话 —— 读口坏行的缺陷句(core 的筛按位置点名并回显落盘标量)、`tool_trace` 行里工具的输出 / 失败句 / 拒因;日志字段行,界 200 码元(含截断记号);
+ *  · `operator-log-arg`:运维日志字段里模型写的工具入参(`tool_trace` 的 `arg.*`:路径 / 命令 / 模式 / 非对象入参的串形);日志字段行,界 120 码元(含截断记号)。
+ */
+declare const EXIT_SEATS: {
+    readonly "trace-frame-text": {
+        readonly scope: "free-text";
+    };
+    readonly "trace-frame-line": {
+        readonly scope: "free-text";
+        readonly maxChars: 300;
+    };
+    readonly "operator-log-text": {
+        readonly scope: "free-text";
+        readonly maxChars: 200;
+        readonly logField: true;
+    };
+    readonly "operator-log-arg": {
+        readonly scope: "free-text";
+        readonly maxChars: 120;
+        readonly logField: true;
+    };
+};
+export type ExitSeat = keyof typeof EXIT_SEATS;
+/**
+ * 出口座:`seat` 是座表的一行,`text` 是要出门的自由文本。返回的 {@link SafeText} 就是这个出口该写出去的字节。
+ * 表外的座名(只有绕过类型才到得了)⇒ 抛 —— 那是调用方的编程错,不是脱敏失败,不吞成占位。
+ */
+export declare function seatText(seat: ExitSeat, text: string): SafeText;
+export {};
+//# sourceMappingURL=exit-seat.d.ts.map

package/dist/trace/exit-seat.js

@@ -0,0 +1,130 @@
+import { CONTROL_AND_BIDI_CHARS, stripControlAndBidi } from "@sema-agent/settings-schema";
+import { CALLER_TEXT_CUT_MARK } from "../caller-text-echo.js";
+import { errorKindOf } from "../observability/err-text.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
+import { proposeRedactionSpans, REDACTION_TOKEN_RE_SRC } from "./redact.js";
+const EXIT_SEATS = {
+    "trace-frame-text": { scope: "free-text" },
+    "trace-frame-line": { scope: "free-text", maxChars: 300 },
+    "operator-log-text": { scope: "free-text", maxChars: 200, logField: true },
+    "operator-log-arg": { scope: "free-text", maxChars: 120, logField: true },
+};
+const SEAT_ROWS = new Map(Object.entries(EXIT_SEATS));
+for (const [name, row] of SEAT_ROWS) {
+    if (row.maxChars !== undefined && row.maxChars < OVERSIZED_REDACTION_PLACEHOLDER.length) {
+        throw new Error(`exit seat "${name}": maxChars ${row.maxChars} cannot hold the failure placeholder (${OVERSIZED_REDACTION_PLACEHOLDER.length} code units)`);
+    }
+    if (row.logField === true && row.maxChars === undefined) {
+        throw new Error(`exit seat "${name}": a log-field row must declare maxChars (the cut mark counts inside the bound)`);
+    }
+}
+function mergeSpans(spans) {
+    const order = spans.map((s, i) => ({ s, i })).sort((a, b) => a.s.start - b.s.start || b.s.end - a.s.end || a.i - b.i);
+    const out = [];
+    for (const { s } of order) {
+        const last = out[out.length - 1];
+        if (last === undefined || s.start > last.end)
+            out.push(s);
+        else if (s.end > last.end)
+            out[out.length - 1] = { start: last.start, end: s.end, repl: last.repl };
+    }
+    return out;
+}
+const TOKEN_AT = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+function cutPlain(gap, room) {
+    let cut = room;
+    const hi = gap.charCodeAt(cut - 1);
+    if (cut > 0 && hi >= 0xd800 && hi <= 0xdbff && (gap.charCodeAt(cut) & 0xfc00) === 0xdc00)
+        cut -= 1;
+    const open = cut > 0 ? gap.lastIndexOf("«", cut - 1) : -1;
+    if (open !== -1) {
+        TOKEN_AT.lastIndex = open;
+        const m = TOKEN_AT.exec(gap);
+        if (m !== null && open + m[0].length > cut)
+            cut = open;
+    }
+    return gap.slice(0, cut);
+}
+function renderOnce(text, groups, maxChars) {
+    const parts = [];
+    let len = 0;
+    let at = 0;
+    for (const g of groups) {
+        const gap = text.slice(at, g.start);
+        if (maxChars !== undefined && len + gap.length > maxChars)
+            return parts.join("") + cutPlain(gap, maxChars - len);
+        parts.push(gap);
+        len += gap.length;
+        if (maxChars !== undefined && len + g.repl.length > maxChars)
+            return parts.join("");
+        parts.push(g.repl);
+        len += g.repl.length;
+        at = g.end;
+    }
+    const tail = text.slice(at);
+    parts.push(maxChars === undefined || len + tail.length <= maxChars ? tail : cutPlain(tail, maxChars - len));
+    return parts.join("");
+}
+const STRIPPED_UNIT = (() => {
+    const inSet = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
+    const table = new Uint8Array(0x10000);
+    for (let unit = 0; unit < table.length; unit++)
+        if (inSet.test(String.fromCharCode(unit)))
+            table[unit] = 1;
+    return table;
+})();
+function mapSpansIntoStripped(text, spans) {
+    const marks = [...new Set(spans.flatMap((sp) => [sp.start, sp.end]))].sort((a, b) => a - b);
+    const strippedBefore = new Map();
+    let removed = 0;
+    let at = 0;
+    for (const mark of marks) {
+        for (; at < mark; at++)
+            if (STRIPPED_UNIT[text.charCodeAt(at)] === 1)
+                removed += 1;
+        strippedBefore.set(mark, mark - removed);
+    }
+    const mapped = [];
+    for (const sp of spans) {
+        const start = strippedBefore.get(sp.start);
+        const end = strippedBefore.get(sp.end);
+        if (end > start)
+            mapped.push({ start, end, repl: sp.repl });
+    }
+    return mapped;
+}
+function proposeLogFieldSpans(text, scope) {
+    const read = stripControlAndBidi(text);
+    if (read === text)
+        return { read, spans: proposeRedactionSpans(text, scope) };
+    if (read.length === 0)
+        return { read, spans: [] };
+    const original = proposeRedactionSpans(text, scope);
+    const stripped = proposeRedactionSpans(read, scope, { countHits: original.length === 0 });
+    return { read, spans: [...stripped, ...mapSpansIntoStripped(text, original)] };
+}
+function renderRow(text, groups, row) {
+    if (row.logField !== true || row.maxChars === undefined)
+        return renderOnce(text, groups, row.maxChars);
+    const whole = renderOnce(text, groups, undefined);
+    if (whole.length <= row.maxChars)
+        return whole;
+    return renderOnce(text, groups, row.maxChars - CALLER_TEXT_CUT_MARK.length) + CALLER_TEXT_CUT_MARK;
+}
+export function seatText(seat, text) {
+    const row = SEAT_ROWS.get(seat);
+    if (row === undefined)
+        throw new Error(`exit seat: ${JSON.stringify(seat)} is not a row of the seat table`);
+    let out;
+    try {
+        const { read, spans } = row.logField === true ? proposeLogFieldSpans(text, row.scope) : { read: text, spans: proposeRedactionSpans(text, row.scope) };
+        out = renderRow(read, mergeSpans(spans), row);
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `seat=${seat} len=${typeof text === "string" ? text.length : -1} err=${errorKindOf(err)}`);
+        out = OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+    return out;
+}
+//# sourceMappingURL=exit-seat.js.map

package/dist/trace/ledger-events.d.ts

@@ -52,11 +52,14 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  | "task_started" | "task_progress" | "task_notification" | "turn_end"
 /** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
  *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
- | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"
+ | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled"
+/** core 7.54.0 [ref] O9b S1:`permission.cross_boundary_taint` 帧的耐久行(伴随记录,与 `config_assembled` 同一只队列、同一批 drain 点;只在执行于目标设备的树上有)。 */
+ | "cross_boundary_taint" | "file_link"
 /** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
-/** [ref] §4.3 新协议的呈卡帧(与上面两只 tool_approval 帧同一条投递面)。 */
- | "approval_request"
+/** [ref] §4.3 呈卡族的开卡帧与单卡消卡帧(与上面两只 tool_approval 帧同一条投递面;一条腿只发其中一族,
+ *  bg / resume 两条 durable 腿恒是呈卡腿 ⇒ 它们的账本自 7.133.0 起只有本族)。 */
+ | "approval_request" | "approval_complete"
 /**
  * [ref]([ref]):批级撤卡帧在 **bg/resume 两条 durable 腿**的账本落行(与呈卡帧同口
  * `append(type, rest)`,seq 由腿自己的 ledger 链步分配)。此前成文「reaper/收敛器无 seq 可分配故