@sema-agent/server 7.132.0 → 7.134.0

package/dist/trace/project.d.ts

@@ -26,6 +26,8 @@
 import type { GateOutcome, McpDelivered, TaskResult, SystemInjectionPriority } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
+import type { RunCompanionRecord } from "../observability/prompt-manifest.js";
+import { type SafeText } from "./exit-seat.js";
 import { type SemaProvenanceInput } from "./sema-provenance.js";
 import type { LedgerEventType } from "./ledger-events.js";
 import type { InstructionsSegment } from "../instruction-selection.js";
@@ -50,7 +52,7 @@ export declare function appendModelUsageDelta(append: AppendFn, modelUsage: Mode
  *  (one Map.get), so callers fire it liberally. */
 export declare function appendPromptManifest(append: AppendFn, tracker: {
     drain(taskId: string): PromptManifestRecord[] | undefined;
-    drainConfig?(taskId: string): Array<Record<string, unknown>> | undefined;
+    drainCompanions?(taskId: string): RunCompanionRecord[] | undefined;
 } | undefined, taskId: string): Promise<void>;
 /** E8: at a TERMINAL done — flush the final delta, then SUM all `model_usage` events (every process leg) into the
  *  result's `stats.modelUsage` echo. Returns the result unchanged when no usage was tracked (shell soft-degrades). */
@@ -81,6 +83,13 @@ export declare function attachModelUsage<T extends TaskResult>(result: T, ctx: {
  *   · **键在场但值坏**(NaN / 字符串 / null)= 数据损坏,写了键的 producer 是在声称自己知道 ⇒ 维持既有
  *     折叠(按 0 计,不传染,已知量不受损),否则一条陈年坏行就能把整个模型的成本抹成"未知"。
  *  下游补偿件早已就位:usage-analytics 的 numOf + `estimated` 标记(缺数值键 ⇒ 总量偏低并诚实标注)。 */
+/** **trace 帧数据的出口形**(RH-1 第一期):`Slots` 里列出的自由文本位只收 {@link SafeText}(出口座铸的),其余键照旧开放 ——
+ *  裸 `string` 写进这些位是 tsc 红;整只帧数据**只读**(交出去之后按键改写 —— 含动态键 `frame[k] = raw` —— 也是 tsc 红)。
+ *  对既有的 `Record<string, unknown>` 读者可赋值(零调用点改动)。类型层管不到的两形如实记:`any` 值、以及把一只 `Record<string, unknown>`
+ *  展开进字面量 / `Object.assign` 事后改写(TypeScript 不拿索引签名去对可选位、也不查 `Object.assign` 的目标)—— 品牌推到汇(SSE 写口 / 账本 append)是第三期。 */
+type FrameData<Slots extends object> = Readonly<Slots> & {
+    readonly [key: string]: unknown;
+};
 export declare function aggregateModelUsage(events: RunEvent[]): Record<string, ModelUsageDelta> | undefined;
 export type TraceBlock = {
     type: "thinking";
@@ -373,7 +382,11 @@ export declare function taskProgressEventData(ev: {
     workflowAgentLabel?: string;
     seq?: number;
     model?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    name?: SafeText;
+    currentAction?: SafeText;
+    workflowAgentLabel?: SafeText;
+}>;
 /**
  * The `task_started` payload(core 7.50.0):一只委派子代**起跑**的那一帧 —— 每周期一只(首派 / 复活;耐久续跑腿不铸),
  * 序在子代的 `wiring_manifest` 之后、它的首个 `task_progress` 与首次模型请求之前。
@@ -414,7 +427,10 @@ export declare function taskStartedEventData(ev: {
     startedAt: number;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    name?: SafeText;
+    workflowAgentLabel?: SafeText;
+}>;
 /** The `task_notification` payload (core 1.202 [ref] P2: a background task finished — this event is the
  *  LEDGER/display projection of the OBSERVED terminal state, emitted the moment core observes it. It does NOT
  *  attest that the `<task-notification>` XML has entered the model context: core's steer targets the NEXT TURN
@@ -492,7 +508,28 @@ export declare function taskNotificationEventData(ev: {
      *  **事件顶层**键,不是 {@link TaskNotificationPayload} 的键,所以只有把整只 core 事件交给本投影的腿
      *  拿得到它;只拿到载荷的 park-drain 腿结构上没有这一位。 */
     priority?: SystemInjectionPriority;
-}): Record<string, unknown>;
+}): FrameData<{
+    summary: SafeText;
+    result?: SafeText;
+    output_file?: SafeText;
+    source?: SafeText;
+    diagnostics?: SafeText;
+    error?: SafeText;
+    lines?: SafeText[];
+    recentSteps?: Array<{
+        tool: string;
+        target: SafeText;
+        outcome: SafeText;
+    }>;
+    editedFiles?: Array<{
+        path: SafeText;
+        edits: number;
+    }>;
+    agentMessage?: {
+        from: string;
+        body: SafeText;
+    };
+}>;
 /** The `compacted` payload — EXPLICIT WHITELIST shared by all three legs (bg runs.ts + resume append + the sync
  *  live SSE frame; the 1.72 task_progress lesson: never `{...ev}`). trigger/tokensBefore (MF-18) verbatim;
  *  `preserved_segment.firstKeptEntryId` verbatim (a core-mint entryId, the shell's compaction-divider anchor);
@@ -519,7 +556,16 @@ export declare function diagnosticsEventData(ev: {
     isNew: boolean;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    files: Array<{
+        uri: SafeText;
+        diagnostics: Array<FrameData<{
+            message: SafeText;
+            code?: SafeText | number;
+            source?: SafeText;
+        }>>;
+    }>;
+}>;
 /** The `steering_injected` payload([ref]/[ref] 裁定透传;core `TaskEvent` 联合臂 `type: "steering_injected"`,
  *  shell 渲染源 = CC 的系统提醒条:core 在 turn 之间给模型注入一条系统提示[todo 提醒/文件变化/日期跨天/
  *  技能列表变化…]时随手抛的展示投影,一附件一帧)。EXPLICIT WHITELIST(source=封闭枚举 verbatim;
@@ -530,7 +576,9 @@ export declare function steeringInjectedEventData(ev: {
     preview: string;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    preview: SafeText;
+}>;
 /** `compaction_outcome`(core 2.5.0 [ref]②:压缩非 compacted 结局——manual /compact 的 mooted/failed
  *  两条真路)。[ref]A-2/C-2:此前它是**唯一**不走共享 builder、只在 live 腿 res.write 内联挑键的
  *  内容帧 ⇒ 两条 durable 腿零 case、回放即消失、三方普查各自失明。收进共享白名单 builder,三腿同源。
@@ -542,7 +590,9 @@ export declare function compactionOutcomeEventData(ev: {
     pass?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
-}): Record<string, unknown>;
+}): FrameData<{
+    reason?: SafeText;
+}>;
 /**
  * `compaction_started`(S-1732,core 7.53.0 #2008)—— 一次压缩 pass 在提交点(触发闸过了、切点在、`preCompact` 没拦)宣告开始,先于摘要调用:
  * 一次在供应方重试表里等很久的摘要(core 实测 503 × 11、173 s)从此在流上不是静默的。**原样投影**:`{ trigger, pass, startedAt }` + 身份两键,
@@ -567,7 +617,9 @@ export declare function workspaceChangedEventData(ev: {
     cwd: string;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    cwd: SafeText;
+}>;
 /**
  * `wiring_manifest`(core 5.14.0 [ref] 新 `TaskEvent` 臂)—— 每条腿(root/child/resume)在 prepare
  * 时自证「我到底接了什么线」的清单帧。
@@ -802,8 +854,8 @@ export declare function wiringManifestEventData(ev: {
  * 代价是 operator 看不到历史腿的 governance 段 —— 治理四布尔是部署形事实(不随 leg 漂),静态自检面
  * (`GET /v1/diagnostics/wiring`)随时给出当前真值。
  *
- * 准入判据是 `explicitOperatorOk`(**不是** `isOperator`):空 `OPERATOR_PRINCIPALS` 必须是「没有人是
- * operator」,不能是「所有人都是」—— 后者会让一个没配 operator 名单的部署把治理面发给每一个订阅者。
+ * 准入判据是 `explicitOperatorOk`(「谁是 operator」的唯一读法):空 `OPERATOR_PRINCIPALS` 是「没有人是 operator」,不是「所有人都是」——
+ * 后者会让一个没配 operator 名单的部署把治理面发给每一个订阅者。单用户形显式声明 `OPERATOR_SINGLE_USER=true` 时它的每个调用方都是。
  *
  * `configFingerprint` 只在本构造器里透传:它是 `sha256(canonicalize(manifest 去 leg/去两个 provenance))`
  * 前 16 hex,**无盐**且输入含整个 governance 段,而 governance 只有 4 个布尔 ⇒ 16 种组合。租户手里已有其余
@@ -885,7 +937,16 @@ export declare function humanInputEventData(ev: {
     attachments?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
-}): Record<string, unknown>;
+}): FrameData<{
+    issuer?: SafeText;
+    actor?: FrameData<{
+        id?: SafeText;
+        issuer?: SafeText;
+    }>;
+    attachments?: Array<FrameData<{
+        label?: SafeText;
+    }>>;
+}>;
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
  *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open, and
@@ -907,7 +968,9 @@ export declare function brainStatusEventData(ev: {
     providerConditionSource?: string;
     eventId?: string;
     parentToolCallId?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    detail?: SafeText;
+}>;
 export declare function compactedEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
@@ -945,7 +1008,13 @@ export declare function compactedEventData(ev: {
     };
     /** S-1732(core 7.53.0 #2008):这次落地的压缩 pass 的 id —— 与它的 `compaction_started` 帧同一个值(引擎在每次落地上都设;型上可选)。逐字。 */
     pass?: string;
-}): Record<string, unknown>;
+}): FrameData<{
+    attachedFiles?: Array<{
+        path: SafeText;
+        chars: number;
+        truncated: boolean;
+    }>;
+}>;
 export interface TraceTurn {
     /** per-task seq = the turn's terminating event seq (so history-up-to-H splices with stream seq>H). */
     seq: number;
@@ -1015,6 +1084,22 @@ export declare function contextUsageEventData(ev: {
  * 与结果面的孪生 `TaskResult.responseModel` 同一只闸 —— 同一个名字在两张脸上不许两种待遇。非串 / 空串同样不铸键(空串在
  * 那条谓词的长度下界之外;core 的读律 `providerReportedModel` 对空串也答「没报」)。
  */
+/**
+ * 🔴 core 7.54.0 [ref] O9b S1 —— 设备车道发射闸的 `permission.cross_boundary_taint` 帧 → 耐久行 `cross_boundary_taint`(`GET /v1/runs/:id/events` 账本回放同名交出;
+ * trace SSE `GET /v1/tasks/:id/stream` 上是 `cross-boundary-taint` 帧,按存下的行原样交出)。帧只在**执行于目标设备的树**上发(武装腿 prepare / 续跑腿 resume 各一帧,离目标读第一次放进树时 observed 一帧),
+ * 宿主车道零帧 ⇒ 本行在宿主车道上永不出现。纯元数据(core 逐字「Metadata only」):树的污染位(`taint`,core `CROSS_BOUNDARY_TAINT_BITS` 的子集)、
+ * 树是否受治理(`governed`)、阶段(`phase`)、腿的 `runId`,observed 时那一只调用(`toolName` / `toolCallId`)。
+ * 信封(`kind` / `version` / `taskId` / `ts`)不上行:行自带 seq / ts,run 就是 taskId(与清单行同一条律;登记表 `cross_boundary_taint` 行)。
+ * 值:`taint` 交一份数组副本(只收串);`toolName` / `toolCallId` 在场才铸。词按开集串过境(属主是引擎的闭集;本仓不判词表)。
+ */
+export declare function crossBoundaryTaintEventData(ev: {
+    runId?: unknown;
+    phase?: unknown;
+    taint?: unknown;
+    governed?: unknown;
+    toolName?: unknown;
+    toolCallId?: unknown;
+}): Record<string, unknown>;
 export declare function turnEndEventData(ev: {
     usage?: unknown;
     usageMissing?: true;

package/dist/trace/project.js

@@ -3,6 +3,7 @@ import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROL
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
+import { seatText } from "./exit-seat.js";
 import { sanitizeWireText } from "./engine-notice-wire.js";
 import { projectToolOutput, projectToolStructured } from "./tool-output-media.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
@@ -23,10 +24,10 @@ export async function appendPromptManifest(append, tracker, taskId) {
     if (records)
         for (const m of records)
             await append("prompt_assembled", m);
-    const cfgs = tracker?.drainConfig?.(taskId);
-    if (cfgs)
-        for (const cfg of cfgs)
-            await append("config_assembled", cfg);
+    const companions = tracker?.drainCompanions?.(taskId);
+    if (companions)
+        for (const c of companions)
+            await append(c.type, c.data);
 }
 export async function attachModelUsage(result, ctx) {
     if (!ctx.modelUsage)
@@ -270,14 +271,14 @@ export function taskProgressEventData(ev) {
         ...(typeof ev.seq === "number" ? { seq: ev.seq } : {}),
         ...(typeof ev.taskType === "string" && ev.taskType.length > 0 ? { taskType: ev.taskType } : {}),
         ...(ev.parentTaskId ? { parentTaskId: ev.parentTaskId } : {}),
-        ...(ev.name ? { name: redactSecrets(ev.name) } : {}),
+        ...(ev.name ? { name: seatText("trace-frame-text", ev.name) } : {}),
         ...(ev.spawnName ? { spawnName: ev.spawnName } : {}),
         ...(typeof ev.model === "string" && ev.model.length > 0 ? { model: ev.model } : {}),
         ...(ev.status !== undefined ? { status: ev.status } : {}),
         ...(ev.usage ? { usage: ev.usage } : {}),
-        ...(ev.currentAction ? { currentAction: redactSecrets(ev.currentAction) } : {}),
+        ...(ev.currentAction ? { currentAction: seatText("trace-frame-text", ev.currentAction) } : {}),
         ...(ev.workflowRunId ? { workflowRunId: ev.workflowRunId } : {}),
-        ...(ev.workflowAgentLabel ? { workflowAgentLabel: redactSecrets(ev.workflowAgentLabel) } : {}),
+        ...(ev.workflowAgentLabel ? { workflowAgentLabel: seatText("trace-frame-text", ev.workflowAgentLabel) } : {}),
         ...identityFields(ev),
     };
 }
@@ -288,11 +289,11 @@ export function taskStartedEventData(ev) {
         ...(typeof ev.taskType === "string" && ev.taskType.length > 0 ? { taskType: ev.taskType } : {}),
         ...(typeof ev.seq === "number" ? { seq: ev.seq } : {}),
         ...(ev.workflowRunId ? { workflowRunId: ev.workflowRunId } : {}),
-        ...(ev.workflowAgentLabel ? { workflowAgentLabel: redactSecrets(ev.workflowAgentLabel) } : {}),
+        ...(ev.workflowAgentLabel ? { workflowAgentLabel: seatText("trace-frame-text", ev.workflowAgentLabel) } : {}),
         ...(ev.parentTaskId ? { parentTaskId: ev.parentTaskId } : {}),
         ...(ev.parentSessionId ? { parentSessionId: ev.parentSessionId } : {}),
         ...(ev.rootSessionId ? { rootSessionId: ev.rootSessionId } : {}),
-        ...(ev.name ? { name: redactSecrets(ev.name) } : {}),
+        ...(ev.name ? { name: seatText("trace-frame-text", ev.name) } : {}),
         ...(ev.spawnName ? { spawnName: ev.spawnName } : {}),
         ...(ev.agentType ? { agentType: ev.agentType } : {}),
         model: ev.model,
@@ -310,10 +311,10 @@ export function taskNotificationEventData(ev) {
         ...(n.toolUseId !== undefined ? { toolUseId: n.toolUseId } : {}),
         status: n.status,
         ...(n.seq !== undefined ? { seq: n.seq } : {}),
-        ...(n.lines !== undefined ? { lines: n.lines.map((l) => redactSecrets(l)) } : {}),
+        ...(n.lines !== undefined ? { lines: n.lines.map((l) => seatText("trace-frame-text", l)) } : {}),
         ...(n.stoppedBy !== undefined ? { stoppedBy: n.stoppedBy } : {}),
         ...(n.completionId !== undefined ? { completionId: n.completionId } : {}),
-        ...(n.error !== undefined ? { error: redactSecrets(n.error) } : {}),
+        ...(n.error !== undefined ? { error: seatText("trace-frame-text", n.error) } : {}),
         ...(n.errorCode !== undefined ? { errorCode: n.errorCode } : {}),
         ...(n.apiFailure !== undefined
             ? {
@@ -323,20 +324,20 @@ export function taskNotificationEventData(ev) {
                 },
             }
             : {}),
-        ...(n.source !== undefined ? { source: redactSecrets(n.source) } : {}),
+        ...(n.source !== undefined ? { source: seatText("trace-frame-text", n.source) } : {}),
         ...(n.exitCode !== undefined ? { exitCode: n.exitCode } : {}),
         ...(n.partial !== undefined ? { partial: n.partial } : {}),
-        ...(n.diagnostics !== undefined ? { diagnostics: redactSecrets(n.diagnostics) } : {}),
+        ...(n.diagnostics !== undefined ? { diagnostics: seatText("trace-frame-text", n.diagnostics) } : {}),
         ...(n.recentSteps !== undefined
-            ? { recentSteps: n.recentSteps.map((s) => ({ tool: s.tool, target: redactSecrets(s.target), outcome: redactSecrets(s.outcome) })) }
+            ? { recentSteps: n.recentSteps.map((s) => ({ tool: s.tool, target: seatText("trace-frame-text", s.target), outcome: seatText("trace-frame-text", s.outcome) })) }
             : {}),
-        ...(n.editedFiles !== undefined ? { editedFiles: n.editedFiles.map((f) => ({ path: redactSecrets(f.path), edits: f.edits })) } : {}),
+        ...(n.editedFiles !== undefined ? { editedFiles: n.editedFiles.map((f) => ({ path: seatText("trace-frame-text", f.path), edits: f.edits })) } : {}),
         ...(n.resumable !== undefined ? { resumable: n.resumable } : {}),
-        summary: redactSecrets(n.summary),
-        ...(n.result !== undefined ? { result: redactSecrets(n.result) } : {}),
-        ...(n.output_file !== undefined ? { output_file: redactSecrets(n.output_file) } : {}),
+        summary: seatText("trace-frame-text", n.summary),
+        ...(n.result !== undefined ? { result: seatText("trace-frame-text", n.result) } : {}),
+        ...(n.output_file !== undefined ? { output_file: seatText("trace-frame-text", n.output_file) } : {}),
         ...(n.usage !== undefined ? { usage: n.usage } : {}),
-        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: redactSecrets(n.agentMessage.body) } } : {}),
+        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: seatText("trace-frame-text", n.agentMessage.body) } } : {}),
         ...(() => {
             if (n._sema_provenance === undefined)
                 return {};
@@ -355,13 +356,13 @@ export function taskNotificationEventData(ev) {
 export function diagnosticsEventData(ev) {
     return {
         files: (Array.isArray(ev.files) ? ev.files : []).map((f) => ({
-            uri: redactSecrets(String(f.uri)),
+            uri: seatText("trace-frame-text", String(f.uri)),
             diagnostics: (Array.isArray(f.diagnostics) ? f.diagnostics : []).map((d) => ({
-                message: redactSecrets(String(d.message)),
+                message: seatText("trace-frame-text", String(d.message)),
                 ...(d.severity !== undefined ? { severity: d.severity } : {}),
                 ...(d.range !== undefined ? { range: d.range } : {}),
-                ...(d.code !== undefined ? { code: typeof d.code === "number" ? d.code : redactSecrets(String(d.code)) } : {}),
-                ...(d.source !== undefined ? { source: redactSecrets(String(d.source)) } : {}),
+                ...(d.code !== undefined ? { code: typeof d.code === "number" ? d.code : seatText("trace-frame-text", String(d.code)) } : {}),
+                ...(d.source !== undefined ? { source: seatText("trace-frame-text", String(d.source)) } : {}),
             })),
         })),
         isNew: ev.isNew === true,
@@ -371,7 +372,7 @@ export function diagnosticsEventData(ev) {
 export function steeringInjectedEventData(ev) {
     return {
         source: String(ev.source),
-        preview: redactSecrets(String(ev.preview)),
+        preview: seatText("trace-frame-text", String(ev.preview)),
         ...identityFields(ev),
     };
 }
@@ -380,7 +381,7 @@ export function compactionOutcomeEventData(ev) {
     return {
         ...(s(ev.outcome) !== undefined ? { outcome: s(ev.outcome) } : {}),
         ...(s(ev.trigger) !== undefined ? { trigger: s(ev.trigger) } : {}),
-        ...(ev.reason !== undefined ? { reason: redactSecrets(String(ev.reason)) } : {}),
+        ...(ev.reason !== undefined ? { reason: seatText("trace-frame-text", String(ev.reason)) } : {}),
         ...(s(ev.pass) !== undefined ? { pass: s(ev.pass) } : {}),
         ...identityFields(ev),
     };
@@ -396,7 +397,7 @@ export function compactionStartedEventData(ev) {
 }
 export function workspaceChangedEventData(ev) {
     return {
-        cwd: redactSecrets(String(ev.cwd)).slice(0, 300),
+        cwd: seatText("trace-frame-line", String(ev.cwd)),
         ...identityFields(ev),
     };
 }
@@ -629,11 +630,23 @@ export function wiringManifestEventData(ev, instructions) {
             return dropProjectedFace("wiring_manifest.fileHistory is not a non-empty string");
         return word;
     })();
+    const permissionMode = (() => {
+        if (m.permissionMode === undefined)
+            return undefined;
+        const seg = sec(m.permissionMode);
+        const effective = str(seg?.effective);
+        const requested = seg?.requested === undefined ? undefined : str(seg.requested);
+        const foldedBy = seg?.foldedBy === undefined ? undefined : str(seg.foldedBy);
+        if (effective === undefined || (seg?.requested !== undefined && requested === undefined) || (seg?.foldedBy !== undefined && foldedBy === undefined))
+            return dropProjectedFace("wiring_manifest.permissionMode is not a receipt shape (effective a non-empty string, requested / foldedBy absent or non-empty strings)");
+        return { ...(requested !== undefined ? { requested } : {}), effective, ...(foldedBy !== undefined ? { foldedBy } : {}) };
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
         ...(teamRole !== undefined ? { teamRole } : {}),
         ...(fileHistory !== undefined ? { fileHistory } : {}),
+        ...(permissionMode !== undefined ? { permissionMode } : {}),
         ...(ask !== undefined ? { ask } : {}),
         ...(question !== undefined ? { question } : {}),
         ...(str(interactionIn.posture) !== undefined ? { interaction: { posture: interactionIn.posture } } : {}),
@@ -712,13 +725,13 @@ export function humanInputEventData(ev) {
             ...(typeof m.ordinal === "number" && Number.isFinite(m.ordinal) ? { ordinal: m.ordinal } : {}),
             ...(str(m.kind) !== undefined ? { kind: m.kind } : {}),
             ...(str(m.outcome) !== undefined ? { outcome: m.outcome } : {}),
-            ...(str(m.label) !== undefined ? { label: redactSecrets(String(m.label)) } : {}),
+            ...(str(m.label) !== undefined ? { label: seatText("trace-frame-text", String(m.label)) } : {}),
         }))
         : undefined;
     const actor = {
-        ...(str(a.id) !== undefined ? { id: redactSecrets(String(a.id)) } : {}),
+        ...(str(a.id) !== undefined ? { id: seatText("trace-frame-text", String(a.id)) } : {}),
         ...(typeof a.hostAsserted === "boolean" ? { hostAsserted: a.hostAsserted } : {}),
-        ...(str(a.issuer) !== undefined ? { issuer: redactSecrets(String(a.issuer)) } : {}),
+        ...(str(a.issuer) !== undefined ? { issuer: seatText("trace-frame-text", String(a.issuer)) } : {}),
     };
     return {
         ...(str(ev.inputId) !== undefined ? { inputId: ev.inputId } : {}),
@@ -726,7 +739,7 @@ export function humanInputEventData(ev) {
         ...(str(ev.carrier) !== undefined ? { carrier: ev.carrier } : {}),
         ...(str(ev.source) !== undefined ? { source: ev.source } : {}),
         ...(str(ev.delivery) !== undefined ? { delivery: ev.delivery } : {}),
-        ...(str(ev.issuer) !== undefined ? { issuer: redactSecrets(String(ev.issuer)) } : {}),
+        ...(str(ev.issuer) !== undefined ? { issuer: seatText("trace-frame-text", String(ev.issuer)) } : {}),
         ...(Object.keys(actor).length > 0 ? { actor } : {}),
         ...(str(ev.entryId) !== undefined ? { entryId: ev.entryId } : {}),
         ...(attachments !== undefined ? { attachments } : {}),
@@ -737,7 +750,7 @@ export function brainStatusEventData(ev) {
     const num = (v) => typeof v === "number" && Number.isFinite(v);
     return {
         phase: String(ev.phase),
-        ...(typeof ev.detail === "string" && ev.detail.length > 0 ? { detail: redactSecrets(ev.detail).slice(0, 300) } : {}),
+        ...(typeof ev.detail === "string" && ev.detail.length > 0 ? { detail: seatText("trace-frame-line", ev.detail) } : {}),
         ...(num(ev.retryInSec) ? { retryInSec: ev.retryInSec } : {}),
         ...(num(ev.attempt) ? { attempt: ev.attempt } : {}),
         ...(num(ev.maxRetries) ? { maxRetries: ev.maxRetries } : {}),
@@ -777,7 +790,7 @@ export function compactedEventData(ev) {
             const files = ev.attachedFiles
                 .filter((f) => typeof f === "object" && f !== null && typeof f.path === "string"
                 && num(f.chars) !== undefined && typeof f.truncated === "boolean")
-                .map((f) => ({ path: redactSecrets(f.path), chars: f.chars, truncated: f.truncated }));
+                .map((f) => ({ path: seatText("trace-frame-text", f.path), chars: f.chars, truncated: f.truncated }));
             return files.length > 0 ? { attachedFiles: files } : {};
         })(),
         ...(ev.modelFallback === true ? { modelFallback: true } : {}),
@@ -833,6 +846,16 @@ function contextUsageSectionsField(sections) {
     }
     return out.length > 0 ? { sections: out } : {};
 }
+export function crossBoundaryTaintEventData(ev) {
+    return {
+        ...(typeof ev.runId === "string" ? { runId: ev.runId } : {}),
+        ...(typeof ev.phase === "string" ? { phase: ev.phase } : {}),
+        ...(Array.isArray(ev.taint) ? { taint: ev.taint.filter((b) => typeof b === "string") } : {}),
+        ...(typeof ev.governed === "boolean" ? { governed: ev.governed } : {}),
+        ...(typeof ev.toolName === "string" ? { toolName: ev.toolName } : {}),
+        ...(typeof ev.toolCallId === "string" ? { toolCallId: ev.toolCallId } : {}),
+    };
+}
 export function turnEndEventData(ev) {
     return {
         ...(ev.usage ? { usage: ev.usage } : {}),
@@ -991,6 +1014,8 @@ function mapTraceEventInner(type, seq, data) {
         }
         case "prompt_assembled":
             return { event: "prompt-assembled", data: { seq, ...data } };
+        case "cross_boundary_taint":
+            return { event: "cross-boundary-taint", data: { seq, ...data } };
         case "done":
             return { event: "done", data: { seq } };
         case "suspended":

package/dist/trace/projection-table.d.ts

@@ -0,0 +1,100 @@
+/**
+ * **投影处置表**:一个 core 类型在一张出口面上的样子,只由一张表回答。
+ *
+ * ## 一条规则
+ * 表对该类型的**每一个键**给四词之一,表外键 = tsc 红(`satisfies DispositionTable<T, …>`):
+ *  · `"forward"` —— 原值出门(只配叶值:原语或原语列表);`{ forward: 读法 }` = 读法认得才出门(读不出 ⇒ 键缺席并计一次),值不改;
+ *  · `"strip"`   —— 本面不出现;
+ *  · `{ redact: 入口 }` —— 原值经**点名的既有脱敏入口**出门(词就是那只导出的名字,本模块不另铸脱敏逻辑);
+ *  · `{ nested: 子表 }` —— 成员级子表;对象逐成员、列表逐元素(列表必须写 `rows`:`"each"` = 每个元素,或一只**只做选取 / 排序**的函数
+ *    —— 运行期按身份核它交回的元素都来自原列表,值仍逐个过子表,带不出表外值);`admit` = 整只对象的读法。
+ * 本仓**自铸**的键(core 没有的派生事实)以 `{ mint: (src, root) => 值 }` 写在表里它的出口位次上 —— 它不是处置词,类型上不许与 core 键同名。
+ * ⚠️ 铸键读到的是**原值**(要从原值算计数 / 时长 / 展示词):它只许回派生事实,不许把原值或其片段回出去 —— 这是表里唯一一处
+ * 表本身拦不住、要靠复审看的地方。
+ * 值形限制写在类型上(整只值形一起判,不按联合分配):叶值(联合每一臂都是原语 / 原语列表)才能 `forward`,文本才能 `redact`,
+ * `nested` 不收各臂键不同的联合(`keyof` 只给交集,某一臂独有的键会悄悄没有处置),core 写成 `unknown` / `any` 的值只能 `strip`;
+ * **一格只许一词** —— 类型上把其余词的键写成 `never`(展开也混不进第二个词),运行期再核一次,两词同在 ⇒ 响亮抛。
+ * 投影函数是表的解释器 {@link projectByTable};`core-keyset-guard.ts` 读表({@link TableCoreKeys})—— 门与投影只有一个写者。
+ *
+ * ## 三条读法(所有表同一条)
+ *  · **缺席即缺席**:源值 `undefined` ⇒ 键缺席(不补 `[]` / `false` / 默认值);
+ *  · **表序 = 出口序**:表字面量按出口顺序写,铸键按位插 ⇒ 输出的键序就是表的键序;
+ *  · **在场却读不出 ⇒ 计一次并丢**(`dropProjectedFace`,F 类;缺席从不计数):读法拒、`redact` 位不是文本、嵌套位不是对象、
+ *    写了 `rows` 的位不是列表、列表元素不是对象 —— 那一格丢,其余照投,不抛、不 500。表里出现解释器不认识的词(只可能经运行期旁路造出)⇒ 响亮抛。
+ *
+ * ## 凭据
+ * `redact` 管「**可能含**凭据的文本」;「**本身是**凭据的值」(赎回令牌)写 `strip`。core 打了品牌的凭据型(`CheckpointToken`)上,
+ * 类型层写不出 `forward`。
+ */
+import type { CheckpointToken } from "@sema-agent/core";
+/** `redact` 可点名的既有脱敏入口(闭集;一词 = 一只既有导出的名字,解释器原样调用)。 */
+export type RedactEntry = "redactSecrets" | "redactErrorMessage";
+/** 窄读:认得 ⇒ `true`(原值出门),认不得 ⇒ 键缺席并计一次。只判不改。 */
+export type Admit = (raw: unknown) => boolean;
+/** 列表位怎么带:`"each"` = 每个元素;函数 = 选取 / 排序(只许交回原列表里的元素 —— 运行期按身份核,交回别的就响亮抛)。 */
+type RowsOf<E, R> = "each" | ((list: readonly E[], root: R) => readonly E[]);
+/** 一格只许一词:对象形的处置把其余词的键写成 `never` —— 多余属性检查之外,经展开 / 赋值也写不进第二个词。 */
+type DispositionKey = "forward" | "redact" | "nested" | "rows" | "admit" | "mint";
+type Only<K extends DispositionKey, T> = T & {
+    readonly [P in Exclude<DispositionKey, K>]?: never;
+};
+/** 不透明值(core 型写成 `unknown` / `any`):本仓写不出它的成员表,也说不出它是不是文本 ⇒ 只能 `strip`。 */
+type IsOpaque<V> = unknown extends V ? true : false;
+/** 叶值:联合的**每一臂**都是原语,或元素每一臂都是原语的列表(不透明元素不算)。 */
+type LeafMember<M> = M extends readonly (infer E)[] ? (unknown extends E ? false : [Extract<E, object>] extends [never] ? true : false) : M extends object ? false : true;
+type IsLeaf<V> = false extends LeafMember<NonNullable<V>> ? false : true;
+/** 联合的任一臂(或列表元素的任一臂)是 core 的品牌凭据。 */
+type TokenMember<M> = M extends readonly (infer E)[] ? ([Extract<E, CheckpointToken>] extends [never] ? false : true) : [Extract<M, CheckpointToken>] extends [never] ? false : true;
+type HoldsToken<V> = true extends TokenMember<NonNullable<V>> ? true : false;
+/** 判别联合的各臂键并集;`nested` 只收「各臂键相同」的对象型 —— 否则 `keyof` 只给交集,只在某一臂上的键会悄悄没有处置。 */
+type ArmKeys<E> = E extends unknown ? keyof E : never;
+type NestedTarget<E> = [ArmKeys<E>] extends [keyof E] ? true : false;
+/** 值形决定可写哪几个词:叶值才能 `forward`(对象 / 对象列表的成员必须逐个处置),文本才能 `redact`,对象 / 对象列表才能 `nested`
+ *  (列表必须写 `rows`、对象不许写),品牌凭据写不出 `forward`,不透明值只能 `strip`。判断都**不按联合分配**:整只值形一起判。 */
+type NestedOf<V, R> = [
+    NonNullable<V>
+] extends [readonly (infer E)[]] ? [E] extends [object] ? NestedTarget<E> extends true ? Only<"nested" | "rows" | "admit", {
+    readonly nested: CoreTable<E, R>;
+    readonly rows: RowsOf<E, R>;
+    readonly admit?: Admit;
+}> : never : never : [NonNullable<V>] extends [object] ? NestedTarget<NonNullable<V>> extends true ? Only<"nested" | "admit", {
+    readonly nested: CoreTable<NonNullable<V>, R>;
+    readonly admit?: Admit;
+}> : never : never;
+type ForwardOf<V> = IsLeaf<V> extends true ? (HoldsToken<V> extends true ? never : "forward" | Only<"forward", {
+    readonly forward: Admit;
+}>) : never;
+/** 一个 core 键在一张面上的处置(四词;`R` = 铸键能读到的根)。 */
+export type Disposition<V, R> = IsOpaque<V> extends true ? "strip" : ForwardOf<V> | "strip" | (NonNullable<V> extends string ? Only<"redact", {
+    readonly redact: RedactEntry;
+}> : never) | NestedOf<V, R>;
+/** 本仓铸键:core 没有的派生事实,值 = `mint(源, 根)`,`undefined` ⇒ 缺席。 */
+export type Mint<T, R> = Only<"mint", {
+    readonly mint: (src: T, root: R) => unknown;
+}>;
+/** `T` 的全量处置(每个键恰一词;可选键也必须写)。 */
+export type CoreTable<T, R> = {
+    readonly [K in keyof T]-?: Disposition<T[K], R>;
+};
+/**
+ * 一张处置表的类型:`T` 的全量处置 + 名为 `M` 的铸键。`M` 与 `keyof T` 相交 ⇒ 整张表型变成错误标记(两个写者抢一个键)。
+ * 用法:`export const X_DISPOSITIONS = { … } as const satisfies DispositionTable<T, R, "铸键A" | "铸键B">`。
+ */
+export type DispositionTable<T, R = T, M extends string = never> = [Extract<M, keyof T>] extends [never] ? CoreTable<T, R> & {
+    readonly [K in M]: Mint<T, R>;
+} : {
+    readonly __mintCollidesWithCoreKey: Extract<M, keyof T>;
+};
+/** 表里处置 core 键的那些键(铸键除外)—— `core-keyset-guard.ts` 读这个。 */
+export type TableCoreKeys<Tbl> = {
+    [K in keyof Tbl]-?: Tbl[K] extends {
+        readonly mint: unknown;
+    } ? never : K;
+}[keyof Tbl];
+/**
+ * 按表投影一个值。`face` = 计数 / 报错里的面名(`<面>.<键路径>`);`root` = 铸键与 `rows` 读到的根(面的顶层值)。
+ * 纯数据进、纯数据出;不改入参。
+ */
+export declare function projectByTable<T extends object, R>(face: string, table: CoreTable<T, R>, value: T, root: R): Record<string, unknown>;
+export {};
+//# sourceMappingURL=projection-table.d.ts.map