@sema-agent/server 7.133.0 → 7.134.0

package/dist/tool-approval.js

@@ -4,6 +4,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
+import { seatText } from "./trace/exit-seat.js";
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
@@ -327,9 +328,14 @@ function parseToolApprovalFields(body, retired) {
 export function buildUnattendedPolicyRefusal(reason) {
     return { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason };
 }
-function unattendedRefusalReason(arm) {
+function unattendedRefusalReason(site) {
+    if (site.arm === "frame_family_undeclared") {
+        return (`UNATTENDED_APPROVAL_POLICY=deny: this run has no live approval channel — the client that started it did not declare the "${site.family}" ` +
+            "approval frame family (settings.approvalFrameFamilies), so no approval card is shown to it, and an approval request no one can answer " +
+            `is refused here instead of being parked for a person. Upgrade the client, or declare the family it renders (arm: ${site.arm}).`);
+    }
     return ("UNATTENDED_APPROVAL_POLICY=deny: this deployment declares that no one attends its approvals, so an approval " +
-        `request no one can answer is refused here instead of being parked for a person (arm: ${arm}).`);
+        `request no one can answer is refused here instead of being parked for a person (arm: ${site.arm}).`);
 }
 function isChildAsk(req) {
     return req.fromSubagent === true;
@@ -361,11 +367,53 @@ export function resolveStreamApprovalGate(input) {
         return { active: false, reason: "protocol_disabled" };
     if (!input.backend)
         return { active: false, reason: "no_backend" };
-    if (!input.parkFacility)
+    if (input.checkpointStore === undefined)
         return { active: false, reason: "no_park_facility" };
-    return { active: true, askStore: input.backend.approvalAsk() };
+    return { active: true, askStore: input.backend.approvalAsk(), checkpointStore: input.checkpointStore };
 }
 export const APPROVAL_FRAME_FAMILIES = ["tool_approval", "approval_request"];
+export function presentedApprovalFrameFamily(streamApprovalOn) {
+    return streamApprovalOn ? "approval_request" : "tool_approval";
+}
+const APPROVAL_FRAME_FAMILIES_FIELD = "settings.approvalFrameFamilies";
+const APPROVAL_FRAME_FAMILY_WORDS = APPROVAL_FRAME_FAMILIES.map((w) => `"${w}"`).join(" | ");
+export function approvalFrameFamiliesIssue(settings) {
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return null;
+    const raw = Reflect.get(settings, "approvalFrameFamilies");
+    if (raw === undefined)
+        return null;
+    if (!Array.isArray(raw)) {
+        return {
+            message: `${APPROVAL_FRAME_FAMILIES_FIELD} must be an array of approval frame family words (${APPROVAL_FRAME_FAMILY_WORDS}) — the families of approval cards this client renders. ` +
+                'Refused rather than ignored, because an ignored declaration reads as "in effect" to the caller',
+            fields: { field: APPROVAL_FRAME_FAMILIES_FIELD, reason: "bad_entry" },
+        };
+    }
+    const seen = new Set();
+    for (const [index, entry] of raw.entries()) {
+        if (!APPROVAL_FRAME_FAMILIES.includes(entry)) {
+            return {
+                message: `${APPROVAL_FRAME_FAMILIES_FIELD}[${index}] is not one of ${APPROVAL_FRAME_FAMILY_WORDS} — every entry must be an approval frame family word. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`,
+                fields: { field: APPROVAL_FRAME_FAMILIES_FIELD, reason: "bad_entry", index },
+            };
+        }
+        if (seen.has(entry)) {
+            return {
+                message: `${APPROVAL_FRAME_FAMILIES_FIELD}[${index}] repeats a family declared earlier in the list — declare each family once`,
+                fields: { field: APPROVAL_FRAME_FAMILIES_FIELD, reason: "bad_entry", index },
+            };
+        }
+        seen.add(entry);
+    }
+    return null;
+}
+export function declaredApprovalFrameFamilies(settings) {
+    if (approvalFrameFamiliesIssue(settings) !== null || settings === null || typeof settings !== "object")
+        return new Set();
+    const raw = Reflect.get(settings, "approvalFrameFamilies");
+    return new Set(Array.isArray(raw) ? raw.filter((w) => APPROVAL_FRAME_FAMILIES.includes(w)) : []);
+}
 export function createApprovalCardEmitter(sinks) {
     const present = [sinks.appendDurable, sinks.writeLive].filter((w) => w !== undefined);
     const attempt = (write, frame) => (async () => {
@@ -410,17 +458,22 @@ export function createApprovalCardEmitter(sinks) {
     };
 }
 export function resolveApprovalLeg(input) {
-    if (!input.streamApprovalOn)
-        return { active: false, windowZero: input.windowMs === 0 };
-    const tightDeadline = input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
+    const active = input.streamApprovalOn;
+    const tightDeadline = active && input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
     if (input.windowMs === 0 || tightDeadline)
-        return { active: true, windowZero: true };
+        return { active, unattended: { arm: "window_zero" } };
+    const family = presentedApprovalFrameFamily(active);
+    if (!input.declaredFamilies.has(family))
+        return { active, unattended: { arm: "frame_family_undeclared", family } };
     return {
-        active: true,
-        windowZero: false,
-        ...(input.legWalltimeMs !== undefined ? { legDeadlineMonotonic: input.nowMonotonicMs + input.legWalltimeMs } : {}),
+        active,
+        ...(active && input.legWalltimeMs !== undefined ? { legDeadlineMonotonic: input.nowMonotonicMs + input.legWalltimeMs } : {}),
     };
 }
+export function approvalPreambleReplays(input) {
+    const leg = resolveApprovalLeg({ ...input, nowMonotonicMs: performance.now() });
+    return leg.active && leg.unattended === undefined;
+}
 function effectiveAskWindowMs(ttlMs, windowMarginMs, legDeadlineMonotonic, nowMonotonicMs) {
     if (legDeadlineMonotonic === undefined)
         return ttlMs;
@@ -513,6 +566,7 @@ export class ToolApprovalCoordinator {
     parkRedemptionTtlMs;
     parkRedemptionPerPrincipalMax;
     parkedRedeem;
+    parkedGate;
     askAudit;
     sessionGrants;
     deploymentListAsks;
@@ -532,6 +586,7 @@ export class ToolApprovalCoordinator {
         this.admitMaxPerOwner = opts?.admitMaxPerOwner ?? DEFAULT_ADMIT_MAX_PER_OWNER;
         this.unattendedPolicy = opts?.unattendedPolicy ?? "park";
         this.parkedRedeem = opts?.parkedRedeem;
+        this.parkedGate = opts?.parkedGate;
         this.parkRedemptionMax = opts?.parkRedemptionMax ?? DEFAULT_PARK_REDEMPTION_MAX;
         this.parkRedemptionTtlMs = opts?.parkRedemptionTtlMs ?? DEFAULT_PARK_REDEMPTION_TTL_MS;
         this.parkRedemptionPerPrincipalMax = opts?.parkRedemptionPerPrincipalMax ?? DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX;
@@ -553,7 +608,7 @@ export class ToolApprovalCoordinator {
                 outcomeWord = "unavailable";
                 break;
             case "deny":
-                outcome = buildUnattendedPolicyRefusal(unattendedRefusalReason(site.arm));
+                outcome = buildUnattendedPolicyRefusal(unattendedRefusalReason(site));
                 outcomeWord = "deny";
                 break;
             default: {
@@ -579,12 +634,12 @@ export class ToolApprovalCoordinator {
         return this.unattendedRoutesToPark ? deriveBatchId(sourceTaskId, runId, legKey) : deriveAskScopedBatchId(askId);
     }
     unattendedAskOutcome(site) {
-        return this.unattendedOutcome({
-            arm: "window_zero",
+        const facts = {
             ...(site.taskId !== undefined ? { taskId: site.taskId } : {}),
             ...(site.owner !== undefined && site.owner !== null ? { owner: site.owner } : {}),
             ...(site.toolName !== undefined ? { toolName: site.toolName } : {}),
-        });
+        };
+        return this.unattendedOutcome(site.arm === "frame_family_undeclared" ? { arm: site.arm, family: site.family, ...facts } : { arm: site.arm, ...facts });
     }
     async landUnattendedOutcome(outcome, row) {
         const store = this.askStore;
@@ -933,12 +988,12 @@ export class ToolApprovalCoordinator {
             return false;
         }
     }
-    boundUnattendedAsk = (identity) => {
+    boundUnattendedAsk = (identity, why) => {
         return async (req) => {
             const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "" };
             if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
                 return true;
-            return this.unattendedAskOutcome({ taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
+            return this.unattendedAskOutcome({ ...why, taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
         };
     };
     async sessionGrantUncontestedByRow(origin, req) {
@@ -2142,7 +2197,19 @@ export class ToolApprovalCoordinator {
     async readAskRowState(store, id, principal) {
         return this.readStateOfRow(await this.askRowFor(store, id, "getAsk(read)"), principal);
     }
-    readStateOfRow(row, principal) {
+    async readParkedGate(row) {
+        const gate = this.parkedGate;
+        if (gate === undefined || row.gateToken === null)
+            return { kind: "open" };
+        try {
+            return await this.withStoreDeadline(gate({ gateToken: row.gateToken, gateBoundCallId: row.gateBoundCallId }), "readParkedGate", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+        }
+        catch (err) {
+            this.noteStoreError(err, "readParkedGate");
+            return { kind: "open" };
+        }
+    }
+    async readStateOfRow(row, principal) {
         if (!askRowVisibleTo(row, principal))
             return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
         const projection = buildAskRowReadProjection(row, Date.now());
@@ -2157,8 +2224,34 @@ export class ToolApprovalCoordinator {
             }
             case "PARKING":
             case "PARKED": {
-                const parkSession = parkSessionOf(row);
-                body = { state: "parked", ...projection, ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}) };
+                const gate = row.state === "PARKED" ? await this.readParkedGate(row) : { kind: "open" };
+                switch (gate.kind) {
+                    case "open": {
+                        const parkSession = parkSessionOf(row);
+                        body = { state: "parked", ...projection, ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}) };
+                        break;
+                    }
+                    case "decided":
+                        body = { state: "decided", ...projection, decision: gate.decision, decidedAtMs: gate.decidedAtMs, ...(gate.decisionNote !== undefined ? { decisionNote: gate.decisionNote } : {}) };
+                        break;
+                    case "void":
+                        body = { state: "void", ...projection };
+                        break;
+                    case "unknown":
+                        if (gate.why === "decision_unreadable") {
+                            defaultLogger.error("tool approval read saw a PARKED row whose gate is settled but carries no usable decision", {
+                                askId: row.askId,
+                                defect: seatText("operator-log-text", gate.defects[0]),
+                                defectCount: gate.defects.length,
+                            });
+                        }
+                        return this.notPending();
+                    default: {
+                        const unhandled = gate;
+                        defaultLogger.error("tool approval read hit an unknown gate reading", { askId: row.askId, gate: unhandled });
+                        return this.notPending();
+                    }
+                }
                 break;
             }
             case "DENIED":

package/dist/tool-rule-names.d.ts

@@ -17,6 +17,12 @@
  * 修前(≤7.107.0)本仓自写的这些臂只比 `req.toolName`:模型按别名调嵌入方工具时,运维名单一个都不拦(core 同族策略判 deny、
  * 本仓判 allow)。本仓自身不声明带别名的工具,所以只有经 `resolveSpec` 席挂别名工具的嵌入方走得到。
  *
+ * ⚠️ **别名只是名字,不是标记的载体**(core 7.54.0 #2105,[ref] 已定案):上面这条读法只回答「这次调用答得上哪些名字」;嵌入方工具自己的
+ * 安全标记(`egress`、不可逆层级 `irreversibility`、可逆探针)**不再**因别名恰是引擎工具名(`MyShell{aliases:["Bash"]}`)而镜像到引擎 shell 上 ——
+ * 7.53.x 及以前,`MyShell` 的 `egress: true` / `irreversibility: "always"` 会让引擎 `Bash` 的调用多问一次(收紧),它的恒可逆探针会让引擎 `Bash` 的
+ * `touch` 不问就跑(放宽);7.54.0 起两者都不再作用于引擎 shell。要收紧引擎 shell:给**正名**叫 `Bash` 的工具声明标记(同名标记仍作用),或请求
+ * `TaskSpec.shellGate: "always"`(本仓的入口 `MANUAL_MODE_SHELL_GATE` / 请求 `shellGate`)。
+ *
  * 返回**命中的那个名字**(调用答得上的名字里第一个被规则够到的,拼写在先)—— 规则归因(`matchedAskRule`)写运维名单里的那个名,
  * 不写一个名单里查不到的 wire 名;够不到 ⇒ `undefined`。判定式(精确集 / covering 规则)由调用方给,本函数只管「读哪些名字」。
  */

package/dist/trace/core-keyset-guard.d.ts

@@ -145,8 +145,9 @@ type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernan
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
 export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed" | "permission.allowed_tools_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
-type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
-type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
+type PermissionTraceRunEvent = "permission.cross_boundary_taint";
+type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped | PermissionTraceRunEvent>>;
+type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped | PermissionTraceRunEvent, PermissionTraceKind>>;
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
@@ -215,7 +216,7 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "targets" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;

package/dist/trace/exit-seat.d.ts

@@ -7,7 +7,9 @@ export type SafeText = string & {
 /**
  * **座表(闭集;一行 = 一类出口)**。加一类出口 = 加一行;表外的座名是编译错误。
  *  · `trace-frame-text`:trace 帧的自由文本位(子代名 / 动作行 / 通告正文与结果 / 诊断 / 注入摘录 / 压缩说明 / 人类输入的署名与附件标签 …),不设界;
- *  · `trace-frame-line`:trace 帧里一行宽的展示位(`workspace_changed.cwd` / `brain_status.detail`),界 300 码元。
+ *  · `trace-frame-line`:trace 帧里一行宽的展示位(`workspace_changed.cwd` / `brain_status.detail`),界 300 码元;
+ *  · `operator-log-text`:运维日志字段里的一句话 —— 读口坏行的缺陷句(core 的筛按位置点名并回显落盘标量)、`tool_trace` 行里工具的输出 / 失败句 / 拒因;日志字段行,界 200 码元(含截断记号);
+ *  · `operator-log-arg`:运维日志字段里模型写的工具入参(`tool_trace` 的 `arg.*`:路径 / 命令 / 模式 / 非对象入参的串形);日志字段行,界 120 码元(含截断记号)。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -17,6 +19,16 @@ declare const EXIT_SEATS: {
         readonly scope: "free-text";
         readonly maxChars: 300;
     };
+    readonly "operator-log-text": {
+        readonly scope: "free-text";
+        readonly maxChars: 200;
+        readonly logField: true;
+    };
+    readonly "operator-log-arg": {
+        readonly scope: "free-text";
+        readonly maxChars: 120;
+        readonly logField: true;
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /**

package/dist/trace/exit-seat.js

@@ -1,3 +1,5 @@
+import { CONTROL_AND_BIDI_CHARS, stripControlAndBidi } from "@sema-agent/settings-schema";
+import { CALLER_TEXT_CUT_MARK } from "../caller-text-echo.js";
 import { errorKindOf } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
@@ -5,12 +7,17 @@ import { proposeRedactionSpans, REDACTION_TOKEN_RE_SRC } from "./redact.js";
 const EXIT_SEATS = {
     "trace-frame-text": { scope: "free-text" },
     "trace-frame-line": { scope: "free-text", maxChars: 300 },
+    "operator-log-text": { scope: "free-text", maxChars: 200, logField: true },
+    "operator-log-arg": { scope: "free-text", maxChars: 120, logField: true },
 };
 const SEAT_ROWS = new Map(Object.entries(EXIT_SEATS));
 for (const [name, row] of SEAT_ROWS) {
     if (row.maxChars !== undefined && row.maxChars < OVERSIZED_REDACTION_PLACEHOLDER.length) {
         throw new Error(`exit seat "${name}": maxChars ${row.maxChars} cannot hold the failure placeholder (${OVERSIZED_REDACTION_PLACEHOLDER.length} code units)`);
     }
+    if (row.logField === true && row.maxChars === undefined) {
+        throw new Error(`exit seat "${name}": a log-field row must declare maxChars (the cut mark counts inside the bound)`);
+    }
 }
 function mergeSpans(spans) {
     const order = spans.map((s, i) => ({ s, i })).sort((a, b) => a.s.start - b.s.start || b.s.end - a.s.end || a.i - b.i);
@@ -59,13 +66,60 @@ function renderOnce(text, groups, maxChars) {
     parts.push(maxChars === undefined || len + tail.length <= maxChars ? tail : cutPlain(tail, maxChars - len));
     return parts.join("");
 }
+const STRIPPED_UNIT = (() => {
+    const inSet = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
+    const table = new Uint8Array(0x10000);
+    for (let unit = 0; unit < table.length; unit++)
+        if (inSet.test(String.fromCharCode(unit)))
+            table[unit] = 1;
+    return table;
+})();
+function mapSpansIntoStripped(text, spans) {
+    const marks = [...new Set(spans.flatMap((sp) => [sp.start, sp.end]))].sort((a, b) => a - b);
+    const strippedBefore = new Map();
+    let removed = 0;
+    let at = 0;
+    for (const mark of marks) {
+        for (; at < mark; at++)
+            if (STRIPPED_UNIT[text.charCodeAt(at)] === 1)
+                removed += 1;
+        strippedBefore.set(mark, mark - removed);
+    }
+    const mapped = [];
+    for (const sp of spans) {
+        const start = strippedBefore.get(sp.start);
+        const end = strippedBefore.get(sp.end);
+        if (end > start)
+            mapped.push({ start, end, repl: sp.repl });
+    }
+    return mapped;
+}
+function proposeLogFieldSpans(text, scope) {
+    const read = stripControlAndBidi(text);
+    if (read === text)
+        return { read, spans: proposeRedactionSpans(text, scope) };
+    if (read.length === 0)
+        return { read, spans: [] };
+    const original = proposeRedactionSpans(text, scope);
+    const stripped = proposeRedactionSpans(read, scope, { countHits: original.length === 0 });
+    return { read, spans: [...stripped, ...mapSpansIntoStripped(text, original)] };
+}
+function renderRow(text, groups, row) {
+    if (row.logField !== true || row.maxChars === undefined)
+        return renderOnce(text, groups, row.maxChars);
+    const whole = renderOnce(text, groups, undefined);
+    if (whole.length <= row.maxChars)
+        return whole;
+    return renderOnce(text, groups, row.maxChars - CALLER_TEXT_CUT_MARK.length) + CALLER_TEXT_CUT_MARK;
+}
 export function seatText(seat, text) {
     const row = SEAT_ROWS.get(seat);
     if (row === undefined)
         throw new Error(`exit seat: ${JSON.stringify(seat)} is not a row of the seat table`);
     let out;
     try {
-        out = renderOnce(text, mergeSpans(proposeRedactionSpans(text, row.scope)), row.maxChars);
+        const { read, spans } = row.logField === true ? proposeLogFieldSpans(text, row.scope) : { read: text, spans: proposeRedactionSpans(text, row.scope) };
+        out = renderRow(read, mergeSpans(spans), row);
     }
     catch (err) {
         recordFailOpen("server.run-terminal.redact-threw", `seat=${seat} len=${typeof text === "string" ? text.length : -1} err=${errorKindOf(err)}`);

package/dist/trace/ledger-events.d.ts

@@ -52,7 +52,9 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  | "task_started" | "task_progress" | "task_notification" | "turn_end"
 /** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
  *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
- | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"
+ | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled"
+/** core 7.54.0 [ref] O9b S1:`permission.cross_boundary_taint` 帧的耐久行(伴随记录,与 `config_assembled` 同一只队列、同一批 drain 点;只在执行于目标设备的树上有)。 */
+ | "cross_boundary_taint" | "file_link"
 /** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
 /** [ref] §4.3 呈卡族的开卡帧与单卡消卡帧(与上面两只 tool_approval 帧同一条投递面;一条腿只发其中一族,

package/dist/trace/project.d.ts

@@ -26,6 +26,7 @@
 import type { GateOutcome, McpDelivered, TaskResult, SystemInjectionPriority } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
+import type { RunCompanionRecord } from "../observability/prompt-manifest.js";
 import { type SafeText } from "./exit-seat.js";
 import { type SemaProvenanceInput } from "./sema-provenance.js";
 import type { LedgerEventType } from "./ledger-events.js";
@@ -51,7 +52,7 @@ export declare function appendModelUsageDelta(append: AppendFn, modelUsage: Mode
  *  (one Map.get), so callers fire it liberally. */
 export declare function appendPromptManifest(append: AppendFn, tracker: {
     drain(taskId: string): PromptManifestRecord[] | undefined;
-    drainConfig?(taskId: string): Array<Record<string, unknown>> | undefined;
+    drainCompanions?(taskId: string): RunCompanionRecord[] | undefined;
 } | undefined, taskId: string): Promise<void>;
 /** E8: at a TERMINAL done — flush the final delta, then SUM all `model_usage` events (every process leg) into the
  *  result's `stats.modelUsage` echo. Returns the result unchanged when no usage was tracked (shell soft-degrades). */
@@ -1083,6 +1084,22 @@ export declare function contextUsageEventData(ev: {
  * 与结果面的孪生 `TaskResult.responseModel` 同一只闸 —— 同一个名字在两张脸上不许两种待遇。非串 / 空串同样不铸键(空串在
  * 那条谓词的长度下界之外;core 的读律 `providerReportedModel` 对空串也答「没报」)。
  */
+/**
+ * 🔴 core 7.54.0 [ref] O9b S1 —— 设备车道发射闸的 `permission.cross_boundary_taint` 帧 → 耐久行 `cross_boundary_taint`(`GET /v1/runs/:id/events` 账本回放同名交出;
+ * trace SSE `GET /v1/tasks/:id/stream` 上是 `cross-boundary-taint` 帧,按存下的行原样交出)。帧只在**执行于目标设备的树**上发(武装腿 prepare / 续跑腿 resume 各一帧,离目标读第一次放进树时 observed 一帧),
+ * 宿主车道零帧 ⇒ 本行在宿主车道上永不出现。纯元数据(core 逐字「Metadata only」):树的污染位(`taint`,core `CROSS_BOUNDARY_TAINT_BITS` 的子集)、
+ * 树是否受治理(`governed`)、阶段(`phase`)、腿的 `runId`,observed 时那一只调用(`toolName` / `toolCallId`)。
+ * 信封(`kind` / `version` / `taskId` / `ts`)不上行:行自带 seq / ts,run 就是 taskId(与清单行同一条律;登记表 `cross_boundary_taint` 行)。
+ * 值:`taint` 交一份数组副本(只收串);`toolName` / `toolCallId` 在场才铸。词按开集串过境(属主是引擎的闭集;本仓不判词表)。
+ */
+export declare function crossBoundaryTaintEventData(ev: {
+    runId?: unknown;
+    phase?: unknown;
+    taint?: unknown;
+    governed?: unknown;
+    toolName?: unknown;
+    toolCallId?: unknown;
+}): Record<string, unknown>;
 export declare function turnEndEventData(ev: {
     usage?: unknown;
     usageMissing?: true;

package/dist/trace/project.js

@@ -24,10 +24,10 @@ export async function appendPromptManifest(append, tracker, taskId) {
     if (records)
         for (const m of records)
             await append("prompt_assembled", m);
-    const cfgs = tracker?.drainConfig?.(taskId);
-    if (cfgs)
-        for (const cfg of cfgs)
-            await append("config_assembled", cfg);
+    const companions = tracker?.drainCompanions?.(taskId);
+    if (companions)
+        for (const c of companions)
+            await append(c.type, c.data);
 }
 export async function attachModelUsage(result, ctx) {
     if (!ctx.modelUsage)
@@ -846,6 +846,16 @@ function contextUsageSectionsField(sections) {
     }
     return out.length > 0 ? { sections: out } : {};
 }
+export function crossBoundaryTaintEventData(ev) {
+    return {
+        ...(typeof ev.runId === "string" ? { runId: ev.runId } : {}),
+        ...(typeof ev.phase === "string" ? { phase: ev.phase } : {}),
+        ...(Array.isArray(ev.taint) ? { taint: ev.taint.filter((b) => typeof b === "string") } : {}),
+        ...(typeof ev.governed === "boolean" ? { governed: ev.governed } : {}),
+        ...(typeof ev.toolName === "string" ? { toolName: ev.toolName } : {}),
+        ...(typeof ev.toolCallId === "string" ? { toolCallId: ev.toolCallId } : {}),
+    };
+}
 export function turnEndEventData(ev) {
     return {
         ...(ev.usage ? { usage: ev.usage } : {}),
@@ -1004,6 +1014,8 @@ function mapTraceEventInner(type, seq, data) {
         }
         case "prompt_assembled":
             return { event: "prompt-assembled", data: { seq, ...data } };
+        case "cross_boundary_taint":
+            return { event: "cross-boundary-taint", data: { seq, ...data } };
         case "done":
             return { event: "done", data: { seq } };
         case "suspended":

package/dist/trace/redact.d.ts

@@ -165,8 +165,9 @@ export declare function redactionSpansForTest(text: string, opts?: {
 /**
  * 🔴 **出口座的提案口**(S-485 / RH-1 第一期;座 = `src/trace/exit-seat.ts` 的 `seatText`)。
  *
- * 同一只 {@link runRedaction}、同一遍扫描、同一次观察者计数(`observe` 与 {@link redactSecrets} 的缺省同口 —— 座上的一次脱敏就是一次
- * 主扫),交出**原文坐标**上的跨度与各自的替换串:臂认什么、档里有哪些臂,仍然只由本模块答。座拿它做**一次区间合并 + 一次渲染**
+ * 同一只 {@link runRedaction}、同一遍扫描、同一次观察者计数(座上的一次脱敏就是一次主扫),交出**原文坐标**上的跨度与各自的替换串:臂认什么、档里有哪些臂,仍然只由本模块答。
+ * `opts.countHits` 缺省 `true`;`false` = 这一遍照常提案、照常留吃尾一类的 fail-open 痕,只是不把命中表喂观察者(`redactions_applied_total`)——
+ * 座对同一段文本要扫两种读法时,让其中一遍计数。与 {@link redactSecrets} 的 `opts.observe:false` 不同:那是影子重扫,计数与留痕一并不记。座拿它做**一次区间合并 + 一次渲染**
  * (合并律与渲染律住在座里,本模块不拼第二份产物给座)。
  *
  * 第一期交的是池解完重叠之后的那一份(升序、两两不交);第二期改交未解重叠的原始候选,池内并集律 {@link resolveSpanOverlaps} 与
@@ -178,7 +179,9 @@ export type RedactionSpan = {
     readonly repl: string;
 };
 export type { RedactionScope };
-export declare function proposeRedactionSpans(text: string, scope: RedactionScope): readonly RedactionSpan[];
+export declare function proposeRedactionSpans(text: string, scope: RedactionScope, opts?: {
+    readonly countHits?: boolean;
+}): readonly RedactionSpan[];
 /**
  * 🔴 环 + 深度预算(2026-07-25 补)。原实现是纯递归、**既不记已访问节点也不限深度**,而它的调用位置是
  * **最不可信的边界**:`toolStart`/`toolEnd` 把工具的 `args`/`output`/`structured` 直接喂进来。后果两条: