@sema-agent/server 7.133.0 → 7.134.0

package/dist/trace/redact.js

@@ -28,6 +28,137 @@ export function mapNormalizedToOriginal(text, normalized) {
     map[normalized.length] = text.length;
     return map;
 }
+function deleteSpelledFormatCharacters(s) {
+    let i = s.indexOf("\\");
+    if (i < 0)
+        return { text: s, at: undefined, cum: undefined };
+    const n = s.length;
+    const read = { end: 0 };
+    let cuts;
+    while (i >= 0) {
+        let body = i + 1;
+        while (body < n && s.charCodeAt(body) === CH_BACKSLASH)
+            body += 1;
+        const cp = readSpelledCodePoint(s, body, read);
+        if (cp >= 0 && isFormatCodePoint(cp)) {
+            (cuts ??= []).push(i, read.end);
+            body = read.end;
+        }
+        i = s.indexOf("\\", body);
+    }
+    if (cuts === undefined)
+        return { text: s, at: undefined, cum: undefined };
+    const count = cuts.length / 2;
+    const at = new Int32Array(count);
+    const cum = new Int32Array(count);
+    const parts = [];
+    let from = 0;
+    let removed = 0;
+    for (let k = 0; k < count; k++) {
+        const a = cuts[2 * k];
+        const b = cuts[2 * k + 1];
+        parts.push(s.slice(from, a));
+        at[k] = a - removed;
+        removed += b - a;
+        cum[k] = removed;
+        from = b;
+    }
+    parts.push(s.slice(from));
+    return { text: parts.join(""), at, cum };
+}
+function viewIndexInInput(fold, v) {
+    const at = fold.at;
+    let lo = 0;
+    let hi = at.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (at[mid] <= v)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo === 0 ? v : v + fold.cum[lo - 1];
+}
+function readHexRun(s, at, count) {
+    let v = 0;
+    for (let k = at; k < at + count; k++) {
+        const d = hexDigitValue(s.charCodeAt(k));
+        if (d < 0)
+            return -1;
+        v = v * 16 + d;
+    }
+    return v;
+}
+function readEscapeElement(s, at, out) {
+    const kind = s.charCodeAt(at);
+    if (kind === CH_x) {
+        out.end = at + 3;
+        return readHexRun(s, at + 1, 2);
+    }
+    if (kind !== CH_u)
+        return -1;
+    if (s.charCodeAt(at + 1) === CH_LBRACE) {
+        let v = 0;
+        let k = at + 2;
+        for (; k < s.length; k++) {
+            const d = hexDigitValue(s.charCodeAt(k));
+            if (d < 0)
+                break;
+            v = v * 16 + d;
+            if (v > 0x10ffff)
+                return -1;
+        }
+        if (k === at + 2 || s.charCodeAt(k) !== CH_RBRACE)
+            return -1;
+        out.end = k + 1;
+        return v;
+    }
+    out.end = at + 5;
+    return readHexRun(s, at + 1, 4);
+}
+function readSpelledCodePoint(s, at, out) {
+    const v = readEscapeElement(s, at, out);
+    if (v < 0xd800 || v > 0xdfff)
+        return v;
+    if (v > 0xdbff)
+        return -1;
+    let k = out.end;
+    if (s.charCodeAt(k) !== CH_BACKSLASH)
+        return -1;
+    while (s.charCodeAt(k) === CH_BACKSLASH)
+        k += 1;
+    const lo = readEscapeElement(s, k, out);
+    return lo >= 0xdc00 && lo <= 0xdfff ? 0x10000 + ((v - 0xd800) << 10) + (lo - 0xdc00) : -1;
+}
+const FORMAT_CODEPOINT_TABLE = (() => {
+    const table = new Uint8Array(0x10000);
+    const units = [];
+    const codes = [];
+    for (let c = 0; c < 0x10000; c++) {
+        if (c >= 0xd800 && c <= 0xdfff)
+            continue;
+        units.push(String.fromCharCode(c));
+        codes.push(c);
+    }
+    const kept = normalizeForRedaction(units.join(""));
+    let j = 0;
+    for (let i = 0; i < codes.length; i++) {
+        if (j < kept.length && kept.charCodeAt(j) === codes[i])
+            j += 1;
+        else
+            table[codes[i]] = 1;
+    }
+    if (j !== kept.length)
+        throw new Error("redact: format-character stripping is not a code-unit deletion over the BMP — refusing to derive the escape-spelled format-character table");
+    return table;
+})();
+function isFormatCodePoint(cp) {
+    if (cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff))
+        return false;
+    if (cp >= 0x10000)
+        return normalizeForRedaction(String.fromCodePoint(cp)) === "";
+    return FORMAT_CODEPOINT_TABLE[cp] === 1;
+}
 export const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
 const ARM_VALUE_CLASSES = [];
 const atLeast = (cls, min) => {
@@ -42,7 +173,7 @@ const WORD_INTERIOR_CLASS = "[A-Za-z0-9]";
 const CH_TAB = 9, CH_LF = 10, CH_CR = 13, CH_ESC = 27, CH_SPACE = 32, CH_PLUS = 43, CH_MINUS = 45, CH_SLASH = 47;
 const CH_0 = 48, CH_9 = 57, CH_COLON = 58, CH_EQ = 61, CH_AT = 64, CH_A = 65, CH_Z = 90;
 const CH_LBRACKET = 91, CH_BACKSLASH = 92, CH_UNDERSCORE = 95;
-const CH_a = 97, CH_b = 98, CH_f = 102, CH_n = 110, CH_r = 114, CH_t = 116, CH_u = 117, CH_z = 122, CH_TILDE = 126;
+const CH_a = 97, CH_b = 98, CH_f = 102, CH_n = 110, CH_r = 114, CH_t = 116, CH_u = 117, CH_x = 120, CH_z = 122, CH_TILDE = 126;
 const CH_QUOTE = 34;
 const CH_CSI8 = 155;
 const CH_LAQUO = 171;
@@ -632,9 +763,15 @@ function collectStickySpans(a, text, at, out) {
     }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
+const SCHEME_DELIMITER_CHARS = "\\\"'`“”|";
+if (/[\]^-]/.test(SCHEME_DELIMITER_CHARS))
+    throw new Error("redact: scheme delimiter table holds a character-class metacharacter — the class source is built without escaping it");
+const SCHEME_DELIMITER_CODES = new Set([...SCHEME_DELIMITER_CHARS].map((c) => c.charCodeAt(0)));
+const isSchemeDelimiterCode = (c) => SCHEME_DELIMITER_CODES.has(c);
+const SCHEME_SEPARATOR_CLASS = `[\\s${SCHEME_DELIMITER_CHARS.replace(/\\/g, "\\\\")}]`;
 const LEXICAL_KEYWORD_ARMS = new Set();
-const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => {
-    const re = new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
+const keywordArm = (keywordSrc, valueClass, min, tailSrc = "", separatorClass = "\\s") => {
+    const re = new RegExp(`(?:${keywordSrc}${separatorClass}+${atLeast(valueClass, min)}${tailSrc}` +
         `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${atLeast(valueClass, min)}${tailSrc})`, "g");
     LEXICAL_KEYWORD_ARMS.add(re);
     return re;
@@ -668,8 +805,8 @@ const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
 const HEADLESS_PPK_TOKEN = "«redacted:private-key:partial»";
 const ANCHORED_VALUE_TOKEN = "«redacted»";
 const KEYWORD_SECRET_PATTERNS = [
-    [keywordArm("[Bb]earer", "[A-Za-z0-9._~+/-]", 20, "=*"), "Bearer «redacted»"],
-    [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}"), "Basic «redacted»"],
+    [keywordArm("[Bb]earer", "[A-Za-z0-9._~+/-]", 20, "=*", SCHEME_SEPARATOR_CLASS), "Bearer «redacted»"],
+    [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}", SCHEME_SEPARATOR_CLASS), "Basic «redacted»"],
     [keywordArm("[Tt]oken", "[A-Za-z0-9._~+/-]", 20), "token «redacted»"],
 ];
 const SK_FULL_ARM_MIN = 20;
@@ -1772,7 +1909,7 @@ const isValueCloser = (ch) => ch === CH_DOT || ch === CH_COMMA || ch === CH_SEMI
 const isInlineSpaceUnit = (ch) => ch === CH_SPACE || ch === CH_TAB;
 const isToken68Code = (c) => isAsciiAlnumCode(c) || c === CH_DOT || c === CH_MINUS || c === CH_UNDERSCORE || c === CH_TILDE || c === CH_PLUS || c === CH_SLASH;
 const endsValueUnit = (ch) => ch === JSON_STRING_END || isRegexSpace(ch) || isQuoteUnit(ch) || isValueCloser(ch);
-const endsHeaderValueUnit = (ch) => ch === JSON_STRING_END || isLineTerminator(ch) || isQuoteUnit(ch) || ch === CH_COMMA || ch === CH_SEMI || ch === CH_RPAREN || ch === CH_RBRACKET || ch === CH_RBRACE || ch === CH_GT;
+const endsHeaderValueUnit = (ch) => ch === JSON_STRING_END || isLineTerminator(ch) || isSchemeDelimiterCode(ch) || ch === CH_COMMA || ch === CH_SEMI || ch === CH_RPAREN || ch === CH_RBRACKET || ch === CH_RBRACE || ch === CH_GT;
 const bracketOf = (c) => c === CH_LPAREN ? 1 : c === CH_RPAREN ? -1 : c === CH_LBRACKET ? 2 : c === CH_RBRACKET ? -2 : c === CH_LBRACE ? 3 : c === CH_RBRACE ? -3 : c === CH_LT ? 4 : c === CH_GT ? -4 : 0;
 let anchoredScanUnits = 0;
 export function anchoredScanUnitsForTest() {
@@ -2016,15 +2153,16 @@ function schemeValueAt(text, s, json) {
     anchoredScanUnits += i - w;
     if (i - w > STRONG_AUTH_SCHEME_MAX || !STRONG_AUTH_SCHEMES.has(text.slice(w, i).toLowerCase()))
         return undefined;
-    let spaced = false;
+    let separated = false;
     while (i < n) {
         const unit = readAnchorUnit(text, i, json);
-        if (!isInlineSpaceUnit(unitChOf(unit)))
+        const ch = unitChOf(unit);
+        if (!isInlineSpaceUnit(ch) && !isSchemeDelimiterCode(ch))
             break;
         i += unitLenOf(unit);
-        spaced = true;
+        separated = true;
     }
-    if (!spaced)
+    if (!separated)
         return undefined;
     const vs = i;
     if (i >= n || !isAsciiAlnumCode(text.charCodeAt(i)))
@@ -2396,6 +2534,7 @@ const armPool = (() => {
         const tokenOf = (sp) => members[sp.order].token;
         const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full").sort((a, b) => a.start - b.start);
         const byArmedToken = new Map();
+        const stamped = [];
         let si = 0;
         let strongMaxEnd = -1;
         for (const sp of kept) {
@@ -2411,8 +2550,9 @@ const armPool = (() => {
                 byArmedToken.set(key, { token, arm, count: 1 });
             else
                 cur.count += 1;
+            stamped.push({ ...sp, hit: { token, arm } });
         }
-        return { hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept };
+        return { hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept: stamped };
     };
 })();
 let onRedaction;
@@ -2433,21 +2573,49 @@ function reportHits(hits) {
         }
     }
 }
-function runRedaction(text, observe, json, wantHits, scope) {
-    const wantCount = wantHits || (onRedaction !== undefined && observe);
+function runRedaction(text, observe, json, wantHits, scope, muteCount = false) {
+    const wantCount = wantHits || (onRedaction !== undefined && observe && !muteCount);
     const normalized = normalizeForRedaction(text);
-    const r = applyRules(normalized, wantCount, json, observe, scope);
+    const first = applyRules(normalized, wantCount, json, observe, scope);
     forgetEscapedSeparatorTails();
-    if (observe)
-        reportHits(r.hits);
-    const spans = spansInOriginal(text, normalized, r.kept);
-    return { text: applySpans(text, spans).out, hits: r.hits, spans };
+    let spans = spansInOriginal(text, normalized, undefined, first.kept);
+    let hits = first.hits;
+    const second = deleteSpelledFormatCharacters(normalized);
+    if (second.at !== undefined) {
+        const r2 = applyRules(second.text, wantCount, json, false, scope);
+        forgetEscapedSeparatorTails();
+        const extra = spansInOriginal(text, normalized, second, r2.kept);
+        if (extra.length > 0) {
+            spans = resolveSpanOverlaps([...spans, ...extra]);
+            hits = wantCount ? hitsOfSpans(spans) : NO_HITS;
+        }
+    }
+    if (observe && !muteCount)
+        reportHits(hits);
+    return { text: applySpans(text, spans).out, hits, spans };
+}
+function hitsOfSpans(spans) {
+    const by = new Map();
+    for (const sp of spans) {
+        if (sp.hit === undefined)
+            continue;
+        const key = `${sp.hit.token}\u0000${sp.hit.arm}`;
+        const cur = by.get(key);
+        if (cur === undefined)
+            by.set(key, { token: sp.hit.token, arm: sp.hit.arm, count: 1 });
+        else
+            cur.count += 1;
+    }
+    return [...by.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm }));
 }
-function spansInOriginal(text, normalized, kept) {
-    if (kept.length === 0 || normalized === text)
+function spansInOriginal(text, normalized, fold, kept) {
+    if (kept.length === 0)
         return kept;
+    const inNormalized = fold?.at === undefined ? kept : kept.map((s) => ({ ...s, start: viewIndexInInput(fold, s.start), end: viewIndexInInput(fold, s.end - 1) + 1 }));
+    if (normalized === text)
+        return inNormalized;
     const map = mapNormalizedToOriginal(text, normalized);
-    return kept.map((s) => ({ ...s, start: map[s.start], end: map[s.end - 1] + 1 }));
+    return inNormalized.map((s) => ({ ...s, start: map[s.start], end: map[s.end - 1] + 1 }));
 }
 export function redactSecrets(text, opts) {
     return runRedaction(text, opts?.observe ?? true, opts?.json === true, false, "free-text").text;
@@ -2460,8 +2628,8 @@ export function redactionSpansForTest(text, opts) {
     const r = runRedaction(text, false, opts?.json === true, false, "free-text");
     return { text: r.text, spans: r.spans.map((sp) => ({ start: sp.start, end: sp.end })) };
 }
-export function proposeRedactionSpans(text, scope) {
-    return runRedaction(text, true, false, false, scope).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
+export function proposeRedactionSpans(text, scope, opts) {
+    return runRedaction(text, true, false, false, scope, opts?.countHits === false).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
 }
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {

package/dist/trace/self-minted-wire.d.ts

@@ -623,6 +623,10 @@ export declare const SELF_MINTED_WIRE: {
                 attr: string;
                 since: string;
             };
+            approval_feedback: {
+                attr: string;
+                since: string;
+            };
         };
     };
     /**

package/dist/trace/self-minted-wire.js

@@ -210,6 +210,7 @@ export const SELF_MINTED_WIRE = {
             plan_mode_after: { attr: "-", since: "7.133.0" },
             bound_call_door: { attr: "-", since: "7.133.0" },
             remember_decision: { attr: "-", since: "7.133.0" },
+            approval_feedback: { attr: "-", since: "7.134.0" },
         },
     },
     limitRefusalReason: {

package/dist/trace/wire-projection-faces.d.ts

@@ -268,6 +268,12 @@ export declare const WIRE_PROJECTION_FACES: {
         readonly excluded: readonly [];
         readonly minted: readonly [];
     };
+    readonly cross_boundary_taint: {
+        readonly projector: "crossBoundaryTaintEventData";
+        readonly coreType: "Extract<TraceEvent, { kind: \"permission.cross_boundary_taint\" }>";
+        readonly excluded: readonly ["kind", "version", "taskId", "ts"];
+        readonly minted: readonly [];
+    };
     readonly prompt_manifest: {
         readonly projector: "promptManifestRecordOf";
         readonly coreType: "Extract<TraceEvent, { kind: \"prompt.assembled\" }>";

package/dist/trace/wire-projection-faces.js

@@ -77,6 +77,12 @@ export const WIRE_PROJECTION_FACES = {
     },
     origin_clearance_origin: { projector: "buildClearanceRowWire", coreType: "MemoryEntryOrigin", excluded: [], minted: [] },
     origin_clearance_event: { projector: "buildClearanceRowWire", coreType: "OriginClearanceEvent", excluded: [], minted: [] },
+    cross_boundary_taint: {
+        projector: "crossBoundaryTaintEventData",
+        coreType: `Extract<TraceEvent, { kind: "permission.cross_boundary_taint" }>`,
+        excluded: ["kind", "version", "taskId", "ts"],
+        minted: [],
+    },
     prompt_manifest: {
         projector: "promptManifestRecordOf",
         coreType: MANIFEST_FRAME,

package/dist/web-admin-client/skills-mcp.d.ts

@@ -30,7 +30,7 @@ export declare function applySkillsManifest(baseline: LoadedSkill[], manifest: {
  * Resolve center MCP servers (`/effective.mcp`) into core `McpServerSpec`s + the scenarios each applies to.
  * env-NAME refs → real values from THIS service's env (secret boundary unchanged); a server with any missing
  * ref is skipped (`resolveRefs` → null). `enabled:false` skipped. A server whose `toolFaces` / `toolAxes` declaration is
- * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / the engine's `readMcpToolAxes`). Restart-to-apply
+ * malformed is skipped whole (both are trust-root declarations — the engine's `readToolFaces` / `readMcpToolAxes` judge them). Restart-to-apply
  * (filtered per scenario in `resolveSpec` via `mcpForScenario`).
  */
 export declare function resolveMcpServers(mcp: {

package/dist/web-admin-client/skills-mcp.js

@@ -1,7 +1,6 @@
 import { readMcpSourceLabel } from "../mcp-source-label.js";
-import { readMcpToolFaces } from "../mcp-tool-faces.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
-import { readMcpToolAxes } from "@sema-agent/core";
+import { readMcpToolAxes, readToolFaces } from "@sema-agent/core";
 import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, isContentOriginWord, isUsableWireName } from "@sema-agent/settings-schema";
 import { noteMcpAssertionHeaderNotSent, sentMcpAssertionHeaderMember, withholdsMcpAssertionHeader } from "../mcp-assertion-header.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
@@ -116,7 +115,7 @@ export function resolveMcpServers(mcp, logger) {
                 });
         }
         const source = readMcpSourceLabel(s.name, s.source);
-        const facesRead = readMcpToolFaces(s.toolFaces);
+        const facesRead = readToolFaces(s.toolFaces);
         if (!facesRead.ok) {
             logger?.warn("web_admin_mcp_tool_faces_invalid", {
                 server: s.name,

package/dist/web-admin-client/types.d.ts

@@ -147,7 +147,7 @@ export interface CenterMcpServer {
      *
      * 🔴 类型是 `unknown` 而不是那个结构,**刻意的**:本类型是两条 center 腿的**承载形**(本地 config.d 经
      * settings-schema 的 `z.unknown()` 解析透明地过来、远端 /effective 是直读 JSON),判据与坏形处置的单一
-     * 属主是 `mcp-tool-faces.ts` 的 `readMcpToolFaces`(`resolveMcpServers` 在铸 spec 那一刻调它)。在承载
+     * 属主是引擎根导出的 `readToolFaces`(`resolveMcpServers` 在铸 spec 那一刻调它)。在承载
      * 形上先写一个结构,等于把同一张判据表抄成两份(而其中一份没有执行力)。
      */
     toolFaces?: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.133.0",
+  "version": "7.134.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -68,7 +68,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.53.0",
+    "@sema-agent/core": "7.54.1",
     "@sema-agent/settings-schema": "14.2.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",

package/scripts/drain-check-local.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * 换钉前的**排空检查 —— `DB_BACKEND=local`(File 店)车道**,只读。随 npm 包出(`scripts/drain-check-local.mjs`)。
- * 一次跑**八条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
+ * 一次跑**九条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
  * 每条判据一段、段首标记 `-- drain-check:<判据名>:<后端>`,判据名与本表的 `name` 同一个词):
  *  · `skill-grants-rollback`(**回滚**到 7.115.x 前,即引擎从 7.41 退回 7.40):四样任一 ——
  *    ① pending 行带 `state.skillGrants`(本次 run 冻结在行上的技能授予行:模型激活 / 子代捕获写下的放行与禁止);
@@ -31,6 +31,7 @@
  *    `dist/orchestration/workflow-agent-session-index.js` 取 —— 本脚本只按 runId 折叠;读不出的行计入 `corrupt`(rc 2:读不出的那一行可能正是点名某张待批卡的那一份);
  *    窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
  *  · `parked-tool-lists`(升级到 7.132.0 前)/ `own-tool-lists-rollback`(从 7.132.0 回滚前):停驻行记下的工具名清单 / 7.52 写下的 `ownToolLists`(判据与出路见判据表那两条的注);
+ *  · `sealed-credentials-rollback`(从 7.134.0 回滚前):续跑上下文的凭据位上带封签的 pending 行(7.133.x 读不懂封签,续跑时把这些位当没有;判据与出路见判据表那一条的注);
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
  *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
  *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
@@ -74,6 +75,7 @@
  *    `SKILL-DENY-INERT-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
  *    `WORKFLOW-PARK-ROW token=<token> sessionId=<id> createdAt=<ms> runId=<点名它的 run,逗号连接>` /
  *    `PARKED-TOOL-LISTS-ROW token=<token> sessionId=<id> createdAt=<ms> member=<toolCeiling|constraintChain|boundGrantDigest>` / `OWN-TOOL-LISTS-ROW token=<token> sessionId=<id> createdAt=<ms>` /
+ *    `SEALED-CREDENTIALS-ROW token=<token> sessionId=<id> createdAt=<ms> field=<第一处带封签的凭据位>|runId=<workflow 子代卡:点它的 run>` /
  *    `ALLOW-LIST-ROW token=<token> sessionId=<id> createdAt=<ms>` / `RETIRED-ROW token=<token> sessionId=<id> createdAt=<ms> member=<成员>`;
  *  · 每条判据一行末行(表序;`RETIRED-MODE-SEED` 那一行恒在最后,7.113.0 起读「最后一行」的下游不受影响;`PERMISSIONS-ALLOW-LIST` 仍是倒数第二行):
  *    `SKILL-GRANTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
@@ -82,6 +84,7 @@
  *    `WORKFLOW-PARK-HOLDER rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PARKED-TOOL-LISTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `OWN-TOOL-LISTS-ROLLBACK rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
+ *    `SEALED-CREDENTIALS-ROLLBACK rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PERMISSIONS-ALLOW-LIST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-MODE-SEED rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`;
  *    `corrupt` = 共用扫描的坏记录 + 这条判据自己读不懂的旁路输入(`permissions-allow-list`:读不懂的 ctx 档,文件名进 stderr —— 一份读不懂的 ctx 可能正是某条 pending 行带 `allow` 的那一份;
@@ -97,7 +100,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** 从脚本隔壁的编译产物取来的服务判据(脚本不持第二份实现)。
- * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined, readAgentSessionLedgerLine: (v: unknown) => { runId: string, rows: Array<{ sessionId: string }> } | undefined }} ServiceCriteria */
+ * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, sealedCredentialFieldOf: (ctx: unknown) => string | undefined, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined, readAgentSessionLedgerLine: (v: unknown) => { runId: string, rows: Array<{ sessionId: string }> } | undefined }} ServiceCriteria */
 
 /** 读期间文件在变时的有界重读次数(含第一次)。 */
 const STABLE_READ_ATTEMPTS = 3;
@@ -460,6 +463,34 @@ export const DRAIN_CRITERIA = [
     load: () => ({ input: undefined, corrupt: 0, unreadable: [] }),
     judge: (row) => (isObject(row.state) && Object.hasOwn(/** @type {Record<string, unknown>} */ (row.state), "ownToolLists") ? "" : undefined),
   },
+  {
+    // 从 7.134.0 回滚到 7.133.x 之前:pending 行所在会话的续跑上下文里,提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+    // 上带封签 —— 7.134.0 封好才落盘,7.133.x 读不懂封签、续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(随包 `MIGRATION.md` 7.134.0 节)。
+    // 判据函数是服务里那一只(`sealedCredentialFieldOf`,经编译产物 `dist/http/checkpoint-ctx.js` 取;走法与封口 / 开口 / 一次性迁移同一只),本脚本不写第二份;
+    // 命中行点名第一处凭据位(`field=`,键名;值从不出来);读不懂的 ctx 档 / 索引账本行计入 `corrupt`(rc 2)。
+    // 读哪一份续跑上下文与续跑腿同:workflow 子代卡(子会话被 park 索引点名)续跑读**发起会话**那一份,而发起会话记在引擎的 run 账里(引擎自己的账本格式,本脚本不重抄)
+    // ⇒ 子代卡数的是真超集:自己那一份带封签,或数据根里任一份 ctx 带封签,即记为候选并点名点它的 run(`runId=`)—— 与随包 SQL 孪生同为超集,不漏。
+    // 表序在 `permissions-allow-list` 之前 —— 那一条仍倒数第二、`RETIRED-MODE-SEED` 仍最后。
+    name: "sealed-credentials-rollback",
+    tail: "SEALED-CREDENTIALS-ROLLBACK",
+    hit: "SEALED-CREDENTIALS-ROW",
+    load: (root, service) => {
+      const idx = readCtxIndex(root);
+      const parks = readParkIndex(root, service.readAgentSessionLedgerLine);
+      const fieldOf = service.sealedCredentialFieldOf;
+      const anySealed = [...idx.bySession.values()].some((ctx) => fieldOf(ctx) !== undefined);
+      return { input: { bySession: idx.bySession, fieldOf, parkedBy: parks.bySession, anySealed }, corrupt: idx.corrupt + parks.corrupt, unreadable: [...idx.unreadable, ...parks.unreadable] };
+    },
+    judge: (row, input) => {
+      const { bySession, fieldOf, parkedBy, anySealed } = /** @type {{ bySession: Map<string, Record<string, unknown>>, fieldOf: ServiceCriteria["sealedCredentialFieldOf"], parkedBy: Map<string, string[]>, anySealed: boolean }} */ (input);
+      if (typeof row.sessionId !== "string") return undefined;
+      const ctx = bySession.get(row.sessionId);
+      const field = ctx === undefined ? undefined : fieldOf(ctx);
+      if (field !== undefined) return ` field=${field}`;
+      const runs = parkedBy.get(row.sessionId);
+      return runs !== undefined && anySealed ? ` runId=${runs.join(",")}` : undefined;
+    },
+  },
   {
     name: "permissions-allow-list",
     tail: "PERMISSIONS-ALLOW-LIST",
@@ -503,6 +534,7 @@ async function loadServiceCriteria(rootEcho) {
   /** @type {Array<[string, () => Promise<Record<string, unknown>>, string]>} 〔产物相对路径(报告用), 取模块, 导出名〕 */
   const wanted = [
     ["dist/http/checkpoint-ctx.js", () => import("../dist/http/checkpoint-ctx.js"), "allowListReadingUnstated"],
+    ["dist/http/checkpoint-ctx.js", () => import("../dist/http/checkpoint-ctx.js"), "sealedCredentialFieldOf"],
     ["dist/http/retired-skill-manifest.js", () => import("../dist/http/retired-skill-manifest.js"), "retiredSkillManifestLayerOf"],
     ["dist/rule-entry-list.js", () => import("../dist/rule-entry-list.js"), "skillDenyInertEntryOf"],
     ["dist/orchestration/workflow-agent-session-index.js", () => import("../dist/orchestration/workflow-agent-session-index.js"), "readAgentSessionLedgerLine"],

package/scripts/drain-check.mysql.sql

@@ -8,15 +8,16 @@
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。以 hit_rows 为准:这一列被会话变量 group_concat_max_len(缺省 1024 字节)截断时,列出的会话数会少于 hit_rows ——
 --              先处理列出的再跑一次,或先在同一个会话里 SET SESSION group_concat_max_len = 1048576; 再跑本文件(本文件自己只含 SELECT)。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,八条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,九条判据同名。
 --
--- 八条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 九条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x 之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -115,6 +116,23 @@ FROM checkpoint k
 WHERE k.status = 'pending'
   AND JSON_CONTAINS_PATH(k.checkpoint, 'one', '$.state.ownToolLists');
 
+-- drain-check:sealed-credentials-rollback:mysql —— 期望 hit_rows = 0;每一行 = 一条**候选**:从 7.134.0 回滚到 7.133.x 后续跑会丢掉请求凭据的停驻行。
+-- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+-- 封成封签(对象,格式词 "checkpoint-ctx-sealedbox-v1")才落盘;7.133.x 读不懂封签,续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(见随包 MIGRATION.md 7.134.0 节)。
+-- 读哪一份续跑上下文:与续跑腿同(连接形与 permissions-allow-list 段逐字同,理由见该段注)。SQL 不走凭据位闭集 ⇒ 数的是**真超集**:提交体里任何一处有一个
+-- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
+SELECT 'sealed-credentials-rollback' AS criterion, COUNT(*) AS hit_rows,
+       COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND EXISTS (SELECT 1
+              FROM checkpoint kk
+              LEFT JOIN workflow_agent_session w ON w.session_id = kk.session_id
+              LEFT JOIN workflow_run r ON r.id = w.run_id
+              JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), kk.session_id)
+              WHERE kk.token = k.token
+                AND LOCATE('"checkpoint-ctx-sealedbox-v1"', CAST(JSON_EXTRACT(c.ctx, '$.body') AS CHAR)) > 0);
+
 -- drain-check:permissions-allow-list:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
 -- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是

package/scripts/drain-check.pg.sql

@@ -7,15 +7,16 @@
 --   hit_rows   命中的停驻行数(pending 行里算命中的那些);**全部为 0 才算排空**,非 0 ⇒ 逐条答完或取消(各判据对应的升级 / 回滚说明见随包 MIGRATION.md);
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,八条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,九条判据同名。
 --
--- 八条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 九条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x 之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -123,6 +124,23 @@ FROM checkpoint k
 WHERE k.status = 'pending'
   AND (k.checkpoint -> 'state') ? 'ownToolLists';
 
+-- drain-check:sealed-credentials-rollback:pg —— 期望 hit_rows = 0;每一行 = 一条**候选**:从 7.134.0 回滚到 7.133.x 后续跑会丢掉请求凭据的停驻行。
+-- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+-- 封成封签(对象,格式词 "checkpoint-ctx-sealedbox-v1")才落盘;7.133.x 读不懂封签,续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(见随包 MIGRATION.md 7.134.0 节)。
+-- 读哪一份续跑上下文:与续跑腿同(连接形与 permissions-allow-list 段逐字同,理由见该段注)。SQL 不走凭据位闭集 ⇒ 数的是**真超集**:提交体里任何一处有一个
+-- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
+SELECT 'sealed-credentials-rollback' AS criterion, count(*) AS hit_rows,
+       coalesce(string_agg(k.session_id, ',' ORDER BY k.created_at_ms DESC), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND EXISTS (SELECT 1
+              FROM checkpoint kk
+              LEFT JOIN workflow_agent_session w ON w.session_id = kk.session_id
+              LEFT JOIN workflow_run r ON r.id = w.run_id
+              JOIN checkpoint_ctx c ON c.session_id = COALESCE(r.run::json->>'originatingSessionId', kk.session_id)
+              WHERE kk.token = k.token
+                AND strpos((c.ctx -> 'body')::text, '"checkpoint-ctx-sealedbox-v1"') > 0);
+
 -- drain-check:permissions-allow-list:pg —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
 -- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是