@sema-agent/server 7.146.0 → 7.147.0

package/dist/trace/core-keyset-guard.d.ts

@@ -20,6 +20,7 @@
 import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, CheckpointGate, CheckpointToken, VerificationResult, CascadeRunResult, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, DeploymentSessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 import type { TableCoreKeys } from "./projection-table.js";
+import type { ProjectRegistration } from "@sema-agent/settings-schema";
 import type { PauseSeat } from "../terminal.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -27,12 +28,12 @@ import type { PauseSeat } from "../terminal.js";
  *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
  *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
 export type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance" | "spawnName" | "handback" | "compaction" | "resupplied" | "attempt";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance" | "spawnName" | "handback" | "compaction" | "resupplied" | "attempt" | "crossSessionMessage" | "crossSessionNotice" | "inboxNotice";
 type NotificationExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["task_notification"]["excluded"][number];
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type _GuardNotificationReverse = AssertAllKeysHandled<Exclude<NotificationProjected | NotificationExcluded, keyof TaskNotificationPayload>>;
-type ProvenanceProjected = "kind" | "from" | "taskId" | "seq" | "agentType";
-type ProvenanceExcluded = "peerMeta";
+type ProvenanceProjected = "kind" | "from" | "taskId" | "seq" | "agentType" | "peerMeta";
+type ProvenanceExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["task_notification_provenance"]["excluded"][number];
 type _GuardProvenance = AssertAllKeysHandled<Exclude<keyof SemaProvenance, ProvenanceProjected | ProvenanceExcluded>>;
 type _GuardProvenanceReverse = AssertAllKeysHandled<Exclude<ProvenanceProjected | ProvenanceExcluded, keyof SemaProvenance>>;
 type AgentMessageProjected = "from" | "body";
@@ -522,6 +523,9 @@ type WorkspaceChangedArm = Extract<TaskEvent, {
 }>;
 type _GuardSessionWorkspace = AssertAllKeysHandled<Exclude<keyof WorkspaceChangedArm, TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>>>;
 type _GuardSessionWorkspaceReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<SessionWorkspaceTables["SESSION_WORKSPACE_DISPOSITIONS"]>, keyof WorkspaceChangedArm>>;
+type ProjectRegistryTables = typeof import("../http/routes/projects.js");
+type _GuardProjectRow = AssertAllKeysHandled<Exclude<keyof ProjectRegistration, TableCoreKeys<ProjectRegistryTables["PROJECT_ROW_DISPOSITIONS"]>>>;
+type _GuardProjectRowReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<ProjectRegistryTables["PROJECT_ROW_DISPOSITIONS"]>, keyof ProjectRegistration>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardTerminalArm,
@@ -668,6 +672,8 @@ export type CoreKeysetGuards = [
     _GuardLedgerRunnerDepsReverse,
     _GuardSessionWorkspace,
     _GuardSessionWorkspaceReverse,
+    _GuardProjectRow,
+    _GuardProjectRowReverse,
     _GuardTokenSeats,
     _GuardTokenSeatsReverse,
     _GuardGateSeats,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -53,6 +53,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "context.tool_schema_removed",
     "memory.harvest_refused",
     "memory.harvest_conflict",
+    "config.legacy_tool_name",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -116,6 +117,7 @@ export const RULE_TEXT_DETAIL_FIELDS = {
     "permission.allowed_tool_not_granted": { array: "entries", field: "entry" },
     "permission.rule_row_dropped": { array: "rows", field: "rule" },
     "config.session_rules_earlier_grammar": { array: "entries", field: "entry" },
+    "config.legacy_tool_name": { array: "entries", field: "entry" },
 };
 export function redactNoticeMessage(message) {
     return redactSecrets(String(message));

package/dist/trace/exit-seat.d.ts

@@ -22,7 +22,14 @@ export type SafeText = string & {
  *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行,以及能力读面 `GET /v1/capabilities/mcp` 上引擎整集拒(两台撞同一工具命名空间前缀)的拒句 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
  *  · `inbox-diagnostics-text`:`workflow_complete` 补投帧上的诊断教学文本(`diagnostics`)—— 引擎在 workflow 完成通知上铸的「读哪里 / 怎么续跑」文本,入会话收件时洗一次,
  *    店里(`payload` 列)只放出门安全的字节,drain 逐字带出。洗法与 live `task_notification.diagnostics` 同一个 scope(`free-text`);
- *    这一行比 `trace-frame-text` 多一条界(4000 码元,与同族条目的文本位同额),原样出门:`payload` 列是 TEXT,无界的文本一旦超过列宽,入箱写整条失败、补投连摘要一起丢(完成已被记作送达),所以先有界。
+ *    这一行比 `trace-frame-text` 多一条界(4000 码元,与同族条目的文本位同额),原样出门:逐成员的粗截;整条 `payload` 装不装得下由条目编码座按字节预算终判
+ *    (`orchestration/workflow-completion-inbox.ts` 的 `encodeInboxBody`,预算 = 最窄后端的 `payload` 列容量,超 ⇒ 最小形 + `payloadTruncated`)。
+ *  · `inbox-frame-text`:`task_notification` 补投帧(停驻收件、下一次开流 drain)上会话箱车道的自由文本位 —— 三只载体的 `crossSessionMessage.fromName` /
+ *    `.body`、`crossSessionNotice.text` 与侧记 `_sema_provenance.peerMeta.notice` 的 `recipient` / `target` / `detail` / `dropReason`(别的会话写的或引擎嵌着
+ *    别的会话文本渲的句子);入会话收件时经与 live 腿同一只判据(`task-notification-facets.ts` / `sema-provenance.ts`)洗一次,店里(`payload` 列)只放
+ *    出门安全的字节,drain 逐字带出。scope 与 live 的 `trace-frame-text` 同(`free-text`),多一条界(4000 码元,与同族条目既有文本位 `result` /
+ *    `agentMessage.body` 同额),原样出门。这条界是**逐成员**的粗截:多枚文本位相加、JSON 转义放大(控制字符一枚 6 字节)后的总和由条目编码座按
+ *    整条字节预算终判(`encodeInboxBody`;同上行),本行只挡一枚文本独自变长。
  *  · `boot-refusal-line`:起服拒启的一行拒句 —— 部署座装配的拒句(`mods-declaration.ts`:声明的席名、包名、读包者 / 引擎准入交回的话);它经进程级 fatal 出口原样多行进 stderr,
  *    所以必须在这里先压成一行(一句拒因里的换行会在运维的终端里伪造出第二条日志行);界 512 码元(含截断记号)。
  *  · `workflow-recovery-summary`:workflow 完成通知在崩溃恢复路径上由 run 行的错误文本合成的摘要(`summary`;`orchestration/workflow-notify-journal.ts` 的 `recoverySummary`)——
@@ -31,6 +38,10 @@ export type SafeText = string & {
  *  · `peer-inbound-card-text`:运维审批队列 `peer_inbound` 行(`GET /v1/approvals` 的 `pending[]` 与 `/v1/approvals/stream` 的 `pending` 帧)上被扣跨会话来信的
  *    存储正文(`content`,core 的规范存储形 `[summary] message`)与发信方显示名(`fromName`)—— 别的会话写的自由文本,读者是收信方本人;不设界(core 存的那一份就是
  *    收信方要审的全文,截了就审不全),原样出门(JSON 串值,消费方自己渲染)。
+ *  · `rewind-ledger-path`:run 外回退口(`POST /v1/sessions/:id/rewind-files`)200 体上被跟踪文件的路径(台账与预览的 `filesChanged` / `identicalSkipped` /
+ *    `refused[].path` / `failed[].path`;源头是模型交的路径参数)—— 不设界(截过的路径就不是那个文件了,消费方要拿它去对文件),原样出门。
+ *  · `rewind-ledger-reason`:同一口台账上的拒因 / 故障句(`refused[].reason` / `failed[].reason` / `error.message`;引擎与文件历史店写的、可能带着抛出物原文)——
+ *    界 500 码元,原样出门(JSON 串值,消费方自己渲染)。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -76,6 +87,10 @@ declare const EXIT_SEATS: {
         readonly scope: "free-text";
         readonly maxChars: 4000;
     };
+    readonly "inbox-frame-text": {
+        readonly scope: "free-text";
+        readonly maxChars: 4000;
+    };
     readonly "boot-refusal-line": {
         readonly scope: "free-text";
         readonly maxChars: 512;
@@ -87,6 +102,13 @@ declare const EXIT_SEATS: {
     readonly "workflow-recovery-summary": {
         readonly scope: "diagnostic";
     };
+    readonly "rewind-ledger-path": {
+        readonly scope: "free-text";
+    };
+    readonly "rewind-ledger-reason": {
+        readonly scope: "free-text";
+        readonly maxChars: 500;
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /** 设了界的座名。 */

package/dist/trace/exit-seat.js

@@ -15,9 +15,12 @@ const EXIT_SEATS = {
     "mcp-remote-text": { scope: "free-text", maxChars: 200 },
     "peer-declaration-sentence": { scope: "free-text" },
     "inbox-diagnostics-text": { scope: "free-text", maxChars: 4000 },
+    "inbox-frame-text": { scope: "free-text", maxChars: 4000 },
     "boot-refusal-line": { scope: "free-text", maxChars: 512, emit: "log-line" },
     "peer-inbound-card-text": { scope: "free-text" },
     "workflow-recovery-summary": { scope: "diagnostic" },
+    "rewind-ledger-path": { scope: "free-text" },
+    "rewind-ledger-reason": { scope: "free-text", maxChars: 500 },
 };
 export function seatMaxChars(seat) {
     return EXIT_SEATS[seat].maxChars;

package/dist/trace/project.d.ts

@@ -25,10 +25,10 @@
  */
 import type { GateOutcome, McpDelivered, TaskResult, SystemInjectionPriority } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
-import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
-import type { RunCompanionRecord } from "../observability/prompt-manifest.js";
+import type { ModelUsageDelta, ModelUsageTracker, PromptManifestTracker } from "../budget.js";
 import { type SafeText } from "./exit-seat.js";
-import { type SemaProvenanceInput } from "./sema-provenance.js";
+import { type SemaProvenanceWire } from "./sema-provenance.js";
+import { type CrossSessionMessageWire, type CrossSessionNoticeWire } from "./task-notification-facets.js";
 import { type ExtensionRequesterFace, type ToolInputRewriteFace } from "./extension-call-face.js";
 import type { LedgerEventType, ParkLedgerEventType } from "./ledger-events.js";
 import type { InstructionsSegment } from "../instruction-selection.js";
@@ -47,15 +47,23 @@ type GetEventsFn = (taskId: string, afterSeq: number) => Promise<RunEvent[]>;
  *  apart rows written under the current component semantics from older rows (pre-dating this label) when it
  *  sums across a run's whole event log. */
 export declare function appendModelUsageDelta(append: AppendFn, modelUsage: ModelUsageTracker | undefined, taskId: string): Promise<void>;
-/** [ref]② drain the pending prompt-manifest records (whitelisted at RECORD time, budget.ts — ids/digests/
- *  counts only, no prompt bodies by core's manifest contract) into durable `prompt_assembled` events, one per
- *  prepare IN EMISSION ORDER (a cascade/verify leg re-prepares under one taskId — every rung's manifest
- *  persists; release-review finding). Shared by both durable-write legs; a no-op when nothing is pending
- *  (one Map.get), so callers fire it liberally. */
-export declare function appendPromptManifest(append: AppendFn, tracker: {
-    drain(taskId: string): PromptManifestRecord[] | undefined;
-    drainCompanions?(taskId: string): RunCompanionRecord[] | undefined;
-} | undefined, taskId: string): Promise<void>;
+/** 一条腿在 run 级清单 / 伴随记录队列上的那一席(产物带方法 ⇒ `create*`)。 */
+export interface PromptManifestSeat {
+    /** 把这条腿已排队的清单行与伴随记录(按发射序)落进**这条腿的**账本写口;无待落 ⇒ 零 I/O(一次 Map 读),所以腿可以在每一帧之前调。 */
+    drain(append: AppendFn): Promise<void>;
+    /** 收摊:只在本席仍持租约时注销并丢弃未排空的记录(B-3 窗:一条快的兄弟续跑腿可能已经以同一 taskId 重新登记,那一席归它)。幂等。 */
+    release(): void;
+}
+/**
+ * **写账本的腿登记 run 级清单 / 伴随记录队列的唯一一只登记器**(`prompt_assembled` / `config_assembled` / `cross_boundary_taint` 三种行同一只队列)。
+ *
+ * 一条律:**有账本的腿就有这一席** —— bg 首跑(`runs.ts`)、续跑两径(`http/resume-legs.ts`)、同步流腿(`http/routes/tasks.ts`,有 durable run 行即有账本)
+ * 都经这一只:建席 = 登记(tracer 的 `record` / `recordCompanion` 只收已登记的顶层 run,子代永不登记)、`drain` = 落本腿账本、`release` = 带租约收摊。
+ * 腿只决定**在哪几拍排空**(每一帧之前 / 终局行之前),不再各写一份「登记 → 排空 → 租约清」—— 7.147.0 之前同步流腿漏了这一席,
+ * 它的账本因此一行清单 / 伴随记录都没有。非流式 `POST /v1/tasks` 结构上没有账本(契约 KL),没有这一席。
+ * `tracker` 缺席(部署没接)⇒ 席是空操作。
+ */
+export declare function createPromptManifestSeat(tracker: PromptManifestTracker | undefined, taskId: string): PromptManifestSeat;
 /** E8: at a TERMINAL done — flush the final delta, then SUM all `model_usage` events (every process leg) into the
  *  result's `stats.modelUsage` echo. Returns the result unchanged when no usage was tracked (shell soft-degrades). */
 export declare function attachModelUsage<T extends TaskResult>(result: T, ctx: {
@@ -538,9 +546,12 @@ export declare function taskNotificationEventData(ev: {
             body: string;
         };
         /** 同批:typed 归因侧记(wire 键;core 契约「a host projects it, the model never sees it」)。成员逐个挑取,
-         *  `kind` 过闭集(`trace/sema-provenance.ts` 单点,park 半场同一判据);`agentType` 本 mount 恒缺席(工具无
-         *  agent-type 席),在场即透传(fleet spawn 帧按 taskId 可 join 时上游给)。 */
-        _sema_provenance?: SemaProvenanceInput;
+         *  `kind` 过闭集、`peerMeta` 逐成员(`trace/sema-provenance.ts` 单点,park 半场同一判据;入参按 `unknown` 收、判过形才成 typed)。 */
+        _sema_provenance?: unknown;
+        /** [ref]:会话箱车道的三只载体 —— 判据单点在 `trace/task-notification-facets.ts`(与 park 半场同一只;入参按 `unknown` 收)。 */
+        crossSessionMessage?: unknown;
+        crossSessionNotice?: unknown;
+        inboxNotice?: unknown;
         /** core 7.30.0 [ref] S1 / [ref] / [ref]([ref]):委派终态帧三枚 facet + 重供两键 —— 判据单点在
          *  `trace/task-notification-facets.ts`(与 park 半场同一只;入参按 `unknown` 收、判过形才成 typed)。 */
         spawnName?: string;
@@ -580,6 +591,9 @@ export declare function taskNotificationEventData(ev: {
         from: string;
         body: SafeText;
     };
+    _sema_provenance?: SemaProvenanceWire;
+    crossSessionMessage?: CrossSessionMessageWire;
+    crossSessionNotice?: CrossSessionNoticeWire;
 }>;
 /** The `compacted` payload — EXPLICIT WHITELIST shared by all three legs (bg runs.ts + resume append + the sync
  *  live SSE frame; the 1.72 task_progress lesson: never `{...ev}`). trigger/tokensBefore (MF-18) verbatim;
@@ -1166,7 +1180,10 @@ export declare function contextUsageEventData(ev: {
  * trace SSE `GET /v1/tasks/:id/stream` 上是 `cross-boundary-taint` 帧,按存下的行原样交出)。帧只在**执行于目标设备的树**上发(武装腿 prepare / 续跑腿 resume 各一帧,离目标读第一次放进树时 observed 一帧),
  * 宿主车道零帧 ⇒ 本行在宿主车道上永不出现。纯元数据(core 逐字「Metadata only」):树的污染位(`taint`,core `CROSS_BOUNDARY_TAINT_BITS` 的子集)、
  * 树是否受治理(`governed`)、阶段(`phase`)、腿的 `runId`,observed 时那一只调用(`toolName` / `toolCallId`)。
- * 信封(`kind` / `version` / `taskId` / `ts`)不上行:行自带 seq / ts,run 就是 taskId(与清单行同一条律;登记表 `cross_boundary_taint` 行)。
+ * 信封(`kind` / `version` / `taskId` / `ts`)不上行:账本行自带 seq / ts(`RunEvent`),行种类由账本行名说;`taskId` 不上行,是因为落进来的帧都是已登记的顶层 run 发的 ——
+ * 落账处 `PromptManifestTracker.recordCompanion` 只收已登记的 `taskId`(与清单行同一只登记门;`createPromptManifestSeat` 建席即登记,子代永不登记),行落进的就是这条 `taskId` 自己的账本,
+ * 所以根腿发的帧它就是 run;委派子代腿发的帧 `taskId` 是**子代腿自己的 id**(不是根 run)、未登记 ⇒ 落账处不收,这类帧今天落不进根 run 的账本
+ * (契约 §4a-cbt「读法」的限定;根归属候引擎给帧加根地址键)。登记表 `cross_boundary_taint` 行(`trace/wire-projection-faces.ts`)是同一句读法。
  * 值:`taint` 交一份数组副本(只收串);`toolName` / `toolCallId` 在场才铸。词按开集串过境(属主是引擎的闭集;本仓不判词表)。
  */
 export declare function crossBoundaryTaintEventData(ev: {

package/dist/trace/project.js

@@ -7,8 +7,8 @@ import { seatText } from "./exit-seat.js";
 import { sanitizeWireText } from "./engine-notice-wire.js";
 import { projectToolOutput, projectToolStructured } from "./tool-output-media.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
-import { semaProvenanceOrAbsent } from "./sema-provenance.js";
-import { resupplyFields, terminalFrameFacetFields } from "./task-notification-facets.js";
+import { semaProvenanceFields } from "./sema-provenance.js";
+import { resupplyFields, sessionBoxCarrierFields, terminalFrameFacetFields } from "./task-notification-facets.js";
 import { dropProjectedFace } from "./projection-drop.js";
 import { extensionAnswererOf, extensionRequesterOf, toolInputRewriteOf } from "./extension-call-face.js";
 import { projectByTable } from "./projection-table.js";
@@ -23,7 +23,7 @@ export async function appendModelUsageDelta(append, modelUsage, taskId) {
         await append("model_usage", { usage: tagged });
     }
 }
-export async function appendPromptManifest(append, tracker, taskId) {
+async function appendPromptManifest(append, tracker, taskId) {
     const records = tracker?.drain(taskId);
     if (records)
         for (const m of records)
@@ -33,6 +33,13 @@ export async function appendPromptManifest(append, tracker, taskId) {
         for (const c of companions)
             await append(c.type, c.data);
 }
+export function createPromptManifestSeat(tracker, taskId) {
+    const lease = tracker?.register(taskId) ?? 0;
+    return {
+        drain: (append) => appendPromptManifest(append, tracker, taskId),
+        release: () => tracker?.clear(taskId, lease),
+    };
+}
 export async function attachModelUsage(result, ctx) {
     if (!ctx.modelUsage)
         return result;
@@ -398,14 +405,10 @@ export function taskNotificationEventData(ev) {
         ...(n.output_file !== undefined ? { output_file: seatText("trace-frame-text", n.output_file) } : {}),
         ...(n.usage !== undefined ? { usage: n.usage } : {}),
         ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: seatText("trace-frame-text", n.agentMessage.body) } } : {}),
-        ...(() => {
-            if (n._sema_provenance === undefined)
-                return {};
-            const p = semaProvenanceOrAbsent(n._sema_provenance);
-            return p !== undefined ? { _sema_provenance: p } : {};
-        })(),
+        ...semaProvenanceFields(n, "trace-frame-text"),
         ...terminalFrameFacetFields(n),
         ...resupplyFields(n),
+        ...sessionBoxCarrierFields(n, "trace-frame-text"),
         ...(() => {
             const tier = injectionTierOrAbsent(ev.priority);
             return tier !== undefined ? { priority: tier } : {};

package/dist/trace/redact.d.ts

@@ -58,7 +58,7 @@ export declare function resetArmPoolBudgetForTest(): void;
  *   自由文本语法」这条**判据**上它们本就不该被排除(踢掉是另一条理由),不是因为它们在这里还起作用。
  *
  * · `"diagnostic"`:诊断面 —— 由错误文本合成、给人读的失败句(workflow 恢复摘要)。多遮一个字只是一句诊断少一截,少遮一个字是凭据明文,
- *   所以这一档 = 自由文本档**全员** + 只在这一档在场的**诊断值位臂**({@link collectDiagnosticValueSpans}:凭据名表里的名字 / `Basic`·`Bearer` 方案词后面的值,
+ *   所以这一档 = 自由文本档**全员** + 只在这一档在场的**诊断值位臂**({@link collectDiagnosticValueSpans}:凭据名 / `Basic`·`Bearer` 方案词后面的值,
  *   不设强度门)。它是诊断面的那一读归进同一只脱敏器的落点:读的是同一张名表、同一个候选池、同一条并集律,出口经出口座的诊断行。
  *
  * 闭集:加一个档而不在 {@link armPool} 的档表里处置 ⇒ **编译**红。

package/dist/trace/redact.js

@@ -1,5 +1,5 @@
 import { REDACTION_MARK, displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
-import { CONTROL_AND_BIDI_CHARS, CREDENTIAL_PARAM_NAMES, isHierarchicalUrl } from "@sema-agent/settings-schema";
+import { CONTROL_AND_BIDI_CHARS, CREDENTIAL_PARAM_NAMES, credentialParamWordOf, isHierarchicalUrl } from "@sema-agent/settings-schema";
 import { recordFailOpen } from "../observability/fail-open.js";
 const normalizeForRedaction = stripFormatCharacters;
 export function mapNormalizedToOriginal(text, normalized) {
@@ -1070,14 +1070,9 @@ const CREDENTIAL_NAME_ANCHORS = {
     "x-amz-signature": "declarative", "x-amz-security-token": "declarative", "x-amz-credential": "declarative",
     sas: "structure-only",
 };
-const CREDENTIAL_NAME_ALT = (() => {
-    for (const w of CREDENTIAL_PARAM_NAMES) {
-        if (!/^[a-z][a-z0-9_-]*$/.test(w))
-            throw new Error(`redact: credential name ${JSON.stringify(w)} must be lowercase [a-z0-9_-] (the alternation is built without escaping)`);
-    }
-    return [...CREDENTIAL_PARAM_NAMES].sort((a, b) => b.length - a.length || (a < b ? -1 : 1)).join("|");
-})();
 const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_PARAM_NAMES.map((w) => w.length));
+const JSON_FIELD_NAME_CLASS = "[A-Za-z0-9_.-]";
+const isJsonFieldNameCode = (c) => isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS || c === CH_DOT;
 const JSON_FIELD_QUOTE_FORMS = ['"', '\\"', '\\\\\\"'];
 for (let d = 0; d < JSON_FIELD_QUOTE_FORMS.length; d++) {
     if (JSON_FIELD_QUOTE_FORMS[d] !== "\\".repeat(2 ** d - 1) + '"')
@@ -1096,15 +1091,26 @@ function buildJsonSecretFieldSource() {
             q = b + q;
             b = b + b;
         }
-        alts.push(String.raw `(${q}(?:${CREDENTIAL_NAME_ALT})${q}\s*:\s*)${q}(?:${o}|${l}|${b}(?:${o}|${b}|${q}))*${q}`);
+        alts.push(String.raw `(${q}(${JSON_FIELD_NAME_CLASS}+)${q}\s*:\s*)${q}(?:${o}|${l}|${b}(?:${o}|${b}|${q}))*${q}`);
     }
     return alts.join("|");
 }
 const asciiLower = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase());
 function credentialNameAnchor(name) {
-    return CREDENTIAL_ANCHOR_OF.get(asciiLower(name));
+    let word = CREDENTIAL_WORD_MEMO.get(name);
+    if (word === undefined) {
+        word = credentialParamWordOf(name) ?? null;
+        if (name.length <= CREDENTIAL_WORD_MEMO_NAME_MAX) {
+            if (CREDENTIAL_WORD_MEMO.size >= CREDENTIAL_WORD_MEMO_SIZE)
+                CREDENTIAL_WORD_MEMO.clear();
+            CREDENTIAL_WORD_MEMO.set(name, word);
+        }
+    }
+    return word === null ? undefined : CREDENTIAL_NAME_ANCHORS[word];
 }
-const CREDENTIAL_ANCHOR_OF = new Map(Object.entries(CREDENTIAL_NAME_ANCHORS));
+const CREDENTIAL_WORD_MEMO = new Map();
+const CREDENTIAL_WORD_MEMO_SIZE = 1024;
+const CREDENTIAL_WORD_MEMO_NAME_MAX = 64;
 const BARE_WORD_READINGS = {
     null: "absent-or-boolean", nil: "absent-or-boolean", none: "absent-or-boolean", undefined: "absent-or-boolean",
     true: "absent-or-boolean", false: "absent-or-boolean", yes: "absent-or-boolean", no: "absent-or-boolean",
@@ -1882,46 +1888,26 @@ const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c =
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
 const isControlCode = (c) => c < 0x20 || c === 0x7f;
 const TOKEN_UNIT_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
-const CREDENTIAL_NAME_SCAN_MAX = CREDENTIAL_NAME_MAX * 3 + 1;
-function decodeAsciiName(name) {
-    let out = "";
-    for (let i = 0; i < name.length; i++) {
-        const c = name.charCodeAt(i);
-        if (c !== 37) {
-            out += name[i];
-            continue;
-        }
-        const hex = name.slice(i + 1, i + 3);
-        if (hex.length !== 2 || !/^[0-9A-Fa-f]{2}$/.test(hex))
-            return undefined;
-        const b = Number.parseInt(hex, 16);
-        if (b >= 0x80)
-            return undefined;
-        out += String.fromCharCode(b);
-        i += 2;
-    }
-    return out;
-}
-function credentialParamValueStart(text, p) {
-    const limit = Math.min(text.length, p + CREDENTIAL_NAME_SCAN_MAX);
-    let hasPct = false;
-    for (let i = p; i < limit; i++) {
+function credentialParamValueStart(text, p, json) {
+    let encoded = false;
+    for (let i = p; i < text.length; i++) {
         const c = text.charCodeAt(i);
-        if (c === 37) {
-            hasPct = true;
-            continue;
-        }
         if (c === CH_EQ) {
             if (i === p)
                 return -1;
-            const name = hasPct ? decodeAsciiName(text.slice(p, i)) : text.slice(p, i);
-            return name !== undefined && credentialNameAnchor(name) !== undefined ? i + 1 : -1;
+            const raw = text.slice(p, i);
+            return credentialNameAnchor(encoded ? receiverParamName(raw) : raw) !== undefined ? i + 1 : -1;
         }
-        if (!(isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS))
+        if (c === 63 || c === 38 || c === 35 || isRegexSpace(c) || isControlCode(c) || (json && c === 34))
             return -1;
+        if (c === 37 || c === 43)
+            encoded = true;
     }
     return -1;
 }
+function receiverParamName(raw) {
+    return new URLSearchParams(`${raw}=`).keys().next().value ?? raw;
+}
 function tokenUnitEnd(text, p) {
     TOKEN_UNIT_Y.lastIndex = p;
     return TOKEN_UNIT_Y.test(text) ? TOKEN_UNIT_Y.lastIndex : -1;
@@ -2975,7 +2961,7 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
         const c = text.charCodeAt(i);
         if (c !== 63 && c !== 38 && c !== 35)
             continue;
-        const valueStart = credentialParamValueStart(text, i + 1);
+        const valueStart = credentialParamValueStart(text, i + 1, json);
         if (valueStart < 0)
             continue;
         while (qc < ppn && pp[qc] < i)
@@ -3024,7 +3010,7 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     scan.footHi = armHi;
 }
 const JSON_FIELD_ANCHOR = '"';
-const JSON_FIELD_BACK = Math.max(...JSON_FIELD_QUOTE_FORMS.map((f) => f.length));
+const JSON_FIELD_HEAD_MAX = Math.max(...JSON_FIELD_QUOTE_FORMS.map((f) => f.length));
 function jsonSecretFieldValueQuoteAt(text, p, depth) {
     const form = JSON_FIELD_QUOTE_FORMS[depth];
     const n = text.length;
@@ -3032,10 +3018,8 @@ function jsonSecretFieldValueQuoteAt(text, p, depth) {
     let i = nameFrom;
     for (; i < n; i++) {
         const c = text.charCodeAt(i);
-        if (!(isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS))
+        if (!isJsonFieldNameCode(c))
             break;
-        if (i - nameFrom >= CREDENTIAL_NAME_MAX)
-            return -1;
     }
     if (i === nameFrom || !text.startsWith(form, i) || credentialNameAnchor(text.slice(nameFrom, i)) === undefined)
         return -1;
@@ -3119,7 +3103,7 @@ function collectJsonSecretFieldSpans(text, span, isHead) {
     let from = 0;
     for (let p = text.indexOf(JSON_FIELD_ANCHOR); p >= 0;) {
         let run = 0;
-        while (run < JSON_FIELD_BACK - 1 && p - run - 1 >= from && text.charCodeAt(p - run - 1) === CH_BACKSLASH)
+        while (run < JSON_FIELD_HEAD_MAX - 1 && p - run - 1 >= from && text.charCodeAt(p - run - 1) === CH_BACKSLASH)
             run += 1;
         let next = -1;
         for (let d = JSON_FIELD_QUOTE_FORMS.length - 1; d >= 0 && next < 0; d--) {
@@ -3134,7 +3118,7 @@ function collectJsonSecretFieldSpans(text, span, isHead) {
             const open = found === STRING_OPEN;
             const end = open ? text.length : found;
             span(q, end, q, open ? NOT_CLOSED : end - form.length, open, JSON_FIELD_VALUE_REPLS[d]);
-            from = scanResumeAfterHit(start, end, JSON_FIELD_BACK);
+            from = scanResumeAfterHit(start, end, end - q);
             next = text.indexOf(JSON_FIELD_ANCHOR, from);
             if (next < 0)
                 return;
@@ -3245,16 +3229,13 @@ function anchorHeadAt(scan, text, op, json) {
         i -= quoteLen;
     }
     const nameEnd = i + 1;
-    const floor = Math.max(-1, i - (CREDENTIAL_NAME_MAX + 2));
     let j = i;
-    while (j > floor && isIdentCode(text.charCodeAt(j)))
+    while (j >= 0 && isIdentCode(text.charCodeAt(j)))
         j -= 1;
     anchoredScanUnits += nameEnd - (j + 1);
     const bound = j + 1 < nameEnd ? nameBoundAt(scan, Math.max(j, 0), nameEnd) : -1;
     if (bound > j)
         j = bound - 1;
-    else if (j === floor && j >= 0 && isIdentCode(text.charCodeAt(j)))
-        return undefined;
     let nameStart = j + 1;
     let afterEscape = false;
     if (j >= 0 && text.charCodeAt(j) === CH_BACKSLASH && escapedAt(text, j + 1)) {
@@ -3763,6 +3744,7 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
     };
     const skipBlank = (from) => readRun(from, isRegexSpace);
     let valueEnd = 0;
+    let plainEnd = 0;
     let nextEq = text.indexOf("=");
     let nextColon = text.indexOf(":");
     while (nextEq >= 0 || nextColon >= 0) {
@@ -3775,26 +3757,23 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
             op = nextColon;
             nextColon = text.indexOf(":", op + 1);
         }
-        if (op + 1 < valueEnd)
-            continue;
+        const inValue = op + 1 < plainEnd;
         let e = op;
         while (e > 0 && isRegexSpace(text.charCodeAt(e - 1)))
             e -= 1;
         diagnosticScanUnits += op - e;
         if (e === 0 || !isRegexWordCode(text.charCodeAt(e - 1)))
             continue;
-        const floor = Math.max(0, e - CREDENTIAL_NAME_MAX - 1);
         let runStart = e;
-        while (runStart > floor && isDiagnosticNameCode(text.charCodeAt(runStart - 1)))
+        while (runStart > 0 && isDiagnosticNameCode(text.charCodeAt(runStart - 1)))
             runStart -= 1;
         diagnosticScanUnits += e - runStart;
-        const runOpen = runStart === floor && floor > 0 && isDiagnosticNameCode(text.charCodeAt(floor - 1));
         let nameStart = -1;
         let nameTier;
-        for (let q = runStart; q < e && nameStart < 0; q++) {
-            if (e - q > CREDENTIAL_NAME_MAX || !isRegexWordCode(text.charCodeAt(q)))
+        for (let q = runStart; q < e && nameStart < 0; q = q === runStart ? Math.max(runStart + 1, e - CREDENTIAL_NAME_MAX) : q + 1) {
+            if (!isRegexWordCode(text.charCodeAt(q)))
                 continue;
-            const bounded = (q === runStart && !runOpen) || text.charCodeAt(q - 1) === CH_MINUS || deletedAt(q) !== "none";
+            const bounded = q === runStart || text.charCodeAt(q - 1) === CH_MINUS || deletedAt(q) !== "none";
             const tier = bounded ? credentialNameAnchor(text.slice(q, e)) : undefined;
             if (tier !== undefined && diagnosticNameSlot(tier)) {
                 nameStart = q;
@@ -3803,18 +3782,27 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
         }
         if (nameStart < 0)
             continue;
-        let s = skipBlank(op + 1);
-        if (s < n) {
-            const unit = readTextUnit(text, s, json);
-            if (unitChOf(unit) === CH_QUOTE)
-                s += unitLenOf(unit);
+        let s;
+        let end;
+        if (inValue) {
+            s = op + 1;
+            end = plainEnd;
         }
-        if (s >= n) {
-            if (isHead)
-                span(nameStart, n, op, NOT_CLOSED, true);
-            continue;
+        else {
+            s = skipBlank(op + 1);
+            if (s < n) {
+                const unit = readTextUnit(text, s, json);
+                if (unitChOf(unit) === CH_QUOTE)
+                    s += unitLenOf(unit);
+            }
+            if (s >= n) {
+                if (isHead)
+                    span(nameStart, n, op, NOT_CLOSED, true);
+                continue;
+            }
+            end = readRun(s, isDiagnosticValueUnit);
+            plainEnd = end;
         }
-        let end = readRun(s, isDiagnosticValueUnit);
         if (end > s && nameTier === "auth-scheme" && readRun(s, isAsciiLetterCode) === end) {
             const k = skipBlank(end);
             if (k > end && k >= n && isHead) {
@@ -3827,7 +3815,7 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
                     end = credEnd;
             }
         }
-        if (end > s) {
+        if (end > s && end > valueEnd) {
             span(s, end, op, NOT_CLOSED);
             valueEnd = end;
         }
@@ -4079,7 +4067,7 @@ const armPool = (() => {
         if (row === URL_CREDENTIAL_PATTERN)
             return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead), "://".length, "url", { kind: "bounded", gap: NO_GAP });
         if (row === JSON_SECRET_FIELD_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_BACK, "json-field", { kind: "bounded", gap: isRegexSpace });
+            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_HEAD_MAX, "json-field", { kind: "bounded", gap: isRegexSpace });
         throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
     };
     const members = [];