@sema-agent/server 7.147.0 → 7.148.0

package/dist/trace/core-keyset-guard.d.ts

@@ -67,10 +67,9 @@ type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_P
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
-type WiringLegHandled = "kind";
-type WiringLegExcluded = "runOrigin";
-type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled | WiringLegExcluded>>;
-type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled | WiringLegExcluded, keyof WiringSection<"leg">>>;
+type WiringLegHandled = "kind" | "runOrigin";
+type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
+type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
 type WiringModRowKeys = WiringSection<"mods">[number] extends infer R ? (R extends unknown ? keyof R : never) : never;
 type WiringModRowHandled = "name" | "seat" | "tier" | "provenance" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
 type _GuardWiringModRow = AssertAllKeysHandled<Exclude<WiringModRowKeys, WiringModRowHandled>>;
@@ -218,8 +217,8 @@ type _GuardPromptManifestKeysReverse = AssertAllKeysHandled<{
 type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
     [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
 }[keyof ManifestCore]>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId" | "rowVerdict";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceSessionId" | "agentId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId" | "runOrigin" | "rowVerdict";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceSessionId" | "agentId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "requestedByCallId";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
@@ -483,6 +482,10 @@ type _GuardWorkflowRunStats = AssertAllKeysHandled<Exclude<keyof WorkflowRun["st
 type _GuardWorkflowRunStatsReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_DISPOSITIONS"]>, keyof WorkflowRun["stats"]>>;
 type _GuardWorkflowRunStatsNested = AssertAllKeysHandled<Exclude<keyof WorkflowRun["stats"]["nested"], TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>>>;
 type _GuardWorkflowRunStatsNestedReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>, keyof WorkflowRun["stats"]["nested"]>>;
+type _GuardWorkflowBudgetOvershoot = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["budgetOvershoot"]>, TableCoreKeys<WorkflowTables["WORKFLOW_BUDGET_OVERSHOOT_DISPOSITIONS"]>>>;
+type _GuardWorkflowBudgetOvershootReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_BUDGET_OVERSHOOT_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["budgetOvershoot"]>>>;
+type _GuardWorkflowTimeoutInterruption = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["timeoutInterruption"]>, TableCoreKeys<WorkflowTables["WORKFLOW_TIMEOUT_INTERRUPTION_DISPOSITIONS"]>>>;
+type _GuardWorkflowTimeoutInterruptionReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_TIMEOUT_INTERRUPTION_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["timeoutInterruption"]>>>;
 type ReadRootCandidateProjected = "dir" | "clearsThisAsk" | "covers";
 type _GuardReadRootCandidate = AssertAllKeysHandled<Exclude<keyof ReadRootGrantCandidate, ReadRootCandidateProjected>>;
 type _GuardReadRootCandidateReverse = AssertAllKeysHandled<Exclude<ReadRootCandidateProjected, keyof ReadRootGrantCandidate>>;
@@ -649,6 +652,10 @@ export type CoreKeysetGuards = [
     _GuardWorkflowRunStatsReverse,
     _GuardWorkflowRunStatsNested,
     _GuardWorkflowRunStatsNestedReverse,
+    _GuardWorkflowBudgetOvershoot,
+    _GuardWorkflowBudgetOvershootReverse,
+    _GuardWorkflowTimeoutInterruption,
+    _GuardWorkflowTimeoutInterruptionReverse,
     _GuardReadRootCandidate,
     _GuardReadRootCandidateReverse,
     _GuardRiskAxes,

package/dist/trace/core-vocab-wire.d.ts

@@ -0,0 +1,95 @@
+/**
+ * **本服务输出面逐字过境的 core 词表的登记处** —— wire 变更机器清单(`scripts/wire-changes-server.mjs`)的第五类源。
+ *
+ * ## 它治的病
+ * 有些 wire 值不是本服务铸的,也不是投影面表登记的键:本服务在自己的座上用 core 的闭集常量校验一个值、原样放上 wire
+ * (审批卡 `card_json` 的卡词 `approvalCard`、续跑起跑失败体的 `cause` …)。core 给这些常量加一个词,本服务的输出闭集就随之放宽 ——
+ * 对卡词写穷举 `switch` 的消费方会编译红;而清单的其余四类源(契约附录 / 面表 / 自铸登记表 / core 新键)都看不见这一层,清单零条。
+ *
+ * ## 一个事实一个来源
+ * **词只住在 core**:本表不抄任何一个词,只登记「哪只 core 词表逐字上了本服务的 wire、自哪一版起」。生成器从 core 随包的逐版清单
+ * (`node_modules/@sema-agent/core/wire-changes/core@<ver>.json` 的 `closedSetMembers`)读区间 (上一 tag 的钉, 本版的钉] 里这只词表的净增删,
+ * 记进本服务清单的 `added` / `removed` 与 `closedSetMembers`(集名 `coreVocab.<词表>`)。本表自身的增删按成员记(集名 `coreVocab`)。
+ *
+ * ## 表的形(一只词表一行)
+ *  · 键      —— core 闭集的名字,与 core 清单 `closedSetMembers[].set` 同一拼写(= core 导出的运行期常量名);
+ *  · `at`    —— 它在本服务 wire 上的坐标(人读);
+ *  · `site`  —— 本服务按它校验 / 放行的那只模块(读点);
+ *  · `since` —— 本服务 wire 上开始逐字带这只词表的版本(= 该常量首次出现在 `site` 模块里的那个 tag)。
+ *
+ * ## 绑定(派生,不手抄)
+ * `test/wire-changes-server.test.ts`「core 词表逐字过境」组:每个键都是 core 导出的字符串数组常量;每只 `site` 模块从 core 引入的
+ * 字符串数组常量 ≡ 本表 `site` 为它的那几行(两个方向:读点多引一只词表而本表没跟 ⇒ 红;本表多登一只读点不引的 ⇒ 红)。
+ * 经 core 谓词(`isAskOrigin` 一类)而不是常量读的词表、帧投影里随 core 型过境的值,不在本表的射程里(清单的已知缺口,见设计稿)。
+ *
+ * ⚠️ 纯数据:零 import(生成器在历史 ref 上把本文件转译求值)。
+ */
+/** 一只逐字过境的 core 词表的登记。 */
+export interface CoreVocabWireEntry {
+    readonly at: string;
+    readonly site: string;
+    readonly since: string;
+}
+export declare const CORE_VOCAB_WIRE: {
+    readonly ALLOW_RULE_MEMBERS: {
+        readonly at: "approval_request card(card_json)allow 层披露记录的 member";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.117.0";
+    };
+    readonly ASK_EVIDENCE_ABSENCE_VALUES: {
+        readonly at: "approval_request card(card_json)规则证据的 orgRevisionAbsent / orgRuleAbsent / personalRuleDotsAbsent";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.23.0";
+    };
+    readonly BOUND_GRANT_ABSENCES: {
+        readonly at: "approval_request 帧活面事实 boundGrantAbsence";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.129.0";
+    };
+    readonly DENIAL_LIMIT_BOUNDS: {
+        readonly at: "approval_request card(card_json)denialLimitFallback.limit";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.135.0";
+    };
+    readonly HOOK_QUESTION_CAUSES: {
+        readonly at: "approval_request card(card_json)问因 { by: hook }.cause";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.143.0";
+    };
+    readonly PERSISTED_RULE_MATCHES: {
+        readonly at: "approval_request card(card_json)ruleOffers[].match";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.57.0";
+    };
+    readonly RESUME_STARTUP_CAUSES: {
+        readonly at: "422 parked_resume.startup_failed 体 cause";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.129.0";
+    };
+    readonly RULE_OFFERS_ABSENCES: {
+        readonly at: "approval_request card(card_json)ruleOffersAbsence";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.129.0";
+    };
+    readonly RULE_OFFER_KINDS: {
+        readonly at: "approval_request card(card_json)ruleOffers[].kind";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.135.0";
+    };
+    readonly STEER_REPLAY_FACETS: {
+        readonly at: "409 steering.duplicate_input_id 体 differs[]";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.118.0";
+    };
+    readonly TOOL_APPROVAL_CARDS: {
+        readonly at: "approval_request card(card_json)approvalCard · 帧活面事实 approvalCard";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.136.0";
+    };
+    readonly UNCOVERED_SEGMENT_REASONS: {
+        readonly at: "approval_request card(card_json)ruleOffers[].uncoveredDetail[].reason";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.57.0";
+    };
+};
+//# sourceMappingURL=core-vocab-wire.d.ts.map

package/dist/trace/core-vocab-wire.js

@@ -0,0 +1,15 @@
+export const CORE_VOCAB_WIRE = {
+    ALLOW_RULE_MEMBERS: { at: "approval_request card(card_json)allow 层披露记录的 member", site: "src/approval-card.ts", since: "7.117.0" },
+    ASK_EVIDENCE_ABSENCE_VALUES: { at: "approval_request card(card_json)规则证据的 orgRevisionAbsent / orgRuleAbsent / personalRuleDotsAbsent", site: "src/approval-card.ts", since: "7.23.0" },
+    BOUND_GRANT_ABSENCES: { at: "approval_request 帧活面事实 boundGrantAbsence", site: "src/approval-card.ts", since: "7.129.0" },
+    DENIAL_LIMIT_BOUNDS: { at: "approval_request card(card_json)denialLimitFallback.limit", site: "src/approval-card.ts", since: "7.135.0" },
+    HOOK_QUESTION_CAUSES: { at: "approval_request card(card_json)问因 { by: hook }.cause", site: "src/approval-card.ts", since: "7.143.0" },
+    PERSISTED_RULE_MATCHES: { at: "approval_request card(card_json)ruleOffers[].match", site: "src/approval-card.ts", since: "7.57.0" },
+    RESUME_STARTUP_CAUSES: { at: "422 parked_resume.startup_failed 体 cause", site: "src/approval-card.ts", since: "7.129.0" },
+    RULE_OFFERS_ABSENCES: { at: "approval_request card(card_json)ruleOffersAbsence", site: "src/approval-card.ts", since: "7.129.0" },
+    RULE_OFFER_KINDS: { at: "approval_request card(card_json)ruleOffers[].kind", site: "src/approval-card.ts", since: "7.135.0" },
+    STEER_REPLAY_FACETS: { at: "409 steering.duplicate_input_id 体 differs[]", site: "src/approval-card.ts", since: "7.118.0" },
+    TOOL_APPROVAL_CARDS: { at: "approval_request card(card_json)approvalCard · 帧活面事实 approvalCard", site: "src/approval-card.ts", since: "7.136.0" },
+    UNCOVERED_SEGMENT_REASONS: { at: "approval_request card(card_json)ruleOffers[].uncoveredDetail[].reason", site: "src/approval-card.ts", since: "7.57.0" },
+};
+//# sourceMappingURL=core-vocab-wire.js.map

package/dist/trace/exit-seat.d.ts

@@ -1,3 +1,8 @@
+/**
+ * 「脱敏器抛 ⇒ 占位」的那一枚登记占位(**唯一属主在这里**:座的抛律用它,`observability/run-terminal.ts` 的终态 / 模型文本座与 `trace/model-segment.ts` 的活面放行窗
+ * 读同一枚)。属主住在座上而不在 run-terminal:日志出口接缝经座过筛,run-terminal 的模块图里有经接缝写日志的模块 —— 占位放在那边就是一个环。
+ */
+export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";
 /** 品牌键:模块私有的 `unique symbol` —— 别处写不出这个键,于是写不出一个 `SafeText` 字面量;断言伪造由普查门在语法树上拦。 */
 declare const SAFE_TEXT: unique symbol;
 /** 经出口座的文本。是 `string` 的子型:读者零改;写进出口位只能用 {@link seatText} 铸的值。 */
@@ -20,9 +25,11 @@ export type SafeText = string & {
  *    引擎放过的形照抹);界 200 码元,原样出门(JSON 串值,消费方自己渲染)。
  *  · `peer-declaration-sentence`:引擎判官对一份 MCP / A2A 对端声明说的句子(`toolAxes` / `toolFaces` / `sessionMetaKey` / 启动界的原因句,逐字带着声明方写的工具名、键名),
  *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行,以及能力读面 `GET /v1/capabilities/mcp` 上引擎整集拒(两台撞同一工具命名空间前缀)的拒句 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
- *  · `inbox-diagnostics-text`:`workflow_complete` 补投帧上的诊断教学文本(`diagnostics`)—— 引擎在 workflow 完成通知上铸的「读哪里 / 怎么续跑」文本,入会话收件时洗一次,
- *    店里(`payload` 列)只放出门安全的字节,drain 逐字带出。洗法与 live `task_notification.diagnostics` 同一个 scope(`free-text`);
- *    这一行比 `trace-frame-text` 多一条界(4000 码元,与同族条目的文本位同额),原样出门:逐成员的粗截;整条 `payload` 装不装得下由条目编码座按字节预算终判
+ *  · `completion-diagnostics-text`:一次 workflow 完成通知上的诊断教学文本(`diagnostics`)—— 引擎在完成通知上铸的「读哪里 / 怎么续跑」文本(含部署上的 journal 坐标:路径或 URL),
+ *    **两张脸同读这一行**:live `task_notification` 帧(`trace/project.ts` 的 `taskNotificationEventData`,停驻补投的 `task_notification` 帧与账本行同一只)与 `workflow_complete` 补投帧
+ *    (入会话收件时洗一次,店里 `payload` 列只放出门安全的字节,drain 逐字带出)。引擎在两条腿上给的不是同一份:sink 腿递未抹的原值、notifier 腿递「人类读者」档抹过的 ——
+ *    所以读者档在**这一行**上声明(`hostLeaks`),不靠哪条腿的上游记得抹:同一段输入,两张脸逐字节相等。洗法其余同 `trace-frame-text`(scope `free-text`);
+ *    这一行多一条界(4000 码元,与同族条目的文本位同额),原样出门:逐成员的粗截;整条 `payload` 装不装得下由条目编码座按字节预算终判
  *    (`orchestration/workflow-completion-inbox.ts` 的 `encodeInboxBody`,预算 = 最窄后端的 `payload` 列容量,超 ⇒ 最小形 + `payloadTruncated`)。
  *  · `inbox-frame-text`:`task_notification` 补投帧(停驻收件、下一次开流 drain)上会话箱车道的自由文本位 —— 三只载体的 `crossSessionMessage.fromName` /
  *    `.body`、`crossSessionNotice.text` 与侧记 `_sema_provenance.peerMeta.notice` 的 `recipient` / `target` / `detail` / `dropReason`(别的会话写的或引擎嵌着
@@ -42,6 +49,10 @@ export type SafeText = string & {
  *    `refused[].path` / `failed[].path`;源头是模型交的路径参数)—— 不设界(截过的路径就不是那个文件了,消费方要拿它去对文件),原样出门。
  *  · `rewind-ledger-reason`:同一口台账上的拒因 / 故障句(`refused[].reason` / `failed[].reason` / `error.message`;引擎与文件历史店写的、可能带着抛出物原文)——
  *    界 500 码元,原样出门(JSON 串值,消费方自己渲染)。
+ *  · `log-record`:日志出口接缝(`observability/logger.ts`)写出的**整条**结构化日志行 —— `{ ts, level, msg, ...fields }` 的 `JSON.stringify` 产物,进程 stdout / stderr 的诊断字节
+ *    (写出点不判:字段里混进来的凭据形 —— 被拒的目录条目名、上游回显、错误消息里的令牌 —— 在这一行上统一挡);脱敏器按 JSON 读法读(`json`),不设界(日志行的长短是写出点的事),
+ *    原样出门。遮过的产物不再是一条 JSON ⇒ 按座的抛律换占位(见模块头注「抛」);占位不是一条 JSON ⇒ 接缝扣下这一行(固定字节的扣下句),见接缝头注。
+ *  · `log-text`:日志出口接缝写出的一段诊断散文(与 `console.*` 同一种格式化,`util.format`;带调用栈的多行);不设界、不整形(多行照旧),原样出门。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -83,9 +94,10 @@ declare const EXIT_SEATS: {
     readonly "peer-declaration-sentence": {
         readonly scope: "free-text";
     };
-    readonly "inbox-diagnostics-text": {
+    readonly "completion-diagnostics-text": {
         readonly scope: "free-text";
         readonly maxChars: 4000;
+        readonly hostLeaks: true;
     };
     readonly "inbox-frame-text": {
         readonly scope: "free-text";
@@ -109,6 +121,13 @@ declare const EXIT_SEATS: {
         readonly scope: "free-text";
         readonly maxChars: 500;
     };
+    readonly "log-record": {
+        readonly scope: "free-text";
+        readonly json: true;
+    };
+    readonly "log-text": {
+        readonly scope: "free-text";
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /** 设了界的座名。 */
@@ -119,6 +138,13 @@ export type BoundedExitSeat = {
 }[ExitSeat];
 /** 一行的界(码元;含截断记号)—— 界的唯一属主是座表,站点要用这个数(显示预算、文档钉)就读它,不另抄一份。 */
 export declare function seatMaxChars(seat: BoundedExitSeat): number;
+type ScanGeometry = {
+    readonly region: number;
+    readonly margin: number;
+    readonly window: number;
+};
+/** 一个有界行的扫描窗几何(读法单元):出门区、余量、窗 = 出门区 + 余量。窗的几何只有这里一处答 —— 站点 / 测试要这几个数就读它,不另抄。 */
+export declare function seatScanGeometry(seat: BoundedExitSeat): ScanGeometry;
 /**
  * 出口座:`seat` 是座表的一行,`text` 是要出门的自由文本。返回的 {@link SafeText} 就是这个出口该写出去的字节。
  * 表外的座名(只有绕过类型才到得了)⇒ 抛 —— 那是调用方的编程错,不是脱敏失败,不吞成占位。

package/dist/trace/exit-seat.js

@@ -1,9 +1,10 @@
 import { stripControlAndBidi } from "@sema-agent/settings-schema";
+import { REDACTION_MARKS, redactHostLeaks } from "@sema-agent/core";
 import { CALLER_TEXT_CUT_MARK } from "../caller-text-echo.js";
 import { errorKindOf } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
-import { proposeRedactionSpans, readingHeadEnd, REDACTION_TOKEN_RE_SRC, WHOLE_EXTENT } from "./redact.js";
+import { MAX_RECOGNITION_SPAN, mergeRedactionSpans, proposeRedactionSpans, readingHeadEnd, REDACTION_TOKEN_RE_SRC, renderRedactionSpans, WHOLE_EXTENT } from "./redact.js";
+export const OVERSIZED_REDACTION_PLACEHOLDER = "«redacted:oversized»";
 const EXIT_SEATS = {
     "trace-frame-text": { scope: "free-text" },
     "trace-frame-line": { scope: "free-text", maxChars: 300 },
@@ -14,13 +15,15 @@ const EXIT_SEATS = {
     "session-title": { scope: "free-text", maxChars: 80, emit: "title-line" },
     "mcp-remote-text": { scope: "free-text", maxChars: 200 },
     "peer-declaration-sentence": { scope: "free-text" },
-    "inbox-diagnostics-text": { scope: "free-text", maxChars: 4000 },
+    "completion-diagnostics-text": { scope: "free-text", maxChars: 4000, hostLeaks: true },
     "inbox-frame-text": { scope: "free-text", maxChars: 4000 },
     "boot-refusal-line": { scope: "free-text", maxChars: 512, emit: "log-line" },
     "peer-inbound-card-text": { scope: "free-text" },
     "workflow-recovery-summary": { scope: "diagnostic" },
     "rewind-ledger-path": { scope: "free-text" },
     "rewind-ledger-reason": { scope: "free-text", maxChars: 500 },
+    "log-record": { scope: "free-text", json: true },
+    "log-text": { scope: "free-text" },
 };
 export function seatMaxChars(seat) {
     return EXIT_SEATS[seat].maxChars;
@@ -34,19 +37,9 @@ for (const [name, row] of SEAT_ROWS) {
         throw new Error(`exit seat "${name}": a row with an emission form must declare maxChars (the cut mark counts inside the bound)`);
     }
 }
-function mergeSpans(spans) {
-    const order = spans.map((s, i) => ({ s, i })).sort((a, b) => a.s.start - b.s.start || b.s.end - a.s.end || a.i - b.i);
-    const out = [];
-    for (const { s } of order) {
-        const last = out[out.length - 1];
-        if (last === undefined || s.start > last.end)
-            out.push(s);
-        else if (s.end > last.end)
-            out[out.length - 1] = { start: last.start, end: s.end, repl: last.repl };
-    }
-    return out;
-}
 const TOKEN_AT = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+const ENGINE_MARKS = Object.values(REDACTION_MARKS);
+const ENGINE_MARK_MAX = Math.max(...ENGINE_MARKS.map((m) => m.length));
 function safeCutPoint(gap, cut) {
     const hi = gap.charCodeAt(cut - 1);
     if (cut > 0 && hi >= 0xd800 && hi <= 0xdbff && (gap.charCodeAt(cut) & 0xfc00) === 0xdc00)
@@ -58,21 +51,23 @@ function safeCutPoint(gap, cut) {
         if (m !== null && open + m[0].length > cut)
             cut = open;
     }
-    return cut;
-}
-const cutPlain = (gap, room) => gap.slice(0, safeCutPoint(gap, room));
-function renderOnce(text, groups, until = Number.POSITIVE_INFINITY) {
-    const parts = [];
-    let at = 0;
-    for (const g of groups) {
-        if (g.start >= until)
+    for (let at = gap.lastIndexOf("[", cut - 1); at !== -1 && at > cut - ENGINE_MARK_MAX; at = at === 0 ? -1 : gap.lastIndexOf("[", at - 1)) {
+        const mark = ENGINE_MARKS.find((m) => gap.startsWith(m, at));
+        if (mark !== undefined && at + mark.length > cut) {
+            cut = at;
             break;
-        parts.push(text.slice(at, g.start), g.repl);
-        at = g.end;
+        }
     }
-    parts.push(text.slice(at, until));
-    return parts.join("");
+    return cut;
+}
+function hostLeakSpans(text) {
+    const report = { findings: [] };
+    redactHostLeaks(text, report);
+    return report.findings
+        .filter((f) => f.marker === REDACTION_MARKS.url || f.marker === REDACTION_MARKS.path)
+        .map((f) => ({ start: f.span[0], end: f.span[1], repl: f.marker }));
 }
+const cutPlain = (gap, room) => gap.slice(0, safeCutPoint(gap, room));
 function emitAs(form, text) {
     switch (form) {
         case "log-line":
@@ -90,9 +85,15 @@ function emitAs(form, text) {
     }
 }
 const layoutOf = (row) => (row.emit === undefined ? "multi-line" : "single-line");
-const SCAN_WINDOW_FLOOR = 4096;
-const SCAN_WINDOW_PER_BOUND = 8;
-const scanWindowOf = (maxChars) => Math.max(SCAN_WINDOW_FLOOR, maxChars * SCAN_WINDOW_PER_BOUND);
+const SCAN_REGION_FLOOR = 2048;
+const SCAN_REGION_PER_BOUND = 4;
+const scanGeometryOf = (maxChars) => {
+    const region = Math.max(SCAN_REGION_FLOOR, maxChars * SCAN_REGION_PER_BOUND);
+    return { region, margin: MAX_RECOGNITION_SPAN, window: region + MAX_RECOGNITION_SPAN };
+};
+export function seatScanGeometry(seat) {
+    return scanGeometryOf(EXIT_SEATS[seat].maxChars);
+}
 function boundRow(out, row, cutUpstream) {
     if (row.maxChars === undefined)
         return out;
@@ -110,13 +111,12 @@ export function seatText(seat, text) {
     let out;
     try {
         const layout = layoutOf(row);
-        const scanWindow = row.maxChars === undefined ? undefined : scanWindowOf(row.maxChars);
+        const geometry = row.maxChars === undefined ? undefined : scanGeometryOf(row.maxChars);
         let windowEnd;
         let regionEnd;
-        if (scanWindow !== undefined && text.length > scanWindow) {
-            const half = scanWindow >>> 1;
-            const region = safeCutPoint(text, readingHeadEnd(text, layout, half));
-            const end = safeCutPoint(text, readingHeadEnd(text, layout, scanWindow - half, region));
+        if (geometry !== undefined && text.length > geometry.window) {
+            const region = safeCutPoint(text, readingHeadEnd(text, layout, geometry.region));
+            const end = safeCutPoint(text, readingHeadEnd(text, layout, geometry.margin, region));
             if (end < text.length) {
                 windowEnd = end;
                 regionEnd = region;
@@ -128,9 +128,13 @@ export function seatText(seat, text) {
         else {
             const emitUntil = regionEnd;
             const extent = windowEnd === undefined || regionEnd === undefined ? WHOLE_EXTENT : { kind: "head", emitEnd: regionEnd };
-            const rendered = renderOnce(head, mergeSpans(proposeRedactionSpans(head, row.scope, layout, extent)), emitUntil);
+            const proposals = proposeRedactionSpans(head, row.scope, layout, extent, row.json === true);
+            const groups = row.hostLeaks === true ? mergeRedactionSpans([...proposals, ...hostLeakSpans(head)]) : proposals;
+            const rendered = renderRedactionSpans(head, groups, 0, emitUntil ?? head.length);
             out = boundRow(row.emit === undefined ? rendered : emitAs(row.emit, rendered), row, windowEnd !== undefined);
         }
+        if (row.json === true && out !== text)
+            JSON.parse(out);
     }
     catch (err) {
         recordFailOpen("server.run-terminal.redact-threw", `seat=${seat} len=${typeof text === "string" ? text.length : -1} err=${errorKindOf(err)}`);

package/dist/trace/extension-call-face.d.ts

@@ -19,8 +19,9 @@
 import type { ExtensionRequester, RewriteAuthor } from "@sema-agent/core";
 /** wire 上的发起者位 = 引擎的 `ExtensionRequester` 同形(`name` 已过出口纪律);引擎加一类发起者 ⇒ 这里的形随之,读法下面一处判。 */
 export type ExtensionRequesterFace = Readonly<ExtensionRequester>;
-/** `requestedBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。`where` 进留痕句(哪一面:`tool_start` / `tool_end` / `tool_approval` / 读腿)。 */
-export declare function extensionRequesterOf(v: unknown, where: string): ExtensionRequesterFace | undefined;
+/** 扩展发起者形(`ExtensionRequester`)的投影 —— `requestedBy`(调用的发起者)与 `declinedBy`(core 7.66.0:拒了这只附件的扩展)同一只读法(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。
+ *  `where` 进留痕句(哪一面:`tool_start` / `tool_end` / `tool_approval` / 读腿 / `human_input.attachments`);`field` 让留痕句点对字段名(判据一只,丢弃句按字段各写一句字面量)。 */
+export declare function extensionRequesterOf(v: unknown, where: string, field?: "requestedBy" | "declinedBy"): ExtensionRequesterFace | undefined;
 /** `answeredBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。 */
 export declare function extensionAnswererOf(v: unknown, where: string): string | undefined;
 /** wire 上的改写记录 = 引擎的 `ToolInputRewrite` 同形(扩展项的 `name` 已过出口纪律、`input` 已脱敏)。 */

package/dist/trace/extension-call-face.js

@@ -1,10 +1,12 @@
 import { sanitizeWireText } from "./engine-notice-wire.js";
 import { dropProjectedFace } from "./projection-drop.js";
-export function extensionRequesterOf(v, where) {
+export function extensionRequesterOf(v, where, field = "requestedBy") {
     if (v === undefined)
         return undefined;
     if (typeof v === "object" && v !== null && "kind" in v && "name" in v && v.kind === "extension" && typeof v.name === "string" && v.name !== "")
         return { kind: "extension", name: sanitizeWireText(v.name) };
+    if (field === "declinedBy")
+        return dropProjectedFace("human_input.declinedBy is not { kind: extension, name: <non-empty string> } on " + where);
     return dropProjectedFace("extension_call.requestedBy is not { kind: extension, name: <non-empty string> } on " + where);
 }
 export function extensionAnswererOf(v, where) {

package/dist/trace/ledger-events.d.ts

@@ -55,18 +55,15 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled"
 /** core 7.54.0 [ref] O9b S1:`permission.cross_boundary_taint` 帧的耐久行(伴随记录,与 `config_assembled` 同一只队列、同一批 drain 点;只在执行于目标设备的树上有)。 */
  | "cross_boundary_taint" | "file_link"
-/** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
+/** 人在环三族的 open/close 帧对(投递 = 本腿那一只人在环传输,先落本账本再写直写面;`hitl-delivery.ts`)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
 /** [ref] §4.3 呈卡族的开卡帧与单卡消卡帧(与上面两只 tool_approval 帧同一条投递面;一条腿只发其中一族,
  *  bg / resume 两条 durable 腿恒是呈卡腿 ⇒ 它们的账本自 7.133.0 起只有本族)。 */
  | "approval_request" | "approval_complete"
 /**
- * [ref]([ref]):批级撤卡帧在 **bg/resume 两条 durable 腿**的账本落行(与呈卡帧同口
- * `append(type, rest)`,seq 由腿自己的 ledger 链步分配)。此前成文「reaper/收敛器无 seq 可分配故
- * live-only」只对**调用点**成立,不对 ctx 的投递口成立——帧经 `emitRevokeTo` 交给各 ctx 的
- * `emitRevoke`,durable 腿的那只钩子自己就是账本写口。sync 腿维持 live-only(行为零变,
- * `routes/tasks.ts` 装配点注)。重放语义:同一账本里卡帧(`approval_request`)在前、撤帧在后,
- * 全量重读恒同序 ⇒ 幂等诚实;不投影成 trace 2.3 帧(`LEDGER_TYPES_NOT_PROJECTED` 登记)。
+ * 批级撤卡帧:与呈卡帧同一只腿传输(`hitl-delivery.ts`:先本 run 账本、再直写),seq 由腿自己的账本链步分配 ——
+ * 三条腿(sync 腿有 durable run 行时)都落行。重放语义:账本里的序 = 入链序(陈旧快照的窄窗里撤帧可先于它点名的卡行),
+ * 全量重读恒同序,消费方按 `askIds` 幂等应用;不投影成 trace 2.3 帧(`LEDGER_TYPES_NOT_PROJECTED` 登记)。
  */
  | "approval_revoke"
 /** 异步 workflow 完成的入箱 drain(`emitPendingWorkflowCompletions` 两个字面型之一)。 */

package/dist/trace/ledger-sink.d.ts

@@ -21,7 +21,7 @@ import { type LedgerEventType, type ParkLedgerEventType } from "./ledger-events.
  * persisted tree; it is never a ledger row).
  */
 export interface LedgerSink {
-    /** Seq-stamped raw append — for a leg's out-of-band rows (elicitation/question frames, model_usage deltas,
+    /** Seq-stamped raw append — for a leg's out-of-band rows (the HITL transport's ledger sink, model_usage deltas,
      *  suggestions, `failed`) that must share this run's single seq counter. Redaction is the CALLER's duty on
      *  this raw door (every existing site already redacts); the typed doors below redact internally. */
     append(type: LedgerEventType, data: unknown): Promise<void>;
@@ -104,35 +104,6 @@ export declare function createSerialLedgerAppend(appendEvent: (seq: number, type
  * 返回 `.catch` 用的处理器(产物是函数 ⇒ `create*`)。
  */
 export declare function createForwardAppendFailedNote(type: string): (err: unknown) => void;
-/**
- * 人在环帧(`question` / `question_complete`、`elicitation` / `elicitation_complete`)的**账本孪生投递口**。
- *
- * 一条律:**凡进 run 流的 HITL 帧都有账本孪生;腿只决定「还要不要同时直写 socket」**。后台腿没有 live 面,
- * 它的投递口就是账本追加本身(`runs.ts`);同步流腿有 live SSE,走本函数 —— 同一只帧对象先落账、再按需直写,
- * 于是两条腿对同一只帧的落法只差「直写要不要」,不差「账本有没有」。
- *
- * 顺序与失败语义(与后台腿同一条):
- *  · **先账本后直写**。账本落不下 ⇒ 本次投递**失败**(抛),帧不上 socket —— 一只没有孪生的帧不许单独露面
- *    (否则壳看见一张重载就丢的卡)。调用方(协调器)按「开帧投递失败」处理:这一问结算 `unavailable`、记一次既有的
- *    P-DEBT 留痕;消卡帧则落「面包屑丢失」的 F 类留痕。
- *  · **seq 不自造**:孪生走 `sink.append` —— 本腿账本唯一的那条串行链(与 text / tool / done 行同一个计数器)。
- *  · **直写口已不可达**(客户端离开,而 run 因 detach 继续)⇒ 账本孪生即送达,不再触碰那条已死的连接
- *    (不抛、也不记「丢帧」—— 帧没丢,在账本里)。
- *  · **本腿没有账本**(无 durable run 行的部署:`sink` 缺席)⇒ 直写就是全部投递,死流姿态由 `writeLive` 自己带
- *    (question 抛、elicitation 静默记账),字节逐字同孪生落地之前。
- *
- * 命名(CLAUDE.md 工厂命名律):`create*` —— 返回的是捕获了两个口的闭包,不是纯数据。
- */
-export declare function createLedgerTwinEmit<F extends {
-    type: LedgerEventType;
-}>(opts: {
-    /** 本腿的账本(sync 腿 = 有 durable run 行才有;缺席 ⇒ 无孪生可落)。只用 `append`:seq 由它那条链铸。 */
-    sink: Pick<LedgerSink, "append"> | undefined;
-    /** 本腿的直写口(sync 腿 = 一个具名 SSE 事件)。 */
-    writeLive: (frame: F) => void;
-    /** 直写面此刻可达吗 —— 与协调器问「这条腿还够得着人吗」的是**同一只**谓词(`QuestionRunContext.deliverable`)。 */
-    liveReachable: () => boolean;
-}): (frame: F) => Promise<void>;
 export declare function createLedgerSink(opts: {
     /** The seq-stamped durable append — typically `(seq, type, data) => runStore.appendEvent(taskId, seq, type, data)`. */
     appendEvent: (seq: number, type: LedgerEventType, data: unknown) => Promise<void>;

package/dist/trace/ledger-sink.js

@@ -17,17 +17,6 @@ export function createSerialLedgerAppend(appendEvent, startSeq) {
 export function createForwardAppendFailedNote(type) {
     return (err) => recordFailOpen("server.ledger.forward-append-failed", `type=${type} err=${err instanceof Error ? err.message : String(err)}`);
 }
-export function createLedgerTwinEmit(opts) {
-    return async (frame) => {
-        if (opts.sink !== undefined) {
-            const { type, ...data } = frame;
-            await opts.sink.append(type, data);
-            if (!opts.liveReachable())
-                return;
-        }
-        opts.writeLive(frame);
-    };
-}
 export function createLedgerSink(opts) {
     const keys = opts.notifiedKeys ?? new NotifiedKeys();
     let seq = 0;

package/dist/trace/model-segment.d.ts

@@ -1,4 +1,4 @@
-import { type LiveEventIdentity, type SegmentEndFields } from "./project.js";
+import { type EventIdentity, type SegmentEndFields } from "./project.js";
 /**
  * 本帧是不是模型文本的段界。**四条消费腿共用这一只**:账本投影 switch(`trace/ledger-sink.ts`)、
  * 顶层 live 流与转发子代腿(`http/routes/tasks.ts`)、子代 tail 面(`fleet/subagent-tail-bus.ts`)。
@@ -14,7 +14,7 @@ export type ReasoningEndFrame = SegmentEndFields & {
 };
 /** 登记册**读到的全部字段**,逐个写出来(不是 `Record<string, unknown>`):`TaskEvent` 与转发腿的原始帧
  *  都结构性满足它,于是调用点一个宽断言都不必写;将来有人想读第八个键,得先在这里加一行。
- *  `type` 而不是 `interface`(与 `LiveEventIdentity` 同一条理由):`text_end` 的铸点收 `Record<string, unknown>`,别名才进得去。 */
+ *  `type` 而不是 `interface`(与 `EventIdentity` 同一条理由):`text_end` 的铸点收 `Record<string, unknown>`,别名才进得去。 */
 export type ModelStreamEvent = {
     type?: string;
     delta?: unknown;
@@ -32,7 +32,7 @@ export interface ModelStreamIdent {
     bgAgentId?: string;
 }
 /** live 面模型文本的帧(本登记册铸的全部四种):两族的逐块帧与各自的段末帧。 */
-export type LiveModelTextFrame = (LiveEventIdentity & {
+export type LiveModelTextFrame = (EventIdentity & {
     type: "text_delta" | "reasoning_delta";
     delta: string;
 }) | (SegmentEndFields & {
@@ -63,8 +63,8 @@ export type LiveModelTextFrame = (LiveEventIdentity & {
  * ## 帧数与身份(消费端看得见的三件事)
  *  · 引擎的每一块 delta 仍恰好一帧、同一枚 `eventId`、原序(`delta` 可以是 `""`:那一块的字节还在窗里)—— 续流游标与 E18 的首块句柄不动;
  *  · 段末还在窗里的字节在段末帧**之前**一帧放出(同一族的逐块帧,带流身份三键、**不带** `eventId` ⇒ 不发 `id:` 行:它不是引擎的内容帧);
- *  · 延迟:一个字节在同一条流又到了脱敏器的未决尾上界(`PENDING_TAIL_UNITS` 个读法单元,由脱敏器的臂表算出)之后的下一次重扫时出门(重扫节律在流式口里);
- *    盖住它的跨度还在判定(未收尾的栅栏 / 引号 / JSON 串值 …)⇒ 判定或段末。
+ *  · 延迟:一个字节在盖住它的判定都不再读到文本末尾之后的下一次重扫时出门(脱敏器的读口闭集定交出点;重扫节律在流式口里)—— 没有开着的判定 ⇒ 到的那一块就出;
+ *    盖住它的跨度还在判定(未收尾的栅栏 / 引号 / JSON 串值 …)、凭据词头写在末尾附近 ⇒ 判定或段末。
  *
  * ## 段界(与账本腿同一只谓词)
  * 两族都只在本流的段界词({@link isModelSegmentBoundary})与腿终局 / 子代终态({@link LiveModelText.cut})收段;引擎的 `text_end` 是块的交付点(上一节),不收段。

package/dist/trace/model-segment.js

@@ -1,7 +1,7 @@
 import { recordFailOpen } from "../observability/fail-open.js";
 import { errorKindOf } from "../observability/err-text.js";
-import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
-import { liveIdentityFields, reasoningEndEventData, textEndEventData } from "./project.js";
+import { OVERSIZED_REDACTION_PLACEHOLDER } from "./exit-seat.js";
+import { identityFields, reasoningEndEventData, textEndEventData } from "./project.js";
 import { dropProjectedFace } from "./projection-drop.js";
 import { createRedactionStream } from "./redact.js";
 const BOUNDARY = new Set([
@@ -93,7 +93,7 @@ export function createLiveModelText() {
         const out = [];
         const rest = remainderOf(family, s);
         if (rest !== "")
-            out.push({ type: deltaType(family), delta: rest, ...liveIdentityFields(s.ident) });
+            out.push({ type: deltaType(family), delta: rest, ...identityFields(s.ident) });
         if (family === "reasoning") {
             const data = reasoningEndEventData({ ...s.ident, eventId: s.segmentEventId, content: s.text.fed });
             if (data !== null)
@@ -127,7 +127,7 @@ export function createLiveModelText() {
         }
         if (!deliver)
             return [];
-        return [{ type: deltaType(family), delta: s === undefined ? "" : release(s), ...liveIdentityFields(ev) }];
+        return [{ type: deltaType(family), delta: s === undefined ? "" : release(s), ...identityFields(ev) }];
     };
     return {
         onEvent: (ev, deliver = true) => {
@@ -157,7 +157,7 @@ export function createLiveModelText() {
                     if (deliver) {
                         const rest = deliverBlock(s);
                         if (rest !== "" && endOnly === undefined)
-                            out.push({ type: "text_delta", delta: rest, ...liveIdentityFields(s.ident) });
+                            out.push({ type: "text_delta", delta: rest, ...identityFields(s.ident) });
                     }
                     closeBlock(s);
                 }