@sema-agent/server 7.147.0 → 7.149.0

package/dist/trace/core-keyset-guard.d.ts

@@ -67,10 +67,9 @@ type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_P
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
-type WiringLegHandled = "kind";
-type WiringLegExcluded = "runOrigin";
-type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled | WiringLegExcluded>>;
-type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled | WiringLegExcluded, keyof WiringSection<"leg">>>;
+type WiringLegHandled = "kind" | "runOrigin";
+type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
+type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
 type WiringModRowKeys = WiringSection<"mods">[number] extends infer R ? (R extends unknown ? keyof R : never) : never;
 type WiringModRowHandled = "name" | "seat" | "tier" | "provenance" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
 type _GuardWiringModRow = AssertAllKeysHandled<Exclude<WiringModRowKeys, WiringModRowHandled>>;
@@ -218,8 +217,8 @@ type _GuardPromptManifestKeysReverse = AssertAllKeysHandled<{
 type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
     [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
 }[keyof ManifestCore]>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId" | "rowVerdict";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceSessionId" | "agentId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId" | "runOrigin" | "rowVerdict";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceSessionId" | "agentId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "requestedByCallId";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
@@ -483,6 +482,10 @@ type _GuardWorkflowRunStats = AssertAllKeysHandled<Exclude<keyof WorkflowRun["st
 type _GuardWorkflowRunStatsReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_DISPOSITIONS"]>, keyof WorkflowRun["stats"]>>;
 type _GuardWorkflowRunStatsNested = AssertAllKeysHandled<Exclude<keyof WorkflowRun["stats"]["nested"], TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>>>;
 type _GuardWorkflowRunStatsNestedReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_RUN_STATS_NESTED_DISPOSITIONS"]>, keyof WorkflowRun["stats"]["nested"]>>;
+type _GuardWorkflowBudgetOvershoot = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["budgetOvershoot"]>, TableCoreKeys<WorkflowTables["WORKFLOW_BUDGET_OVERSHOOT_DISPOSITIONS"]>>>;
+type _GuardWorkflowBudgetOvershootReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_BUDGET_OVERSHOOT_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["budgetOvershoot"]>>>;
+type _GuardWorkflowTimeoutInterruption = AssertAllKeysHandled<Exclude<keyof NonNullable<WorkflowRun["timeoutInterruption"]>, TableCoreKeys<WorkflowTables["WORKFLOW_TIMEOUT_INTERRUPTION_DISPOSITIONS"]>>>;
+type _GuardWorkflowTimeoutInterruptionReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<WorkflowTables["WORKFLOW_TIMEOUT_INTERRUPTION_DISPOSITIONS"]>, keyof NonNullable<WorkflowRun["timeoutInterruption"]>>>;
 type ReadRootCandidateProjected = "dir" | "clearsThisAsk" | "covers";
 type _GuardReadRootCandidate = AssertAllKeysHandled<Exclude<keyof ReadRootGrantCandidate, ReadRootCandidateProjected>>;
 type _GuardReadRootCandidateReverse = AssertAllKeysHandled<Exclude<ReadRootCandidateProjected, keyof ReadRootGrantCandidate>>;
@@ -649,6 +652,10 @@ export type CoreKeysetGuards = [
     _GuardWorkflowRunStatsReverse,
     _GuardWorkflowRunStatsNested,
     _GuardWorkflowRunStatsNestedReverse,
+    _GuardWorkflowBudgetOvershoot,
+    _GuardWorkflowBudgetOvershootReverse,
+    _GuardWorkflowTimeoutInterruption,
+    _GuardWorkflowTimeoutInterruptionReverse,
     _GuardReadRootCandidate,
     _GuardReadRootCandidateReverse,
     _GuardRiskAxes,

package/dist/trace/core-vocab-wire.d.ts

@@ -0,0 +1,95 @@
+/**
+ * **本服务输出面逐字过境的 core 词表的登记处** —— wire 变更机器清单(`scripts/wire-changes-server.mjs`)的第五类源。
+ *
+ * ## 它治的病
+ * 有些 wire 值不是本服务铸的,也不是投影面表登记的键:本服务在自己的座上用 core 的闭集常量校验一个值、原样放上 wire
+ * (审批卡 `card_json` 的卡词 `approvalCard`、续跑起跑失败体的 `cause` …)。core 给这些常量加一个词,本服务的输出闭集就随之放宽 ——
+ * 对卡词写穷举 `switch` 的消费方会编译红;而清单的其余四类源(契约附录 / 面表 / 自铸登记表 / core 新键)都看不见这一层,清单零条。
+ *
+ * ## 一个事实一个来源
+ * **词只住在 core**:本表不抄任何一个词,只登记「哪只 core 词表逐字上了本服务的 wire、自哪一版起」。生成器从 core 随包的逐版清单
+ * (`node_modules/@sema-agent/core/wire-changes/core@<ver>.json` 的 `closedSetMembers`)读区间 (上一 tag 的钉, 本版的钉] 里这只词表的净增删,
+ * 记进本服务清单的 `added` / `removed` 与 `closedSetMembers`(集名 `coreVocab.<词表>`)。本表自身的增删按成员记(集名 `coreVocab`)。
+ *
+ * ## 表的形(一只词表一行)
+ *  · 键      —— core 闭集的名字,与 core 清单 `closedSetMembers[].set` 同一拼写(= core 导出的运行期常量名);
+ *  · `at`    —— 它在本服务 wire 上的坐标(人读);
+ *  · `site`  —— 本服务按它校验 / 放行的那只模块(读点);
+ *  · `since` —— 本服务 wire 上开始逐字带这只词表的版本(= 该常量首次出现在 `site` 模块里的那个 tag)。
+ *
+ * ## 绑定(派生,不手抄)
+ * `test/wire-changes-server.test.ts`「core 词表逐字过境」组:每个键都是 core 导出的字符串数组常量;每只 `site` 模块从 core 引入的
+ * 字符串数组常量 ≡ 本表 `site` 为它的那几行(两个方向:读点多引一只词表而本表没跟 ⇒ 红;本表多登一只读点不引的 ⇒ 红)。
+ * 经 core 谓词(`isAskOrigin` 一类)而不是常量读的词表、帧投影里随 core 型过境的值,不在本表的射程里(清单的已知缺口,见设计稿)。
+ *
+ * ⚠️ 纯数据:零 import(生成器在历史 ref 上把本文件转译求值)。
+ */
+/** 一只逐字过境的 core 词表的登记。 */
+export interface CoreVocabWireEntry {
+    readonly at: string;
+    readonly site: string;
+    readonly since: string;
+}
+export declare const CORE_VOCAB_WIRE: {
+    readonly ALLOW_RULE_MEMBERS: {
+        readonly at: "approval_request card(card_json)allow 层披露记录的 member";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.117.0";
+    };
+    readonly ASK_EVIDENCE_ABSENCE_VALUES: {
+        readonly at: "approval_request card(card_json)规则证据的 orgRevisionAbsent / orgRuleAbsent / personalRuleDotsAbsent";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.23.0";
+    };
+    readonly BOUND_GRANT_ABSENCES: {
+        readonly at: "approval_request 帧活面事实 boundGrantAbsence";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.129.0";
+    };
+    readonly DENIAL_LIMIT_BOUNDS: {
+        readonly at: "approval_request card(card_json)denialLimitFallback.limit";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.135.0";
+    };
+    readonly HOOK_QUESTION_CAUSES: {
+        readonly at: "approval_request card(card_json)问因 { by: hook }.cause";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.143.0";
+    };
+    readonly PERSISTED_RULE_MATCHES: {
+        readonly at: "approval_request card(card_json)ruleOffers[].match";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.57.0";
+    };
+    readonly RESUME_STARTUP_CAUSES: {
+        readonly at: "422 parked_resume.startup_failed 体 cause";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.129.0";
+    };
+    readonly RULE_OFFERS_ABSENCES: {
+        readonly at: "approval_request card(card_json)ruleOffersAbsence";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.129.0";
+    };
+    readonly RULE_OFFER_KINDS: {
+        readonly at: "approval_request card(card_json)ruleOffers[].kind";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.135.0";
+    };
+    readonly STEER_REPLAY_FACETS: {
+        readonly at: "409 steering.duplicate_input_id 体 differs[]";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.118.0";
+    };
+    readonly TOOL_APPROVAL_CARDS: {
+        readonly at: "approval_request card(card_json)approvalCard · 帧活面事实 approvalCard";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.136.0";
+    };
+    readonly UNCOVERED_SEGMENT_REASONS: {
+        readonly at: "approval_request card(card_json)ruleOffers[].uncoveredDetail[].reason";
+        readonly site: "src/approval-card.ts";
+        readonly since: "7.57.0";
+    };
+};
+//# sourceMappingURL=core-vocab-wire.d.ts.map

package/dist/trace/core-vocab-wire.js

@@ -0,0 +1,15 @@
+export const CORE_VOCAB_WIRE = {
+    ALLOW_RULE_MEMBERS: { at: "approval_request card(card_json)allow 层披露记录的 member", site: "src/approval-card.ts", since: "7.117.0" },
+    ASK_EVIDENCE_ABSENCE_VALUES: { at: "approval_request card(card_json)规则证据的 orgRevisionAbsent / orgRuleAbsent / personalRuleDotsAbsent", site: "src/approval-card.ts", since: "7.23.0" },
+    BOUND_GRANT_ABSENCES: { at: "approval_request 帧活面事实 boundGrantAbsence", site: "src/approval-card.ts", since: "7.129.0" },
+    DENIAL_LIMIT_BOUNDS: { at: "approval_request card(card_json)denialLimitFallback.limit", site: "src/approval-card.ts", since: "7.135.0" },
+    HOOK_QUESTION_CAUSES: { at: "approval_request card(card_json)问因 { by: hook }.cause", site: "src/approval-card.ts", since: "7.143.0" },
+    PERSISTED_RULE_MATCHES: { at: "approval_request card(card_json)ruleOffers[].match", site: "src/approval-card.ts", since: "7.57.0" },
+    RESUME_STARTUP_CAUSES: { at: "422 parked_resume.startup_failed 体 cause", site: "src/approval-card.ts", since: "7.129.0" },
+    RULE_OFFERS_ABSENCES: { at: "approval_request card(card_json)ruleOffersAbsence", site: "src/approval-card.ts", since: "7.129.0" },
+    RULE_OFFER_KINDS: { at: "approval_request card(card_json)ruleOffers[].kind", site: "src/approval-card.ts", since: "7.135.0" },
+    STEER_REPLAY_FACETS: { at: "409 steering.duplicate_input_id 体 differs[]", site: "src/approval-card.ts", since: "7.118.0" },
+    TOOL_APPROVAL_CARDS: { at: "approval_request card(card_json)approvalCard · 帧活面事实 approvalCard", site: "src/approval-card.ts", since: "7.136.0" },
+    UNCOVERED_SEGMENT_REASONS: { at: "approval_request card(card_json)ruleOffers[].uncoveredDetail[].reason", site: "src/approval-card.ts", since: "7.57.0" },
+};
+//# sourceMappingURL=core-vocab-wire.js.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name", "config.read_deny_floor_unkept"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -121,6 +121,17 @@ export declare function engineNoticeEventData(notice: {
 export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => unknown;
 /** 口的槽位(闭集):`live` = 流上的人(SSE),`durable` = 这条 run 的事件账。{@link EngineNoticeRouter.routeConfirmed} 只数 `durable` 槽的落账确认。 */
 export type EngineNoticeSlot = "live" | "durable";
+/**
+ * 分流器收的通告形:引擎的四键(`code` / `message` / `detail` / 顶层 `sessionId`)加本服务的一只**投递键** `taskId` ——
+ * 在场 = 这条通告说的是哪一条 run(run 资源 id),只投给登记了同一条 run 的腿;缺席 = 按会话投(引擎的通告都不带它)。投递键不上 wire(行里没有它)。
+ */
+export interface RoutedNotice {
+    readonly code: string;
+    readonly message: string;
+    readonly detail?: Record<string, unknown>;
+    readonly sessionId?: unknown;
+    readonly taskId?: unknown;
+}
 /** 一条腿的两只具名口(各自可缺席:bg 腿没有 live SSE,ephemeral sync 腿没有账本)。 */
 export interface EngineNoticeLegSlots {
     readonly live?: EngineNoticeWireSink;
@@ -142,6 +153,11 @@ export interface EngineNoticeLegSlots {
  * 药:每次 `registerLeg` 铸一个单调 legId,`route` **只投最新代**;旧代的口留在表里(它自己的注销仍
  * 按身份精确删,不会误删新代),但一帧都收不到。方向 = fail-closed(宁可旧腿少一帧,不可新腿的事实
  * 写进旧腿的账)。
+ *
+ * 🔴 **反方向同一条:点名了 run 的通告不进别的 run 的账**(投递键 `taskId`,{@link RoutedNotice})。本服务按腿作用域定归属的通告
+ * (`read-deny-floor-notice.ts`:腿派出去的 run 的那一帧)带上这条腿的 run;腿的作用域可以被续延留住(后台子代在腿收场之后才准备),
+ * 那一刻同会话的最新一代可能已是下一条 run ⇒ 最新一代登记的 run 不是点名的那一条 ⇒ 不投。腿登记时带它写的那条 run(`registerEngineNoticeLeg` 的 `taskId`);
+ * 引擎的通告不带投递键,照旧按会话投。
  */
 export declare class EngineNoticeRouter {
     private readonly legs;
@@ -150,7 +166,7 @@ export declare class EngineNoticeRouter {
      *
      * 每只口各自 try 隔离在 {@link route} 里,单口抛不牵连同腿另一口。
      */
-    registerLeg(sessionId: string, slots: EngineNoticeLegSlots): () => void;
+    registerLeg(sessionId: string, slots: EngineNoticeLegSlots, taskId?: string): () => void;
     /** 单口腿的便捷形(测试用):登记为 **durable** 槽 —— 这样 `route()` 与 `routeConfirmed()` 两条路都能用一只口测到(live 槽对后者结构上恒不计)。 */
     register(sessionId: string, sink: EngineNoticeWireSink): () => void;
     /** 诊断/门用:某会话此刻**最新代**有几只口在听(旧代不计——它们收不到帧)。 */
@@ -158,28 +174,18 @@ export declare class EngineNoticeRouter {
     /** 诊断/门用:某会话此刻有几代腿在表里(>1 = 正处在换代窗内)。 */
     legCount(sessionId: string): number;
     /**
-     * 分流器的 wire 半场。返回**真投出去的口数**(0 = 没投:非白名单码 / 缺 sessionId / 该会话无活跃腿)。
+     * 分流器的 wire 半场。返回**真投出去的口数**(0 = 没投:非白名单码 / 缺 sessionId / 该会话无活跃腿 / 点名的 run 不是最新一代登记的那一条)。
      *
      * 单只口抛错**不吃掉同腿的其它口**(fleet bus 订阅者隔离同理由),并按 F 类登记留痕。
      */
-    route(notice: {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }, nowMs?: number): number;
+    route(notice: RoutedNotice, nowMs?: number): number;
     /**
      * [ref](codex r1-F2 / r2-F1;[ref] opus 腿 L2 改按槽判):同一只扇出,但**等**每只口交回的持久化结果 —— 返回**确认落账**的口数:
      * 只数 **`durable` 槽**里交回 thenable 且兑现 `true` 的口;兑现 `false` / 拒绝不算;`live` 槽**结构上不计**(不管它返回什么 —— 流上的人收没收到说明不了落账;
      * 修前按「交回 thenable」反推是不是 durable 口,哪天 live 口改成 async 返回 `true` 就会被计成落账)。给「投出之后要记一笔『告知过』」的铸点用:
      * 记账必须跟在**落账**之后,不能跟在「调用了口」之后(后台腿唯一的口是事件账 append,写失败时 `route()` 的计数照样是 1)。判据(白名单 / 归属 / 最新代 / 隔离)与 `route()` 逐字同一条。
      */
-    routeConfirmed(notice: {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }, nowMs?: number): Promise<number>;
+    routeConfirmed(notice: RoutedNotice, nowMs?: number): Promise<number>;
     /** 两只入口共用的扇出:返回每只**没抛**的口的持久化结果(promise 形一律先接住拒绝 ⇒ 绝不留未处理拒绝)。 */
     private fanOut;
 }
@@ -197,6 +203,8 @@ export declare const defaultEngineNoticeRouter: EngineNoticeRouter;
  */
 export declare function registerEngineNoticeLeg(opts: {
     sessionId: string | undefined;
+    /** 这条腿写的那条 run(run 资源 id = 本腿 `spec.taskId`;没有 run 资源 ⇒ 缺席)—— 点名了 run 的通告只投给登记了同一条 run 的腿。 */
+    taskId?: string;
     live?: EngineNoticeWireSink;
     durable?: EngineNoticeWireSink;
     router?: EngineNoticeRouter;
@@ -210,11 +218,6 @@ export declare function registerEngineNoticeLeg(opts: {
      * `route()` 恒返 0 —— 一条结构上永远投不出去的用户面披露,就是本仓 `task.user_steer_undrained` 陈腐明拒
      * 那一族的病。缺席/空数组 ⇒ 一个字节不投(既有腿逐字不变)。
      */
-    pending?: readonly {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }[];
+    pending?: readonly RoutedNotice[];
 }): () => void;
 //# sourceMappingURL=engine-notice-wire.d.ts.map

package/dist/trace/engine-notice-wire.js

@@ -54,6 +54,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.harvest_refused",
     "memory.harvest_conflict",
     "config.legacy_tool_name",
+    "config.read_deny_floor_unkept",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -149,9 +150,9 @@ const isThenableResult = (v) => typeof v === "object" && v !== null && typeof v.
 let nextLegId = 1;
 export class EngineNoticeRouter {
     legs = new Map();
-    registerLeg(sessionId, slots) {
+    registerLeg(sessionId, slots, taskId) {
         const sinks = [...(slots.live ? [{ slot: "live", sink: slots.live }] : []), ...(slots.durable ? [{ slot: "durable", sink: slots.durable }] : [])];
-        const leg = { legId: nextLegId++, sinks };
+        const leg = { legId: nextLegId++, sinks, ...(taskId !== undefined && taskId.length > 0 ? { taskId } : {}) };
         const list = this.legs.get(sessionId) ?? [];
         list.push(leg);
         this.legs.set(sessionId, list);
@@ -197,6 +198,9 @@ export class EngineNoticeRouter {
         const leg = list && list.length > 0 ? list[list.length - 1] : undefined;
         if (!leg || leg.sinks.length === 0)
             return [];
+        const named = notice.taskId;
+        if (typeof named === "string" && named.length > 0 && leg.taskId !== named)
+            return [];
         const row = engineNoticeEventData(notice, sessionId, nowMs, uuidv7());
         const outcomes = [];
         for (const { slot, sink } of leg.sinks) {
@@ -219,7 +223,7 @@ export function registerEngineNoticeLeg(opts) {
     if (live === undefined && durable === undefined)
         return () => undefined;
     const router = opts.router ?? defaultEngineNoticeRouter;
-    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) });
+    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) }, opts.taskId);
     for (const notice of opts.pending ?? [])
         router.route(notice);
     return unregister;

package/dist/trace/exit-seat.d.ts

@@ -1,3 +1,8 @@
+/**
+ * 「脱敏器抛 ⇒ 占位」的那一枚登记占位(**唯一属主在这里**:座的抛律用它,`observability/run-terminal.ts` 的终态 / 模型文本座与 `trace/model-segment.ts` 的活面放行窗
+ * 读同一枚)。属主住在座上而不在 run-terminal:日志出口接缝经座过筛,run-terminal 的模块图里有经接缝写日志的模块 —— 占位放在那边就是一个环。
+ */
+export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";
 /** 品牌键:模块私有的 `unique symbol` —— 别处写不出这个键,于是写不出一个 `SafeText` 字面量;断言伪造由普查门在语法树上拦。 */
 declare const SAFE_TEXT: unique symbol;
 /** 经出口座的文本。是 `string` 的子型:读者零改;写进出口位只能用 {@link seatText} 铸的值。 */
@@ -20,9 +25,11 @@ export type SafeText = string & {
  *    引擎放过的形照抹);界 200 码元,原样出门(JSON 串值,消费方自己渲染)。
  *  · `peer-declaration-sentence`:引擎判官对一份 MCP / A2A 对端声明说的句子(`toolAxes` / `toolFaces` / `sessionMetaKey` / 启动界的原因句,逐字带着声明方写的工具名、键名),
  *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行,以及能力读面 `GET /v1/capabilities/mcp` 上引擎整集拒(两台撞同一工具命名空间前缀)的拒句 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
- *  · `inbox-diagnostics-text`:`workflow_complete` 补投帧上的诊断教学文本(`diagnostics`)—— 引擎在 workflow 完成通知上铸的「读哪里 / 怎么续跑」文本,入会话收件时洗一次,
- *    店里(`payload` 列)只放出门安全的字节,drain 逐字带出。洗法与 live `task_notification.diagnostics` 同一个 scope(`free-text`);
- *    这一行比 `trace-frame-text` 多一条界(4000 码元,与同族条目的文本位同额),原样出门:逐成员的粗截;整条 `payload` 装不装得下由条目编码座按字节预算终判
+ *  · `completion-diagnostics-text`:一次 workflow 完成通知上的诊断教学文本(`diagnostics`)—— 引擎在完成通知上铸的「读哪里 / 怎么续跑」文本(含部署上的 journal 坐标:路径或 URL),
+ *    **两张脸同读这一行**:live `task_notification` 帧(`trace/project.ts` 的 `taskNotificationEventData`,停驻补投的 `task_notification` 帧与账本行同一只)与 `workflow_complete` 补投帧
+ *    (入会话收件时洗一次,店里 `payload` 列只放出门安全的字节,drain 逐字带出)。引擎在两条腿上给的不是同一份:sink 腿递未抹的原值、notifier 腿递「人类读者」档抹过的 ——
+ *    所以读者档在**这一行**上声明(`hostLeaks`),不靠哪条腿的上游记得抹:同一段输入,两张脸逐字节相等。洗法其余同 `trace-frame-text`(scope `free-text`);
+ *    这一行多一条界(4000 码元,与同族条目的文本位同额),原样出门:逐成员的粗截;整条 `payload` 装不装得下由条目编码座按字节预算终判
  *    (`orchestration/workflow-completion-inbox.ts` 的 `encodeInboxBody`,预算 = 最窄后端的 `payload` 列容量,超 ⇒ 最小形 + `payloadTruncated`)。
  *  · `inbox-frame-text`:`task_notification` 补投帧(停驻收件、下一次开流 drain)上会话箱车道的自由文本位 —— 三只载体的 `crossSessionMessage.fromName` /
  *    `.body`、`crossSessionNotice.text` 与侧记 `_sema_provenance.peerMeta.notice` 的 `recipient` / `target` / `detail` / `dropReason`(别的会话写的或引擎嵌着
@@ -42,6 +49,10 @@ export type SafeText = string & {
  *    `refused[].path` / `failed[].path`;源头是模型交的路径参数)—— 不设界(截过的路径就不是那个文件了,消费方要拿它去对文件),原样出门。
  *  · `rewind-ledger-reason`:同一口台账上的拒因 / 故障句(`refused[].reason` / `failed[].reason` / `error.message`;引擎与文件历史店写的、可能带着抛出物原文)——
  *    界 500 码元,原样出门(JSON 串值,消费方自己渲染)。
+ *  · `log-record`:日志出口接缝(`observability/logger.ts`)写出的**整条**结构化日志行 —— `{ ts, level, msg, ...fields }` 的 `JSON.stringify` 产物,进程 stdout / stderr 的诊断字节
+ *    (写出点不判:字段里混进来的凭据形 —— 被拒的目录条目名、上游回显、错误消息里的令牌 —— 在这一行上统一挡);脱敏器按 JSON 读法读(`json`),不设界(日志行的长短是写出点的事),
+ *    原样出门。遮过的产物不再是一条 JSON ⇒ 按座的抛律换占位(见模块头注「抛」);占位不是一条 JSON ⇒ 接缝扣下这一行(固定字节的扣下句),见接缝头注。
+ *  · `log-text`:日志出口接缝写出的一段诊断散文(与 `console.*` 同一种格式化,`util.format`;带调用栈的多行);不设界、不整形(多行照旧),原样出门。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -83,9 +94,10 @@ declare const EXIT_SEATS: {
     readonly "peer-declaration-sentence": {
         readonly scope: "free-text";
     };
-    readonly "inbox-diagnostics-text": {
+    readonly "completion-diagnostics-text": {
         readonly scope: "free-text";
         readonly maxChars: 4000;
+        readonly hostLeaks: true;
     };
     readonly "inbox-frame-text": {
         readonly scope: "free-text";
@@ -109,6 +121,13 @@ declare const EXIT_SEATS: {
         readonly scope: "free-text";
         readonly maxChars: 500;
     };
+    readonly "log-record": {
+        readonly scope: "free-text";
+        readonly json: true;
+    };
+    readonly "log-text": {
+        readonly scope: "free-text";
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /** 设了界的座名。 */
@@ -119,6 +138,13 @@ export type BoundedExitSeat = {
 }[ExitSeat];
 /** 一行的界(码元;含截断记号)—— 界的唯一属主是座表,站点要用这个数(显示预算、文档钉)就读它,不另抄一份。 */
 export declare function seatMaxChars(seat: BoundedExitSeat): number;
+type ScanGeometry = {
+    readonly region: number;
+    readonly margin: number;
+    readonly window: number;
+};
+/** 一个有界行的扫描窗几何(读法单元):出门区、余量、窗 = 出门区 + 余量。窗的几何只有这里一处答 —— 站点 / 测试要这几个数就读它,不另抄。 */
+export declare function seatScanGeometry(seat: BoundedExitSeat): ScanGeometry;
 /**
  * 出口座:`seat` 是座表的一行,`text` 是要出门的自由文本。返回的 {@link SafeText} 就是这个出口该写出去的字节。
  * 表外的座名(只有绕过类型才到得了)⇒ 抛 —— 那是调用方的编程错,不是脱敏失败,不吞成占位。

package/dist/trace/exit-seat.js

@@ -1,9 +1,10 @@
 import { stripControlAndBidi } from "@sema-agent/settings-schema";
+import { REDACTION_MARKS, redactHostLeaks } from "@sema-agent/core";
 import { CALLER_TEXT_CUT_MARK } from "../caller-text-echo.js";
 import { errorKindOf } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
-import { proposeRedactionSpans, readingHeadEnd, REDACTION_TOKEN_RE_SRC, WHOLE_EXTENT } from "./redact.js";
+import { MAX_RECOGNITION_SPAN, mergeRedactionSpans, proposeRedactionSpans, readingHeadEnd, REDACTION_TOKEN_RE_SRC, renderRedactionSpans, WHOLE_EXTENT } from "./redact.js";
+export const OVERSIZED_REDACTION_PLACEHOLDER = "«redacted:oversized»";
 const EXIT_SEATS = {
     "trace-frame-text": { scope: "free-text" },
     "trace-frame-line": { scope: "free-text", maxChars: 300 },
@@ -14,13 +15,15 @@ const EXIT_SEATS = {
     "session-title": { scope: "free-text", maxChars: 80, emit: "title-line" },
     "mcp-remote-text": { scope: "free-text", maxChars: 200 },
     "peer-declaration-sentence": { scope: "free-text" },
-    "inbox-diagnostics-text": { scope: "free-text", maxChars: 4000 },
+    "completion-diagnostics-text": { scope: "free-text", maxChars: 4000, hostLeaks: true },
     "inbox-frame-text": { scope: "free-text", maxChars: 4000 },
     "boot-refusal-line": { scope: "free-text", maxChars: 512, emit: "log-line" },
     "peer-inbound-card-text": { scope: "free-text" },
     "workflow-recovery-summary": { scope: "diagnostic" },
     "rewind-ledger-path": { scope: "free-text" },
     "rewind-ledger-reason": { scope: "free-text", maxChars: 500 },
+    "log-record": { scope: "free-text", json: true },
+    "log-text": { scope: "free-text" },
 };
 export function seatMaxChars(seat) {
     return EXIT_SEATS[seat].maxChars;
@@ -34,19 +37,9 @@ for (const [name, row] of SEAT_ROWS) {
         throw new Error(`exit seat "${name}": a row with an emission form must declare maxChars (the cut mark counts inside the bound)`);
     }
 }
-function mergeSpans(spans) {
-    const order = spans.map((s, i) => ({ s, i })).sort((a, b) => a.s.start - b.s.start || b.s.end - a.s.end || a.i - b.i);
-    const out = [];
-    for (const { s } of order) {
-        const last = out[out.length - 1];
-        if (last === undefined || s.start > last.end)
-            out.push(s);
-        else if (s.end > last.end)
-            out[out.length - 1] = { start: last.start, end: s.end, repl: last.repl };
-    }
-    return out;
-}
 const TOKEN_AT = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+const ENGINE_MARKS = Object.values(REDACTION_MARKS);
+const ENGINE_MARK_MAX = Math.max(...ENGINE_MARKS.map((m) => m.length));
 function safeCutPoint(gap, cut) {
     const hi = gap.charCodeAt(cut - 1);
     if (cut > 0 && hi >= 0xd800 && hi <= 0xdbff && (gap.charCodeAt(cut) & 0xfc00) === 0xdc00)
@@ -58,21 +51,23 @@ function safeCutPoint(gap, cut) {
         if (m !== null && open + m[0].length > cut)
             cut = open;
     }
-    return cut;
-}
-const cutPlain = (gap, room) => gap.slice(0, safeCutPoint(gap, room));
-function renderOnce(text, groups, until = Number.POSITIVE_INFINITY) {
-    const parts = [];
-    let at = 0;
-    for (const g of groups) {
-        if (g.start >= until)
+    for (let at = gap.lastIndexOf("[", cut - 1); at !== -1 && at > cut - ENGINE_MARK_MAX; at = at === 0 ? -1 : gap.lastIndexOf("[", at - 1)) {
+        const mark = ENGINE_MARKS.find((m) => gap.startsWith(m, at));
+        if (mark !== undefined && at + mark.length > cut) {
+            cut = at;
             break;
-        parts.push(text.slice(at, g.start), g.repl);
-        at = g.end;
+        }
     }
-    parts.push(text.slice(at, until));
-    return parts.join("");
+    return cut;
+}
+function hostLeakSpans(text) {
+    const report = { findings: [] };
+    redactHostLeaks(text, report);
+    return report.findings
+        .filter((f) => f.marker === REDACTION_MARKS.url || f.marker === REDACTION_MARKS.path)
+        .map((f) => ({ start: f.span[0], end: f.span[1], repl: f.marker }));
 }
+const cutPlain = (gap, room) => gap.slice(0, safeCutPoint(gap, room));
 function emitAs(form, text) {
     switch (form) {
         case "log-line":
@@ -90,9 +85,15 @@ function emitAs(form, text) {
     }
 }
 const layoutOf = (row) => (row.emit === undefined ? "multi-line" : "single-line");
-const SCAN_WINDOW_FLOOR = 4096;
-const SCAN_WINDOW_PER_BOUND = 8;
-const scanWindowOf = (maxChars) => Math.max(SCAN_WINDOW_FLOOR, maxChars * SCAN_WINDOW_PER_BOUND);
+const SCAN_REGION_FLOOR = 2048;
+const SCAN_REGION_PER_BOUND = 4;
+const scanGeometryOf = (maxChars) => {
+    const region = Math.max(SCAN_REGION_FLOOR, maxChars * SCAN_REGION_PER_BOUND);
+    return { region, margin: MAX_RECOGNITION_SPAN, window: region + MAX_RECOGNITION_SPAN };
+};
+export function seatScanGeometry(seat) {
+    return scanGeometryOf(EXIT_SEATS[seat].maxChars);
+}
 function boundRow(out, row, cutUpstream) {
     if (row.maxChars === undefined)
         return out;
@@ -110,13 +111,12 @@ export function seatText(seat, text) {
     let out;
     try {
         const layout = layoutOf(row);
-        const scanWindow = row.maxChars === undefined ? undefined : scanWindowOf(row.maxChars);
+        const geometry = row.maxChars === undefined ? undefined : scanGeometryOf(row.maxChars);
         let windowEnd;
         let regionEnd;
-        if (scanWindow !== undefined && text.length > scanWindow) {
-            const half = scanWindow >>> 1;
-            const region = safeCutPoint(text, readingHeadEnd(text, layout, half));
-            const end = safeCutPoint(text, readingHeadEnd(text, layout, scanWindow - half, region));
+        if (geometry !== undefined && text.length > geometry.window) {
+            const region = safeCutPoint(text, readingHeadEnd(text, layout, geometry.region));
+            const end = safeCutPoint(text, readingHeadEnd(text, layout, geometry.margin, region));
             if (end < text.length) {
                 windowEnd = end;
                 regionEnd = region;
@@ -128,9 +128,13 @@ export function seatText(seat, text) {
         else {
             const emitUntil = regionEnd;
             const extent = windowEnd === undefined || regionEnd === undefined ? WHOLE_EXTENT : { kind: "head", emitEnd: regionEnd };
-            const rendered = renderOnce(head, mergeSpans(proposeRedactionSpans(head, row.scope, layout, extent)), emitUntil);
+            const proposals = proposeRedactionSpans(head, row.scope, layout, extent, row.json === true);
+            const groups = row.hostLeaks === true ? mergeRedactionSpans([...proposals, ...hostLeakSpans(head)]) : proposals;
+            const rendered = renderRedactionSpans(head, groups, 0, emitUntil ?? head.length);
             out = boundRow(row.emit === undefined ? rendered : emitAs(row.emit, rendered), row, windowEnd !== undefined);
         }
+        if (row.json === true && out !== text)
+            JSON.parse(out);
     }
     catch (err) {
         recordFailOpen("server.run-terminal.redact-threw", `seat=${seat} len=${typeof text === "string" ? text.length : -1} err=${errorKindOf(err)}`);

package/dist/trace/extension-call-face.d.ts

@@ -19,8 +19,9 @@
 import type { ExtensionRequester, RewriteAuthor } from "@sema-agent/core";
 /** wire 上的发起者位 = 引擎的 `ExtensionRequester` 同形(`name` 已过出口纪律);引擎加一类发起者 ⇒ 这里的形随之,读法下面一处判。 */
 export type ExtensionRequesterFace = Readonly<ExtensionRequester>;
-/** `requestedBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。`where` 进留痕句(哪一面:`tool_start` / `tool_end` / `tool_approval` / 读腿)。 */
-export declare function extensionRequesterOf(v: unknown, where: string): ExtensionRequesterFace | undefined;
+/** 扩展发起者形(`ExtensionRequester`)的投影 —— `requestedBy`(调用的发起者)与 `declinedBy`(core 7.66.0:拒了这只附件的扩展)同一只读法(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。
+ *  `where` 进留痕句(哪一面:`tool_start` / `tool_end` / `tool_approval` / 读腿 / `human_input.attachments`);`field` 让留痕句点对字段名(判据一只,丢弃句按字段各写一句字面量)。 */
+export declare function extensionRequesterOf(v: unknown, where: string, field?: "requestedBy" | "declinedBy"): ExtensionRequesterFace | undefined;
 /** `answeredBy` 的投影(缺席 ⇒ 缺席;形不对 ⇒ 丢 + 计一次)。 */
 export declare function extensionAnswererOf(v: unknown, where: string): string | undefined;
 /** wire 上的改写记录 = 引擎的 `ToolInputRewrite` 同形(扩展项的 `name` 已过出口纪律、`input` 已脱敏)。 */

package/dist/trace/extension-call-face.js

@@ -1,10 +1,12 @@
 import { sanitizeWireText } from "./engine-notice-wire.js";
 import { dropProjectedFace } from "./projection-drop.js";
-export function extensionRequesterOf(v, where) {
+export function extensionRequesterOf(v, where, field = "requestedBy") {
     if (v === undefined)
         return undefined;
     if (typeof v === "object" && v !== null && "kind" in v && "name" in v && v.kind === "extension" && typeof v.name === "string" && v.name !== "")
         return { kind: "extension", name: sanitizeWireText(v.name) };
+    if (field === "declinedBy")
+        return dropProjectedFace("human_input.declinedBy is not { kind: extension, name: <non-empty string> } on " + where);
     return dropProjectedFace("extension_call.requestedBy is not { kind: extension, name: <non-empty string> } on " + where);
 }
 export function extensionAnswererOf(v, where) {

package/dist/trace/ledger-events.d.ts

@@ -55,18 +55,15 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled"
 /** core 7.54.0 [ref] O9b S1:`permission.cross_boundary_taint` 帧的耐久行(伴随记录,与 `config_assembled` 同一只队列、同一批 drain 点;只在执行于目标设备的树上有)。 */
  | "cross_boundary_taint" | "file_link"
-/** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
+/** 人在环三族的 open/close 帧对(投递 = 本腿那一只人在环传输,先落本账本再写直写面;`hitl-delivery.ts`)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
 /** [ref] §4.3 呈卡族的开卡帧与单卡消卡帧(与上面两只 tool_approval 帧同一条投递面;一条腿只发其中一族,
  *  bg / resume 两条 durable 腿恒是呈卡腿 ⇒ 它们的账本自 7.133.0 起只有本族)。 */
  | "approval_request" | "approval_complete"
 /**
- * [ref]([ref]):批级撤卡帧在 **bg/resume 两条 durable 腿**的账本落行(与呈卡帧同口
- * `append(type, rest)`,seq 由腿自己的 ledger 链步分配)。此前成文「reaper/收敛器无 seq 可分配故
- * live-only」只对**调用点**成立,不对 ctx 的投递口成立——帧经 `emitRevokeTo` 交给各 ctx 的
- * `emitRevoke`,durable 腿的那只钩子自己就是账本写口。sync 腿维持 live-only(行为零变,
- * `routes/tasks.ts` 装配点注)。重放语义:同一账本里卡帧(`approval_request`)在前、撤帧在后,
- * 全量重读恒同序 ⇒ 幂等诚实;不投影成 trace 2.3 帧(`LEDGER_TYPES_NOT_PROJECTED` 登记)。
+ * 批级撤卡帧:与呈卡帧同一只腿传输(`hitl-delivery.ts`:先本 run 账本、再直写),seq 由腿自己的账本链步分配 ——
+ * 三条腿(sync 腿有 durable run 行时)都落行。重放语义:账本里的序 = 入链序(陈旧快照的窄窗里撤帧可先于它点名的卡行),
+ * 全量重读恒同序,消费方按 `askIds` 幂等应用;不投影成 trace 2.3 帧(`LEDGER_TYPES_NOT_PROJECTED` 登记)。
  */
  | "approval_revoke"
 /** 异步 workflow 完成的入箱 drain(`emitPendingWorkflowCompletions` 两个字面型之一)。 */