@sema-agent/server 7.22.0-rc.1 → 7.23.0-rc.1

package/dist/security.js

@@ -1,5 +1,4 @@
-import { uuidv7 } from "@sema-agent/core";
-import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
+import { uuidv7, PROJECT_ID_REGEX } from "@sema-agent/core";
 // design/158 A4: the env→key-set decoders (parseApprovalHmacKeys / parsePrincipalJwks + their row types) moved to
 // the leaf ./auth-keys.js so config.ts's env-load no longer value-imports this whole auth module (lens2 §F). The
 // verifiers that consume the parsed key-sets now live in ./approval-hmac.js / ./principal-jwt.js (design/158 A13);
@@ -110,16 +109,25 @@ export function createAuthorizer(config, sessionStore) {
             throw new HttpError(401, `missing principal header '${config.principalHeader}'`);
         }
         // 142-S4 projectId 线程化(design/142 §2 行为面):body.projectId 是「哪个项目」的选择器,不是身份 —
-        // scope 的 tenant 段永远来自 verified principal(上面),所以它过 SHAPE 门即可(PROJECT_ID_REGEX,
-        // registry-core 0.10.0 与 center 登记簿同一词法;generic lowercase UUID)。不合形状 = 422 typed
-        // fail-loud(注入串/大小写/任意路径段绝不进 scope 键或 config.projects 查表)。RESUME 腿不过此门
+        // scope 的 tenant 段永远来自 verified principal(上面),所以它过 SHAPE 门即可。不合形状 = 422 typed
+        // fail-loud(注入串/任意路径段绝不进 scope 键或 config.projects 查表)。RESUME 腿不过此门
         // (checkpoint 重建 auth 不跑 authorizer)— 持久化 body 在原始提交时已验过,形状不变。
+        //
+        // 🔴 A-033.1(#256)单源换装 + **宽读严写**两半:
+        //  ① 形状词法改从 core 取(`PROJECT_ID_REGEX`,core 自陈「projectId 格式单源」[637]①)。此前取自
+        //    registry-core 的**自持镜像**,而那份镜像与 core 已实证漂移:core 带 `/i`、registry-core 不带 ⇒
+        //    一个 projectId 能过 core 的 scope 面(`parseProjectMarker`/`resolveProjectId` 都认大小写)却被
+        //    本仓的门 422。registry-core 自己的 `types.d.ts` 就挂着「core 公开导出后即改从 core 取」的 TODO。
+        //  ② 收下之后**立即折小写**再往下走 —— core 的铸造面同款纪律(`formatProjectMarker` 亲读:验形用
+        //    带 `/i` 的同一条正则,写盘 `projectId.toLowerCase()`)。这一折是承重的:`formatProjScope` 不做
+        //    任何归一化,不折的话 `proj:<t>/ABC…` 与 `proj:<t>/abc…` 是**两只不同的记忆盘**,同一个项目按
+        //    大小写分家(而 registry-core 的 `ProjectsConfig` 只收小写键 ⇒ 大写形还会在 config.projects 恒 miss)。
         let projectId;
         if (body.projectId !== undefined) {
             if (typeof body.projectId !== "string" || !PROJECT_ID_REGEX.test(body.projectId)) {
-                throw new HttpError(422, "projectId must be a lowercase UUID (the center project registry's id shape)", { code: "invalid_project_id" });
+                throw new HttpError(422, "projectId must be a UUID (the center project registry's id shape)", { code: "invalid_project_id" });
             }
-            projectId = body.projectId;
+            projectId = body.projectId.toLowerCase();
         }
         // design/114 Phase3 (reuse-path warm-resume): the caller requires the session to ALREADY exist. The authorizer
         // must NOT claim-create a missing id — that would materialize an empty session_meta row and DEFEAT core's

package/dist/task-settings.js

@@ -35,7 +35,7 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, } from "@sema-agent/core";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, } from "@sema-agent/core";
 import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 /**
@@ -339,12 +339,17 @@ function createAskListPolicy(askNames) {
  *  only, a workflow confirmation is not an edit ([1248]② — cli to verify against the 212 live shell; flip there
  *  if the real shell differs). bypassPermissions/undefined-mode attach nothing (pre-existing behavior); plan is
  *  blocked upstream by handsReadOnly (effect="write"). Deployment disable stays `RuntimeCaps.allowWorkflows` —
- *  this leg is the per-request HITL gate, not the capability switch. */
-const WORKFLOW_ASK_NAMES = ["Workflow"];
+ *  this leg is the per-request HITL gate, not the capability switch.
+ *
+ *  🔴 A-033.1(#256):这三处曾**手抄字面量** `"Workflow"`。core 改名该工具时,手抄的名字与 core 实挂的名字
+ *  分家 ⇒ ask 腿的 `req.toolName !== "Workflow"` 恒真、deny 腿恒假,**整条门不触发**,而且不报错、不留痕
+ *  —— 安全轴上的静默 fail-open。现在四处引用(本文件两条腿 + `nameSets` 审计面 + `http/server.ts` 的
+ *  可满足性预检)全部派生自 core 导出的 {@link RUN_WORKFLOW_TOOL_NAME},core 一改名这四处同步跟着改。 */
+const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
 function createWorkflowAskPolicy(isExempt) {
     return {
         async check(req) {
-            if (req.toolName !== "Workflow")
+            if (req.toolName !== RUN_WORKFLOW_TOOL_NAME)
                 return { action: "allow" };
             // codex F2 (durable lane): the "don't ask again this session" grant (decide remember="session" →
             // approvalExemptionStore) is probed at the POLICY layer here — the durable lane parks every policy `ask`
@@ -375,7 +380,7 @@ function createWorkflowAskPolicy(isExempt) {
 function createWorkflowPlanDenyPolicy() {
     return {
         check(req) {
-            return req.toolName === "Workflow"
+            return req.toolName === RUN_WORKFLOW_TOOL_NAME
                 ? { action: "deny", message: `Plan mode is active — "${req.toolName}" is a write/mutating tool and is read-only-blocked.`, decisionReason: "rule" }
                 : { action: "allow" };
         },

package/dist/tool-approval.d.ts

@@ -1,6 +1,6 @@
 import { type AskRequest, type AskOutcome } from "@sema-agent/core";
 import type { CardRulePersisted, RuleConsentLane } from "./rules-consent.js";
-import { type ApprovalRequestFrame, type ApprovalRevokeFrame } from "./approval-card.js";
+import { type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import type { ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** A-002.1:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
@@ -143,6 +143,25 @@ export interface ToolApprovalFrame {
             total: number;
         };
     };
+    /**
+     * #263 件 G2(core 5.35.0 design/252 G-2;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 背后的
+     * **规则出处证据**(`AskRequest.ruleEvidence`,引擎在 gate 内盖章):org 快照 `orgRevision` / 命中的
+     * org 规则原文 `orgRule` / 被越级个人规则的 add dots `personalRuleDots`,**每员 = 值或五词命名缺席**
+     * (`not_wired|not_adjudicated|unavailable|no_match|not_reported`,core `AskEvidenceAbsence` 闭集)。
+     *
+     * 🔴 **缺席词表是本键的存在理由**:裸 `undefined` 对「没接治理层」与「治理源读不动」是同一个答案,
+     * 审计链会把后者重构成「这次调用无治理」。`"unavailable"` 是承重员:org 层报了「看不见组织规则」,
+     * 手上这只 ask 是随之而来的 fail-closed 收紧——不是任何已发布规则要求的 ask。
+     *
+     * 🔴 **展示/对账元数据,永不是裁决输入**(core 契约逐字:removing it would leave every decision
+     * byte-identical);server 逐字转录**引擎盖章**的那一份,**永不自铸缺席词**(server 铸词 = 谎报
+     * 「某一层没报」)。窄读走 `approval-card.ts` 的 `readRuleEvidence`(卡也用它 ⇒ 帧与 `card_json`
+     * 同值;redact+截长在函数内一次算定,`persistedRuleShadowed` R2-[medium] 同款)。
+     *
+     * 与 `persistedRuleShadowed` **刻意分列**:那是**人读的**越级规则原文(display 值,非身份通道),
+     * 本键的 dots 是那条规则的**机器身份**(a rule is a set of adds;数组即身份,消费端禁 join 成标量)。
+     */
+    ruleEvidence?: RuleEvidenceProjection;
     /** "tool_approval" only: the tool call's args, secret-redacted, UNTRUSTED-for-display. Absent (with
      *  `argsOmitted: true`) when over the byte cap or unserializable. */
     args?: unknown;

package/dist/tool-approval.js

@@ -48,7 +48,7 @@ import { uuidv7, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { createLogger } from "./observability/logger.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_SUGGESTIONS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_SUGGESTIONS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, } from "./approval-card.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 /** #151 车2:本模块自有的日志出口——同 config-provider.ts/runtime-caps-resolver.ts 先例(协调器不走
  *  DI logger,构造签名是设计定稿钉死的三键 options bag,加第四个 logger 键属于重议已裁事项）。仅用于
@@ -903,6 +903,9 @@ export class ToolApprovalCoordinator {
             // #253 件 G1:结构化探针因由。窄读走 `approval-card.ts` 的 `readProbeCause` —— **卡也用它**,
             // 所以活卡帧与 `card_json` 是同一份值(而不是两处各挑一次键)。缺席/形不合 ⇒ 不铸键。
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
+            // #263 件 G2:规则出处证据。同款同源(`readRuleEvidence`,redact+截长函数内一次算定);
+            // 缺席/形不合/恰一不变量被破 ⇒ 不铸键(语义见字段顶注)。
+            ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
         };
         // #151 车2(design/172 §3.3 D3 窗长三元):有效窗——legDeadlineMonotonic 缺席时退化成 ttlMs(D1 零

package/dist/trace/core-keyset-guard.d.ts

@@ -26,7 +26,7 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleSuggestions" | "persistedRuleShadowed" | "probeCause";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleSuggestions" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence";
 type AskExcluded = "preview" | "principal" | "requiresRealApproval" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";

package/dist/trace/project.d.ts

@@ -94,6 +94,7 @@ export type TraceBlock = {
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
     eventId?: string;
     parentToolCallId?: string;
 } | {
@@ -136,6 +137,7 @@ export declare function toolEndEventData(ev: {
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    approver?: string;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -176,6 +176,14 @@ export function toolEndEventData(ev) {
         //     一律不铸键 —— 既不折 "human" 也不折 null,把「不知道」如实表达成「没有这个键」。
         // 值是引擎铸的枚举短串、非用户内容 ⇒ 不脱敏。
         ...(isApprovalSettledBy(ev.settledBy) ? { settledBy: ev.settledBy } : {}),
+        // core 5.35.0 design/252 G-7(#263 提货批,[4022] G3):`approver` = 这次结算**是谁的**——审批通道
+        // 自报的结算方标识串,core `screenApproverAttribution` 筛形后逐字转录在 `settledBy` 旁,两键**合读**
+        // (`settledBy:"timeout"` + approver = 超时的那条队列名,不是拒绝的人)。与 settledBy 同族三条纪律:
+        //  ① 只挂在经审批结算的 tool_end 上;缺席 = 通道没报名字,**永不**意味「没人批」或「有人批」;
+        //  ② core 只筛形不鉴别(转录不是认证)—— server 同姿势,不折不铸,typeof 判形即过境;
+        //  ③ 值是**宿主派生的身份串**(login/email/账号 id),照 humanInputEventData 的 issuer/actor.id
+        //     先例过 redactSecrets(对正常标识恒等,对密钥形打码;core 已拒控制符/超长,无需重复筛)。
+        ...(typeof ev.approver === "string" && ev.approver !== "" ? { approver: redactSecrets(ev.approver) } : {}),
         ...identityFields(ev),
     };
 }
@@ -737,6 +745,9 @@ export function toolResultFieldsOf(d) {
         // 🔴 读腿的闭集门是**独立的一道**,不是写侧那道的复述:账本行可以来自任何引擎世代、任何第三方
         // producer,写侧的门管不到它们;这里放行 = 把一个 core 从未发过的词直接送上 wire。
         ...(isApprovalSettledBy(d.settledBy) ? { settledBy: d.settledBy } : {}),
+        // core 5.35.0 G-7(#263):结算归属(settledBy 旁的 WHOSE)——写侧已 redactSecrets 后落账,读腿
+        // 同键过境;判形独立一道(同上款理由),开集身份串故只判 string 非空,不设词表。
+        ...(typeof d.approver === "string" && d.approver !== "" ? { approver: d.approver } : {}),
         ...identityFields(d),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.22.0-rc.1",
+  "version": "7.23.0-rc.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.34.0",
+    "@sema-agent/core": "^5.35.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.17.2",
+    "@sema-agent/sdk": "7.1.0-rc.1",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",