@sema-agent/server 7.49.0 → 7.51.0

package/dist/plugins/remote-scratchpad.js

@@ -1,4 +1,4 @@
-const REMOTE_SCRATCHPAD_LANES = new Set(["e2b", "k8s", "local-docker", "ssh"]);
+const REMOTE_SCRATCHPAD_LANES = new Set(["e2b", "k8s", "local-docker", "ssh", "device"]);
 export function isRemoteScratchpadLane(provider) {
     return provider !== undefined && REMOTE_SCRATCHPAD_LANES.has(provider);
 }

package/dist/plugins/store-backend.d.ts

@@ -17,6 +17,7 @@ import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.j
 import { TiDBImageIndex, PgImageIndex } from "./image-index-sql.js";
 import { TiDBImageBake, PgImageBake } from "./image-bake-store-sql.js";
 import { TiDBLeaderRunStore, PgLeaderRunStore } from "./leader-run-store-sql.js";
+import type { DeviceStore } from "../device-store.js";
 import { TiDBBreakerState, PgBreakerState } from "./breaker-state-sql.js";
 import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
@@ -212,6 +213,14 @@ export interface StoreBackend {
      * 缺席 ⇒ endpoint 落到显式的单副本内存降级臂(见 `leader/endpoint.ts` 的 store 缺席注)。
      */
     leaderRun?(): LeaderRunStore;
+    /**
+     * device lane 的四表店(device-executor-lane-v2 §6,车A-2 交店 / 车A-4 接线)。**SQL 后端专有**,
+     * `local` 刻意省略 —— 与 {@link leaderRun} 逐字同一条理由:config 层已经把「`REMOTE_EXEC=device` 且
+     * 无外部 SQL 店」整个组合拒启了(`device-durable-store` 不变量),所以 local 车道上根本不存在一个需要
+     * 这四张表的 device worker。消费点按 `backend?.device?.()` 取,缺席 ⇒ `boot/device-lane.ts` 的
+     * `assertDeviceLaneWired` 响亮拒启(**不是**静默落进程内 stub)。
+     */
+    device?(): DeviceStore;
     /**
      * #270 —— 托管留存的**破坏性**三方法(core `ManagedRetentionCapability` 的 server 侧真身)。
      * **SQL 后端专有**,`local` 刻意省略:那三条腿是跨十余张表的单事务级联,file/in-memory 形没有事务面

package/dist/plugins/store-backend.js

@@ -26,6 +26,7 @@ import { TiDBToolResultStore, PgToolResultStore } from "./tool-result-store-sql.
 import { TiDBImageIndex, PgImageIndex } from "./image-index-sql.js";
 import { TiDBImageBake, PgImageBake } from "./image-bake-store-sql.js";
 import { TiDBLeaderRunStore, PgLeaderRunStore } from "./leader-run-store-sql.js";
+import { TiDBDeviceStore, PgDeviceStore } from "./device-store-sql.js";
 import { TiDBBreakerState, PgBreakerState } from "./breaker-state-sql.js";
 import { TiDBCostQuota } from "./tidb-cost-quota.js";
 import { PgCostQuota } from "./pg-cost-quota.js";
@@ -96,6 +97,7 @@ class TiDBBackend {
     imageIndex() { return new TiDBImageIndex(this.pool); }
     imageBake() { return new TiDBImageBake(this.pool); }
     leaderRun() { return new TiDBLeaderRunStore(this.pool); }
+    device() { return new TiDBDeviceStore(this.pool); }
     retention(opts) { return new TiDBRetentionStore(this.pool, opts); }
     retentionLane() { return new TiDBRetentionLaneStore(this.pool); }
     breaker(onWriteFail) { return new TiDBBreakerState(this.pool, onWriteFail); }
@@ -136,6 +138,7 @@ class PgBackend {
     imageIndex() { return new PgImageIndex(this.pool); }
     imageBake() { return new PgImageBake(this.pool); }
     leaderRun() { return new PgLeaderRunStore(this.pool); }
+    device() { return new PgDeviceStore(this.pool); }
     retention(opts) { return new PgRetentionStore(this.pool, opts); }
     retentionLane() { return new PgRetentionLaneStore(this.pool); }
     breaker(onWriteFail) { return new PgBreakerState(this.pool, onWriteFail); }

package/dist/plugins/usage-window-store-sql.d.ts

@@ -30,13 +30,13 @@ export declare function ensurePgUsageWindowSchema(q: (text: string, params?: unk
 export declare class TiDBUsageWindowStore implements UsageWindowStore {
     private readonly pool;
     constructor(pool: MySqlPool);
-    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[]): Promise<void>;
+    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[], costMicroUsd?: number | null): Promise<void>;
     read(key: string, windows: readonly UsageWindow[], now: number): Promise<readonly UsageWindowReading[]>;
 }
 export declare class PgUsageWindowStore implements UsageWindowStore {
     private readonly pool;
     constructor(pool: PgPool);
-    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[]): Promise<void>;
+    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[], costMicroUsd?: number | null): Promise<void>;
     read(key: string, windows: readonly UsageWindow[], now: number): Promise<readonly UsageWindowReading[]>;
 }
 //# sourceMappingURL=usage-window-store-sql.d.ts.map

package/dist/plugins/usage-window-store-sql.js

@@ -14,13 +14,24 @@ function parseRecord(raw, key) {
     }
     const badShape = (detail) => new Error(`usage_window record for key "${key}" has an invalid shape (${detail}) — refusing to mis-count a governance window`);
     const finite = (x) => typeof x === "number" && Number.isFinite(x);
+    const costKeys = (e) => {
+        if (e.costMicroUsd !== undefined && (typeof e.costMicroUsd !== "number" || !Number.isSafeInteger(e.costMicroUsd) || e.costMicroUsd < 0)) {
+            throw badShape("`costMicroUsd` present but not a non-negative safe integer");
+        }
+        if (e.costUnknown !== undefined && e.costUnknown !== true)
+            throw badShape("`costUnknown` present but not literal true");
+        return {
+            ...(e.costMicroUsd !== undefined ? { costMicroUsd: e.costMicroUsd } : {}),
+            ...(e.costUnknown === true ? { costUnknown: true } : {}),
+        };
+    };
     const slots = r.slots.map((s) => {
         if (s === null || typeof s !== "object")
             throw badShape("`slots` entry is not an object");
         const { at, tokens } = s;
         if (!finite(at) || !finite(tokens))
             throw badShape("`slots` entry has a non-finite-numeric `at`/`tokens`");
-        return { at, tokens };
+        return { at, tokens, ...costKeys(s) };
     });
     const buckets = r.buckets.map((b) => {
         if (b === null || typeof b !== "object")
@@ -29,7 +40,7 @@ function parseRecord(raw, key) {
         if (!finite(windowMs) || windowMs <= 0 || !finite(openedAt) || !finite(tokens)) {
             throw badShape("`buckets` entry has a non-finite-numeric `windowMs`/`openedAt`/`tokens` (windowMs must be > 0)");
         }
-        return { windowMs, openedAt, tokens };
+        return { windowMs, openedAt, tokens, ...costKeys(b) };
     });
     return { slots, buckets };
 }
@@ -54,7 +65,7 @@ export class TiDBUsageWindowStore {
     constructor(pool) {
         this.pool = pool;
     }
-    async charge(key, tokens, at, windows) {
+    async charge(key, tokens, at, windows, costMicroUsd) {
         const c = await this.pool.getConnection();
         try {
             await c.beginTransaction();
@@ -68,7 +79,7 @@ export class TiDBUsageWindowStore {
                 throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
             }
             const record = parseRecord(rows[0].record, key);
-            const next = chargeUsageRecord(record, tokens, at, windows);
+            const next = chargeUsageRecord(record, tokens, at, windows, costMicroUsd);
             await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = ?, updated_at_ms = ? WHERE usage_key = ?`, [JSON.stringify(next), at, key]);
             await c.commit();
         }
@@ -91,7 +102,7 @@ export class PgUsageWindowStore {
     constructor(pool) {
         this.pool = pool;
     }
-    async charge(key, tokens, at, windows) {
+    async charge(key, tokens, at, windows, costMicroUsd) {
         const c = await this.pool.connect();
         try {
             await c.query("BEGIN");
@@ -105,7 +116,7 @@ export class PgUsageWindowStore {
                 throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
             }
             const record = parseRecord(rows[0].record, key);
-            const next = chargeUsageRecord(record, tokens, at, windows);
+            const next = chargeUsageRecord(record, tokens, at, windows, costMicroUsd);
             await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = $1, updated_at_ms = $2 WHERE usage_key = $3`, [JSON.stringify(next), at, key]);
             await c.query("COMMIT");
         }

package/dist/task-cwd.d.ts

@@ -17,6 +17,31 @@ export declare function cwdHonored(config: {
     };
     requirePrincipal?: boolean;
 }): boolean;
+/**
+ * device lane 的**平行**判别式(device-executor-lane-v2 §4.3.3,车A-4)——「员工在自己设备的项目目录
+ * 里干活」是这条车道的存在理由,所以 caller cwd 必须被尊重。
+ *
+ * 🔴 **为什么不合并进 {@link cwdHonored}**:两闸语义不同,合并会把 host 的单用户约束**放松**。
+ *  · `cwdHonored` 的 `requirePrincipal !== true` 防的是「一个租户的输入把 agent 指向 **worker 宿主**上
+ *    另一个租户/运维的目录」—— 那是一台共享机器上的跨租户穿越;
+ *  · device lane 上那个穿越面**结构性不存在**:路径落在**发起者自己的设备**上,而设备归属已由
+ *    `device_session` 绑定行(提交期用验证过的 principal 写下)+ 准入链的 owner 谓词验过。所以本闸
+ *    **不要求**单用户 —— 多租户部署里每个员工各连各的设备,正是这条车道的正常形态。
+ * 合并两者 = 让 host 车道在多租户下也开始尊重 cwd,那是一条真实的越权面。
+ *
+ * 消费者:写侧 = `boot/resolve-spec.ts`(**单写者**,与 cwdHonored 同一处);读侧 =
+ * `plugins/remote-env-device.ts` 的工厂(`effectiveDeviceCwd`)。两侧必须同批落 —— 只开写侧会留下一个
+ * 没有消费者的登记项(这正是 A-1 把它登记进 `PLANNED_LANE_DIVERGENCES` 而不是当场开的理由)。
+ *
+ * ⚠️ 刻意**不**连带放开 `additionalDirectories`:那一位在 device v1 上诚实缺席(v2 §4.1 capability
+ * projectContext 行:「拆精确字段,device v1 对 unsupported 项显式 false,不打包沿用」)。
+ */
+export declare function deviceCwdHonored(config: {
+    remoteExec?: {
+        provider?: string;
+    };
+    requirePrincipal?: boolean;
+}): boolean;
 /**
  * [851]P3a — the OTHER host-semantics lane: provider UNSET = the in-process single-user lane. It has NO shell
  * hands (core prepare-task: no factory/executionEnv ⇒ StubExecutionEnv), so the perSession cwd/env registries

package/dist/task-cwd.js

@@ -11,6 +11,9 @@ export function isValidCwd(cwd) {
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }
+export function deviceCwdHonored(config) {
+    return config.remoteExec?.provider === "device";
+}
 export function inProcessSingleUserLane(config) {
     return config.remoteExec === undefined && config.requirePrincipal !== true;
 }

package/dist/task-settings.js

@@ -1,5 +1,6 @@
 import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, } from "@sema-agent/core";
 import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
     if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
@@ -160,7 +161,8 @@ function createAskListPolicy(askNames) {
         });
     }
     catch (e) {
-        throw new Error(`permissions.ask has rule(s) core cannot compile — ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        throw new Error(`permissions.ask has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];

package/dist/trace/core-keyset-guard.d.ts

@@ -27,9 +27,9 @@ type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, Bg
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
@@ -45,7 +45,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 export type CoreKeysetGuards = [
     _GuardNotification,

package/dist/trace/engine-notice-wire.d.ts

@@ -14,7 +14,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "task.user_steer_undrained", "task.user_followup_undrained"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -8,6 +8,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.hold_released",
     "memory.hold_disposed",
     "task.turn_interrupted",
+    "steering.parked_input_blocked",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.49.0",
+  "version": "7.51.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.61.0",
-    "@sema-agent/settings-schema": "^1.0.0",
+    "@sema-agent/core": "5.65.0",
+    "@sema-agent/settings-schema": "1.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",