@sema-agent/server 7.55.0 → 7.57.0

package/dist/observability/run-terminal-log.d.ts

@@ -0,0 +1,120 @@
+import type { RunRecord } from "../plugins/store-contracts.js";
+/** 一次终局写口交给观测面的原料(store 侧装配,**未脱敏** —— 脱敏在本模块内做,见 {@link notifyRunTerminal})。 */
+export interface RunTerminalRecord {
+    /** 这条 run 的账本 id = `GET /v1/runs/:id` 的 id(本仓 run 行主键名为 taskId,同一个值)。 */
+    runId: string;
+    sessionId: string;
+    owner: string | null;
+    status: RunRecord["status"];
+    /** 终局结果里的引擎侧 taskId —— 只在与 {@link RunTerminalRecord.runId} **不同**时进日志(sync 腿上 core 会把它
+     *  铸成 sessionId,两者同值时重复一遍只是噪音)。 */
+    resultTaskId?: string | undefined;
+    model?: string | undefined;
+    errorCode?: string | undefined;
+    errorMessage?: string | undefined;
+    /** 行创建到终局的墙钟毫秒(store 侧用行的 createdAt 算;算不出=不传,键缺席)。 */
+    elapsedMs?: number | undefined;
+}
+/** 观测者收到的是**已判级 + 已脱敏 + 已截断**的成品——装配层只负责把它送进 logger。 */
+export type RunTerminalObserver = (level: "error" | "info", fields: Record<string, unknown>) => void;
+/**
+ * 终局行的级别判据。`undefined` = 不打行。
+ *
+ * `blocked` 刻意不打:它是**治理判决**(门拒绝了这次执行),不是失败——它有自己的门遥测与
+ * `GET /v1/runs/:id` 读面,混进 `run_failed` 会把「模型/网络出事了」这条读法冲淡。
+ */
+export declare function runTerminalLogLevel(status: RunRecord["status"], errorCode: string | undefined): "error" | "info" | undefined;
+/** 装配点(`main.ts` 唯一)。传 `undefined` 卸载(测试隔离)。 */
+export declare function setRunTerminalObserver(fn: RunTerminalObserver | undefined): void;
+/**
+ * store 的终局写口在 **CAS 赢了之后**调用它。未装配观测者 ⇒ 无操作(纯内存/无 boot 的单测车道)。
+ *
+ * 脱敏:`errorMessage` 过 `redactSecrets` 再截断到 {@link MESSAGE_CAP} —— provider 的错误体
+ * 会原样回显请求片段(取证里的 403 体带订阅链接;别的 provider 会回显 Authorization 头前缀),
+ * 而引擎日志是运维面、常被整条采集走。`errorCode` / `model` 是闭集式短标量,verbatim。
+ */
+export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
+/** S-105(test [ref] 旁生):终态**持久化**的 `errorMessage` 与日志副本同一脱敏口——provider 错误体(403 体带回显请求头/
+ *  订阅链接)里的密钥形不得原文落 run 行再由 `GET /v1/runs/:id` 直出。三 run store 的 `setTerminal` 写入前同调此函数;
+ *  `undefined` 透传(缺席仍缺席),不截断(日志上限是日志的事,行上保留全文供取证)。 */
+/** r4 最终轮 [medium]:`redactSecrets` 的关键字/前缀臂对 ≥2^23 单段仍会抛 `RangeError`(既有,S-106 登记);S-105 把脱敏
+ *  挪到 `setTerminal` **入口**后,这个抛会先于 CAS/claim 释放 ⇒ run 卡 `running`、会话 claim 悬挂到 reaper。这里 **fail-closed
+ *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。 */
+export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";
+/** S-107 窄范围重扫 [medium]:`redactSecrets` 对 PEM 起始栅栏密集的多 MB 文案**不抛但慢**(实测 1MB 1.4s / 8MB 7.9s 同步阻塞
+ *  事件循环),而终态座每次写要扫两遍(appendEvent + setTerminal 入口)、每次读再扫一遍。超过本上限的自由文本**整段**换占位
+ *  (fail-closed:不截断——截断会把密钥切成半截,[ref] 的病;不扫——O(1)),取证面丢的是「>256KB 的错误文案」这一档。 */
+/** codex r2 [medium]:上限按**边界最坏耗时**定——PEM 栅栏密集形 256KB 一次扫 0.25–0.46s、终态一次写扫两遍再加读面,一行
+ *  能让副本卡 ~1s;64KB 时同形 ≤ ~0.1s/次。正常 provider 错误体 < 10KB,>64KB 的错误文案只剩取证价值(整段占位丢弃)。 */
+export declare const REDACT_INPUT_CAP = 65536;
+/** 第十七轮重扫 [medium]:TiDB `task_run.error` 是 TEXT(65,535 **字节**),而上限按**字符**(65,536)量,多字节 / 占位膨胀(`«»` 各 2 字节、
+ *  `«redacted:key»` 比短匹配长)都能让脱后串超列 ⇒ UPDATE 抛 ER_DATA_TOO_LONG、事务回滚、claim 不释放、run 卡 running 到 reaper。
+ *  脱敏**之后**按字节封顶(占位已替换完,切在占位中间不是泄漏)并带标记。 */
+export declare const REDACT_OUTPUT_MAX_BYTES = 65000;
+export declare function redactErrorMessage(raw: string | undefined): string | undefined;
+/** 同口:终态 `result` 整块也持久化(`GET /v1/runs/:id` 直出 `result.errorMessage`)——写入前把内层 `errorMessage` 脱敏,
+ *  其余键逐字不动;`undefined`/`null` 透传。 */
+export declare function redactTerminalResult<T extends {
+    errorMessage?: string | undefined;
+    blockedReason?: string | undefined;
+    remoteEnvFailures?: readonly {
+        message?: string | undefined;
+    }[] | undefined;
+} | null | undefined>(result: T): T;
+/** S-107(第五轮合并重扫 wf_f00c00bc 两根 [high]):同一个 `TaskResult` 除 run 行外还被逐字追加进 run_events 的 `done` 行
+ *  (bg/verify/cascade/stream/resume 五腿),`failed` 行带原文 `errorMessage`,`GET /v1/runs/:id/events` 原样回放。
+ *  三孪生 `appendEvent` 入口 + 事件读面(旧行纵深)同调本函数:只认 `done.result`(整块走 `redactTerminalResult`)与
+ *  `failed.errorMessage`,其余事件类型/键逐字不动(它们各有自己的 sink 侧脱敏);形不合(非对象)原样返回,不抛。 */
+export declare function redactLedgerEventData(type: string, data: unknown): unknown;
+/** S-107 第三轮窄范围重扫 [high]×2:leader 面的三处原文座——①`WorkerReport.error`(生产路径经 `runWorker` 构造,`fanout.ts`
+ *  的 runTaskStream 回退座不是生产座);②`LeaderResult.error`(plan/provision 失败带 `e.message`);③`merge.reason`
+ *  (coordinator push 失败把 `git clone <带凭据的 durableRemote>` 命令行整段回显)。全部随 leader_run.result JSON 落库并经
+ *  `GET /v1/leader/:id` 直出。修=**咽喉**:fanOut 边界对每份报告脱一次(不问谁产的),endpoint 落库前 + 读面各脱一次
+ *  (幂等;旧行纵深)。只碰这三个自由文本键,其余逐字。 */
+export declare function redactWorkerReportError<T extends {
+    error?: string | undefined;
+    checkpointGate?: unknown;
+}>(report: T): T;
+/** codex r5 [high]:`WorkerReport.checkpointGate`(core `CheckpointGate`)整块随 LeaderResult 落库/直出——`reason` 与
+ *  `riskDescriptor.summary`/`shadowedRule` 是自由文本([ref] 实测 summary 带 PEM 明文;[ref] R3 登记),按类型表脱这三叶;
+ *  `kind`/`toolName`/`axes`/`severity`/`touchedPaths` 闭集或路径,逐字。非对象形原样返回。 */
+export declare function redactCheckpointGate(gate: unknown): unknown;
+/** 工件字节(patch / *.rej 拒绝块):codex r6 [high]——拒绝块能带 `git clone https://u:TOKEN@host` 或 `_authToken=` 行,
+ *  「工件保真」不能让原凭据上元数据读面。做**原位密钥形替换**(与预览同一张规则表,字节只在密钥处变)、**不截断**;
+ *  单份上限 256KB(`ARTIFACT_INPUT_CAP`,第八轮重扫:不封顶=worker 可控 DoS)——超过整份换占位,这是有意的取证丢弃
+ *  (原字节仍在 worker 分支 / merge 咽喉);扫描器抛 ⇒ 占位(fail-closed)。server 无任何消费方用持久化的这份字节回放。 */
+/** 诊断文本(stdout/stderr/err.message/模型输出)的「先脱后切」——第九轮重扫 [medium]×3 + 第十轮 [high]×2 + codex r9 [high]:
+ *  ①不能把整段喂进 64KB 上限臂(长测试日志整段占位、灌水计数);②**固定 PAD 的窗不是 fail-closed**:比 PAD 长的密钥形
+ *  (>4096 的 URL 密码 / JSON 值 / PEM 体)锚点落在窗外,窗内只剩无锚的体,任何规则都认不出;窗在脱敏下缩短时残片还会
+ *  落进最终切片。所以**不开窗**:文本 ≤ 256KB ⇒ 整段扫(guard,不封顶于 64KB;PEM 密集形最坏 ~0.4s/座)再切;> 256KB ⇒
+ *  整段换占位并带原长(fail-closed 取证丢弃,单独计数:普查第 59 行)。 */
+export declare const DIAG_INPUT_CAP = 262144;
+export declare const OVERSIZED_DIAG_PLACEHOLDER = "\u00ABredacted:oversized-diagnostic\u00BB";
+export declare function redactDiagnosticText(text: string): string;
+export declare function redactHead(text: string, keep: number): string;
+/** 进模型的 worker 补丁头(collapse 目标 / 冲突解决目标):**不开窗**。第十三轮为保留大 diff 的可复用头部开了 256KB 头窗,
+ *  此后 codex r12–r15 与第十五至十七轮重扫五轮各证一次「窗上的裁切守卫可被打穿」(无上界的 JSON 值/URL 密码臂;脱前/脱后坐标
+ *  错位;PEM 逐块;前面一处脱敏会**吃掉**守卫所依赖的锚点)——同 S-103 的教训:猜边界的规则总有反例。终形=补丁 ≤256KB 整段扫
+ *  再切 keep(完全正确);>256KB **不内联**(占位带原长,tag `patch-head-cut`):冲突解决者仍有工作树里的冲突标记,collapse solo
+ *  对 lockfile 级大 diff 失去内联上下文(worker 分支仍在)——这是有意成文的安全轴取舍。 */
+export declare const OVERSIZED_PATCH_PLACEHOLDER = "\u00ABredacted:oversized-patch-not-inlined\u00BB";
+export declare function redactPatchHead(patch: string, keep: number): string;
+export declare function redactTail(text: string, keep: number): string;
+export declare const ARTIFACT_INPUT_CAP = 262144;
+export declare const OVERSIZED_ARTIFACT_PLACEHOLDER = "\u00ABredacted:oversized-artifact\u00BB";
+export declare function redactArtifactText(raw: string): string;
+export declare function redactLeaderResult(result: unknown): unknown;
+/** 同上,附带「有没有任何叶子变过」——读面记忆用它区分「本就干净的行」(只记 id,不留体)与「旧脏行」(留脱后体)。 */
+export declare function redactLeaderResultWithFlag(result: unknown): {
+    value: unknown;
+    changed: boolean;
+};
+export declare function memoRedactedRead<T>(seat: string, raw: T, redact: (v: T) => T): T;
+/** run 终态 result 的读面记忆只按**可脱敏的三叶**(errorMessage / blockedReason / remoteEnvFailures[].message)做键与留体——
+ *  第十六轮重扫:按整块 result 摘要每次轮询要 stringify 一份可能数 MB 的 result,且大 result 的脏行永远存不进去。三叶缺席
+ *  ⇒ O(1) 直返(`redactTerminalResult` 本就同引用)。 */
+export declare function memoRedactTerminalResult<T extends Parameters<typeof redactTerminalResult>[0]>(seat: string, result: T): T;
+export declare function diffScanShadowCountForTest(): number;
+export declare function resetDiffScanShadowCountForTest(): void;
+export declare function resetReadRedactionMemoForTest(): void;
+//# sourceMappingURL=run-terminal-log.d.ts.map

package/dist/observability/run-terminal-log.js

@@ -0,0 +1,360 @@
+import { createHash } from "node:crypto";
+import { redactSecrets } from "../trace/redact.js";
+import { errorText } from "./err-text.js";
+import { recordFailOpen } from "./fail-open.js";
+const MESSAGE_CAP = 1024;
+export function runTerminalLogLevel(status, errorCode) {
+    switch (status) {
+        case "failed":
+            return errorCode === "cancelled" ? "info" : "error";
+        case "blocked":
+        case "completed":
+        case "running":
+        case "suspended":
+        case "needs_review":
+            return undefined;
+        default: {
+            const unhandled = status;
+            void unhandled;
+            return undefined;
+        }
+    }
+}
+let observer;
+export function setRunTerminalObserver(fn) {
+    observer = fn;
+}
+export function notifyRunTerminal(rec) {
+    const level = runTerminalLogLevel(rec.status, rec.errorCode);
+    if (level === undefined || !observer)
+        return;
+    const raw = rec.errorMessage;
+    const message = raw === undefined ? undefined : (redactErrorMessage(raw) ?? "").slice(0, MESSAGE_CAP);
+    observer(level, {
+        runId: rec.runId,
+        sessionId: rec.sessionId,
+        ...(rec.owner !== null ? { owner: rec.owner } : {}),
+        status: rec.status,
+        ...(rec.resultTaskId !== undefined && rec.resultTaskId !== rec.runId ? { taskId: rec.resultTaskId } : {}),
+        ...(rec.model !== undefined ? { model: rec.model } : {}),
+        ...(rec.errorCode !== undefined ? { errorCode: rec.errorCode } : {}),
+        ...(message !== undefined ? { errorMessage: message } : {}),
+        ...(rec.elapsedMs !== undefined ? { elapsedMs: rec.elapsedMs } : {}),
+    });
+}
+export const OVERSIZED_REDACTION_PLACEHOLDER = "«redacted:oversized»";
+export const REDACT_INPUT_CAP = 65_536;
+export const REDACT_OUTPUT_MAX_BYTES = 65_000;
+const OUTPUT_TRUNCATED_MARK = "…[truncated: exceeds store column]";
+function fitOutputBytes(s) {
+    if (Buffer.byteLength(s) <= REDACT_OUTPUT_MAX_BYTES)
+        return s;
+    recordFailOpen("server.run-terminal.output-truncated", `bytes=${Buffer.byteLength(s)} cap=${REDACT_OUTPUT_MAX_BYTES}`);
+    const budget = REDACT_OUTPUT_MAX_BYTES - Buffer.byteLength(OUTPUT_TRUNCATED_MARK);
+    let cut = Buffer.from(s).subarray(0, budget).toString();
+    if (cut.endsWith("\uFFFD"))
+        cut = cut.slice(0, -1);
+    return cut + OUTPUT_TRUNCATED_MARK;
+}
+export function redactErrorMessage(raw) {
+    if (raw === undefined)
+        return undefined;
+    let len = -1;
+    try {
+        const text = typeof raw === "string" ? raw : String(raw);
+        len = text.length;
+        if (len > REDACT_INPUT_CAP) {
+            recordFailOpen("server.run-terminal.redact-capped", `len=${len} cap=${REDACT_INPUT_CAP}`);
+            return OVERSIZED_REDACTION_PLACEHOLDER;
+        }
+        return fitOutputBytes(redactSecrets(text));
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `len=${len} err=${errorText(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactTerminalResult(result) {
+    if (result === undefined || result === null)
+        return result;
+    const r = result;
+    let changed = false;
+    const out = { ...r };
+    if (r.errorMessage !== undefined) {
+        out.errorMessage = redactErrorMessage(r.errorMessage);
+        changed = true;
+    }
+    if (r.blockedReason !== undefined) {
+        out.blockedReason = redactErrorMessage(r.blockedReason);
+        changed = true;
+    }
+    if (r.remoteEnvFailures !== undefined) {
+        out.remoteEnvFailures = Array.isArray(r.remoteEnvFailures)
+            ? r.remoteEnvFailures.map((f) => (f && typeof f === "object" && typeof f.message === "string" ? { ...f, message: redactErrorMessage(f.message) } : f))
+            : r.remoteEnvFailures;
+        changed = true;
+    }
+    return changed ? out : result;
+}
+export function redactLedgerEventData(type, data) {
+    if (data === null || typeof data !== "object" || Array.isArray(data))
+        return data;
+    if (type === "done") {
+        const result = data.result;
+        if (result === null || typeof result !== "object")
+            return data;
+        return { ...data, result: redactTerminalResult(result) };
+    }
+    if (type === "failed") {
+        const msg = data.errorMessage;
+        if (typeof msg !== "string")
+            return data;
+        return { ...data, errorMessage: redactErrorMessage(msg) };
+    }
+    return data;
+}
+export function redactWorkerReportError(report) {
+    const gate = redactCheckpointGate(report.checkpointGate);
+    const error = report.error === undefined ? undefined : (redactErrorMessage(report.error) ?? "");
+    if (error === report.error && gate === report.checkpointGate)
+        return report;
+    return { ...report, ...(error !== report.error ? { error } : {}), ...(gate !== report.checkpointGate ? { checkpointGate: gate } : {}) };
+}
+export function redactCheckpointGate(gate) {
+    if (gate === null || typeof gate !== "object" || Array.isArray(gate))
+        return gate;
+    const g = gate;
+    let changed = false;
+    const out = { ...g };
+    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
+    if (typeof g.reason === "string")
+        out.reason = str(g.reason);
+    const rd = g.riskDescriptor;
+    if (rd && typeof rd === "object" && !Array.isArray(rd)) {
+        const r = rd;
+        const nr = { ...r };
+        for (const k of ["summary", "shadowedRule", "probeReason"])
+            if (typeof r[k] === "string")
+                nr[k] = str(r[k]);
+        if (Array.isArray(r.touchedPaths))
+            nr.touchedPaths = strs(r.touchedPaths);
+        const pc = r.probeCause;
+        if (pc && typeof pc === "object" && !Array.isArray(pc)) {
+            const p = pc;
+            const np = { ...p };
+            for (const k of ["roots", "further"]) {
+                const ops = p[k];
+                if (ops && typeof ops === "object" && !Array.isArray(ops) && Array.isArray(ops.shown))
+                    np[k] = { ...ops, shown: strs(ops.shown) };
+            }
+            nr.probeCause = np;
+        }
+        out.riskDescriptor = nr;
+    }
+    return changed ? out : gate;
+}
+export const DIAG_INPUT_CAP = 262_144;
+export const OVERSIZED_DIAG_PLACEHOLDER = "«redacted:oversized-diagnostic»";
+export function redactDiagnosticText(text) {
+    if (text.length > DIAG_INPUT_CAP) {
+        recordFailOpen("server.run-terminal.diag-capped", `len=${text.length} cap=${DIAG_INPUT_CAP}`);
+        return `${OVERSIZED_DIAG_PLACEHOLDER} [len=${text.length}]`;
+    }
+    try {
+        return redactSecrets(text);
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `diag len=${text.length} err=${err instanceof Error ? err.name : String(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactHead(text, keep) {
+    return redactDiagnosticText(text).slice(0, keep);
+}
+export const OVERSIZED_PATCH_PLACEHOLDER = "«redacted:oversized-patch-not-inlined»";
+function diffScanRefusal(patch, direct) {
+    if (/^diff --(?:cc|combined) |^@{3,} /m.test(patch))
+        return "combined-diff";
+    const fence = /-{4,5} ?BEGIN[^\n-]*PRIVATE KEY(?: BLOCK)?[^\n-]*-{4,5}/;
+    if (fence.test(direct))
+        return "pem-fence-survived";
+    const ppkField = /Private-(?:MAC|Hash): [0-9a-fA-F]{32}/;
+    const ppkLinesField = /Private-Lines: \d+/;
+    const b64Line = /^[ +-]?[A-Za-z0-9+/=]{16,}[ \t]*$/m;
+    const ppkAnchorInSections = (t) => t.split(/^(?=diff --git )/m).some((sec) => ppkLinesField.test(sec) && b64Line.test(sec));
+    if (ppkAnchorInSections(patch))
+        return "ppk-field-survived";
+    if (ppkField.test(direct))
+        return "ppk-field-survived";
+    const strip1 = (t) => t.replace(/^[+-]/gm, "");
+    const stripFull = (t) => t.replace(/^[+-]+/gm, "");
+    const layers = [["1", strip1]];
+    if (/^[+-]{2}/m.test(patch))
+        layers.push(["full", stripFull]);
+    for (const [name, strip] of layers) {
+        shadowScans += 1;
+        const shadow = redactSecrets(strip(patch), { observe: false });
+        if (strip(direct) !== shadow)
+            return `shadow-diverged@${name}`;
+        if (fence.test(shadow))
+            return "pem-fence-survived";
+        if (ppkField.test(shadow))
+            return "ppk-field-survived";
+    }
+    return undefined;
+}
+export function redactPatchHead(patch, keep) {
+    if (patch.length > DIAG_INPUT_CAP) {
+        recordFailOpen("server.run-terminal.patch-head-cut", `not-inlined len=${patch.length} keep=${keep}`);
+        return `${OVERSIZED_PATCH_PLACEHOLDER} [len=${patch.length}]`;
+    }
+    try {
+        const direct = redactSecrets(patch);
+        const refusal = diffScanRefusal(patch, direct);
+        if (refusal !== undefined) {
+            recordFailOpen("server.run-terminal.patch-head-cut", `${refusal} len=${patch.length} keep=${keep}`);
+            return `${OVERSIZED_PATCH_PLACEHOLDER} [len=${patch.length}]`;
+        }
+        return direct.slice(0, keep);
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `patch-head len=${patch.length} err=${err instanceof Error ? err.name : String(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactTail(text, keep) {
+    return redactDiagnosticText(text).slice(-keep);
+}
+export const ARTIFACT_INPUT_CAP = 262_144;
+export const OVERSIZED_ARTIFACT_PLACEHOLDER = "«redacted:oversized-artifact»";
+export function redactArtifactText(raw) {
+    if (raw.length > ARTIFACT_INPUT_CAP) {
+        recordFailOpen("server.run-terminal.artifact-capped", `len=${raw.length} cap=${ARTIFACT_INPUT_CAP}`);
+        return OVERSIZED_ARTIFACT_PLACEHOLDER;
+    }
+    try {
+        const direct = redactSecrets(raw);
+        const refusal = diffScanRefusal(raw, direct);
+        if (refusal !== undefined) {
+            recordFailOpen("server.run-terminal.artifact-capped", `${refusal} len=${raw.length}`);
+            return `${OVERSIZED_ARTIFACT_PLACEHOLDER} [${refusal} len=${raw.length}]`;
+        }
+        return direct;
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `artifact len=${raw.length} err=${err instanceof Error ? err.name : String(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactLeaderResult(result) {
+    return redactLeaderResultWithFlag(result).value;
+}
+export function redactLeaderResultWithFlag(result) {
+    if (result === null || typeof result !== "object" || Array.isArray(result))
+        return { value: result, changed: false };
+    let changed = false;
+    const str = (v) => { if (typeof v !== "string")
+        return undefined; const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const artMemo = new Map();
+    const art = (v) => { if (typeof v !== "string")
+        return v; let o = artMemo.get(v); if (o === undefined) {
+        o = redactArtifactText(v);
+        artMemo.set(v, o);
+    } if (o !== v)
+        changed = true; return o; };
+    const obj = (v) => (v && typeof v === "object" && !Array.isArray(v) ? v : undefined);
+    const r = result;
+    const out = { ...r };
+    if (Array.isArray(r.reports))
+        out.reports = r.reports.map((w) => {
+            if (!obj(w))
+                return w;
+            const nw = redactWorkerReportError(w);
+            if (nw !== w)
+                changed = true;
+            return nw;
+        });
+    if (typeof r.error === "string")
+        out.error = str(r.error);
+    const replan = obj(r.replan);
+    if (replan && typeof replan.collapsed === "string")
+        out.replan = { ...replan, collapsed: str(replan.collapsed) };
+    const merge = obj(r.merge);
+    if (merge) {
+        const m = { ...merge };
+        for (const k of ["reason", "details"])
+            if (typeof merge[k] === "string")
+                m[k] = str(merge[k]);
+        for (const k of ["rej", "candidatePatch"])
+            if (typeof merge[k] === "string")
+                m[k] = art(merge[k]);
+        const measure = obj(merge.measure);
+        if (measure && typeof measure.reason === "string")
+            m.measure = { ...measure, reason: str(measure.reason) };
+        out.merge = m;
+    }
+    const cp = obj(r.candidatePatch);
+    if (cp)
+        out.candidatePatch = { ...cp, ...(typeof cp.reason === "string" ? { reason: str(cp.reason) } : {}), ...(typeof cp.patch === "string" ? { patch: art(cp.patch) } : {}) };
+    if (Array.isArray(r.salvaged))
+        out.salvaged = r.salvaged.map((x) => (obj(x) && typeof x.patch === "string" ? { ...x, patch: art(x.patch) } : x));
+    return { value: changed ? out : result, changed };
+}
+const READ_MEMO_CLEAN_CAP = 8192;
+const READ_MEMO_DIRTY_CAP = 512;
+const READ_MEMO_DIRTY_MAX_ENTRY_BYTES = 262_144;
+const READ_MEMO_DIRTY_MAX_TOTAL_BYTES = 16 * 1_048_576;
+const readMemoClean = new Set();
+const readMemoDirty = new Map();
+let readMemoDirtyBytes = 0;
+export function memoRedactedRead(seat, raw, redact) {
+    const key = `${seat}\u0000${createHash("sha256").update(typeof raw === "string" ? raw : JSON.stringify(raw) ?? "").digest("hex")}`;
+    if (readMemoClean.has(key))
+        return raw;
+    const hit = readMemoDirty.get(key);
+    if (hit)
+        return hit.value;
+    const out = redact(raw);
+    const clean = out === raw || (typeof out === "string" && out === raw) || JSON.stringify(out) === JSON.stringify(raw);
+    if (clean) {
+        if (readMemoClean.size >= READ_MEMO_CLEAN_CAP)
+            readMemoClean.delete(readMemoClean.values().next().value);
+        readMemoClean.add(key);
+        return out;
+    }
+    const bytes = Buffer.byteLength(typeof out === "string" ? out : JSON.stringify(out));
+    if (bytes <= READ_MEMO_DIRTY_MAX_ENTRY_BYTES) {
+        while (readMemoDirty.size > 0 && (readMemoDirty.size >= READ_MEMO_DIRTY_CAP || readMemoDirtyBytes + bytes > READ_MEMO_DIRTY_MAX_TOTAL_BYTES)) {
+            const oldest = readMemoDirty.keys().next().value;
+            readMemoDirtyBytes -= readMemoDirty.get(oldest).bytes;
+            readMemoDirty.delete(oldest);
+        }
+        readMemoDirty.set(key, { value: out, bytes });
+        readMemoDirtyBytes += bytes;
+    }
+    return out;
+}
+export function memoRedactTerminalResult(seat, result) {
+    if (result === undefined || result === null)
+        return result;
+    const r = result;
+    if (r.errorMessage === undefined && r.blockedReason === undefined && r.remoteEnvFailures === undefined)
+        return result;
+    const leaves = { errorMessage: r.errorMessage, blockedReason: r.blockedReason, remoteEnvFailures: r.remoteEnvFailures };
+    const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
+    if (redacted === leaves)
+        return result;
+    return { ...result, ...redacted };
+}
+let shadowScans = 0;
+export function diffScanShadowCountForTest() { return shadowScans; }
+export function resetDiffScanShadowCountForTest() { shadowScans = 0; }
+export function resetReadRedactionMemoForTest() {
+    readMemoClean.clear();
+    readMemoDirty.clear();
+    readMemoDirtyBytes = 0;
+}
+//# sourceMappingURL=run-terminal-log.js.map

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,3 +1,4 @@
+import { type SemaProvenanceInput } from "../trace/sema-provenance.js";
 import type { SystemInjectionPriority } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
@@ -259,6 +260,14 @@ export declare function taskNotificationInboxEntry(sessionId: string, owner: str
     resumable?: boolean;
     /** core 1.353([ref]):诊断槽(journal 坐标+教句,引擎值单源)——park 透传,drain 帧原样带。 */
     diagnostics?: string;
+    /** [ref] [ref] 片6 d1(core 7.2.0):子代→主代 uplink 帧的渲染判别成员 + typed 归因侧记。park 是
+     *  **空闲态**(父 leg 已收尾)到达的那条路——恰是 [ref](b) 的场景;不过桥 ⇒ drain 帧无判别键、cli 渲老形卡。
+     *  body = UNTRUSTED 子代文本 → redact+cap(与 result 同姿势);provenance 成员逐挑 verbatim(引擎值)。 */
+    agentMessage?: {
+        from: string;
+        body: string;
+    };
+    _sema_provenance?: SemaProvenanceInput;
 }, enqueuedAt: number, 
 /** lead-b (dual-ID audit): the PARENT run's durable taskId (the uuid the shell's footer rows
  *  key on) — rides the drained frame so a consumer can bind the a*-keyed child notification to its uuid-keyed

package/dist/orchestration/workflow-completion-inbox.js

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, cl
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
+import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -314,6 +315,13 @@ export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, pare
         ...(n.resumable !== undefined ? { resumable: n.resumable } : {}),
         ...(n.result ? { result: cap(redactSecrets(n.result), 4000) } : {}),
         ...(n.output_file ? { output_file: cap(redactSecrets(n.output_file), 1024) } : {}),
+        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: cap(redactSecrets(n.agentMessage.body), 4000) } } : {}),
+        ...(() => {
+            if (n._sema_provenance === undefined)
+                return {};
+            const p = semaProvenanceOrAbsent(n._sema_provenance);
+            return p !== undefined ? { _sema_provenance: p } : {};
+        })(),
     };
     return {
         sessionId,

package/dist/permission-rule-vocab.d.ts

@@ -0,0 +1,40 @@
+/**
+ * [ref] + [ref](core `e298c9e0`,随 7.2.x 提货生效;[ref])—— 规则车道**闭词表的单一属主**。
+ *
+ * 为什么要一个模块而不是各处各写一份 `z.enum([...])`:同一张词表此前在四处各抄一份字面量
+ * (`approval-card.ts` 两腿的 offer schema、`http/routes/rules.ts` 的直通票口行形、
+ * `plugins/permission-rule-store-sql.ts` 的 `rules_json` 读/写形),core 给 `PersistedRuleMatch` 加两员
+ * (wildcard / subpath)、给 `PersistedRuleTool` 加 Read 时,四份抄件**没有一份**会编译红 —— zod 的 enum
+ * 只是运行期的一个 Set,静默把一次上游语义扩张翻成一整类合法行的拒收([ref] 词表纪律说的正是这形:
+ * 未知词必须是**编译**错,不是运行期一个安静的 false)。
+ *
+ * 🔴 每张表都带一条**双向全等钉**(`Exact<>`):元组的成员并 ≡ core 的联合型。core 加员 ⇒ 这里编译红,
+ * 由人裁定新词在每个消费面的处置(收 / 拒 / 剥),而不是让它在某一处静默落进「不认识」臂;本仓多写一个
+ * core 没有的词 ⇒ 同样红(词表属主是 core,本仓只转录)。
+ *
+ * ⚠️ 转录**不是**判据:一个词在表里只说「这是 core 定义的一员」,不说「本仓每条腿都接受它」。逐腿的收窄
+ * (例如卡编辑臂对 `subpath` 的拒)写在那条腿自己的穷举 `switch` 里,并各带理由。
+ */
+import type { RuleApprovalRecord } from "@sema-agent/core";
+/** `PersistedRuleTool`([ref] §2.2:`"Read"` 只说一种文法 —— `Read(//abs-dir/**)` 目录只读授权)。 */
+export declare const PERSISTED_RULE_TOOLS: readonly ["Bash", "Read"];
+/**
+ * `PersistedRuleMatch` 四员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
+ * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
+ * `subpath`(Read 目录形,永不容纳任何命令)。
+ */
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath"];
+/** [ref] §2.3 B3:batch offer 成员的判别位(`command` = 历史逐段 Bash 规则;`directoryRead` = cd 段铸的目录只读授权)。 */
+export declare const RULE_OFFER_BATCH_MEMBER_KINDS: readonly ["command", "directoryRead"];
+/** [ref] §3.5:一段「为什么仍未被覆盖」的闭三词集(`redirection` 永久逐次 / `no_rule_form` 无可覆盖形 / `cap_overflow` 去重+帽挤出)。 */
+export declare const UNCOVERED_SEGMENT_REASONS: readonly ["redirection", "no_rule_form", "cap_overflow"];
+/** [ref] §3.3-5:卡编辑面的 breadth 警告码(记录 `edited.warnings` 存的就是这两个字面)。 */
+export declare const EDITED_RULE_BREADTH_WARNING_CODES: readonly ["broad_prefix", "compound_prefix"];
+/**
+ * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 2→3)。
+ * 类型绑 core 的字面型:core 再升号 ⇒ 这里编译红,两只 durable 店(SQL 双方言 + File)的 stale 判别与写侧钉
+ * 同批随之;判别是**等式**(`!==`)不是下限 —— 旧号的行按 stale 信封交还(不迁移、不 widen、不丢行),
+ * pending 卡短命,重触发即取新卡(B7/B8 既诺)。
+ */
+export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
+//# sourceMappingURL=permission-rule-vocab.d.ts.map

package/dist/permission-rule-vocab.js

@@ -0,0 +1,17 @@
+export const PERSISTED_RULE_TOOLS = ["Bash", "Read"];
+const TOOLS_PIN = true;
+void TOOLS_PIN;
+export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath"];
+const MATCHES_PIN = true;
+void MATCHES_PIN;
+export const RULE_OFFER_BATCH_MEMBER_KINDS = ["command", "directoryRead"];
+const MEMBER_KINDS_PIN = true;
+void MEMBER_KINDS_PIN;
+export const UNCOVERED_SEGMENT_REASONS = ["redirection", "no_rule_form", "cap_overflow"];
+const REASONS_PIN = true;
+void REASONS_PIN;
+export const EDITED_RULE_BREADTH_WARNING_CODES = ["broad_prefix", "compound_prefix"];
+const WARNING_CODES_PIN = true;
+void WARNING_CODES_PIN;
+export const RULE_APPROVAL_RECORD_SCHEMA = 3;
+//# sourceMappingURL=permission-rule-vocab.js.map

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -120,6 +120,18 @@ export interface PendingCheckpoint {
      * 展示/分诊用,永不参与 resume / gate / CAS(core 同款 ECHO-ONLY 定性)。
      */
     hasBidiControls?: true;
+    /**
+     * [ref]([ref]② core 点名 / [ref] 认领):**内容问句分型键** —— `"content_ask"` 当这条 tool_approval
+     * park 门住的是保留工具 AskUserQuestion(问用户的问题,不是副作用工具),消费端(cli/壳审批面)据它
+     * 渲问句 UI 而不用嗅探 `toolName`。词与判据 = core `summarizeCheckpoint` 的同一行规则(行上 core 铸的
+     * `toolName` 的**全函数**派生;词属主 `approval-content-kind.ts`,parity 钉看漂移)——**不是**
+     * `hasBidiControls` 那类「server 不重算」的扫描位:派生 ≠ 重扫。
+     * 🔴 `"content_ask"` 或**缺席**([ref]② OMIT 纪律,恒不铸 `null`/`false`):缺席 = 非内容问句门
+     * (普通工具门 / 非工具 park / toolName 缺席的存量行)。展示/分诊用,永不参与 resume / gate / CAS。
+     * 两条 durable 读面(`GET /v1/approvals` 行 + `/stream` `pending` 帧)经同一投影同时携带;live 腿的
+     * 同名键在 `LivePendingRow.contentKind`(同一词属主)。
+     */
+    contentKind?: "content_ask";
 }
 /**
  * [ref]([ref] / DEBTS [ref]):session 键读口(`findPendingTokenBySession` / `peekPendingScope`)的**行绑定**。
@@ -641,6 +653,20 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      * caller may only decide a checkpoint in their OWN scope. Returns `undefined` (no pending row), `null`
      * (anonymous/dev session — open), or the owner scope string.
      */
+    /**
+     * [ref]:**按 token** 的 scope 轻读 —— `undefined`(无该行)/ `null`(匿名/开放)/ 属主 scope 串。
+     *
+     * 为什么必须有这一口(codex [ref] r1-[medium],验真后修):`peekPendingScope` 是**按 session** 的读,答的
+     * 是「此刻绑定下最新的那一行」;而 `get(token)` 读的是**那一个** token。表无 per-session pending 唯一
+     * 约束、两读又非事务 ⇒ 并发轮换窗内两者可以是不同的行。于是「按 session 轻读出的属主」不能拿来当
+     * 「可否把 `get(token)` 的失败细节回显给这位调用方」的准入位 —— 那正是 [ref] 要封的存在性 oracle 在
+     * TOCTOU 面上的复活形。本口把属主证明与**将要载入的那个 token** 原子绑定(同一 `WHERE token = ?`)。
+     *
+     * 刻意**不带** `status='pending'` 谓词:判据是「这一行是不是你的」,与它此刻处在哪一态无关(`get()`
+     * 自己也是裸 `WHERE token = ?`);加了反而在「刚被并发消费」的窗里把属主自己的诊断吞掉。
+     * 只 SELECT `scope` 一列 ⇒ 版本闸/坏 blob 都影响不到它(那是 `get()` 读 `version`/`checkpoint` 的事)。
+     */
+    peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;
     /** Upsert the resume rebuild inputs for a session (written at SUBMIT when durable mode is on). */
     putCtx(sessionId: string, ctx: unknown): Promise<void>;