@sema-agent/server 7.55.0 → 7.57.0

package/dist/http/routes/runs.js

@@ -1,3 +1,4 @@
+import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -22,10 +23,12 @@ import { normalizeRunEventType } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { buildActiveRunConflict } from "../active-run-conflict.js";
 import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
+import { buildCancelContext } from "../../run-cancel-context.js";
 import { buildCrossSliceUsage, readResourceWindow, recordResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
+import { withPrincipal } from "../../observability/principal-context.js";
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
 export const RUN_CANCEL_RE = /^\/v1\/runs\/([^/]+)\/cancel$/;
 export const RUN_STEER_RE = /^\/v1\/runs\/([^/]+)\/steer$/;
@@ -136,7 +139,10 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         retainedFrom: (id) => runStore.retainedFrom(id),
         formatEvent: (ev) => {
             const type = normalizeRunEventType(ev.type);
-            return { id: ev.seq, event: type, data: { type, ...(ev.data ?? {}) } };
+            const data = type === "done" && ev.data && typeof ev.data === "object" && ev.data.result && typeof ev.data.result === "object"
+                ? { ...ev.data, result: memoRedactTerminalResult("ev.done.result", ev.data.result) }
+                : type === "failed" ? memoRedactedRead("ev.failed", ev.data, (d) => redactLedgerEventData(type, d)) : redactLedgerEventData(type, ev.data);
+            return { id: ev.seq, event: type, data: { type, ...(data ?? {}) } };
         },
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
@@ -251,11 +257,11 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 status: stale ? "failed" : run.status,
                 ...(lastActivityAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastActivityAt) } : {}),
                 ...(crossSliceUsage !== undefined ? { crossSliceUsage } : {}),
-                result: run.result ?? undefined,
+                result: isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : redactTerminalResult(run.result ?? undefined),
                 supervisorCost,
                 suggestions,
                 errorCode: stale ? undefined : (run.result?.errorCode ?? undefined),
-                error: stale ? "run stalled (instance lost?)" : run.error ?? undefined,
+                error: stale ? "run stalled (instance lost?)" : isTerminalRunStatus(run.status) ? memoRedactedRead("run.error", run.error ?? undefined, redactErrorMessage) : redactErrorMessage(run.error ?? undefined),
                 jobId: run.jobId ?? undefined,
                 source: run.source ?? undefined,
             });
@@ -324,7 +330,8 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             }
             const err = note;
             try {
-                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 } };
+                const cancelContext = buildCancelContext(taskId, Date.parse(run.createdAt));
+                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {
@@ -870,7 +877,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             deps.logger?.[level]?.("manual_compact_outcome", { taskId, outcome, note: outcome === "compacted" ? "a compacted{trigger:'manual'} event rode the run stream" : `no event (see compaction.${outcome === "mooted" ? "mooted" : outcome} trace / task terminal events)` });
         }, (e) => {
             if (e.code !== "steering.not_running") {
-                deps.logger?.warn?.("manual_compact_failed", { taskId, err: e instanceof Error ? e.message : String(e) });
+                deps.logger?.warn?.("manual_compact_failed", { taskId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
             }
             else {
                 deps.logger?.info?.("manual_compact_not_running", { taskId, note: "stream settled between lookup and compact() — benign unless systematic" });
@@ -934,7 +941,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
 }
 async function handleRunVerbsBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
     const subOutputMatch = req.method === "GET" ? RUN_SUBAGENT_OUTPUT_RE.exec(url) : null;
     if (subOutputMatch) {
         if (!deps.runStore || !deps.subagentTaskOutput) {
@@ -1159,7 +1166,12 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
                         send409("resume.retain_off", "the parent run did not retain sub-agent sessions (set retainSubagentSessions on the run to enable revival)");
                         return;
                     }
-                    const marker = await handle.resume(redacted);
+                    if (ownerQuotaDenied(res, run.owner ?? undefined))
+                        return;
+                    if (await ownerLeaseDenied(res, run.owner ?? undefined))
+                        return;
+                    const resumeFn = handle.resume;
+                    const marker = await withPrincipal(run.owner ?? undefined, () => resumeFn(redacted));
                     sendJson(res, 200, { taskId: runId, target, status: "running", delivery: "applied", marker, note: `Message queued for delivery to ${handle.agentName ?? target}; it will continue in the background.` });
                     return;
                 }
@@ -1593,7 +1605,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
                     backend: deps.backend,
                     parkFacility: deps.checkpointStore !== undefined,
                 }).active,
-                windowMs: deps.config.streamApproval?.windowMs ?? 0,
+                windowMs: deps.config.streamApproval?.windowMs,
                 windowMarginMs: deps.config.streamAskWindowMarginMs,
             }
             : undefined, deps.checkpointStore);

package/dist/http/routes/tasks.js

@@ -1,3 +1,4 @@
+import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal-log.js";
 import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, stripCheckpointToken, HEARTBEAT_MS } from "../../runs.js";
 import { withPrincipal } from "../../observability/principal-context.js";
@@ -7,6 +8,7 @@ import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotific
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
+import { buildCancelContext } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
@@ -47,6 +49,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
     const { prepareSpec, finalizeTaskResult } = ctx.legs;
     const reqState = ctx.req;
     const source = ctx.req.source;
+    const noteRunOutcome = (r) => {
+        if (!r?.status)
+            return;
+        reqState.runStatus = r.status;
+        if (r.errorCode)
+            reqState.runErrorCode = r.errorCode;
+    };
     if (req.method === "POST" && (url === "/v1/tasks" || url === "/v1/tasks/stream")) {
         const rawIdem = headerStr(req.headers["idempotency-key"]);
         const idemKey = rawIdem ? scopedIdempotencyKey(rawIdem, source, gatedPrincipal(req, deps.config)) : undefined;
@@ -88,6 +97,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 return;
             }
             const earlyDurableTid = deps.runStore && prepared.spec.sessionId ? uuidv7() : undefined;
+            const streamLegStartedAt = Date.now();
             const detachOnDisconnect = headerStr(req.headers["x-detach-on-disconnect"]) === "true";
             if (detachOnDisconnect && earlyDurableTid === undefined) {
                 sendError(res, 400, "request.precondition_unmet", "x-detach-on-disconnect requires a durable run (a run store + sessionId) — without one the detached result would be unqueryable");
@@ -178,6 +188,19 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 let runRowSettled = false;
                 let durableTaskId;
                 let durableHeartbeat;
+                const mintCancelledResult = (errorMessage) => {
+                    const ctx = durableTaskId === undefined ? undefined : buildCancelContext(durableTaskId, streamLegStartedAt);
+                    return {
+                        taskId: durableTaskId ?? "",
+                        sessionId: prepared.spec.sessionId ?? "",
+                        status: "failed",
+                        result: "",
+                        errorCode: "cancelled",
+                        errorMessage,
+                        stats: { turns: 0, tokens: 0 },
+                        ...(ctx ? { cancelContext: ctx } : {}),
+                    };
+                };
                 let userMsgEntryId;
                 let anchorPut = false;
                 const putRewindAnchor = () => {
@@ -211,7 +234,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (detachOnDisconnect && durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: () => recordTurnActivity(tid) });
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
                     usageKey = durableTaskId;
                     if (usageKey)
                         deps.modelUsage?.register(usageKey);
@@ -380,13 +403,14 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 if (ev.type === "message_committed" && ev.role === "user")
                                     userMsgEntryId = ev.entryId;
                                 if (ev.type === "done") {
-                                    finalResult = stripCheckpointToken(await graftParkToolCallId(ev.result, deps.checkpointStore));
+                                    finalResult = redactTerminalResult(stripCheckpointToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
                                     if (durableTaskId && finalResult)
                                         finalResult = { ...finalResult, taskId: durableTaskId };
                                     if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.status === "failed" && !finalResult.errorCode) {
                                         finalResult = { ...finalResult, errorCode: "cancelled" };
                                     }
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
+                                    noteRunOutcome(finalResult);
                                     putRewindAnchor();
                                     settleFleet(finalResult?.status ?? "completed", fleetRunResiduals(finalResult));
                                     if (ledgerSink && finalResult) {
@@ -530,7 +554,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
                     const approvalLeg = resolveApprovalLeg({
                         streamApprovalOn,
-                        windowMs: deps.config.streamApproval?.windowMs ?? 0,
+                        windowMs: deps.config.streamApproval?.windowMs,
                         windowMarginMs: deps.config.streamAskWindowMarginMs,
                         ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
                         nowMonotonicMs: performance.now(),
@@ -618,13 +642,14 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             }
                             else {
                                 const dcErr = "stream client disconnected before completion (run aborted)";
-                                const dc = { taskId: durableTaskId, sessionId: prepared.spec.sessionId ?? "", status: "failed", errorCode: "cancelled", errorMessage: dcErr, stats: { turns: 0, tokens: 0 } };
+                                const dc = mintCancelledResult(dcErr);
                                 if (ledgerSink && !ledgerTerminal) {
                                     ledgerTerminal = true;
                                     await ledgerSink.flush().catch(() => undefined);
                                     await ledgerSink.append("failed", { errorMessage: dcErr, errorCode: "cancelled" }).catch(() => undefined);
                                 }
                                 await deps.runStore.setTerminal(durableTaskId, "failed", dc, dcErr);
+                                noteRunOutcome(dc);
                                 settleFleet("failed");
                             }
                         }
@@ -668,7 +693,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 }
                                 else if (ac.signal.aborted) {
                                     const err = "stream aborted before completion (run cancelled)";
-                                    const c = { taskId: durableTaskId, sessionId: prepared.spec.sessionId ?? "", status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 } };
+                                    const c = mintCancelledResult(err);
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
                                         await ledgerSink.flush().catch(() => undefined);
@@ -699,7 +724,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 resp = await idemCache.run(idemKey, runStreamSubmitLeg, (r) => r.body?.status === "completed");
             }
             catch (e) {
-                deps.logger?.error("stream_error", { closed, err: e instanceof Error ? e.message : String(e) });
+                deps.logger?.error("stream_error", { closed, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                 if (!closed)
                     throw e;
             }
@@ -790,7 +815,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const retryAfterSec = result.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
                         ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
                         : undefined;
-                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: result.errorMessage ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
+                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: redactErrorMessage(result.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
                 }
                 if (result.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
@@ -805,7 +830,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (durableTaskId && deps.runStore)
                     await deps.runStore.setTerminal(durableTaskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
                 finalizeTaskResult(result, principal, prepared.spec.objective, prepared.spec.sessionId);
-                return { status: 200, body: withDiscoveryNotice(stripCheckpointToken(result)) };
+                noteRunOutcome(result);
+                return { status: 200, body: withDiscoveryNotice(redactTerminalResult(stripCheckpointToken(result))) };
             };
             const resp = await idemCache.run(idemKey, runSyncSubmitLeg, (r) => r.status < 400);
             sendSubmitResult(res, resp);

package/dist/http/routes/workflows.js

@@ -2,6 +2,10 @@ import { z } from "zod";
 import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { createHash } from "node:crypto";
+import { redactErrorMessage, redactHead } from "../../observability/run-terminal-log.js";
+const JOURNAL_PROJECTION_MEMO_CAP = 1024;
+const journalProjectionMemo = new Map();
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 const WORKFLOWS_RE = /^\/v1\/workflows(?:\/([^/]+)(\/stream|\/journal)?)?$/;
@@ -68,16 +72,27 @@ async function handleWorkflowsReadBody(req, res, url, ctx, miss) {
             const jLimit = Math.min(50, Math.max(1, Number(jq.get("limit") ?? 20) || 20));
             const jOffset = Math.max(0, Number(jq.get("offset") ?? 0) || 0);
             const MAX_ROW_BYTES = 64 * 1024;
-            const firstLine = (t) => (t ? redactSecrets(t.split("\n")[0].slice(0, 300)) : undefined);
+            const firstLine = (t) => (t ? redactHead(t.split("\n")[0], 300) : undefined);
             const MAX_RESULT_CHARS = 2000;
-            const projectResult = (callKey, r) => ({
+            const projectResult = (callKey, r) => {
+                const memoKey = `${wfId}\u0000${callKey}\u0000${createHash("sha256").update(JSON.stringify(r)).digest("hex")}`;
+                const hit = journalProjectionMemo.get(memoKey);
+                if (hit)
+                    return hit;
+                const out = projectResultUncached(callKey, r);
+                if (journalProjectionMemo.size >= JOURNAL_PROJECTION_MEMO_CAP)
+                    journalProjectionMemo.delete(journalProjectionMemo.keys().next().value);
+                journalProjectionMemo.set(memoKey, out);
+                return out;
+            };
+            const projectResultUncached = (callKey, r) => ({
                 callKey,
                 ordinal: callKeyOrdinal(callKey),
                 status: r.status,
                 ...(r.errorMessage ? { error: firstLine(r.errorMessage) } : {}),
                 ...(r.result
                     ? {
-                        result: redactSecrets(r.result.slice(0, MAX_RESULT_CHARS)),
+                        result: redactHead(r.result, MAX_RESULT_CHARS),
                         ...(r.result.length > MAX_RESULT_CHARS ? { resultTruncated: true, resultChars: r.result.length } : {}),
                     }
                     : {}),
@@ -196,7 +211,7 @@ async function handleWorkflowAgentSteerBody(req, res, url, ctx, miss) {
         sendNotRunningWf(!wfRun
             ? "workflow agent is not running on this replica (no live handle)"
             : wfRun.status === "running"
-                ? "workflow agent is active on another replica — cross-replica live-steer is not yet supported"
+                ? "no live handle for this workflow agent on this replica — the run may be live on another replica (cross-replica live-steer is not yet supported), or this replica holds no steerable stream for it; read the workflow status faces for progress"
                 : `workflow is ${wfRun.status} — agent is not running`);
         return;
     }
@@ -310,7 +325,7 @@ function summarizeWorkflowDetail(run) {
         createdAt: run.createdAt,
         durationMs: durationOf(run),
         rev: run.rev,
-        error: run.error,
+        ...(run.error !== undefined ? { error: redactErrorMessage(run.error) ?? "" } : {}),
         ...(run.result !== undefined ? { result: redactSecrets(run.result) } : {}),
         phases,
         ...(unphasedView ? { unphased: unphasedView } : {}),

package/dist/http/server.d.ts

@@ -18,7 +18,7 @@ import { type FleetEventBus } from "../fleet/fleet-bus.js";
 import type { ElicitationCoordinator } from "../elicitation.js";
 import type { QuestionCoordinator } from "../question.js";
 import { type ParkedAskRedeem, type ToolApprovalCoordinator } from "../tool-approval.js";
-import type { ApprovalAskAuditReadFace } from "../approval-ask-audit-store.js";
+import type { ApprovalAskAuditReadFace, ApprovalLateSettleSink } from "../approval-ask-audit-store.js";
 import type { PlanCacheProbe } from "../plan-cache-probe.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
@@ -210,6 +210,11 @@ export interface ServiceCoordinatorDeps {
      *  SQL 车道恒缺席(那里有真 ask 店,[ref])—— 键缺席 = 本部署无此面,`[]` = 有面且无崩溃残账,
      *  两义与 `livePending` 同律可判别。 */
     approvalAskAudit?: ApprovalAskAuditReadFace;
+    /** [ref] 迟到人工结算的**写面**(与 {@link approvalAskAudit} 同一个店实例,两把窄口:读面喂
+     *  `GET /v1/approvals` 的 `crashConverged`,写面只有 `recordLateSettle` 一个动词 —— 铸造/决议/腿闭
+     *  三点的属主是协调器,路由层拿到它们只会长出第二个写者)。在场判据与读面逐字同源(local 车道 ∧
+     *  审批面开着);缺席 ⇒ 两条 decide 腿**不写、不抛**,行为与修前逐字相同(SQL 车道恒缺席)。 */
+    approvalLateSettle?: ApprovalLateSettleSink;
     /** SVC-5 ([ref] CORE-5 #6): the process-local registry of STEERABLE workflow-agent handles
      *  (`ctx.agentStream`) live on THIS replica. Enables POST /v1/workflows/:id/agents/:label/steer. See
      *  workflow-agent-steer.ts for the handle-visibility seam status (the registry is real + ready; core does not
@@ -539,6 +544,11 @@ export interface ServiceGovernanceDeps {
      *  pre-admission 读窗用(主力 /v1/runs 是 202 异步,core 进场拒发生在 202 之后永远变不成 429;
      *  这里是异步车道唯一的 429 出路)。enforcement 真源在 core(RunnerDeps 同店),此门是快速座。 */
     usageWindowStore?: import("@sema-agent/core").UsageWindowStore;
+    /** [ref] ④([ref]/[ref],core [ref] 合修):auto 模式自查读面的三件装配事实(席位在不在 / 合成后的
+     *  per-principal caps resolver / 分类器配置路由)。`/v1/capabilities.permissionModeAuto.{armed,reason,model}`
+     *  只消费它,不自算 —— 席位与 resolver 都必须是递给 `RunnerDeps` 的**同一只**(main.ts 装配),否则又是
+     *  「诊断说亮、位说暗」。缺席(桩/一次性 CLI)⇒ 读面如实答 `deployment_incapable`。 */
+    autoModeFace?: import("../auto-mode-face.js").AutoModeFaceDeps;
 }
 /** **部署自述面**:只被 /health、/v1/capabilities 与提交前置门读的部署事实(多为 live getter,
  *  不是快照——/health 必须回答「此刻」)。 */