@sema-agent/server 7.55.0 → 7.57.0

package/dist/leader/endpoint.js

@@ -1,4 +1,6 @@
 import { uuidv7 } from "@sema-agent/core";
+import { redactErrorMessage, redactHead, redactLeaderResult, redactLeaderResultWithFlag } from "../observability/run-terminal-log.js";
+import { withPrincipal } from "../observability/principal-context.js";
 import { leaderIdemKey } from "../plugins/leader-run-store-sql.js";
 function statusForLeaderResult(result) {
     switch (result.repairTerminal) {
@@ -37,17 +39,17 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
             }
         }
     }
-    function drive(id, body) {
+    function drive(id, body, owner) {
         void (async () => {
             let terminal;
             try {
-                const result = await runLeader(body);
+                const result = redactLeaderResult(await withPrincipal(owner ?? undefined, () => runLeader(body)));
                 const status = statusForLeaderResult(result);
                 terminal = { status: status, result };
                 opts.logger?.info?.("leader_run_done", { id, ok: result.ok, status, ...(result.repairTerminal ? { repairTerminal: result.repairTerminal } : {}), merged: result.merge && result.merge.ok ? result.merge.merged : undefined });
             }
             catch (e) {
-                terminal = { status: "failed", error: e instanceof Error ? e.message : String(e) };
+                terminal = { status: "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
                 opts.logger?.error?.("leader_run_error", { id, err: terminal.error });
             }
             if (opts.store) {
@@ -60,7 +62,7 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
                     }
                     catch (e) {
                         if (attempt >= TERMINAL_WRITE_ATTEMPTS) {
-                            opts.logger?.error?.("leader_run_terminal_write_failed", { id, status: terminal.status, attempts: attempt, err: e instanceof Error ? e.message : String(e) });
+                            opts.logger?.error?.("leader_run_terminal_write_failed", { id, status: terminal.status, attempts: attempt, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                             break;
                         }
                         await new Promise((r) => setTimeout(r, TERMINAL_WRITE_RETRY_MS));
@@ -78,16 +80,48 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
             }
         })();
     }
+    const CLEAN_MEMO_CAP = 4096;
+    const cleanIds = new Set();
+    const DIRTY_MEMO_CAP = 256;
+    const DIRTY_MEMO_MAX_ENTRY_BYTES = 1_048_576;
+    const DIRTY_MEMO_MAX_TOTAL_BYTES = 16 * 1_048_576;
+    const dirtyMemo = new Map();
+    let dirtyMemoBytes = 0;
+    function redactedView(run) {
+        const terminal = run.status !== "running";
+        if (terminal) {
+            if (cleanIds.has(run.id))
+                return { ...(run.result ? { result: run.result } : {}), ...(run.error ? { error: run.error } : {}) };
+            const hit = dirtyMemo.get(run.id);
+            if (hit)
+                return hit.view;
+        }
+        const rr = run.result ? redactLeaderResultWithFlag(run.result) : undefined;
+        const err = run.error ? (redactErrorMessage(run.error) ?? "") : undefined;
+        const changed = (rr?.changed ?? false) || (err !== undefined && err !== run.error);
+        const view = { ...(rr ? { result: rr.value } : {}), ...(err !== undefined ? { error: err } : {}) };
+        if (!terminal)
+            return view;
+        if (!changed) {
+            if (cleanIds.size >= CLEAN_MEMO_CAP)
+                cleanIds.delete(cleanIds.values().next().value);
+            cleanIds.add(run.id);
+            return view;
+        }
+        const bytes = Buffer.byteLength(JSON.stringify(view));
+        if (bytes <= DIRTY_MEMO_MAX_ENTRY_BYTES) {
+            while (dirtyMemo.size > 0 && (dirtyMemo.size >= DIRTY_MEMO_CAP || dirtyMemoBytes + bytes > DIRTY_MEMO_MAX_TOTAL_BYTES)) {
+                const oldest = dirtyMemo.keys().next().value;
+                dirtyMemoBytes -= dirtyMemo.get(oldest).bytes;
+                dirtyMemo.delete(oldest);
+            }
+            dirtyMemo.set(run.id, { view, bytes });
+            dirtyMemoBytes += bytes;
+        }
+        return view;
+    }
     function getBody(run) {
-        return {
-            status: 200,
-            body: {
-                id: run.id,
-                status: run.status,
-                ...(run.result ? { result: run.result } : {}),
-                ...(run.error ? { error: run.error } : {}),
-            },
-        };
+        return { status: 200, body: { id: run.id, status: run.status, ...redactedView(run) } };
     }
     const NOT_FOUND = { status: 404, body: { error: "leader run not found", errorCode: "not_found.leader_run" } };
     async function handle(method, url, body, requester, idempotencyKey) {
@@ -120,7 +154,7 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
                     return { status: 202, body: { leaderRunId: run.id, status: run.status } };
                 }
                 runs.set(run.id, { id: run.id, status: "running", startedAt: run.startedAtMs, owner });
-                drive(run.id, b);
+                drive(run.id, b, owner);
                 return { status: 202, body: { leaderRunId: run.id, status: "running" } };
             }
             if (scopedIdem) {
@@ -133,7 +167,7 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
             runs.set(id, { id, status: "running", startedAt: Date.now(), owner });
             if (scopedIdem)
                 memIdem.set(scopedIdem, id);
-            drive(id, b);
+            drive(id, b, owner);
             return { status: 202, body: { leaderRunId: id, status: "running" } };
         }
         const m = method === "GET" ? LEADER_ID_RE.exec(url) : null;

package/dist/leader/fanout.js

@@ -1,3 +1,4 @@
+import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal-log.js";
 class Semaphore {
     max;
     active = 0;
@@ -62,10 +63,10 @@ export async function fanOut(subtasks, opts) {
                 return { ...base, status: "timeout", error: "cancelled before start" };
             if (opts.runWorker) {
                 try {
-                    return maybeCancelOnSuspend(await opts.runWorker(st, sharedAC.signal));
+                    return maybeCancelOnSuspend(redactWorkerReportError(await opts.runWorker(st, sharedAC.signal)));
                 }
                 catch (e) {
-                    return { ...base, status: cancelled ? "timeout" : "failed", error: e instanceof Error ? e.message : String(e) };
+                    return { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
                 }
             }
             let stream;
@@ -73,16 +74,16 @@ export async function fanOut(subtasks, opts) {
                 stream = opts.runner.runTaskStream({ ...st.spec, sessionId: st.sessionId, signal: sharedAC.signal });
             }
             catch (e) {
-                return { ...base, status: "failed", error: e instanceof Error ? e.message : String(e) };
+                return { ...base, status: "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
             }
             streams.set(st.workerId, stream);
             let report;
             try {
                 const result = await stream.result();
-                report = { ...base, status: mapStatus(result.status), stats: result.stats, ...(result.errorMessage ? { error: result.errorMessage } : {}) };
+                report = { ...base, status: mapStatus(result.status), stats: result.stats, ...(result.errorMessage ? { error: redactErrorMessage(result.errorMessage) ?? "" } : {}) };
             }
             catch (e) {
-                report = { ...base, status: cancelled ? "timeout" : "failed", error: e instanceof Error ? e.message : String(e) };
+                report = { ...base, status: cancelled ? "timeout" : "failed", error: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" };
             }
             finally {
                 streams.delete(st.workerId);

package/dist/leader/leader.js

@@ -1,4 +1,5 @@
 import { fanOut, isDurablePauseStatus } from "./fanout.js";
+import { redactErrorMessage, redactHead, redactPatchHead } from "../observability/run-terminal-log.js";
 import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
 import { Runner, runWithVerification, resumeWithVerification, delimitUntrusted } from "@sema-agent/core";
@@ -58,8 +59,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                             deps.logger?.warn?.("worker_failed", {
                                 workerId: w.workerId, status: r.status, turns: r.stats?.turns ?? 0,
                                 ...(r.errorCode ? { errorCode: r.errorCode } : {}),
-                                ...(r.errorMessage ? { error: r.errorMessage.slice(0, 200) } : {}),
-                                ...(r.blockedReason ? { blockedReason: r.blockedReason.slice(0, 200) } : {}),
+                                ...(r.errorMessage ? { error: redactHead(r.errorMessage, 200) } : {}),
+                                ...(r.blockedReason ? { blockedReason: redactHead(r.blockedReason, 200) } : {}),
                             });
                         }
                         return {
@@ -85,7 +86,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                         deps.logger?.info?.("worker_resource_resume", { workerId: w.workerId, slice });
                         return resumeWithVerification(w.runner, token, { gate: "resource_limit", decision: "continue" }, { ...w.spec, sessionId: w.sessionId, signal }, w.spec.objective ?? "", cfg);
                     });
-                    deps.logger?.info?.("verify_outcome", { workerId: w.workerId, status: vr.status, verdict: vr.verification.verdict, rounds: vr.verification.rounds, finding: (vr.verification.findings[0] ?? "").slice(0, 220) });
+                    deps.logger?.info?.("verify_outcome", { workerId: w.workerId, status: vr.status, verdict: vr.verification.verdict, rounds: vr.verification.rounds, finding: redactHead(vr.verification.findings[0] ?? "", 220) });
                     const pass = vr.status === "completed" && vr.verification.verdict === "PASS";
                     const stillSuspended = vr.checkpointToken !== undefined;
                     const reportStatus = pass ? "completed" : stillSuspended ? "suspended" : "failed";
@@ -93,8 +94,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                         deps.logger?.warn?.("worker_failed", {
                             workerId: w.workerId, status: reportStatus, turns: vr.stats?.turns ?? 0, verdict: vr.verification.verdict,
                             ...(vr.errorCode ? { errorCode: vr.errorCode } : {}),
-                            ...(vr.errorMessage ? { error: vr.errorMessage.slice(0, 200) } : {}),
-                            ...(vr.blockedReason ? { blockedReason: vr.blockedReason.slice(0, 200) } : {}),
+                            ...(vr.errorMessage ? { error: redactHead(vr.errorMessage, 200) } : {}),
+                            ...(vr.blockedReason ? { blockedReason: redactHead(vr.blockedReason, 200) } : {}),
                         });
                     }
                     return {
@@ -105,7 +106,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                             : {
                                 error: vr.verification.verdict === "unverified"
                                     ? (vr.errorMessage ?? vr.blockedReason ?? `worker ${vr.status}`)
-                                    : `verify ${vr.verification.verdict}: ${(vr.verification.findings[0] ?? "").slice(0, 200)}`,
+                                    : `verify ${vr.verification.verdict}: ${redactHead(vr.verification.findings[0] ?? "", 200)}`,
                             }),
                         ...(vr.checkpointGate ? { checkpointGate: vr.checkpointGate } : {}),
                         ...(vr.errorCode ? { errorCode: vr.errorCode } : {}),
@@ -127,7 +128,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                 return { reports: [rr.report], cancelled: false };
             }
             catch (e) {
-                deps.logger?.warn?.("repair_loop_dispatch_failed", { workerId: solo.workerId, err: e instanceof Error ? e.message : String(e) });
+                deps.logger?.warn?.("repair_loop_dispatch_failed", { workerId: solo.workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                 return runWave([toSubtask(solo)]);
             }
         };
@@ -178,14 +179,15 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     r.repairs = attempt;
                     if (verdict.ok)
                         return;
+                    const safeVerdictReason = redactErrorMessage(verdict.reason ?? "behaviorally incorrect") ?? "";
                     if (attempt === maxR) {
                         r.status = "failed";
-                        r.error = `module gate: ${(verdict.reason ?? "behaviorally incorrect").slice(0, 200)}`;
+                        r.error = `module gate: ${redactHead(verdict.reason ?? "behaviorally incorrect", 200)}`;
                         return;
                     }
-                    deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: verdict.reason });
+                    deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, verdict.reason ?? ""), sessionId: `${w.sessionId}-r${attempt + 1}` }).result();
+                        const rr = await w.runner.runTaskStream({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }
@@ -226,8 +228,9 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             };
         };
         const collapseToSingle = async (trigger, reason, priorMerge) => {
-            deps.logger?.warn?.("replan_collapse_to_single", { trigger, reason: reason.slice(0, 300) });
-            const replan = { trigger, collapsed: reason.slice(0, 300), ...(redispatched ? { redispatched } : {}) };
+            const safeReason = redactHead(reason, 300);
+            deps.logger?.warn?.("replan_collapse_to_single", { trigger, reason: safeReason });
+            const replan = { trigger, collapsed: safeReason, ...(redispatched ? { redispatched } : {}) };
             const priorDiffs = [];
             await Promise.all(reports.map(async (r) => {
                 const w = byId.get(r.workerId);
@@ -249,8 +252,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     task,
                     ``,
                     `--- PRIOR PARALLEL WORK — REUSE IT, do not re-derive from scratch ---`,
-                    `${priorDiffs.length} worker(s) attempted this task in parallel; their changes could NOT be integrated cleanly (${reason.slice(0, 150)}). Each worker's diff over the base is below. COPY the correct, non-overlapping parts verbatim and produce ONE coherent change for the WHOLE task, resolving only the overlaps. Treat these as a strong starting point — fix anything wrong, but do not throw the work away.`,
-                    ...priorDiffs.map((d) => delimitUntrusted(`PRIOR WORKER '${d.workerId}' (${d.status}) DIFF (untrusted)`, d.patch.slice(0, 8000))),
+                    `${priorDiffs.length} worker(s) attempted this task in parallel; their changes could NOT be integrated cleanly (${safeReason.slice(0, 150)}). Each worker's diff over the base is below. COPY the correct, non-overlapping parts verbatim and produce ONE coherent change for the WHOLE task, resolving only the overlaps. Treat these as a strong starting point — fix anything wrong, but do not throw the work away.`,
+                    ...priorDiffs.map((d) => delimitUntrusted(`PRIOR WORKER '${d.workerId}' (${d.status}) DIFF (untrusted)`, redactPatchHead(d.patch, 8000))),
                 ].join("\n");
             const soloSub = { workerId: "collapse-solo", branch: "worker/collapse-solo", files: ["."], spec: { objective: soloObjective } };
             let solo;

package/dist/leader/merge.js

@@ -1,4 +1,5 @@
 import { delimitUntrusted } from "@sema-agent/core";
+import { OVERSIZED_DIAG_PLACEHOLDER, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
 import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.js";
 import { shellQuote as Q } from "../plugins/remote-shell.js";
 export async function mergeBranches(reports, baseSha, deps) {
@@ -40,7 +41,7 @@ export async function mergeBranches(reports, baseSha, deps) {
                 conflictResolverCostUsd += cr.costUsd;
                 if (!cr.resolved) {
                     deps.logger?.warn?.("merge_apply_failed", { workerId: p.workerId, exitCode: ap.exitCode });
-                    return { ok: false, phase: "apply", reason: `git apply --3way failed for ${p.workerId} (conflict)`, quarantine: [p.workerId], rej: rej.stdout, details: ap.stderr.slice(0, 800), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
+                    return { ok: false, phase: "apply", reason: `git apply --3way failed for ${p.workerId} (conflict)`, quarantine: [p.workerId], rej: rej.stdout, details: redactHead(ap.stderr, 800), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
                 }
                 conflictsResolved.push(p.workerId);
             }
@@ -51,14 +52,18 @@ export async function mergeBranches(reports, baseSha, deps) {
             let cost = 0;
             let round = 0;
             for (; round < integ.repair.maxRounds && test.exitCode !== 0; round++) {
-                const errorText = (test.stdout + "\n" + test.stderr).slice(-4000);
+                const errorText = redactTail(test.stdout + "\n" + test.stderr, 4000);
+                if (errorText.startsWith(OVERSIZED_DIAG_PLACEHOLDER)) {
+                    deps.logger?.warn?.("integration_repair_skipped_oversized_output", { round: round + 1, outputChars: test.stdout.length + test.stderr.length });
+                    break;
+                }
                 deps.logger?.warn?.("integration_repair_round", { round: round + 1, maxRounds: integ.repair.maxRounds });
                 try {
                     const r = await integ.repair.run({ round: round + 1, errorText, testCmd: deps.testCmd, repoDir: repo });
                     cost += r.costUsd ?? 0;
                 }
                 catch (e) {
-                    deps.logger?.warn?.("integration_repair_error", { round: round + 1, err: e instanceof Error ? e.message : String(e) });
+                    deps.logger?.warn?.("integration_repair_error", { round: round + 1, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
                     break;
                 }
                 repairMeta = { rounds: round + 1, fixed: false, costUsd: cost };
@@ -69,11 +74,11 @@ export async function mergeBranches(reports, baseSha, deps) {
             deps.logger?.info?.("integration_repair_done", { ...repairMeta });
         }
         if (test.exitCode !== 0) {
-            return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: (test.stdout + "\n" + test.stderr).slice(-2000), ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
+            return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: redactTail(test.stdout + "\n" + test.stderr, 2000), ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
         }
         if (deps.measureCmd) {
             const mr = await env.exec(deps.measureCmd, { cwd: repo });
-            measure = mr.exitCode === 0 ? { pass: true } : { pass: false, reason: (mr.stdout + " " + mr.stderr).slice(-200) };
+            measure = mr.exitCode === 0 ? { pass: true } : { pass: false, reason: redactTail(mr.stdout + " " + mr.stderr, 200) };
         }
         phase = "push";
         if (repairMeta)
@@ -81,11 +86,11 @@ export async function mergeBranches(reports, baseSha, deps) {
         const costTail = { ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
         const commit = await env.exec(`git add -A && git -c user.email=leader@local -c user.name=leader commit -m ${Q(`merge: integrate ${mergeable.map((r) => r.workerId).join("+")}`)} --allow-empty`, { cwd: repo });
         if (commit.exitCode !== 0) {
-            return { ok: false, phase: "push", reason: `failed to create integration commit (exit ${commit.exitCode})`, details: (commit.stdout + "\n" + commit.stderr).slice(0, 800), ...costTail };
+            return { ok: false, phase: "push", reason: `failed to create integration commit (exit ${commit.exitCode})`, details: redactHead(commit.stdout + "\n" + commit.stderr, 800), ...costTail };
         }
         const integrated = await env.exec(`git format-patch --stdout ${Q(integBase)}..HEAD`, { cwd: repo });
         if (integrated.exitCode !== 0) {
-            return { ok: false, phase: "push", reason: `failed to produce integrated patch (exit ${integrated.exitCode})`, details: integrated.stderr.slice(0, 800), ...costTail };
+            return { ok: false, phase: "push", reason: `failed to produce integrated patch (exit ${integrated.exitCode})`, details: redactHead(integrated.stderr, 800), ...costTail };
         }
         if (!integrated.stdout.trim()) {
             return { ok: false, phase: "push", reason: "integrated patch is empty (nothing applied over base) — refusing to push", quarantine: mergeable.map((r) => r.workerId), ...costTail };
@@ -148,11 +153,11 @@ async function evaluatePushHold(mergeable, observeMeasure, integratedPatch, deps
                 return { hold: { reason: `integrated patch touches out-of-allowlist / build-config paths (${offending.slice(0, 5).join(", ")}) — needs_human_oracle (§10.4(ii))`, terminal: "needs_human_oracle", candidatePatch: heldCandidate() }, measure };
             }
             const grade = await applyAndGrade(mdr.grader, integratedPatch, mdr.measureSteps);
-            measure = grade.passed ? { pass: true } : { pass: false, reason: (grade.trace ?? "measure failed in out-of-process grader").slice(-200) };
+            measure = grade.passed ? { pass: true } : { pass: false, reason: redactTail(grade.trace ?? "measure failed in out-of-process grader", 200) };
             deps.logger?.info?.("merge_measure_grader", { passed: grade.passed, applied: grade.applied });
         }
         catch (e) {
-            deps.logger?.warn?.("merge_measure_grader_error", { err: e instanceof Error ? e.message : String(e) });
+            deps.logger?.warn?.("merge_measure_grader_error", { err: redactErrorMessage(e instanceof Error ? e.message : String(e)) ?? "" });
             return { hold: { reason: `measure grader errored — needs_human_oracle (§10.4)`, terminal: "needs_human_oracle", candidatePatch: heldCandidate() }, measure };
         }
     }
@@ -160,14 +165,14 @@ async function evaluatePushHold(mergeable, observeMeasure, integratedPatch, deps
     const strongOracleUnconfirmed = deps.strongOracleSeeded === true;
     if (measureFailing || strongOracleUnconfirmed) {
         const why = measureFailing ? "measure did not pass" : "hidden held-out oracle seeded but only the compile gate cleared";
-        deps.logger?.warn?.("merge_push_held_signal", { why, measureReason: (measure?.reason ?? "").slice(0, 200) });
+        deps.logger?.warn?.("merge_push_held_signal", { why, measureReason: redactHead(measure?.reason ?? "", 200) });
         return { hold: { reason: `strong oracle unconfirmed: ${why} — candidate_only, push held (§10.3)`, terminal: "candidate_only", candidatePatch: heldCandidate() }, measure };
     }
     return { measure };
 }
 async function resolveApplyConflict(env, repo, p, rejText, applyStderr, resolver, deps) {
     let costUsd = 0;
-    const conflictText = `git apply --3way could not cleanly apply worker '${p.workerId}'.\n--- apply stderr ---\n${applyStderr.slice(0, 1500)}\n--- reject hunks (*.rej) ---\n${rejText.slice(0, 3000)}`;
+    const conflictText = `git apply --3way could not cleanly apply worker '${p.workerId}'.\n--- apply stderr ---\n${redactHead(applyStderr, 1500)}\n--- reject hunks (*.rej) ---\n${redactHead(rejText, 3000)}`;
     for (let round = 0; round < resolver.maxRounds; round++) {
         deps.logger?.warn?.("merge_conflict_repair_round", { workerId: p.workerId, round: round + 1, maxRounds: resolver.maxRounds });
         try {
@@ -175,7 +180,7 @@ async function resolveApplyConflict(env, repo, p, rejText, applyStderr, resolver
             costUsd += r.costUsd ?? 0;
         }
         catch (e) {
-            deps.logger?.warn?.("merge_conflict_repair_error", { workerId: p.workerId, err: e instanceof Error ? e.message : String(e) });
+            deps.logger?.warn?.("merge_conflict_repair_error", { workerId: p.workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
             return { resolved: false, costUsd };
         }
         const check = await env

package/dist/leader/planner.js

@@ -1,3 +1,4 @@
+import { redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
 export function economicGuard(objective, opts = {}) {
     if (opts.fanoutEnabled === false)
         return { single: true, reason: "fan-out disabled by deployment (A6)" };
@@ -124,13 +125,13 @@ export async function routePlanWithFallback(objective, runRoute, opts = {}) {
         catch (e) {
             firstErr ??= e;
             if (!firstRaw)
-                firstRaw = raw.length > 600 ? `${raw.slice(0, 300)}…[${raw.length}ch]…${raw.slice(-150)}` : raw;
+                firstRaw = raw.length > 600 ? `${redactHead(raw, 300)}…[${raw.length}ch]…${redactTail(raw, 150)}` : (redactErrorMessage(raw) ?? "");
         }
     }
     const reason = firstErr instanceof Error ? firstErr.message : String(firstErr);
     return {
         subs: singleRoute(objective),
-        collapsed: `plan rejected twice → collapse to single: ${reason.slice(0, 200)}`,
+        collapsed: `plan rejected twice → collapse to single: ${redactHead(reason, 200)}`,
         rawSample: firstRaw,
     };
 }

package/dist/leader/repair-oracle.js

@@ -1,6 +1,7 @@
 import { runExecGate, } from "@sema-agent/core";
 import { createHash } from "node:crypto";
 import { shellQuote as sq } from "../plugins/remote-shell.js";
+import { redactHead, redactTail } from "../observability/run-terminal-log.js";
 const sha = (s) => createHash("sha256").update(s).digest("hex").slice(0, 16);
 function changedFilesOf(patch) {
     const out = new Set();
@@ -28,8 +29,9 @@ export function mkRepairOracle(cfg) {
     return async (graderEnv, _evidence) => {
         const diff = await cfg.pullWorkerDiff();
         if (!diff.ok) {
-            cfg.log?.("repair_oracle_pull_failed", { error: diff.error });
-            return { tier: cfg.passTier, passed: false, flaky: false, retries: 0, trace: `pull worker diff failed: ${diff.error}` };
+            const safeErr = redactHead(diff.error ?? "", 2000);
+            cfg.log?.("repair_oracle_pull_failed", { error: safeErr });
+            return { tier: cfg.passTier, passed: false, flaky: false, retries: 0, trace: `pull worker diff failed: ${safeErr}` };
         }
         const diffHash = sha(diff.patch);
         const tampered = cfg.oraclePaths && cfg.oraclePaths.length > 0 ? touchesOraclePath(changedFilesOf(diff.patch), cfg.oraclePaths) : undefined;
@@ -51,7 +53,7 @@ export function mkRepairOracle(cfg) {
             { command: `git -C ${sq(repo)} apply --whitespace=nowarn ${sq(patchPath)}`, label: "grader-apply" },
         ]);
         if (!prep.passed) {
-            const trace = prep.steps.map((s) => `${s.label}: ${s.stderr}`).join("\n").slice(-2000);
+            const trace = redactTail(prep.steps.map((s) => `${s.label}: ${s.stderr}`).join("\n"), 2000);
             cfg.log?.("repair_oracle_prep_failed", { trace });
             cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed: false });
             return { tier: cfg.passTier, passed: false, flaky: false, retries: 0, trace: `grader prep failed:\n${trace}` };
@@ -64,7 +66,7 @@ export function mkRepairOracle(cfg) {
             const gate = await runExecGate(graderEnv, cfg.oracleSteps);
             verdicts.push(gate.passed);
             if (!gate.passed) {
-                lastTrace = gate.steps.map((s) => `${s.label}\n${s.stdout}\n${s.stderr}`).join("\n").slice(-4000);
+                lastTrace = redactTail(gate.steps.map((s) => `${s.label}\n${s.stdout}\n${s.stderr}`).join("\n"), 4000);
                 break;
             }
         }

package/dist/leader/repair-wire.js

@@ -1,5 +1,6 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
+import { redactHead } from "../observability/run-terminal-log.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }
@@ -41,12 +42,13 @@ async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
             ...(cfg.onAttempt
                 ? { onAttempt: (i) => cfg.onAttempt({ attempt: i.attempt, terminal: i.terminal, oracleTier: i.oracle.tier, passed: i.oracle.passed, flaky: i.oracle.flaky }) }
                 : {}),
-            onWarn: (e) => cfg.log?.("repair_loop_warn", { warning: e.message }),
+            onWarn: (e) => cfg.log?.("repair_loop_warn", { warning: redactHead(e.message, 2000) }),
         });
     }
     catch (e) {
-        cfg.log?.("repair_loop_threw", { error: e instanceof Error ? e.message : String(e) });
-        return { report: { ...base, status: "failed", error: e instanceof Error ? e.message : String(e) }, result: undefined };
+        const safe = redactHead(e instanceof Error ? e.message : String(e), 2000);
+        cfg.log?.("repair_loop_threw", { error: safe });
+        return { report: { ...base, status: "failed", error: safe }, result: undefined };
     }
     const terminal = result.terminal;
     const report = {

package/dist/leader/wire.d.ts

@@ -1,4 +1,4 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type RunnerDeps } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -48,6 +48,56 @@ export interface LeaderWireConfig {
      * leader 编排的 planner / worker / repair / conflict 四类任务**静默不生效**(core 内建 deny 表仍在)。
      */
     deploymentPosture?: DeploymentPostureSeats;
+    /**
+     * [ref]([ref])—— **计费/遥测追踪席**,原样递给本车道的每一只 Runner。唯一属主 =
+     * `boot/budget-tracing.ts` 的 `createTracer(...)`(主 runner / subRunner / hook runner 经共享基座吃的
+     * 就是它),`boot/leader.ts` 搬的是**同一只**。
+     *
+     * 🔴 为什么这一席是承重的:`src/budget.ts` 的 `createTracer` 是 `brain.call` **唯一**的记账点 ——
+     * `costQuota.add` / `fleetUsage.record` / `fleetLease.recordSpend` / `model_cost_micro_usd_total` 四个写口
+     * 全在那里(`createBrain` 自己不记账)。而 `POST /v1/leader` 的准入处**读**的正是 costQuota / fleetLease
+     * 这两个桶。缺席 ⇒ 门查的桶与花钱的手不是同一只:`MAX_PRINCIPAL_COST_USD` 与 fleet 租约对这条腿结构性
+     * 失效,而一条 leader run 扇出 ≤6 个带手 worker + planner + repair/conflict 环,全是实钱。
+     * 归因的另一半在 `leader/endpoint.ts` 的 `drive()`(ALS `withPrincipal`)—— 记账臂按 `currentPrincipal()`
+     * 分租户,只补席不包裹 = 归因恒 undefined = 假绿。缺席 ⇒ 展开空对象(与接线前逐字相同)。
+     */
+    tracer?: RunnerDeps["tracer"];
+    /**
+     * [ref]([ref],[ref]-T1)—— **部署级 token 治理窗**两键,**成对**递给本车道的每一只 Runner。
+     * 属主 = `config.usageWindows`(声明)+ `boot/stores.ts` 造的账本店(两者同真同假,与
+     * `boot/runner-deps.ts` 的共享基座同规);leader 不自己读 config。
+     *
+     * 成对的理由是 core 的消费形:`prepare-task.js` 的 `buildUsageGovernance(usageWindows, deps, …)` 要求
+     * 声明与 `deps.usageWindowStore` **同时**在场才铸 `usageGovernance`,缺一即 undefined(既不 check 也不
+     * commit)⇒ 半席只是死键。缺席 ⇒ 展开空对象。
+     * 提交面那一半(`POST /v1/leader` 的 `usageWindowDenied` 门)在 `src/http/routes/leader.ts`。
+     */
+    usageWindows?: RunnerDeps["usageWindows"];
+    usageWindowStore?: RunnerDeps["usageWindowStore"];
+    /**
+     * [ref]([ref])—— **center 发布的 prompt catalog** 席,原样递给本车道的每一只 Runner。唯一属主 =
+     * `boot/config-center.ts` 的 `configCenter.promptSource`(主 runner / subRunner 同一只;run-local 有自己
+     * 的等价腿)。缺席 ⇒ leader 的 planner/worker/repair/conflict 四类**顶层**任务跑引擎内置提示词,而同一
+     * 部署的 `/v1/tasks`、`/v1/runs` 跑运维发布的那一份 —— 且 core 顶层新任务走的是**静默**臂(pinned /
+     * parentCenterArtifactDigest 两支才 `prompt.snapshot_unavailable` fail-loud),运维面零信号。
+     * 缺席 ⇒ 展开空对象(与接线前逐字相同)。
+     */
+    promptSource?: RunnerDeps["promptSource"];
+    /**
+     * [ref] 的**披露半件**([ref],codex 对抗复审 r2-[high],亲读装树 core 后修)—— 部署级错误汇。
+     *
+     * 🔴 为什么它与治理窗席**同生共死**:core 对「治理窗最终扣账失败」的唯一出口就是这一席 ——
+     * `dist/core/runner/runtask.js` 收尾段 `catch (flushErr) { this.deps.onError?.(flushErr, { phase: "config", … }) }`
+     * (以及 10s 慢盘披露的同一只回调),抛错之后任务**按原结果收尾**。挂了窗席却不挂本席 = 一次窗账
+     * 永久丢失时这条腿上零日志零计数,后续提交继续读偏低的窗被放行 —— CLAUDE.md [ref]「治理/门轴禁静默
+     * fail-open」正是说这个。它顺带也把 leader 车道其余 phase(degraded / rewind / memory / mcp / a2a /
+     * prompt-cache …)的既有观测面补齐,与 `onNotice` 席当年([ref]②)同一个理由。
+     *
+     * 属主唯一 = `boot/runner-deps.ts` `createRunnerDeps` 铸的那一只;`boot/leader.ts` 直引
+     * `runnerDeps.onError`(**同一实例**,[ref]§三族A 的最强同源形,与 main.ts subRunner 的先例逐字同姿势),
+     * leader 绝不另写一份臂表(两份必漂)。缺席 ⇒ 展开空对象(与接线前逐字相同)。
+     */
+    onError?: RunnerDeps["onError"];
     /** Worker model brain + catalog (the same the service runs tasks on). */
     brain: Brain;
     models: Record<string, Model>;
@@ -96,6 +146,35 @@ export interface LeaderWireConfig {
 }
 /** The env surface wire needs (both the E2B and k8s adapters implement core's RemoteExecutionEnv). */
 type WireEnv = Pick<RemoteExecutionEnv, "exec" | "writeFile">;
+/**
+ * [ref] —— leader 自铸沙盒的**回收闸**(集成沙盒 / repair-loop grader 各一只)。
+ *
+ * core 契约:`ExecutionEnv` 基面**没有** `destroy`;只有实现了 `RemoteExecutionEnv` 的适配器才有
+ * (`core/remote-env.d.ts:426`),而「这只 env 到底有没有」是**运行期结构事实**,core 自己也只用结构探测
+ * `hasDestroy()`(:487,runtask/prepare-task 全部 destroy 站点都先过它)。修前 leader 三处把它写成编译期
+ * 断言(`as … & { destroy(): Promise<unknown> }`),于是 TS 对「手里其实是个 **Promise**」完全无感——
+ * `env.destroy()` 抛 `env.destroy is not a function`,还把**原始错误盖掉**([ref] 现场)。
+ *
+ * 🔴 缺席臂 = **fail-closed,当场响亮拒**([ref]:执行车道禁静默兜底;codex r2-[medium] 采纳)。理由:
+ *  · core 之所以容忍「工厂产物没有 destroy」,是因为工厂**可以**交回一只**共享静态** env(`withWorktreeIsolation`
+ *    的非隔离臂就是这一形)——那种 env 本来就不该被谁拆掉。但 leader 这两只是**专用、临时、只属于它自己**
+ *    的沙盒:唯一的拆机口就是本闭包(`mergeBranches` / `runRepairLoopForLeader` 在 `finally` 里调它)。
+ *    收不动 = 一只计费中的沙盒必然留到后端自己的 timeout,零上行收益 ⇒ 没有「合法兜底」可言。
+ *  · 静默 no-op 反而比**修前**更松:修前同步工厂路径上,一只没有 destroy 的 env 会当场抛 TypeError。
+ *    本闸只是把那个抛**提前到 provision 时刻**,并换成一句点名沙盒与成因的话——不是新增严格度。
+ *  · 当前三条已接线的 leader 车道交回的 env 都实现了 destroy(e2b `RemoteContainerExecutionEnv`、
+ *    k8s、host `RemoteHostExecutionEnv`——`hostExecutionEnvFactory` 恒 `new RemoteHostExecutionEnv`),
+ *    所以这条臂是**防御性**的:它真响的那天,意思是有人接了一条新工厂车道而 leader 收不动它的沙盒。
+ */
+/** 冲突解决模型的目标文本——纯函数(第十三轮重扫 [medium]:wire 内联时无法钉「补丁先脱」;抽出来直接钉)。
+ *  补丁走补丁头窗(头 256KB 扫再切 6000;解决者仍有工作树里的冲突标记),conflictText 由 merge.ts 先脱后切。 */
+export declare function buildConflictResolverObjective(args: {
+    workerId: string;
+    repoDir: string;
+    patch: string;
+    conflictText: string;
+}): string;
+export declare function createEnvReaper(env: ExecutionEnv, what: string): () => Promise<void>;
 /**
  * Resume-safe worker staging (the [ref] F2(a) factory-env path). Runs adapter-side before the agent's
  * first workspace-touching call: seed the base repo at the worker branch + plant the upload script (so the