@sema-agent/server 7.56.0 → 7.57.0

package/dist/plugins/local-checkpoint-store.js

@@ -231,6 +231,9 @@ export class LocalCheckpointStore {
         }
         return out;
     }
+    async peekScopeByToken(token) {
+        return (await this.inner.get(token))?.scope;
+    }
     async peekPendingScope(sessionId, binding) {
         return this.pickPendingRow(await this.pendings(), sessionId, binding)?.cp.scope;
     }

package/dist/plugins/memory-run-store.d.ts

@@ -1,18 +1,6 @@
-/**
- * In-memory async run registry + replayable event log — the LOCAL (DB-less) twin of {@link TiDBRunStore}/
- * {@link PgRunStore} (clay 2026-06-25: the seamless local↔cloud switch — a locally-run HTTP service must serve the
- * SAME contract a cloud worker does, incl. `/v1/runs` async runs + the trace event log). Behaviourally identical to
- * the SQL twins (the shared `storeBehaviorSuite` keeps them in lock-step), but process-local + ephemeral: a restart
- * loses run history (file-backed durability is the immediate follow-on; the conversation HISTORY + checkpoints DO
- * persist via core's FileStorageBackend). Single-process, so the cross-replica/durable reapers degrade — see below.
- *
- * Mirrors the SQL semantics exactly: the `task_active` single-active-run claim (a Map keyed by sessionId), the
- * NON-terminal suspend/needs_review parks that KEEP the claim, the markResuming CAS that resets cancel/preempt, the
- * owner null-safe guard on the flag/heartbeat paths (`<=>` → JS `(a??null)===(b??null)`), and the keyset list order.
- */
 import { type UsageRow } from "../usage-analytics.js";
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
+import type { TaskStatus } from "@sema-agent/core";
+import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /**
  * [ref] P0 — the local lane's stand-in for the SQL twins' checkpoint-table JOIN. The file/memory run stores
@@ -66,7 +54,7 @@ export declare class MemoryRunStore {
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
-    setTerminal(taskId: string, status: TaskStatus, result: TaskResult | null, error: string | null): Promise<void>;
+    setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
     setSuspended(taskId: string): Promise<void>;
     /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */

package/dist/plugins/memory-run-store.js

@@ -1,4 +1,6 @@
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
+import { notifyRunTerminal } from "../observability/run-terminal-log.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
     runs = new Map();
@@ -78,6 +80,7 @@ export class MemoryRunStore {
             r.updatedAt = new Date();
     }
     async appendEvent(taskId, seq, type, data) {
+        data = redactLedgerEventData(type, data);
         const list = this.events.get(taskId) ?? [];
         if (list.some((e) => e.seq === seq))
             return;
@@ -100,6 +103,8 @@ export class MemoryRunStore {
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
     async setTerminal(taskId, status, result, error) {
+        result = redactTerminalResult(result);
+        error = error === null ? null : (redactErrorMessage(error) ?? null);
         const r = this.runs.get(taskId);
         if (!r) {
             for (const [sessionId, tid] of this.active)
@@ -109,15 +114,29 @@ export class MemoryRunStore {
                 }
             return;
         }
+        let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
             r.error = error;
             r.errorCode = result?.errorCode ?? null;
             r.updatedAt = new Date();
+            pending = {
+                runId: taskId,
+                sessionId: r.sessionId,
+                owner: r.owner,
+                status,
+                resultTaskId: result?.taskId,
+                model: result?.model,
+                errorCode: r.errorCode ?? undefined,
+                errorMessage: result?.errorMessage ?? error ?? undefined,
+                elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
+            };
         }
         if (this.active.get(r.sessionId) === taskId)
             this.active.delete(r.sessionId);
+        if (pending)
+            notifyRunTerminal(pending);
     }
     async setSuspended(taskId) {
         const r = this.runs.get(taskId);

package/dist/plugins/permission-rule-store-file.js

@@ -5,6 +5,7 @@ import { performance } from "node:perf_hooks";
 import { FilePermissionRuleStoreProvider, AppendLog, ensureDir, readJsonlRecords, } from "@sema-agent/core";
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
+import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 const RuleScopeSchema = z.union([
     z.object({ kind: z.literal("global") }).strict(),
     z.object({ kind: z.literal("project"), root: z.string().min(1) }).strict(),
@@ -19,6 +20,7 @@ const RuleOffer2Schema = z.union([
         candidates: z.array(z.number().int().nonnegative().safe()),
         segments: z.array(z.string()).optional(),
         uncoveredSegments: z.number().int().nonnegative().safe().optional(),
+        uncoveredDetail: z.array(z.object({ segment: z.string(), reason: z.enum(UNCOVERED_SEGMENT_REASONS) }).strict()).optional(),
     })
         .strict(),
 ]);
@@ -27,7 +29,7 @@ const ApprovalRecordSchema = z
     id: z.string().min(1),
     principal: z.string().optional(),
     owner: z.union([z.object({ kind: z.literal("principal"), principal: z.string() }).strict(), z.object({ kind: z.literal("local-owner") }).strict()]).optional(),
-    schema: z.literal(2),
+    schema: z.literal(RULE_APPROVAL_RECORD_SCHEMA),
     kind: z.enum(["card", "import", "starter"]),
     state: z.enum(["pending", "approved", "redeemed"]),
     candidates: z.array(RuleCandidateSchema),
@@ -36,7 +38,10 @@ const ApprovalRecordSchema = z
     toolCallId: z.string().optional(),
     boundInputHash: z.string().optional(),
     command: z.string().optional(),
-    edited: z.object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string() }).strict().optional(),
+    edited: z
+        .object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string(), warnings: z.array(z.enum(EDITED_RULE_BREADTH_WARNING_CODES)).optional() })
+        .strict()
+        .optional(),
     rev: z.number().int().nonnegative().safe(),
     selectedOffer: z.number().int().nonnegative().safe().optional(),
     redeemedDots: z.record(z.string(), RuleDotSchema).optional(),
@@ -138,7 +143,7 @@ export class FileRuleApprovalRecordStore {
             const parsed = ApprovalLineSchema.safeParse(raw);
             if (!parsed.success) {
                 const stale = StaleApprovalLineSchema.safeParse(raw);
-                if (stale.success && stale.data.record.schema !== 2) {
+                if (stale.success && stale.data.record.schema !== RULE_APPROVAL_RECORD_SCHEMA) {
                     this.rows.set(stale.data.record.id, toStaleEnvelope(stale.data.record));
                     continue;
                 }

package/dist/plugins/permission-rule-store-sql.js

@@ -4,6 +4,7 @@ import { applyTombstones, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuar
 import { dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 import { canonicalJson } from "../canonical-json.js";
+import { EDITED_RULE_BREADTH_WARNING_CODES, PERSISTED_RULE_MATCHES, PERSISTED_RULE_TOOLS, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 export function writerOfSqlRuleStore(store) {
     const w = Reflect.get(store, PERMISSION_RULE_WRITER);
     if (w === null || typeof w !== "object")
@@ -26,8 +27,8 @@ const RuleAddSchema = z
 const PersistedAllowRuleSchema = z
     .object({
     rule: z.string(),
-    tool: z.literal("Bash"),
-    match: z.enum(["exact", "prefix"]),
+    tool: z.enum(PERSISTED_RULE_TOOLS),
+    match: z.enum(PERSISTED_RULE_MATCHES),
     command: z.string(),
     scope: DurableRuleScopeSchema,
     adds: z.array(RuleAddSchema),
@@ -52,7 +53,9 @@ const QuarantinedRuleAddSchema = z
 const FrontierSchema = z.record(z.string(), z.number().int().nonnegative().safe());
 const RuleCandidateSchema = z.object({ rule: z.string(), scope: DurableRuleScopeSchema }).strict();
 const RedeemedDotsSchema = z.record(z.string(), RuleDotSchema);
-const RuleEditedSchema = z.object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string() }).strict();
+const RuleEditedSchema = z
+    .object({ index: z.number().int().nonnegative().safe(), text: z.string(), at: z.string(), warnings: z.array(z.enum(EDITED_RULE_BREADTH_WARNING_CODES)).optional() })
+    .strict();
 const RuleOffer2Schema = z.union([
     z.object({ kind: z.literal("single"), candidate: z.number().int().nonnegative().safe() }).strict(),
     z
@@ -61,6 +64,7 @@ const RuleOffer2Schema = z.union([
         candidates: z.array(z.number().int().nonnegative().safe()),
         segments: z.array(z.string()).optional(),
         uncoveredSegments: z.number().int().nonnegative().safe().optional(),
+        uncoveredDetail: z.array(z.object({ segment: z.string(), reason: z.enum(UNCOVERED_SEGMENT_REASONS) }).strict()).optional(),
     })
         .strict(),
 ]);
@@ -104,8 +108,9 @@ export const TIDB_PERMISSION_RULE_STATEMENTS = [
     state VARCHAR(32) NOT NULL,
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json LONGTEXT NOT NULL,
-    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 2;OCC 守卫另在 rev,
-    -- 两轴禁混,schema-naming 门③ 白名单登记)。读侧对非 2 的行交还 design/375 §4.5 的
+    -- version:**数据格式版本**(= core \`RuleApprovalRecord.schema\`,本形恒 3 —— design/382 §3.5 由 2 升,
+    -- 代码里的单点是 RULE_APPROVAL_RECORD_SCHEMA;OCC 守卫另在 rev,两轴禁混,schema-naming 门③ 白名单
+    -- 登记)。读侧对非 3 的行(含上一形的 2)交还 design/375 §4.5 的
     -- StaleRuleApprovalRecord 信封(identity 键 only)—— 本仓 SCHEMA POLICY 是删表重建,重建后的表
     -- 不该有这种行,这一臂是「未来再换形」的防御位,绝不静默 widen 成一条本形担保不了的记录。
     version INT NOT NULL,
@@ -258,7 +263,8 @@ export async function ensurePgPermissionRuleSchema(q) {
     rev BIGINT NOT NULL DEFAULT 0,
     candidates_json TEXT COLLATE "C" NOT NULL,
     -- version / offers_json / selected_offer:design/375 换形三列(MySQL 孪生的行内注写了理由:
-    -- version=数据格式版本恒 2,非 2 的行读成 Stale 信封;offers_json=按 index 引用的 OPTION 结构,
+    -- version=数据格式版本恒 3(design/382 §3.5 由 2 升;单点 RULE_APPROVAL_RECORD_SCHEMA),非 3 的行(含 2)
+    -- 读成 Stale 信封;offers_json=按 index 引用的 OPTION 结构,
     -- 禁存文本副本;selected_offer=确认的 OFFER index,与 ticket/redeemed_dots 的 CANDIDATE index
     -- 两空间分离)。
     version INT NOT NULL,
@@ -525,7 +531,7 @@ export class SqlRuleApprovalRecordStore {
         const ownerKind = String(row.owner_kind);
         const principal = row.principal === null || row.principal === undefined ? undefined : String(row.principal);
         const identity = ownerKind === "principal" ? { principal: principal ?? "" } : { owner: { kind: "local-owner" } };
-        if (Number(row.version) !== 2) {
+        if (Number(row.version) !== RULE_APPROVAL_RECORD_SCHEMA) {
             return { staleSchema: true, id: String(row.record_id), ...identity };
         }
         const candidates = parseColumn(z.array(RuleCandidateSchema), row.candidates_json, "candidates_json", id);
@@ -541,7 +547,7 @@ export class SqlRuleApprovalRecordStore {
         return {
             id: String(row.record_id),
             ...identity,
-            schema: 2,
+            schema: RULE_APPROVAL_RECORD_SCHEMA,
             kind: kind.data,
             state: state.data,
             candidates,
@@ -584,14 +590,14 @@ export class SqlRuleApprovalRecordStore {
         ]);
     }
     async discardPendingRecord(recordId) {
-        const { affected } = await this.db.query(this.q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = ? AND state = 'pending' AND version = 2`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = $1 AND state = 'pending' AND version = 2`), [recordId]);
+        const { affected } = await this.db.query(this.q(`DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = ? AND state = 'pending' AND version = ${RULE_APPROVAL_RECORD_SCHEMA}`, `DELETE FROM ${PERMISSION_RULE_APPROVAL_TABLE} WHERE record_id = $1 AND state = 'pending' AND version = ${RULE_APPROVAL_RECORD_SCHEMA}`), [recordId]);
         return affected === 1;
     }
     async cas(id, expectRev, next) {
         if (next.rev !== expectRev + 1) {
             throw new Error(`rule-approval CAS must advance rev by exactly one (expectRev=${expectRev}, next.rev=${next.rev})`);
         }
-        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = ?, rev = ?, candidates_json = ?, offers_json = ?, selected_offer = ?, redeemed_dots_json = ?, edited_json = ?, updated_at_ms = ? WHERE record_id = ? AND rev = ? AND version = 2`, `UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = $1, rev = $2, candidates_json = $3, offers_json = $4, selected_offer = $5, redeemed_dots_json = $6, edited_json = $7, updated_at_ms = $8 WHERE record_id = $9 AND rev = $10 AND version = 2`), [
+        const { affected } = await this.db.query(this.q(`UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = ?, rev = ?, candidates_json = ?, offers_json = ?, selected_offer = ?, redeemed_dots_json = ?, edited_json = ?, updated_at_ms = ? WHERE record_id = ? AND rev = ? AND version = ${RULE_APPROVAL_RECORD_SCHEMA}`, `UPDATE ${PERMISSION_RULE_APPROVAL_TABLE} SET state = $1, rev = $2, candidates_json = $3, offers_json = $4, selected_offer = $5, redeemed_dots_json = $6, edited_json = $7, updated_at_ms = $8 WHERE record_id = $9 AND rev = $10 AND version = ${RULE_APPROVAL_RECORD_SCHEMA}`), [
             next.state,
             next.rev,
             this.enc(next.candidates, "permission_rule_approval.candidates_json"),

package/dist/plugins/remote-scratchpad.js

@@ -1,3 +1,4 @@
+import { redactHead } from "../observability/run-terminal-log.js";
 const REMOTE_SCRATCHPAD_LANES = new Set(["e2b", "k8s", "local-docker", "ssh", "device"]);
 export function isRemoteScratchpadLane(provider) {
     return provider !== undefined && REMOTE_SCRATCHPAD_LANES.has(provider);
@@ -28,12 +29,12 @@ export function withRemoteScratchpad(factory, logger) {
                 if (!r.ok || r.value.exitCode !== 0) {
                     logger?.warn?.("remote_scratchpad_mkdir_failed", {
                         dir,
-                        ...(r.ok ? { exitCode: r.value.exitCode, stderr: r.value.stderr.slice(0, 256) } : { error: r.error.message }),
+                        ...(r.ok ? { exitCode: r.value.exitCode, stderr: redactHead(r.value.stderr, 256) } : { error: redactHead(r.error.message, 512) }),
                     });
                 }
             }
             catch (err) {
-                logger?.warn?.("remote_scratchpad_mkdir_failed", { dir, error: err instanceof Error ? err.message : String(err) });
+                logger?.warn?.("remote_scratchpad_mkdir_failed", { dir, error: redactHead(err instanceof Error ? err.message : String(err), 512) });
             }
         })());
         e.exec = async (command, options) => {

package/dist/plugins/run-store-sql.d.ts

@@ -1,47 +1,8 @@
-/**
- * Async run registry (S1) + replayable event log (S2) — SINGLE-FILE DUAL-DIALECT ([ref] A12 定型半场).
- * ONE implementation, TWO dialects; the historical `TiDBRunStore` / `PgRunStore` class names survive as thin
- * ctor subclasses so every consumer (store-backend.ts, the run/reaper/session/usage suites) is untouched.
- *
- * A run is the background execution of one task. `POST /v1/runs` records it `running` and returns
- * immediately; the background driver (`src/runs.ts`) appends events here as they happen and marks the
- * run terminal when done. Because runs + events are durable and shared, any stateless instance can
- * report status or replay the event stream — a client can reconnect (even to a different instance)
- * with `Last-Event-ID` and resume. The two dialects are kept in lock-step by ONE shared integration suite
- * (test/run-store-reaper-integration.test.ts) that runs the SAME park→resume→claim scenario against BOTH
- * real engines — the anti-drift guard.
- *
- * ── Dialect deltas, kept EXPLICIT (never hidden behind an abstraction) ────────────────────────────────
- *   - `?` placeholders vs `$n` (transaction control itself is normalized by `SqlDriver`/`SqlTxConn` —
- *     mysql2's native begin/commit/rollback vs PG's statement form; see sql-driver.ts)
- *   - dup-key classification (createRun's task_active claim race) — the PREDICATE has a single owner
- *     (`sql-errors.ts`, [ref] P1-①); only the dialect DISPATCH is visible here
- *
- * ⚠️ The run ACTIVE-status word list written out in the `status IN (…)` / `NOT IN (…)` fragments below
- * is the closed set owned by `store-contracts.ts` (`isTerminalRunStatus` / `isParkedRunStatus`). The SQL
- * text stays literal ON PURPOSE (A12: both dialects readable side by side), so the tie is a PARITY GATE:
- * `test/source-hygiene-gate.test.ts` → "[ref] P1-② run 活状态 SQL 字面 ↔ store-contracts 闭集属主 parity".
- * core adding a TaskStatus member turns that gate red on every fragment here — update them in the same batch.
- *   - null-safe owner compare: `<=>` (TiDB) vs `IS NOT DISTINCT FROM` (PG) — a null-owner run still matches
- *     `owner=null` on both, single-DB-fleet defense-in-depth (see {@link requestCancel})
- *   - multi-table DELETE: `DELETE t FROM t JOIN j …` (TiDB) vs `DELETE FROM t USING j …` (PG)
- *   - `UPDATE t AS a SET col=…` — PG's SET columns are NOT alias-qualified (PG rejects `SET a.col`), while
- *     TiDB's SET clause DOES qualify (`SET tr.col = …`) — see reapSuspended / failSuspendedWithExpiredCheckpoint
- *   - JSON binding: TiDB `JSON.stringify` verbatim vs PG `pgSafeJsonStringify` + `$n::jsonb` casts
- *   - PG-only protocol-byte defenses on plain-TEXT columns: `pgSanitizeText` on objective_preview (createRun)
- *     and error/error_code (setTerminal) — a raw NUL would throw 22P05 and roll back the whole terminal write,
- *     stranding the run in a live status forever (codex R12); TiDB stores these verbatim
- *   - dynamic multi-clause builders (listRuns/listSessions): TiDB's `?` is position-agnostic so the WHERE
- *     array is built with plain string pushes; PG's `$n` needs numbered placeholders, so those two methods
- *     keep an EXPLICIT per-dialect branch (a shared positional-counter abstraction would hide the very
- *     placeholder-numbering divergence this file exists to keep visible)
- *   - schema ownership: TiDB DDL in tidb-pool.ts, PG DDL centrally in pg-pool.ts (neither store creates tables).
- */
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
+import type { TaskStatus } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type UsageRow } from "../usage-analytics.js";
-import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
+import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult } from "./store-contracts.js";
 import { type SqlDriver } from "./sql-driver.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 export type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
@@ -119,7 +80,7 @@ export declare class SqlRunStore {
      *  abort text, or vice versa). Positive form ([1.207 codex M1]): the negative NOT IN missed the
      *  blocked/timeout terminals — a first write of those could still be overwritten. The claim DELETE stays
      *  unconditional (idempotent; the first writer already released it). */
-    setTerminal(taskId: string, status: TaskStatus, result: TaskResult | null, error: string | null): Promise<void>;
+    setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
     /**
      * Durable F4 ([ref]): a task suspended on a policy `ask`. Sets the run NON-terminal `suspended` and
      * KEEPS the `task_active` claim — the session stays locked (no new run) until an operator resumes it to a

package/dist/plugins/run-store-sql.js

@@ -1,7 +1,9 @@
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { escapeLike } from "./sql-escape.js";
 import { pgSanitizeText } from "./pg-safe-json.js";
 import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
+import { notifyRunTerminal, runTerminalLogLevel } from "../observability/run-terminal-log.js";
 import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 export class SqlRunStore {
@@ -105,6 +107,7 @@ export class SqlRunStore {
         await this.db.query(this.q("UPDATE task_run SET updated_at = ? WHERE task_id = ? AND owner <=> ? AND status = 'running'", "UPDATE task_run SET updated_at = $1 WHERE task_id = $2 AND owner IS NOT DISTINCT FROM $3 AND status = 'running'"), [new Date(), taskId, owner]);
     }
     async appendEvent(taskId, seq, type, data) {
+        data = redactLedgerEventData(type, data);
         await this.db.query(this.q("INSERT INTO task_event (task_id, seq, type, data, ts) VALUES (?,?,?,?,?)", "INSERT INTO task_event (task_id, seq, type, data, ts) VALUES ($1,$2,$3,$4::jsonb,$5)"), [taskId, seq, type, data == null ? null : this.json(data), new Date()]);
     }
     async maxSeq(taskId) {
@@ -113,9 +116,12 @@ export class SqlRunStore {
         return m == null ? 0 : Number(m);
     }
     async setTerminal(taskId, status, result, error) {
+        result = redactTerminalResult(result);
+        error = error === null ? null : (redactErrorMessage(error) ?? null);
         const errorCode = result?.errorCode ?? null;
+        let observed;
         await this.tx(async (conn) => {
-            await conn.query(this.q("UPDATE task_run SET status = ?, result = ?, error = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended','needs_review')", "UPDATE task_run SET status = $1, result = $2::jsonb, error = $3, error_code = $4, updated_at = $5 WHERE task_id = $6 AND status IN ('running','suspended','needs_review')"), [
+            const w = await conn.query(this.q("UPDATE task_run SET status = ?, result = ?, error = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended','needs_review')", "UPDATE task_run SET status = $1, result = $2::jsonb, error = $3, error_code = $4, updated_at = $5 WHERE task_id = $6 AND status IN ('running','suspended','needs_review')"), [
                 status,
                 result == null ? null : this.json(result),
                 this.db.dialect === "tidb" ? error : error == null ? null : pgSanitizeText(error),
@@ -123,8 +129,31 @@ export class SqlRunStore {
                 new Date(),
                 taskId,
             ]);
+            if (w.affected > 0 && runTerminalLogLevel(status, errorCode ?? undefined) !== undefined) {
+                const { rows } = await conn.query(this.q("SELECT owner, session_id, created_at FROM task_run WHERE task_id = ?", "SELECT owner, session_id, created_at FROM task_run WHERE task_id = $1"), [taskId]);
+                const row = rows[0];
+                const createdAt = row ? Date.parse(iso(row.created_at)) : NaN;
+                observed = {
+                    owner: row?.owner ?? null,
+                    sessionId: String(row?.session_id ?? result?.sessionId ?? ""),
+                    createdAt: Number.isFinite(createdAt) ? createdAt : undefined,
+                };
+            }
             await conn.query(this.q("DELETE FROM task_active WHERE task_id = ?", "DELETE FROM task_active WHERE task_id = $1"), [taskId]);
         });
+        if (observed) {
+            notifyRunTerminal({
+                runId: taskId,
+                sessionId: observed.sessionId,
+                owner: observed.owner,
+                status,
+                resultTaskId: result?.taskId,
+                model: result?.model,
+                errorCode: errorCode ?? undefined,
+                errorMessage: result?.errorMessage ?? error ?? undefined,
+                elapsedMs: observed.createdAt === undefined ? undefined : Math.max(0, Date.now() - observed.createdAt),
+            });
+        }
     }
     async setSuspended(taskId) {
         await this.db.query(this.q("UPDATE task_run SET status = 'suspended', updated_at = ? WHERE task_id = ? AND status IN ('running','suspended')", "UPDATE task_run SET status = 'suspended', updated_at = $1 WHERE task_id = $2 AND status IN ('running','suspended')"), [new Date(), taskId]);

package/dist/plugins/store-backend.d.ts

@@ -95,7 +95,7 @@ export type ImageBake = TiDBImageBake | PgImageBake;
 /** [ref] 车4 件1:durable leader-run 登记表的双方言孪生(union 同族——TS 私有字段让具体类名义上不同)。 */
 export type LeaderRunStore = TiDBLeaderRunStore | PgLeaderRunStore;
 /** The FULL checkpoint store (core CheckpointStore + the service operator-queue/ctx methods listPending/
- *  listByScope/findPendingTokenBySession/peekPendingScope/putCtx/getCtx/reapCtx) — the SQL twins carry them,
+ *  listByScope/findPendingTokenBySession/peekPendingScope/peekScopeByToken/putCtx/getCtx/reapCtx) — the SQL twins carry them,
  *  and the LOCAL lane now does too (core FileCheckpointStore + the service half — TOC plan-mode /
  *  durable HITL work on one box). */
 export type CheckpointStoreFull = TiDBCheckpointStore | PgCheckpointStore | LocalCheckpointStore;

package/dist/plugins/store-contracts.d.ts

@@ -15,12 +15,77 @@
  *    code should import from this file.
  */
 import type { TaskResult, TaskStatus } from "@sema-agent/core";
+/**
+ * 取消便签里的**大脑相位**快照 —— core `BrainStatus` 帧经 `brainStatusEventData` 投影后的五键子集。
+ *
+ * 刻意**不含** `detail`(provider 自由文本,宽面)与 `retryInMs`/`retryInSec`(相对量,过期即失真;
+ * 绝对量 `retryAtMs` 才是可跨进程读的那个,core 顶注已裁)。`phase` 是这只快照的存在理由:没有它
+ * 就没有快照(不铸半只)。
+ */
+export interface RunBrainStatusSnapshot {
+    phase: string;
+    attempt?: number;
+    maxRetries?: number;
+    /** 等待结束的**墙钟**时刻(发端进程钟域,非单调)—— 只当近似,别与本地单调计时器比。 */
+    retryAtMs?: number;
+    errClass?: string;
+}
+/**
+ * [ref] 件3(cli [ref] sema-bug4 (d) / server [ref]):**用户取消时的现场快照**。
+ *
+ * 病(取证 `audits/evidence/2026-09-03-model-failure-visibility/`):模型挂起 7 分 26 秒后用户放弃,
+ * 账本把这条 run 记成 `failed` + `errorCode:"cancelled"` + 「stream client disconnected before
+ * completion」—— 与「用户看了一眼不想跑了,秒按 Esc」**同形**。历史 314 条里 96 条 failed、其中 63 条
+ * 是 `user_disconnect`,「其中有多少条其实是模型挂死」在数据面**不可考**。
+ *
+ * 本结构是那一维判别材料:取消发生时,距离**本 run 上一条引擎事件**过了多久。
+ *
+ * 【语义边界(勿漂)】
+ * - 它**不**描述模型调用相位(首字节/重试在 core 的 stream-engine/with-retry 里,server 结构上看不见
+ *   ——那半场是 [ref] 的 core 钩,别在这里编造)。它只说「server 这一侧多久没收到这条 run 的动静了」。
+ * - `lastEventKind`/`lastEventAgeMs` 的数据源是**同副本进程内**的 turn 活性登记(`turn-activity.ts`)。
+ *   跨副本 / 本副本重启后读不到 ⇒ 两键**诚实缺席**(缺席 = 「证不出」,不是「0ms 前刚活过」)。
+ * - `elapsedMs` 恒在场:run 起跑到取消的墙钟毫秒。
+ * - 分诊材料,不是状态机输入:任何门 / CAS / resume 判定都不许读它。
+ *
+ * 落点 = 终局 `result` blob 里的一个 additive 可缺席键({@link PersistedTaskResult}),**零新列**
+ * ——run 行的 `result` 本来就是整只 JSON 存(SQL 双方言同形),所以两个孪生都不需要 DDL 变更。
+ */
+export interface RunCancelContext {
+    /** 最后一条进本 run durable 账本的事件类型(`text` / `tool_start` / `status` / …)。
+     *  🔴 它比 {@link RunCancelContext.lastEventAgeMs} **更容易缺席**(codex 交叉复审 R1-[medium],验真后
+     *  改的正是这条契约):打点方里有几席拿不到事件类型(core 的 `onActivity` 第五席、resume 腿的手动
+     *  打点),它们只推进「时刻」不带「词」。所以两键**不是**同在同缺 —— 有 age 无 kind 是合法读数,
+     *  意思是「本副本知道那一刻,但说不出那是条什么事件」。 */
+    lastEventKind?: string;
+    /** 距最后一条 durable 事件过了多久(ms,≥0)。同副本有活性登记就在场。 */
+    lastEventAgeMs?: number;
+    /** 本 run 账本尾**最后一条** `status`(BrainStatus)帧的五键快照([ref]/[ref])——「已重试几次 /
+     *  在等什么 / 什么错类」。这条帧 server 早就在透传与落账(`trace/project.ts` 的 `brainStatusEventData`),
+     *  取消时把最后一条摘下来当便签,**不需要 core 新钩**。sticky:后续 text/tool 事件不清它。
+     *  这条 run 从没出过 status 帧(或跨副本读不到)⇒ 缺席,恒不铸 null。 */
+    lastBrainStatus?: RunBrainStatusSnapshot;
+    /** run 起跑到本次取消的墙钟毫秒(≥0)。常态在场;行的 `createdAt` 坏到解析不出时缺席
+     *  ——**绝不折成 0**(0 会被读成「刚起跑就取消」,与本结构要判别的那件事正好相反)。 */
+    elapsedMs?: number;
+}
+/**
+ * 落库/上 wire 的终局结果 = core 的 `TaskResult` **加上** server 自铸的可缺席侧记键。
+ *
+ * 今天只有一个成员({@link RunCancelContext});additive 且可缺席,所以旧行、旧消费端逐字不受影响
+ * (`TaskResult` 仍可原样赋给本型)。⚠️ 这不是给「往 core 结果里塞私货」开的口子:每加一个键都要能
+ * 回答「为什么它属于 run 账本而不属于 core 的任务结果」——`cancelContext` 的答案是它描述的是
+ * **server 侧的取消现场**,core 那一侧根本不知道有人按了取消。
+ */
+export type PersistedTaskResult = TaskResult & {
+    cancelContext?: RunCancelContext;
+};
 export interface RunRecord {
     taskId: string;
     sessionId: string;
     owner: string | null;
     status: "running" | TaskStatus;
-    result: TaskResult | null;
+    result: PersistedTaskResult | null;
     error: string | null;
     /** Structured failure code (1.36/1.37) denormalized from the result for SQL queryability. */
     errorCode: string | null;

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -75,6 +75,11 @@ export type InboxWarn = typeof onWarnType;
  *  with an explicit marker. Returns null only when even the skeleton is oversize (physics — caller keeps the
  *  prior revision, matching the old behavior for that corner). Dialect-neutral (pure JS, no SQL) — shared
  *  verbatim by both twins. */
+/** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`,core 源头不脱)在**两条写腿**(put / update 常态 + oversize 降级)
+ *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。 */
+export declare function withRedactedError<T extends {
+    error?: string | undefined;
+}>(run: T): T;
 export declare function slimOversizeRun(run: WorkflowRun & {
     id: string;
     scope: string;

package/dist/plugins/workflow-run-store-sql.js

@@ -1,16 +1,23 @@
+import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { summarizeWorkflowRun, isTerminalWorkflowStatus, WorkflowRunStoreError } from "@sema-agent/core";
 import { foldKeyFamily, MAX_PENDING_PER_SESSION, PURGE_FENCE_MS, SERVED_FENCE_MS, } from "../orchestration/workflow-completion-inbox.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 export const MAX_RUN_BLOB_BYTES = 4 * 1024 * 1024;
 const onWarnType = (msg, meta) => void [msg, meta];
+export function withRedactedError(run) {
+    if (typeof run.error !== "string")
+        return run;
+    const error = redactErrorMessage(run.error) ?? "";
+    return error === run.error ? run : { ...run, error };
+}
 export function slimOversizeRun(run, maxBytes) {
     const MARK = "…[truncated: run blob exceeded the store cap]";
     const cut = (s) => s.slice(0, 4000) + MARK;
     const step1 = {
         ...run,
         ...(typeof run.result === "string" && run.result.length > 4000 ? { result: cut(run.result) } : {}),
-        ...(typeof run.error === "string" && run.error.length > 4000 ? { error: cut(run.error) } : {}),
+        ...(typeof run.error === "string" && run.error.length > 4000 ? { error: redactHead(run.error, 4000) + MARK } : {}),
     };
     let blob = JSON.stringify(step1);
     if (Buffer.byteLength(blob) <= maxBytes)
@@ -30,7 +37,7 @@ export class SqlWorkflowRunStore {
         return this.db.dialect === "tidb" ? tidb : pg;
     }
     async put(id, run) {
-        const stored = { ...run, id, rev: run.rev ?? 0 };
+        const stored = { ...withRedactedError(run), id, rev: run.rev ?? 0 };
         try {
             await this.db.query(this.q("INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at_ms) VALUES (?,?,?,?,?,?,?)", "INSERT INTO workflow_run (id, scope, status, run, rev, created_at_ms, ended_at_ms) VALUES ($1,$2,$3,$4,$5,$6,$7)"), [id, run.scope, run.status, JSON.stringify(stored), stored.rev, run.createdAt, run.endedAt ?? null]);
         }
@@ -51,6 +58,7 @@ export class SqlWorkflowRunStore {
         return run;
     }
     async update(id, scope, run, expect) {
+        run = withRedactedError(run);
         let blob = JSON.stringify({ ...run, id, scope });
         if (Buffer.byteLength(blob) > MAX_RUN_BLOB_BYTES) {
             this.onWarn?.("workflow_run_blob_oversize_slimmed", { id, scope, fullBytes: Buffer.byteLength(blob), capBytes: MAX_RUN_BLOB_BYTES });

package/dist/rules-consent.js

@@ -80,7 +80,10 @@ function isSupportedRuleMatch(match) {
     switch (match) {
         case "exact":
         case "prefix":
+        case "wildcard":
             return true;
+        case "subpath":
+            return false;
         default: {
             const unknown = match;
             void unknown;
@@ -166,25 +169,28 @@ function screenLocalImportRow(row) {
             detail: "this project root carries control bytes (C0/DEL) — it is not a path, one SQL dialect refuses to store it at all, and it breaks the separator assumption this lane's comparison keys rest on",
         };
     }
+    const consistent = (derived) => {
+        if (derived.tool !== row.tool || derived.match !== row.match || derived.command !== row.command) {
+            return {
+                reason: "row_inconsistent",
+                detail: `this row's tool/match/command are derived facts of its rule text, and they disagree: the rule reads as ` +
+                    `${derived.tool}/${derived.match}/${JSON.stringify(derived.command)} but the row says ${String(row.tool)}/${String(row.match)}/${JSON.stringify(row.command)}`,
+            };
+        }
+        return { rule: derived.rule, scope };
+    };
+    const written = parseAllowRuleText(row.rule);
+    if ("reject" in written)
+        return { reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
+    if (written.rule.tool === "Read")
+        return consistent(written.rule);
     const pre = precheckCardRuleText(row.rule, row.command);
     if (pre === undefined) {
         return { reason: "rule_uncheckable", detail: "the rule text gate could not be asked about this row (its command is absent or not a string) — the row itself is malformed" };
     }
     if (!pre.ok)
         return { reason: "rule_rejected", detail: pre.message };
-    const canonical = parseAllowRuleText(pre.canonicalRule);
-    if ("reject" in canonical) {
-        return { reason: "rule_rejected", detail: `the canonical spelling the engine minted does not re-parse: ${canonical.reject.message}` };
-    }
-    const derived = canonical.rule;
-    if (derived.tool !== row.tool || derived.match !== row.match || derived.command !== row.command) {
-        return {
-            reason: "row_inconsistent",
-            detail: `this row's tool/match/command are derived facts of its rule text, and they disagree: the rule reads as ` +
-                `${derived.tool}/${derived.match}/${JSON.stringify(derived.command)} but the row says ${String(row.tool)}/${String(row.match)}/${JSON.stringify(row.command)}`,
-        };
-    }
-    return { rule: derived.rule, scope };
+    return consistent(written.rule);
 }
 const LOCAL_IMPORT_LAYER_PATH = "local-import:rules";
 const CONTROL_AND_BIDI_DETECT_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
@@ -241,6 +247,7 @@ export function createRuleConsentLane(stores, opts) {
                     ...(input.toolCallId !== undefined ? { toolCallId: input.toolCallId } : {}),
                     ...(input.boundInputHash !== undefined ? { boundInputHash: input.boundInputHash } : {}),
                     ...(input.scope !== undefined ? { scope: input.scope } : {}),
+                    ...(input.scope?.kind === "project" ? { cwd: input.scope.root } : {}),
                     deps,
                 });
             }

package/dist/run-cancel-context.d.ts

@@ -0,0 +1,13 @@
+import type { RunCancelContext } from "./plugins/store-contracts.js";
+/**
+ * @param taskId  这条 run 的账本 id(turn 活性登记的键)。
+ * @param startedAtMs 这条 run 起跑的墙钟时刻(epoch ms):取消腿手上有行就用行的 `createdAt`,
+ *                    只有本腿起点时用本腿起点(两者在同一条 run 上相差 ms 级)。**非有限值**
+ *                    (坏 `createdAt` 解析出的 NaN)⇒ `elapsedMs` 诚实缺席,绝不折成 0
+ *                    ——0 会被读成「刚起跑就取消了」,与「模型挂死 8 分钟后用户放弃」正好相反。
+ * @param nowMs 取样时刻(缺省 `Date.now()`;测试注入用)。
+ * @returns 三键至少有一键可证时的快照;**一键都证不出** ⇒ `undefined`(写一只空对象等于在 wire 上
+ *          断言「我看过现场,什么都没有」,而事实是「我什么都没看见」)。
+ */
+export declare function buildCancelContext(taskId: string, startedAtMs: number, nowMs?: number): RunCancelContext | undefined;
+//# sourceMappingURL=run-cancel-context.d.ts.map

package/dist/run-cancel-context.js

@@ -0,0 +1,15 @@
+import { readTurnActivity } from "./turn-activity.js";
+export function buildCancelContext(taskId, startedAtMs, nowMs = Date.now()) {
+    const activity = readTurnActivity(taskId);
+    const age = activity === undefined ? undefined : Math.max(0, nowMs - activity.at);
+    const elapsedMs = Number.isFinite(startedAtMs) ? Math.max(0, nowMs - startedAtMs) : undefined;
+    if (age === undefined && elapsedMs === undefined)
+        return undefined;
+    return {
+        ...(activity?.kind !== undefined ? { lastEventKind: activity.kind } : {}),
+        ...(age !== undefined ? { lastEventAgeMs: age } : {}),
+        ...(activity?.brainStatus !== undefined ? { lastBrainStatus: activity.brainStatus } : {}),
+        ...(elapsedMs !== undefined ? { elapsedMs } : {}),
+    };
+}
+//# sourceMappingURL=run-cancel-context.js.map