@sema-agent/server 7.56.0 → 7.57.0

package/dist/task-settings.js

@@ -3,12 +3,18 @@ import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNam
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
-    if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
-        return raw;
+    const strict = coercePermissionModeStrict(raw);
+    if (strict !== undefined)
+        return strict;
     if (typeof raw === "string" && raw.length > 0)
         return "default";
     return undefined;
 }
+export function coercePermissionModeStrict(raw) {
+    if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
+        return raw;
+    return undefined;
+}
 export function effectiveThinking(reasoningEffort, ultracode) {
     const explicit = isThinkingLevel(reasoningEffort) ? reasoningEffort : undefined;
     if (!ultracode)
@@ -21,7 +27,11 @@ export function withPermissionMode(settings, mode) {
     return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
 }
 export function effectivePermissionMode(body, settings) {
-    return coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
+    const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
+    const kill = settings?.permissions?.disableAutoMode;
+    if (requested === "auto" && (kill === "disable" || kill === true))
+        return "default";
+    return requested;
 }
 export function shellGateForMode(effMode) {
     switch (effMode) {
@@ -62,6 +72,61 @@ function cleanStringArray(v) {
     const out = v.filter((x) => typeof x === "string" && x.length > 0).slice(0, MAX_SETTINGS_PERMISSION_RULES);
     return out.length > 0 ? out : undefined;
 }
+export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
+export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "sandbox", "statusLine"];
+export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
+export const MAX_SETTINGS_KEY_ECHO = 20;
+const MAX_SETTINGS_KEY_ECHO_CHARS = 64;
+const ACCEPTED_TOP = new Set(TASK_SETTINGS_KEYS);
+const ACCEPTED_PERM = new Set(TASK_SETTINGS_PERMISSION_KEYS);
+const UNSUPPORTED_TOP = new Set(TASK_SETTINGS_UNSUPPORTED_KEYS);
+const UNSUPPORTED_PERM = new Set(TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS);
+function echoSettingsKey(prefix, key) {
+    const clean = key.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return `${prefix}${clean.length > MAX_SETTINGS_KEY_ECHO_CHARS ? `${clean.slice(0, MAX_SETTINGS_KEY_ECHO_CHARS)}…` : clean}`;
+}
+export function taskSettingsKeyIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const unknown = [];
+    const unsupported = [];
+    const scan = (bag, prefix, accepted, tolerated) => {
+        for (const k of Object.keys(bag)) {
+            if (accepted.has(k))
+                continue;
+            (tolerated.has(k) ? unsupported : unknown).push(echoSettingsKey(prefix, k));
+        }
+    };
+    scan(raw, "settings.", ACCEPTED_TOP, UNSUPPORTED_TOP);
+    const perms = raw.permissions;
+    if (perms !== null && typeof perms === "object" && !Array.isArray(perms)) {
+        scan(perms, "settings.permissions.", ACCEPTED_PERM, UNSUPPORTED_PERM);
+    }
+    if (unknown.length === 0 && unsupported.length === 0)
+        return null;
+    unknown.sort();
+    unsupported.sort();
+    const clause = (names, label) => {
+        const shown = names.slice(0, MAX_SETTINGS_KEY_ECHO);
+        const more = names.length - shown.length;
+        return `${label}: ${shown.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
+    };
+    const parts = [
+        ...(unknown.length > 0 ? [clause(unknown, "unknown (not a settings key here — check the spelling)")] : []),
+        ...(unsupported.length > 0 ? [clause(unsupported, "unsupported (a CC settings key this service does not wire)")] : []),
+    ];
+    const dirHint = unsupported.some((n) => n.endsWith(".additionalDirectories"))
+        ? " Extra directories ride the top-level body.additionalDirectories instead."
+        : "";
+    return {
+        message: `settings: unrecognized key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
+            `${parts.join("; ")}.${dirHint} ` +
+            `Accepted: settings.{${[...TASK_SETTINGS_KEYS].join(",")}} and settings.permissions.{${[...TASK_SETTINGS_PERMISSION_KEYS].join(",")}}`,
+        unknownKeys: unknown.slice(0, MAX_SETTINGS_KEY_ECHO),
+        unsupportedKeys: unsupported.slice(0, MAX_SETTINGS_KEY_ECHO),
+    };
+}
 export function parseTaskSettings(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
@@ -90,8 +155,16 @@ export function parseTaskSettings(raw) {
         const ask = cleanStringArray(p.ask);
         const mode = p.defaultMode;
         const defaultMode = mode === "default" || mode === "acceptEdits" || mode === "plan" || mode === "bypassPermissions" || mode === "auto" ? mode : undefined;
-        if (allow || deny || ask || defaultMode) {
-            out.permissions = { ...(allow ? { allow } : {}), ...(deny ? { deny } : {}), ...(ask ? { ask } : {}), ...(defaultMode ? { defaultMode } : {}) };
+        const rawKill = p.disableAutoMode;
+        const disableAutoMode = rawKill === "disable" || rawKill === true || rawKill === false ? rawKill : undefined;
+        if (allow || deny || ask || defaultMode || disableAutoMode !== undefined) {
+            out.permissions = {
+                ...(allow ? { allow } : {}),
+                ...(deny ? { deny } : {}),
+                ...(ask ? { ask } : {}),
+                ...(defaultMode ? { defaultMode } : {}),
+                ...(disableAutoMode !== undefined ? { disableAutoMode } : {}),
+            };
         }
     }
     if (typeof s.model === "string" && s.model.length > 0)

package/dist/task-workflow.d.ts

@@ -15,13 +15,43 @@
  *    source must NOT leak the LLM-authored workflow engine). WITH a resolver, core enforces `allowWorkflows`
  *    per-principal (deny → fail-closed). Single-user (owns its own worker) honors directly. Three-gate: engine-can ∧
  *    center-may(allowWorkflows) ∧ shell-show.
+ *
+ * 🔴 [ref](2026-09-03):fail-closed 的**方向**从来是对的,错的是它**没人说**。多租户 + 无 entitlement 源
+ * 的部署上,这条腿把 `body.selfOrchestration:true`(以及 `settings.ultracode` 展开出来的同一个意图)静默
+ * 折成 `undefined`,而 `/v1/capabilities` 照报 `workflows:true` ⇒ 「壳显示支持、引擎按普通 run 跑」。修法
+ * 是把部署级半场抽成下面的 {@link selfOrchestrationDenial}(能力位与准入**同一只**谓词),提交面在拒因
+ * 在场时**响亮**拒(`routes` 的 501 `capability.self_orchestration_required`),不再静默折。
  */
 export declare function selfOrchestrationFromBody(body: {
     selfOrchestration?: unknown;
-}, config: {
+}, config: SelfOrchestrationGateConfig, hasEntitlementResolver: boolean): true | undefined;
+/** 本模块读的部署面(`selfOrchestrationEnabled` 恒在真 config 上;遗留双重断言 stub 可能真缺,故一律 `!== true` 读)。 */
+export interface SelfOrchestrationGateConfig {
     selfOrchestrationEnabled: boolean;
     requirePrincipal?: boolean;
-}, hasEntitlementResolver: boolean): true | undefined;
+}
+/**
+ * [ref](DEBTS,P1)—— 自编排准入的**部署级拒因**闭集。`null` = 本部署这一层不拒(是否真跑还看 engine-can
+ * 与 core 的 per-principal `allowWorkflows`)。
+ *
+ * 唯一成员 `"entitlement_resolver_absent"`:多租户(`requirePrincipal === true`)+ 运维**显式开了**
+ * `SELF_ORCHESTRATION_ENABLED` + 没有任何 per-principal entitlement 源(`hasEntitlementResolver` —— 判据由
+ * 调用方从 `centerEntitlementSourceWired(config)` / 装配好的 caps 客户端取)。这一形下上面的准入腿对
+ * **每一个** principal 都 fail-closed(理由见函数上方注:core 的 `allowWorkflows` 是 tighten-only,
+ * resolver 缺席 = 无限制,所以本层必须自己关死),于是这台机器上的自编排是**结构性死的**。
+ *
+ * 🔴 为什么这不是布尔而是**闭集拒因**:能力面要能对壳说清「为什么暗」——「这份二进制/这台机器没有工作流
+ * 引擎」与「引擎在、但本部署配不出 per-principal 授权」是两件事,壳对它们要做的事不同(前者别给这一格;
+ * 后者该提示运维接 center)。合成一个布尔就把这两件事打成同一个 false —— 与 `permissionModeAuto` 那一位
+ * 「三项不合成一个布尔」同判据。
+ *
+ * 🔴 为什么 `selfOrchestrationEnabled` 关着时返回 `null` 而不是另一个拒因:那是**运维刻意的姿态**
+ * (多租户缺省就是关),能力面的 engine-can 半场自己就已经诚实为假;而本拒因说的是**半配置**
+ * (阀门开着而配不出来),两者的处置不同——后者才需要点名。这也正是本件的补偿旋钮:把
+ * `SELF_ORCHESTRATION_ENABLED` 关掉(对这台机器而言是唯一诚实的姿态)即刻回到姿态形。
+ */
+export type SelfOrchestrationDenial = "entitlement_resolver_absent";
+export declare function selfOrchestrationDenial(config: SelfOrchestrationGateConfig, hasEntitlementResolver: boolean): SelfOrchestrationDenial | null;
 /**
  * §4 (Fork) — map the per-task `body.enableFork` intent onto `TaskSpec.enableFork`. core 1.257 ([ref] BREAKING)
  * RETIRED the standalone `Fork` tool; a fork is now `Agent(subagent_type:"fork")`, and `enableFork` is one of the two

package/dist/task-workflow.js

@@ -1,9 +1,14 @@
 export function selfOrchestrationFromBody(body, config, hasEntitlementResolver) {
-    if (body.selfOrchestration !== true || !config.selfOrchestrationEnabled)
+    if (body.selfOrchestration !== true || config.selfOrchestrationEnabled !== true)
         return undefined;
+    return selfOrchestrationDenial(config, hasEntitlementResolver) === null ? true : undefined;
+}
+export function selfOrchestrationDenial(config, hasEntitlementResolver) {
+    if (config.selfOrchestrationEnabled !== true)
+        return null;
     if (config.requirePrincipal !== true)
-        return true;
-    return hasEntitlementResolver ? true : undefined;
+        return null;
+    return hasEntitlementResolver ? null : "entitlement_resolver_absent";
 }
 export function enableForkFromBody(body, config, hasEntitlementResolver) {
     if (!config.forkEnabled)

package/dist/tool-approval.d.ts

@@ -541,6 +541,10 @@ export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput
  * `prepare-task.js` 的 durableMandate/contentMandate(:1415/:1417)与 durableQuestionFace(:2136)等),
  * 故不在本函数内。
  *
+ * 🔴 **[ref](半接线旋钮族)**:`windowZero` 的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在
+ * `streamApprovalOn` 后面** —— 那是部署级旋钮,它的语义不该因为这台机器有没有 durable ask 账而改变
+ * (`ApprovalLegAssembly.windowZero` 顶注写了那条病)。第三源(贴 deadline)照旧只在协议上场时参与。
+ *
  * **`windowZero` 的两件事必须同时做**(调用方契约):不包 ALS **且**注入 immediate-unavailable 闭包。
  * 只做一件另一条路仍会呈卡。⚠️ [ref] 起**三腿都有** per-task `spec.onAsk` 装配点(sync=routes/tasks.ts,
  * bg=runs.ts,resume=server.ts driveResumeLeg),windowZero 的第二件在三腿都是显式闭包 —— 旧文「bg/
@@ -554,7 +558,14 @@ export interface ApprovalLegAssembly {
      *  同 (owner, session) 活流呈活卡(sync 腿 [ref] 起本就如此;bg/resume 的这条行为差 = [ref] CHANGELOG
      *  披露的行为面变更)。旧文「本腿逐字保持协议之前的行为」只对协议件成立,别再把它读成「协议关 = 零呈卡」。 */
     active: boolean;
-    /** §8.3 窗=0 恒 park。`active` 为假时恒 false(协议都没上场,谈不上关窗)。 */
+    /** §8.3 窗=0 恒 park。
+     *  🔴 **[ref] 起它与 `active` 解耦**(旧文「`active` 为假时恒 false —— 协议都没上场,谈不上关窗」已
+     *  作废):`STREAM_ASK_WINDOW_MS` 是**部署级**旋钮,`0` 的语义(运维显式关窗 ⇒ 恒走
+     *  {@link ToolApprovalCoordinator.unattendedAskOutcome},连卡都不发)在两条车道上必须是同一个意思。
+     *  旧形下 local 车道(`volatile_ask_ledger`)/ 无 park 设施 / 显式关协议的部署配了 `0`,拿到的是一张
+     *  等满 5min 的活卡 —— 与它自己的域注正好相反,且没有任何一行说出来。
+     *  ⚠️ 「窗**缺席**」(`windowMs: undefined` = 这份装配根本没有 streamApproval 段,只出现在 stub-harness)
+     *  **不是**关窗:那时逐字保持活卡腿。 */
     windowZero: boolean;
     /** §7.3 本 leg 的 walltime deadline(`performance.now()` 单调基)。只在 `active ∧ ¬windowZero ∧
      *  有 walltime 墙` 时在场 —— 关着时供值会把既有 5min 活卡窗按三元公式缩短(§7.2 真行为变更)。 */
@@ -583,8 +594,13 @@ export declare function createApprovalCardEmitter(sinks: {
 export declare function resolveApprovalLeg(input: {
     /** = `resolveStreamApprovalGate(...).active`(协议在本 worker 上场没有)。 */
     streamApprovalOn: boolean;
-    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。 */
-    windowMs: number;
+    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。
+     *  🔴 [ref]:`undefined` = **这份装配没有 `streamApproval` 段**(只出现在只填被测键的 stub-harness ——
+     *  真实 boot 无条件铸该段,见 `config.ts`)。此前三个调用点各写 `?? 0` 把这一形折成「0」,在旧语义下
+     *  是死代码(`windowZero` 那时挂在 `streamApprovalOn` 后面,协议关就恒 false);[ref] 让 `0` 在协议关的
+     *  腿上也真生效之后,那个折算会把一台**什么都没配**的 harness 判成「运维显式关窗」。故本字段收成
+     *  `number | undefined`,由每个调用点如实交出「有没有这个值」,不许再就地编一个。 */
+    windowMs: number | undefined;
     /** `config.streamAskWindowMarginMs`(`STREAM_ASK_WINDOW_MARGIN_MS`)。 */
     windowMarginMs: number;
     /** `spec.limits.maxWalltimeMs`。缺席 = 没有 walltime 墙 ⇒ 第三源不参与(**缺席 ≠ 0**)。 */
@@ -802,6 +818,8 @@ export declare class ToolApprovalCoordinator {
     /** 两份候选是否**逐条逐键**相等(顺序即展示序 ⇒ 顺序敏感)。两侧都缺席 = 相等;一侧缺席 = 不等。
      *  用在幂等重入的「行 = 真源」对账上(见 `ensureAsk` 那段撤回臂)。 */
     private static ruleOffersEqual;
+    private static batchMemberEqual;
+    private static uncoveredDetailEqual;
     /**
      * [ref] / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
      *
@@ -824,6 +842,11 @@ export declare class ToolApprovalCoordinator {
      * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
      * 已截素材,而不是两处各截一遍。
      */
+    /** 兑付侧座(single 的 rule/command、command 成员的 rule/command、directoryRead 成员的 rule/directory)任一超尺?
+     *  `segment` 与 `uncoveredDetail[].segment` 是纯渲染座,不在此列(截长是诚实省略)。 */
+    private static ruleOfferTextsOverSize;
+    /** codex r1 [high]([ref]):offer 的自称座与 `parseAllowRuleText(rule)` 派生的三元组逐字一致?(理由见调用点) */
+    private static ruleOfferDerivedFactsAgree;
     private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;
     /** [ref]([ref]/[ref] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -195,7 +195,7 @@ export function createApprovalCardEmitter(sinks) {
 }
 export function resolveApprovalLeg(input) {
     if (!input.streamApprovalOn)
-        return { active: false, windowZero: false };
+        return { active: false, windowZero: input.windowMs === 0 };
     const tightDeadline = input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
     if (input.windowMs === 0 || tightDeadline)
         return { active: true, windowZero: true };
@@ -344,32 +344,115 @@ export class ToolApprovalCoordinator {
             if (x.kind === "batch" && y.kind === "batch") {
                 return (x.uncoveredSegments === y.uncoveredSegments &&
                     x.rules.length === y.rules.length &&
-                    x.rules.every((r, j) => r.rule === y.rules[j].rule && r.match === y.rules[j].match && r.command === y.rules[j].command && r.segment === y.rules[j].segment));
+                    x.rules.every((r, j) => ToolApprovalCoordinator.batchMemberEqual(r, y.rules[j])) &&
+                    ToolApprovalCoordinator.uncoveredDetailEqual(x.uncoveredDetail, y.uncoveredDetail));
             }
             return false;
         });
     }
+    static batchMemberEqual(r, s) {
+        if (r.kind !== s.kind)
+            return false;
+        if (r.kind === "command" && s.kind === "command")
+            return r.rule === s.rule && r.match === s.match && r.command === s.command && r.segment === s.segment;
+        if (r.kind === "directoryRead" && s.kind === "directoryRead")
+            return r.rule === s.rule && r.directory === s.directory && r.segment === s.segment;
+        return false;
+    }
+    static uncoveredDetailEqual(a, b) {
+        if (a === undefined || b === undefined)
+            return a === b;
+        return a.length === b.length && a.every((d, i) => d.segment === b[i].segment && d.reason === b[i].reason);
+    }
+    static ruleOfferTextsOverSize(offer) {
+        const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        if (offer.kind === "single")
+            return over(offer.rule) || over(offer.command);
+        return offer.rules.some((r) => {
+            switch (r.kind) {
+                case "command":
+                    return over(r.rule) || over(r.command);
+                case "directoryRead":
+                    return over(r.rule) || over(r.directory);
+                default:
+                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+            }
+        });
+    }
+    static ruleOfferDerivedFactsAgree(offer) {
+        const derive = (rule) => {
+            const p = parseAllowRuleText(rule);
+            return "rule" in p ? p.rule : undefined;
+        };
+        if (offer.kind === "single") {
+            const d = derive(offer.rule);
+            return d !== undefined && d.rule === offer.rule && d.tool === "Bash" && d.match === offer.match && d.command === offer.command;
+        }
+        return offer.rules.every((m) => {
+            const d = derive(m.rule);
+            if (d === undefined || d.rule !== m.rule)
+                return false;
+            switch (m.kind) {
+                case "command":
+                    return d.tool === "Bash" && d.match === m.match && d.command === m.command;
+                case "directoryRead":
+                    return d.tool === "Read" && d.match === "subpath" && d.command === m.directory;
+                default:
+                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(m)}`);
+            }
+        });
+    }
     static boundRuleOfferTexts(offers) {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
         const out = [];
-        for (const offer of offers) {
+        for (const raw of offers) {
+            const parsed = RuleOfferRawSchema.safeParse(screenUncoveredDetailSeat(backfillLegacyBatchMemberKind(raw)));
+            if (!parsed.success) {
+                defaultLogger.warn("rule_offer_dropped_unreadable_shape", {
+                    kind: typeof raw === "object" && raw !== null ? String(raw.kind) : typeof raw,
+                    note: "this offer's shape is outside the closed vocabulary this build reads (member kind / match / reason) — dropped whole; sibling offers still render (core/dist skew?)",
+                });
+                continue;
+            }
+            const offer = parsed.data;
+            if (ToolApprovalCoordinator.ruleOfferTextsOverSize(offer))
+                return undefined;
+            if (!ToolApprovalCoordinator.ruleOfferDerivedFactsAgree(offer)) {
+                defaultLogger.warn("rule_offer_dropped_derived_facts_disagree", {
+                    kind: offer.kind,
+                    note: "an offer's kind/match/command/directory seats do not agree with what the shared validator derives from its rule text — dropped whole so the card never shows one grant while redeeming another (core/dist skew or forged material?)",
+                });
+                continue;
+            }
             switch (offer.kind) {
                 case "single":
-                    if (over(offer.rule) || over(offer.command))
-                        return undefined;
-                    out.push(offer);
+                    out.push({ kind: "single", rule: offer.rule, match: offer.match, command: offer.command });
                     break;
-                case "batch":
-                    if (offer.rules.some((r) => over(r.rule) || over(r.command)))
-                        return undefined;
+                case "batch": {
+                    const rules = [];
+                    for (const r of offer.rules) {
+                        switch (r.kind) {
+                            case "command":
+                                rules.push({ kind: "command", rule: r.rule, match: r.match, command: r.command, segment: clipSegment(r.segment) });
+                                break;
+                            case "directoryRead":
+                                rules.push({ kind: "directoryRead", rule: r.rule, directory: r.directory, segment: clipSegment(r.segment) });
+                                break;
+                            default:
+                                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                        }
+                    }
                     out.push({
                         kind: "batch",
-                        rules: offer.rules.map((r) => (over(r.segment) ? { ...r, segment: r.segment.slice(0, MAX_RULE_TEXT_CHARS) } : r)),
+                        rules,
                         uncoveredSegments: offer.uncoveredSegments,
+                        ...(offer.uncoveredDetail !== undefined ? { uncoveredDetail: offer.uncoveredDetail.map((d) => ({ segment: clipSegment(d.segment), reason: d.reason })) } : {}),
                     });
                     break;
+                }
                 default:
-                    return undefined;
+                    throw new Error(`unknown rule-offer kind: ${JSON.stringify(offer)}`);
             }
         }
         return out;

package/dist/trace/core-keyset-guard.d.ts

@@ -20,7 +20,7 @@
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxStore, TaskSpec, TaskResult } from "@sema-agent/core";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
 type NotificationExcluded = "peer";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
@@ -29,7 +29,7 @@ type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, Bg
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;

package/dist/trace/ledger-sink.d.ts

@@ -58,8 +58,14 @@ export interface LedgerSink {
     onForwardEvent(e: {
         type?: string;
     }): void;
-    /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the non-secret `checkpointGate` is
-     *  persisted — never the capability `checkpointToken` (search [18] Q1b). */
+    /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the `checkpointGate` is persisted —
+     *  never the capability `checkpointToken` (search [18] Q1b).
+     *  ⚠️ **"non-secret" was the old wording and it is not true** ([ref] R3, 2026-09-03 — wording only, behaviour
+     *  unchanged; [ref] decides the arm): the gate carries NO capability token, but its `riskDescriptor.summary` /
+     *  `shadowedRule` are model-/human-controlled display text that [ref] measured carrying a PEM private-key
+     *  body verbatim. This durable row replays on every `GET /v1/runs/:id/events` reconnect and is NOT backfilled
+     *  by core [ref]'s mint-point fix — it is the third face of the `checkpointGate` sister item recorded in
+     *  `http/routes/approvals-assistant.ts` (`redactPendingDisclosures` header). */
     appendParked(kind: "suspended" | "needs_review", result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */
@@ -101,7 +107,10 @@ export declare function createLedgerSink(opts: {
      *  ——**text_delta/reasoning_delta 只进内存缓冲、到 flush 边界才 append**(codex S1-F1,2026-08-13:
      *  只打 append 会让长时间流式输出被误读成「无进展」,方向与本键的设计目的正好相反);②`append`
      *  入口——兜住不经 onEvent 的直写路径(appendParked/appendDone/onForwardEvent)。分诊提示性回调:
-     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。 */
-    onActivity?: () => void;
+     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。
+     *  🔴 [ref] 件3:回调带**事件类型**(`kind`)——`cancelContext.lastEventKind` 的数据源。两个打点位
+     *  各传自己看得见的那个词(位①=流事件 `ev.type`,位②=账本行 `type`);拿不到类型的打点方
+     *  (core 的 onActivity 第五席、resume 腿手动打点)省参,`kind` 诚实缺席(见 turn-activity.ts)。 */
+    onActivity?: (kind?: string, statusData?: Record<string, unknown>) => void;
 }): LedgerSink;
 //# sourceMappingURL=ledger-sink.d.ts.map

package/dist/trace/ledger-sink.js

@@ -17,15 +17,15 @@ export function createLedgerSink(opts) {
     let text = "";
     let reasoning = "";
     let textEventId;
-    const beat = () => {
+    const beat = (kind, statusData) => {
         try {
-            opts.onActivity?.();
+            opts.onActivity?.(kind, statusData);
         }
         catch {
         }
     };
     const append = (type, data) => {
-        beat();
+        beat(type);
         const step = chain.then(() => opts.appendEvent(++seq, type, data));
         chain = step.then(() => undefined, () => undefined);
         return step;
@@ -41,7 +41,7 @@ export function createLedgerSink(opts) {
         }
     };
     const onEvent = async (ev) => {
-        beat();
+        beat(ev.type);
         switch (ev.type) {
             case "text_delta": {
                 const td = ev;
@@ -63,7 +63,11 @@ export function createLedgerSink(opts) {
                 break;
             case "status":
                 await flush();
-                await append("status", brainStatusEventData(ev));
+                {
+                    const statusData = brainStatusEventData(ev);
+                    beat("status", statusData);
+                    await append("status", statusData);
+                }
                 break;
             case "context_usage":
                 await flush();
@@ -134,7 +138,11 @@ export function createLedgerSink(opts) {
             void append("tool_end", toolEndEventData(e)).catch(() => undefined);
         }
     };
-    const appendStatus = (ev) => append("status", brainStatusEventData(ev));
+    const appendStatus = (ev) => {
+        const statusData = brainStatusEventData(ev);
+        beat("status", statusData);
+        return append("status", statusData);
+    };
     const appendParked = (kind, result) => append(kind, {
         gate: result?.checkpointGate ?? null,
         ...(typeof result?.toolCallId === "string" ? { toolCallId: result.toolCallId } : {}),

package/dist/trace/project.d.ts

@@ -16,6 +16,7 @@ import type { ApprovalSettledBy, TaskResult, SystemInjectionPriority } from "@se
 import { type AskDenyResolution } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
+import { type SemaProvenanceInput } from "./sema-provenance.js";
 import type { LedgerEventType } from "./ledger-events.js";
 /** 账本写口的统一签名 —— `type` 是**闭集**(`ledger-events.ts`):新型必须先登记,否则调用点编译红
  *  (codex 交叉复审 F2:别名门 `ap("x")` 与动态首参让纯词法门结构性抓不全)。 */
@@ -214,6 +215,18 @@ export declare function taskNotificationEventData(ev: {
             status?: number;
             requestId?: string;
         };
+        /** [ref](a) [ref] 片6 d1(core 7.2.0):子代→主代 uplink 帧的**渲染判别**成员。在场 = 这一帧是
+         *  `SendMessage("main")` 的 agent-message(cli 渲 agent-message 卡;父模型面读的是顶层 `<agent-message from=…>`
+         *  帧而非 task-notification 外壳);缺席 = 老形卡。`body` 是子代文本 = UNTRUSTED(与 `result` 同姿势 redact);
+         *  `from` 是 core 铸的发送方标签(引擎值,verbatim)。铸造点唯一:core `agents/send-message-tool.ts` uplink 腿。 */
+        agentMessage?: {
+            from: string;
+            body: string;
+        };
+        /** 同批:typed 归因侧记(wire 键;core 契约「a host projects it, the model never sees it」)。成员逐个挑取,
+         *  `kind` 过闭集(`trace/sema-provenance.ts` 单点,park 半场同一判据);`agentType` 本 mount 恒缺席(工具无
+         *  agent-type 席),在场即透传(fleet spawn 帧按 taskId 可 join 时上游给)。 */
+        _sema_provenance?: SemaProvenanceInput;
     };
     eventId?: string;
     parentToolCallId?: string;

package/dist/trace/project.js

@@ -1,6 +1,8 @@
+import { redactErrorMessage } from "../observability/run-terminal-log.js";
 import { isApprovalSettledBy, isAskDenyResolution } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
+import { semaProvenanceOrAbsent } from "./sema-provenance.js";
 export async function appendModelUsageDelta(append, modelUsage, taskId) {
     const delta = modelUsage?.drain(taskId);
     if (delta) {
@@ -151,6 +153,13 @@ export function taskNotificationEventData(ev) {
         ...(n.result !== undefined ? { result: redactSecrets(n.result) } : {}),
         ...(n.output_file !== undefined ? { output_file: redactSecrets(n.output_file) } : {}),
         ...(n.usage !== undefined ? { usage: n.usage } : {}),
+        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: redactSecrets(n.agentMessage.body) } } : {}),
+        ...(() => {
+            if (n._sema_provenance === undefined)
+                return {};
+            const p = semaProvenanceOrAbsent(n._sema_provenance);
+            return p !== undefined ? { _sema_provenance: p } : {};
+        })(),
         ...(() => {
             const tier = injectionTierOrAbsent(ev.priority);
             return tier !== undefined ? { priority: tier } : {};
@@ -522,7 +531,7 @@ function mapTraceEventInner(type, seq, data) {
         case "needs_review":
             return { event: "done", data: { seq, suspended: true } };
         case "failed":
-            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactSecrets(String(data.errorMessage ?? "run failed")) } };
+            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactErrorMessage(String(data.errorMessage ?? "run failed")) ?? "run failed" } };
         case "context_usage":
         case "compaction_outcome":
         case "wiring_manifest":

package/dist/trace/redact.d.ts

@@ -1,17 +1,28 @@
-export declare function setRedactionObserver(fn: ((patternLabel: string, count: number) => void) | undefined): void;
-/**
- * `opts.observe: false` = **照常脱敏,但这一遍不计数**(合并码重扫)。
- *
- * 为什么需要它:本函数对自己的输出**值幂等、计数不幂等** —— URL-userinfo 与 JSON 秘密字段两条 pattern
- * 会命中自己已经替换过的输出并再计一次。于是任何**重扫已脱敏文本**的读路径(耐久待批队列的回读腿,
- * `/v1/approvals/stream` 每 3s 一拍)都会持续给 `redactions_applied_total` 加数,把那个用来识别
- * 「过度脱敏 / pattern 从不触发」的指标灌成不可读。
+/** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
+export declare function ppkScanBytesForTest(): number;
+export declare function resetPpkScanBytesForTest(): void;
+/** Redact unambiguous secret formats from reasoning/CoT before it is persisted to the durable trace log. */
+/** S24 (SILENT-FALLBACK P1): optional redaction observer — rewrites previously had zero fingerprint, so
+ *  over-redaction (mangling legit content) and under-redaction (a pattern that never fires) were both
+ *  invisible. main.ts wires this to `redactions_applied_total{pattern}`. Hot path: the observer only runs
+ *  when a pattern actually matched; the label is derived once per pattern at module load. */
+/** [ref]:第三参 `meta.arm` = 命中的是哪一组臂。加参而不是改参 —— 只读两参的既有观察者原样可用
+ *  (TS 允许少形参),main.ts 把它铺成 `redactions_applied_total{pattern,arm}` 的第二个维度。
  *
- * 🔴 关的是**计数**,不是脱敏:重扫这一遍仍是纵深防御(手改过的行、未来某条写路径漏了脱敏,读面照样
- * 兜住)—— 少脱一次的代价是把凭证投上跨租户可见的运维队列,那条永远不能省。
- */
+ *  🔴 **词义如实**(codex r1 [medium] 三,采纳):这一维说的是「命中的是**哪一条臂**」,**不是**
+ *  「这段文本真的被上游截过」—— server 收到的是纯字节,core 的 `clip()` 是 `slice(0, 80)` **不留标记**
+ *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js:9-11`),截过与天生就短在 wire 上不可区分。
+ *  所以一个 `arm="fragment"` 计数可能来自残片,也可能来自一个恰好落在阈值之上的 look-alike;
+ *  core [ref] 落地后这一支**趋零是证据、不归零不是证明**。别把它当截断事实的度量用。 */
+export type RedactionArm = "full" | "fragment";
+export interface RedactionHitMeta {
+    /** `"fragment"` = {@link FRAGMENT_SECRET_PATTERNS} 里的前缀残片臂;`"full"` = 完整臂。闭集两词。 */
+    arm: RedactionArm;
+}
+export declare function setRedactionObserver(fn: ((patternLabel: string, count: number, meta: RedactionHitMeta) => void) | undefined): void;
 export declare function redactSecrets(text: string, opts?: {
     observe?: boolean;
+    json?: boolean;
 }): string;
 /**
  * 🔴 环 + 深度预算(2026-07-25 补)。原实现是纯递归、**既不记已访问节点也不限深度**,而它的调用位置是