@sema-agent/server 7.56.0 → 7.57.0

package/dist/observability/run-terminal-log.js

@@ -0,0 +1,360 @@
+import { createHash } from "node:crypto";
+import { redactSecrets } from "../trace/redact.js";
+import { errorText } from "./err-text.js";
+import { recordFailOpen } from "./fail-open.js";
+const MESSAGE_CAP = 1024;
+export function runTerminalLogLevel(status, errorCode) {
+    switch (status) {
+        case "failed":
+            return errorCode === "cancelled" ? "info" : "error";
+        case "blocked":
+        case "completed":
+        case "running":
+        case "suspended":
+        case "needs_review":
+            return undefined;
+        default: {
+            const unhandled = status;
+            void unhandled;
+            return undefined;
+        }
+    }
+}
+let observer;
+export function setRunTerminalObserver(fn) {
+    observer = fn;
+}
+export function notifyRunTerminal(rec) {
+    const level = runTerminalLogLevel(rec.status, rec.errorCode);
+    if (level === undefined || !observer)
+        return;
+    const raw = rec.errorMessage;
+    const message = raw === undefined ? undefined : (redactErrorMessage(raw) ?? "").slice(0, MESSAGE_CAP);
+    observer(level, {
+        runId: rec.runId,
+        sessionId: rec.sessionId,
+        ...(rec.owner !== null ? { owner: rec.owner } : {}),
+        status: rec.status,
+        ...(rec.resultTaskId !== undefined && rec.resultTaskId !== rec.runId ? { taskId: rec.resultTaskId } : {}),
+        ...(rec.model !== undefined ? { model: rec.model } : {}),
+        ...(rec.errorCode !== undefined ? { errorCode: rec.errorCode } : {}),
+        ...(message !== undefined ? { errorMessage: message } : {}),
+        ...(rec.elapsedMs !== undefined ? { elapsedMs: rec.elapsedMs } : {}),
+    });
+}
+export const OVERSIZED_REDACTION_PLACEHOLDER = "«redacted:oversized»";
+export const REDACT_INPUT_CAP = 65_536;
+export const REDACT_OUTPUT_MAX_BYTES = 65_000;
+const OUTPUT_TRUNCATED_MARK = "…[truncated: exceeds store column]";
+function fitOutputBytes(s) {
+    if (Buffer.byteLength(s) <= REDACT_OUTPUT_MAX_BYTES)
+        return s;
+    recordFailOpen("server.run-terminal.output-truncated", `bytes=${Buffer.byteLength(s)} cap=${REDACT_OUTPUT_MAX_BYTES}`);
+    const budget = REDACT_OUTPUT_MAX_BYTES - Buffer.byteLength(OUTPUT_TRUNCATED_MARK);
+    let cut = Buffer.from(s).subarray(0, budget).toString();
+    if (cut.endsWith("\uFFFD"))
+        cut = cut.slice(0, -1);
+    return cut + OUTPUT_TRUNCATED_MARK;
+}
+export function redactErrorMessage(raw) {
+    if (raw === undefined)
+        return undefined;
+    let len = -1;
+    try {
+        const text = typeof raw === "string" ? raw : String(raw);
+        len = text.length;
+        if (len > REDACT_INPUT_CAP) {
+            recordFailOpen("server.run-terminal.redact-capped", `len=${len} cap=${REDACT_INPUT_CAP}`);
+            return OVERSIZED_REDACTION_PLACEHOLDER;
+        }
+        return fitOutputBytes(redactSecrets(text));
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `len=${len} err=${errorText(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactTerminalResult(result) {
+    if (result === undefined || result === null)
+        return result;
+    const r = result;
+    let changed = false;
+    const out = { ...r };
+    if (r.errorMessage !== undefined) {
+        out.errorMessage = redactErrorMessage(r.errorMessage);
+        changed = true;
+    }
+    if (r.blockedReason !== undefined) {
+        out.blockedReason = redactErrorMessage(r.blockedReason);
+        changed = true;
+    }
+    if (r.remoteEnvFailures !== undefined) {
+        out.remoteEnvFailures = Array.isArray(r.remoteEnvFailures)
+            ? r.remoteEnvFailures.map((f) => (f && typeof f === "object" && typeof f.message === "string" ? { ...f, message: redactErrorMessage(f.message) } : f))
+            : r.remoteEnvFailures;
+        changed = true;
+    }
+    return changed ? out : result;
+}
+export function redactLedgerEventData(type, data) {
+    if (data === null || typeof data !== "object" || Array.isArray(data))
+        return data;
+    if (type === "done") {
+        const result = data.result;
+        if (result === null || typeof result !== "object")
+            return data;
+        return { ...data, result: redactTerminalResult(result) };
+    }
+    if (type === "failed") {
+        const msg = data.errorMessage;
+        if (typeof msg !== "string")
+            return data;
+        return { ...data, errorMessage: redactErrorMessage(msg) };
+    }
+    return data;
+}
+export function redactWorkerReportError(report) {
+    const gate = redactCheckpointGate(report.checkpointGate);
+    const error = report.error === undefined ? undefined : (redactErrorMessage(report.error) ?? "");
+    if (error === report.error && gate === report.checkpointGate)
+        return report;
+    return { ...report, ...(error !== report.error ? { error } : {}), ...(gate !== report.checkpointGate ? { checkpointGate: gate } : {}) };
+}
+export function redactCheckpointGate(gate) {
+    if (gate === null || typeof gate !== "object" || Array.isArray(gate))
+        return gate;
+    const g = gate;
+    let changed = false;
+    const out = { ...g };
+    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
+    if (typeof g.reason === "string")
+        out.reason = str(g.reason);
+    const rd = g.riskDescriptor;
+    if (rd && typeof rd === "object" && !Array.isArray(rd)) {
+        const r = rd;
+        const nr = { ...r };
+        for (const k of ["summary", "shadowedRule", "probeReason"])
+            if (typeof r[k] === "string")
+                nr[k] = str(r[k]);
+        if (Array.isArray(r.touchedPaths))
+            nr.touchedPaths = strs(r.touchedPaths);
+        const pc = r.probeCause;
+        if (pc && typeof pc === "object" && !Array.isArray(pc)) {
+            const p = pc;
+            const np = { ...p };
+            for (const k of ["roots", "further"]) {
+                const ops = p[k];
+                if (ops && typeof ops === "object" && !Array.isArray(ops) && Array.isArray(ops.shown))
+                    np[k] = { ...ops, shown: strs(ops.shown) };
+            }
+            nr.probeCause = np;
+        }
+        out.riskDescriptor = nr;
+    }
+    return changed ? out : gate;
+}
+export const DIAG_INPUT_CAP = 262_144;
+export const OVERSIZED_DIAG_PLACEHOLDER = "«redacted:oversized-diagnostic»";
+export function redactDiagnosticText(text) {
+    if (text.length > DIAG_INPUT_CAP) {
+        recordFailOpen("server.run-terminal.diag-capped", `len=${text.length} cap=${DIAG_INPUT_CAP}`);
+        return `${OVERSIZED_DIAG_PLACEHOLDER} [len=${text.length}]`;
+    }
+    try {
+        return redactSecrets(text);
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `diag len=${text.length} err=${err instanceof Error ? err.name : String(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactHead(text, keep) {
+    return redactDiagnosticText(text).slice(0, keep);
+}
+export const OVERSIZED_PATCH_PLACEHOLDER = "«redacted:oversized-patch-not-inlined»";
+function diffScanRefusal(patch, direct) {
+    if (/^diff --(?:cc|combined) |^@{3,} /m.test(patch))
+        return "combined-diff";
+    const fence = /-{4,5} ?BEGIN[^\n-]*PRIVATE KEY(?: BLOCK)?[^\n-]*-{4,5}/;
+    if (fence.test(direct))
+        return "pem-fence-survived";
+    const ppkField = /Private-(?:MAC|Hash): [0-9a-fA-F]{32}/;
+    const ppkLinesField = /Private-Lines: \d+/;
+    const b64Line = /^[ +-]?[A-Za-z0-9+/=]{16,}[ \t]*$/m;
+    const ppkAnchorInSections = (t) => t.split(/^(?=diff --git )/m).some((sec) => ppkLinesField.test(sec) && b64Line.test(sec));
+    if (ppkAnchorInSections(patch))
+        return "ppk-field-survived";
+    if (ppkField.test(direct))
+        return "ppk-field-survived";
+    const strip1 = (t) => t.replace(/^[+-]/gm, "");
+    const stripFull = (t) => t.replace(/^[+-]+/gm, "");
+    const layers = [["1", strip1]];
+    if (/^[+-]{2}/m.test(patch))
+        layers.push(["full", stripFull]);
+    for (const [name, strip] of layers) {
+        shadowScans += 1;
+        const shadow = redactSecrets(strip(patch), { observe: false });
+        if (strip(direct) !== shadow)
+            return `shadow-diverged@${name}`;
+        if (fence.test(shadow))
+            return "pem-fence-survived";
+        if (ppkField.test(shadow))
+            return "ppk-field-survived";
+    }
+    return undefined;
+}
+export function redactPatchHead(patch, keep) {
+    if (patch.length > DIAG_INPUT_CAP) {
+        recordFailOpen("server.run-terminal.patch-head-cut", `not-inlined len=${patch.length} keep=${keep}`);
+        return `${OVERSIZED_PATCH_PLACEHOLDER} [len=${patch.length}]`;
+    }
+    try {
+        const direct = redactSecrets(patch);
+        const refusal = diffScanRefusal(patch, direct);
+        if (refusal !== undefined) {
+            recordFailOpen("server.run-terminal.patch-head-cut", `${refusal} len=${patch.length} keep=${keep}`);
+            return `${OVERSIZED_PATCH_PLACEHOLDER} [len=${patch.length}]`;
+        }
+        return direct.slice(0, keep);
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `patch-head len=${patch.length} err=${err instanceof Error ? err.name : String(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactTail(text, keep) {
+    return redactDiagnosticText(text).slice(-keep);
+}
+export const ARTIFACT_INPUT_CAP = 262_144;
+export const OVERSIZED_ARTIFACT_PLACEHOLDER = "«redacted:oversized-artifact»";
+export function redactArtifactText(raw) {
+    if (raw.length > ARTIFACT_INPUT_CAP) {
+        recordFailOpen("server.run-terminal.artifact-capped", `len=${raw.length} cap=${ARTIFACT_INPUT_CAP}`);
+        return OVERSIZED_ARTIFACT_PLACEHOLDER;
+    }
+    try {
+        const direct = redactSecrets(raw);
+        const refusal = diffScanRefusal(raw, direct);
+        if (refusal !== undefined) {
+            recordFailOpen("server.run-terminal.artifact-capped", `${refusal} len=${raw.length}`);
+            return `${OVERSIZED_ARTIFACT_PLACEHOLDER} [${refusal} len=${raw.length}]`;
+        }
+        return direct;
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `artifact len=${raw.length} err=${err instanceof Error ? err.name : String(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function redactLeaderResult(result) {
+    return redactLeaderResultWithFlag(result).value;
+}
+export function redactLeaderResultWithFlag(result) {
+    if (result === null || typeof result !== "object" || Array.isArray(result))
+        return { value: result, changed: false };
+    let changed = false;
+    const str = (v) => { if (typeof v !== "string")
+        return undefined; const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const artMemo = new Map();
+    const art = (v) => { if (typeof v !== "string")
+        return v; let o = artMemo.get(v); if (o === undefined) {
+        o = redactArtifactText(v);
+        artMemo.set(v, o);
+    } if (o !== v)
+        changed = true; return o; };
+    const obj = (v) => (v && typeof v === "object" && !Array.isArray(v) ? v : undefined);
+    const r = result;
+    const out = { ...r };
+    if (Array.isArray(r.reports))
+        out.reports = r.reports.map((w) => {
+            if (!obj(w))
+                return w;
+            const nw = redactWorkerReportError(w);
+            if (nw !== w)
+                changed = true;
+            return nw;
+        });
+    if (typeof r.error === "string")
+        out.error = str(r.error);
+    const replan = obj(r.replan);
+    if (replan && typeof replan.collapsed === "string")
+        out.replan = { ...replan, collapsed: str(replan.collapsed) };
+    const merge = obj(r.merge);
+    if (merge) {
+        const m = { ...merge };
+        for (const k of ["reason", "details"])
+            if (typeof merge[k] === "string")
+                m[k] = str(merge[k]);
+        for (const k of ["rej", "candidatePatch"])
+            if (typeof merge[k] === "string")
+                m[k] = art(merge[k]);
+        const measure = obj(merge.measure);
+        if (measure && typeof measure.reason === "string")
+            m.measure = { ...measure, reason: str(measure.reason) };
+        out.merge = m;
+    }
+    const cp = obj(r.candidatePatch);
+    if (cp)
+        out.candidatePatch = { ...cp, ...(typeof cp.reason === "string" ? { reason: str(cp.reason) } : {}), ...(typeof cp.patch === "string" ? { patch: art(cp.patch) } : {}) };
+    if (Array.isArray(r.salvaged))
+        out.salvaged = r.salvaged.map((x) => (obj(x) && typeof x.patch === "string" ? { ...x, patch: art(x.patch) } : x));
+    return { value: changed ? out : result, changed };
+}
+const READ_MEMO_CLEAN_CAP = 8192;
+const READ_MEMO_DIRTY_CAP = 512;
+const READ_MEMO_DIRTY_MAX_ENTRY_BYTES = 262_144;
+const READ_MEMO_DIRTY_MAX_TOTAL_BYTES = 16 * 1_048_576;
+const readMemoClean = new Set();
+const readMemoDirty = new Map();
+let readMemoDirtyBytes = 0;
+export function memoRedactedRead(seat, raw, redact) {
+    const key = `${seat}\u0000${createHash("sha256").update(typeof raw === "string" ? raw : JSON.stringify(raw) ?? "").digest("hex")}`;
+    if (readMemoClean.has(key))
+        return raw;
+    const hit = readMemoDirty.get(key);
+    if (hit)
+        return hit.value;
+    const out = redact(raw);
+    const clean = out === raw || (typeof out === "string" && out === raw) || JSON.stringify(out) === JSON.stringify(raw);
+    if (clean) {
+        if (readMemoClean.size >= READ_MEMO_CLEAN_CAP)
+            readMemoClean.delete(readMemoClean.values().next().value);
+        readMemoClean.add(key);
+        return out;
+    }
+    const bytes = Buffer.byteLength(typeof out === "string" ? out : JSON.stringify(out));
+    if (bytes <= READ_MEMO_DIRTY_MAX_ENTRY_BYTES) {
+        while (readMemoDirty.size > 0 && (readMemoDirty.size >= READ_MEMO_DIRTY_CAP || readMemoDirtyBytes + bytes > READ_MEMO_DIRTY_MAX_TOTAL_BYTES)) {
+            const oldest = readMemoDirty.keys().next().value;
+            readMemoDirtyBytes -= readMemoDirty.get(oldest).bytes;
+            readMemoDirty.delete(oldest);
+        }
+        readMemoDirty.set(key, { value: out, bytes });
+        readMemoDirtyBytes += bytes;
+    }
+    return out;
+}
+export function memoRedactTerminalResult(seat, result) {
+    if (result === undefined || result === null)
+        return result;
+    const r = result;
+    if (r.errorMessage === undefined && r.blockedReason === undefined && r.remoteEnvFailures === undefined)
+        return result;
+    const leaves = { errorMessage: r.errorMessage, blockedReason: r.blockedReason, remoteEnvFailures: r.remoteEnvFailures };
+    const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
+    if (redacted === leaves)
+        return result;
+    return { ...result, ...redacted };
+}
+let shadowScans = 0;
+export function diffScanShadowCountForTest() { return shadowScans; }
+export function resetDiffScanShadowCountForTest() { shadowScans = 0; }
+export function resetReadRedactionMemoForTest() {
+    readMemoClean.clear();
+    readMemoDirty.clear();
+    readMemoDirtyBytes = 0;
+}
+//# sourceMappingURL=run-terminal-log.js.map

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,3 +1,4 @@
+import { type SemaProvenanceInput } from "../trace/sema-provenance.js";
 import type { SystemInjectionPriority } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
@@ -259,6 +260,14 @@ export declare function taskNotificationInboxEntry(sessionId: string, owner: str
     resumable?: boolean;
     /** core 1.353([ref]):诊断槽(journal 坐标+教句,引擎值单源)——park 透传,drain 帧原样带。 */
     diagnostics?: string;
+    /** [ref] [ref] 片6 d1(core 7.2.0):子代→主代 uplink 帧的渲染判别成员 + typed 归因侧记。park 是
+     *  **空闲态**(父 leg 已收尾)到达的那条路——恰是 [ref](b) 的场景;不过桥 ⇒ drain 帧无判别键、cli 渲老形卡。
+     *  body = UNTRUSTED 子代文本 → redact+cap(与 result 同姿势);provenance 成员逐挑 verbatim(引擎值)。 */
+    agentMessage?: {
+        from: string;
+        body: string;
+    };
+    _sema_provenance?: SemaProvenanceInput;
 }, enqueuedAt: number, 
 /** lead-b (dual-ID audit): the PARENT run's durable taskId (the uuid the shell's footer rows
  *  key on) — rides the drained frame so a consumer can bind the a*-keyed child notification to its uuid-keyed

package/dist/orchestration/workflow-completion-inbox.js

@@ -2,6 +2,7 @@ import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, cl
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
+import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -314,6 +315,13 @@ export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, pare
         ...(n.resumable !== undefined ? { resumable: n.resumable } : {}),
         ...(n.result ? { result: cap(redactSecrets(n.result), 4000) } : {}),
         ...(n.output_file ? { output_file: cap(redactSecrets(n.output_file), 1024) } : {}),
+        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: cap(redactSecrets(n.agentMessage.body), 4000) } } : {}),
+        ...(() => {
+            if (n._sema_provenance === undefined)
+                return {};
+            const p = semaProvenanceOrAbsent(n._sema_provenance);
+            return p !== undefined ? { _sema_provenance: p } : {};
+        })(),
     };
     return {
         sessionId,

package/dist/permission-rule-vocab.d.ts

@@ -0,0 +1,40 @@
+/**
+ * [ref] + [ref](core `e298c9e0`,随 7.2.x 提货生效;[ref])—— 规则车道**闭词表的单一属主**。
+ *
+ * 为什么要一个模块而不是各处各写一份 `z.enum([...])`:同一张词表此前在四处各抄一份字面量
+ * (`approval-card.ts` 两腿的 offer schema、`http/routes/rules.ts` 的直通票口行形、
+ * `plugins/permission-rule-store-sql.ts` 的 `rules_json` 读/写形),core 给 `PersistedRuleMatch` 加两员
+ * (wildcard / subpath)、给 `PersistedRuleTool` 加 Read 时,四份抄件**没有一份**会编译红 —— zod 的 enum
+ * 只是运行期的一个 Set,静默把一次上游语义扩张翻成一整类合法行的拒收([ref] 词表纪律说的正是这形:
+ * 未知词必须是**编译**错,不是运行期一个安静的 false)。
+ *
+ * 🔴 每张表都带一条**双向全等钉**(`Exact<>`):元组的成员并 ≡ core 的联合型。core 加员 ⇒ 这里编译红,
+ * 由人裁定新词在每个消费面的处置(收 / 拒 / 剥),而不是让它在某一处静默落进「不认识」臂;本仓多写一个
+ * core 没有的词 ⇒ 同样红(词表属主是 core,本仓只转录)。
+ *
+ * ⚠️ 转录**不是**判据:一个词在表里只说「这是 core 定义的一员」,不说「本仓每条腿都接受它」。逐腿的收窄
+ * (例如卡编辑臂对 `subpath` 的拒)写在那条腿自己的穷举 `switch` 里,并各带理由。
+ */
+import type { RuleApprovalRecord } from "@sema-agent/core";
+/** `PersistedRuleTool`([ref] §2.2:`"Read"` 只说一种文法 —— `Read(//abs-dir/**)` 目录只读授权)。 */
+export declare const PERSISTED_RULE_TOOLS: readonly ["Bash", "Read"];
+/**
+ * `PersistedRuleMatch` 四员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
+ * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
+ * `subpath`(Read 目录形,永不容纳任何命令)。
+ */
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath"];
+/** [ref] §2.3 B3:batch offer 成员的判别位(`command` = 历史逐段 Bash 规则;`directoryRead` = cd 段铸的目录只读授权)。 */
+export declare const RULE_OFFER_BATCH_MEMBER_KINDS: readonly ["command", "directoryRead"];
+/** [ref] §3.5:一段「为什么仍未被覆盖」的闭三词集(`redirection` 永久逐次 / `no_rule_form` 无可覆盖形 / `cap_overflow` 去重+帽挤出)。 */
+export declare const UNCOVERED_SEGMENT_REASONS: readonly ["redirection", "no_rule_form", "cap_overflow"];
+/** [ref] §3.3-5:卡编辑面的 breadth 警告码(记录 `edited.warnings` 存的就是这两个字面)。 */
+export declare const EDITED_RULE_BREADTH_WARNING_CODES: readonly ["broad_prefix", "compound_prefix"];
+/**
+ * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 2→3)。
+ * 类型绑 core 的字面型:core 再升号 ⇒ 这里编译红,两只 durable 店(SQL 双方言 + File)的 stale 判别与写侧钉
+ * 同批随之;判别是**等式**(`!==`)不是下限 —— 旧号的行按 stale 信封交还(不迁移、不 widen、不丢行),
+ * pending 卡短命,重触发即取新卡(B7/B8 既诺)。
+ */
+export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
+//# sourceMappingURL=permission-rule-vocab.d.ts.map

package/dist/permission-rule-vocab.js

@@ -0,0 +1,17 @@
+export const PERSISTED_RULE_TOOLS = ["Bash", "Read"];
+const TOOLS_PIN = true;
+void TOOLS_PIN;
+export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath"];
+const MATCHES_PIN = true;
+void MATCHES_PIN;
+export const RULE_OFFER_BATCH_MEMBER_KINDS = ["command", "directoryRead"];
+const MEMBER_KINDS_PIN = true;
+void MEMBER_KINDS_PIN;
+export const UNCOVERED_SEGMENT_REASONS = ["redirection", "no_rule_form", "cap_overflow"];
+const REASONS_PIN = true;
+void REASONS_PIN;
+export const EDITED_RULE_BREADTH_WARNING_CODES = ["broad_prefix", "compound_prefix"];
+const WARNING_CODES_PIN = true;
+void WARNING_CODES_PIN;
+export const RULE_APPROVAL_RECORD_SCHEMA = 3;
+//# sourceMappingURL=permission-rule-vocab.js.map

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -653,6 +653,20 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      * caller may only decide a checkpoint in their OWN scope. Returns `undefined` (no pending row), `null`
      * (anonymous/dev session — open), or the owner scope string.
      */
+    /**
+     * [ref]:**按 token** 的 scope 轻读 —— `undefined`(无该行)/ `null`(匿名/开放)/ 属主 scope 串。
+     *
+     * 为什么必须有这一口(codex [ref] r1-[medium],验真后修):`peekPendingScope` 是**按 session** 的读,答的
+     * 是「此刻绑定下最新的那一行」;而 `get(token)` 读的是**那一个** token。表无 per-session pending 唯一
+     * 约束、两读又非事务 ⇒ 并发轮换窗内两者可以是不同的行。于是「按 session 轻读出的属主」不能拿来当
+     * 「可否把 `get(token)` 的失败细节回显给这位调用方」的准入位 —— 那正是 [ref] 要封的存在性 oracle 在
+     * TOCTOU 面上的复活形。本口把属主证明与**将要载入的那个 token** 原子绑定(同一 `WHERE token = ?`)。
+     *
+     * 刻意**不带** `status='pending'` 谓词:判据是「这一行是不是你的」,与它此刻处在哪一态无关(`get()`
+     * 自己也是裸 `WHERE token = ?`);加了反而在「刚被并发消费」的窗里把属主自己的诊断吞掉。
+     * 只 SELECT `scope` 一列 ⇒ 版本闸/坏 blob 都影响不到它(那是 `get()` 读 `version`/`checkpoint` 的事)。
+     */
+    peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;
     /** Upsert the resume rebuild inputs for a session (written at SUBMIT when durable mode is on). */
     putCtx(sessionId: string, ctx: unknown): Promise<void>;

package/dist/plugins/checkpoint-store-sql.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
 import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
-import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema } from "../approval-card.js";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat } from "../approval-card.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
@@ -69,7 +69,7 @@ export function boundedRuleOffers(raw, opts = {}) {
     for (const item of raw.slice(0, MAX_RULE_OFFER_SCAN)) {
         if (out.length >= MAX_RULE_OFFERS)
             break;
-        const parsed = RuleOfferRawSchema.safeParse(preboundBatchMembers(item));
+        const parsed = RuleOfferRawSchema.safeParse(screenUncoveredDetailSeat(backfillLegacyBatchMemberKind(preboundBatchMembers(item))));
         if (!parsed.success)
             continue;
         if (parsed.data.kind === "single") {
@@ -78,8 +78,18 @@ export function boundedRuleOffers(raw, opts = {}) {
         else {
             out.push({
                 kind: "batch",
-                rules: parsed.data.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS).map((r) => ({ rule: scrub(r.rule), match: r.match, command: scrub(r.command), segment: scrub(r.segment) })),
+                rules: parsed.data.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS).map((r) => {
+                    switch (r.kind) {
+                        case "command":
+                            return { kind: "command", rule: scrub(r.rule), match: r.match, command: scrub(r.command), segment: scrub(r.segment) };
+                        case "directoryRead":
+                            return { kind: "directoryRead", rule: scrub(r.rule), directory: scrub(r.directory), segment: scrub(r.segment) };
+                        default:
+                            throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                    }
+                }),
                 uncoveredSegments: parsed.data.uncoveredSegments,
+                ...(parsed.data.uncoveredDetail !== undefined ? { uncoveredDetail: parsed.data.uncoveredDetail.map((d) => ({ segment: scrub(d.segment), reason: d.reason })) } : {}),
             });
         }
     }
@@ -539,6 +549,12 @@ export class SqlCheckpointStore {
             };
         });
     }
+    async peekScopeByToken(token) {
+        const { rows } = await this.db.query(this.q("SELECT scope FROM checkpoint WHERE token = ?", "SELECT scope FROM checkpoint WHERE token = $1"), [token]);
+        if (!rows[0])
+            return undefined;
+        return rows[0].scope ?? null;
+    }
     async peekPendingScope(sessionId, binding) {
         const { sql, params } = this.pendingRowQuery("scope", sessionId, undefined, binding);
         const { rows } = await this.db.query(sql, params);

package/dist/plugins/file-run-store.d.ts

@@ -1,37 +1,6 @@
-/**
- * File-backed async run registry + replayable event log — the DURABLE local twin of {@link MemoryRunStore} (and the
- * file-backed sibling of {@link TiDBRunStore}/{@link PgRunStore}). P0.5 variant-1 (clay 2026-06-26): the file-backed
- * follow-on the Memory twin's header promised — a locally-run HTTP service now keeps its runs ledger + trace event log
- * across a process restart, not just in memory. Behaviour is byte-identical to MemoryRunStore (the shared parity oracle
- * — same single-active claim, the suspend/needs_review parks that KEEP the claim, the markResuming CAS that resets
- * cancel/preempt, the owner null-safe guard, the keyset list order, the (taskId,seq) event dedup, and the structuredClone
- * write/read isolation); the only difference is durability.
- *
- * THREE on-disk data planes (all under `<root>/runs/`), each using core's crash-safe fs primitives — never hand-rolled
- * fs (zero drift, no zero-length/torn corruption):
- *  1. run registry  — `<root>/runs/<taskId>/run.json` = the RunRow, replaced WHOLE on every status change via
- *                     `atomicWriteFile` (tmp→fsync→rename→fsync-dir, the 5-step atomic replace).
- *  2. single-active claim — `<root>/runs/active/<sanitizePathComponent(sessionId)>` carrying the active taskId, created
- *                     with `writeThenLink` (atomic create; EEXIST ⇒ the session already has an active run → the
- *                     createRun loses the claim, returns `{ok:false, activeTaskId}`). The file version of task_active's
- *                     unique key.
- *  3. per-run event log — `<root>/runs/<taskId>/events.jsonl` = an `AppendLog` (one line per event, fsync:false — events
- *                     are high-frequency, the torn-tail-drop on replay covers a crash tail; only the run.json status
- *                     commit + the active-claim create use fsync). (taskId,seq) is deduped on replay.
- *
- * An in-memory INDEX (the same Maps MemoryRunStore holds) is hydrated on construction by scanning each runs/<taskId>/
- * run.json + the active claim files — so listRuns/listSessions/getActiveTaskId are O(in-mem) with byte-identical keyset sort to the SQL/Memory
- * twins. Every write touches BOTH the disk and the index on one path. Single-process (the FileStorageBackend boot lock
- * guarantees one writer per data dir), so there is no per-op lock — with ONE exception: [ref]'s claim acquisition
- * (`withClaimLock`) runs under a per-session in-process critical section, because judging a claim stale involves
- * awaits (the checkpoint probe) and the claim + run row must commit as one unit (the SQL twin's transaction). The
- * checkpoint-coupled suspended-run reapers run
- * off an injected {@link RunStoreCheckpointProbe} ([ref]; wired by the local backend where checkpoint + run store
- * share one root) and degrade to honest no-ops when the probe is absent — exactly like MemoryRunStore.
- */
 import { type UsageRow } from "../usage-analytics.js";
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
+import type { TaskStatus } from "@sema-agent/core";
+import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /**
@@ -136,7 +105,7 @@ export declare class FileRunStore {
     getEvents(taskId: string, afterSeq: number): Promise<RunEvent[]>;
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
-    setTerminal(taskId: string, status: TaskStatus, result: TaskResult | null, error: string | null): Promise<void>;
+    setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
     setSuspended(taskId: string): Promise<void>;
     /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */

package/dist/plugins/file-run-store.js

@@ -1,9 +1,11 @@
+import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal-log.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, readJsonlRecords, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { notifyRunTerminal } from "../observability/run-terminal-log.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const PROCESS_FACTS = {
     pid: process.pid,
@@ -338,6 +340,7 @@ export class FileRunStore {
         }
     }
     async appendEvent(taskId, seq, type, data) {
+        data = redactLedgerEventData(type, data);
         const list = this.events.get(taskId) ?? [];
         if (list.some((e) => e.seq === seq))
             return;
@@ -363,6 +366,8 @@ export class FileRunStore {
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
     async setTerminal(taskId, status, result, error) {
+        result = redactTerminalResult(result);
+        error = error === null ? null : (redactErrorMessage(error) ?? null);
         const r = this.runs.get(taskId);
         if (!r) {
             for (const [sessionId, tid] of this.active)
@@ -372,6 +377,7 @@ export class FileRunStore {
                 }
             return;
         }
+        let pending;
         if (r.status === "running" || r.status === "suspended" || r.status === "needs_review") {
             r.status = status;
             r.result = result;
@@ -379,9 +385,22 @@ export class FileRunStore {
             r.errorCode = result?.errorCode ?? null;
             r.updatedAt = new Date();
             this.persist(r);
+            pending = {
+                runId: taskId,
+                sessionId: r.sessionId,
+                owner: r.owner,
+                status,
+                resultTaskId: result?.taskId,
+                model: result?.model,
+                errorCode: r.errorCode ?? undefined,
+                errorMessage: result?.errorMessage ?? error ?? undefined,
+                elapsedMs: Math.max(0, Date.now() - r.createdAt.getTime()),
+            };
         }
         if (this.active.get(r.sessionId) === taskId)
             this.releaseClaim(r.sessionId);
+        if (pending)
+            notifyRunTerminal(pending);
     }
     async setSuspended(taskId) {
         const r = this.runs.get(taskId);

package/dist/plugins/local-checkpoint-store.d.ts

@@ -112,6 +112,16 @@ export declare class LocalCheckpointStore {
      *    投了就是「SQL 车道有、local 车道没有」的键集分岔。
      */
     findDecidedApprovalsForBinding(sessionId: string, boundCallId: string): Promise<DecidedApprovalRecord[]>;
+    /**
+     * [ref]:按 token 的 scope 读 —— 与 SQL 孪生**同一条契约**(`undefined` 无行 / `null` 匿名 / 属主串),
+     * 语义与存在理由的唯一属主 = SQL 侧 `peekScopeByToken` 顶注。
+     *
+     * ⚠️ 形差如实记:SQL 孪生那口是真「轻读」(只 SELECT scope 一列),本形没有列可选 —— core 的 File 店
+     * 只给 `get(token)`,所以这里读的是**整行**。后果对本形无害:本形的 `get()` 没有行级版本闸(唯一的
+     * 读不动形是账本重放级 = 整店同时读不动,`findPendingTokenBySession` 先抛),所以「行体读得出而 scope
+     * 读不出」这一支在本形结构上不存在。哪天本形补了行级闸,这里要跟着改成不碰行体的读。
+     */
+    peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     /** `undefined` = no pending row; else the owner scope (local scopes are always strings — never null).
      *  [ref]:与 `findPendingTokenBySession` 同一个 {@link pickPendingRow}(同 binding ⇒ 同一行)。 */
     peekPendingScope(sessionId: string, binding?: PendingRowBinding): Promise<string | null | undefined>;