@sema-agent/server 7.56.0 → 7.58.0

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -195,7 +195,7 @@ export function createApprovalCardEmitter(sinks) {
 }
 export function resolveApprovalLeg(input) {
     if (!input.streamApprovalOn)
-        return { active: false, windowZero: false };
+        return { active: false, windowZero: input.windowMs === 0 };
     const tightDeadline = input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
     if (input.windowMs === 0 || tightDeadline)
         return { active: true, windowZero: true };
@@ -344,32 +344,115 @@ export class ToolApprovalCoordinator {
             if (x.kind === "batch" && y.kind === "batch") {
                 return (x.uncoveredSegments === y.uncoveredSegments &&
                     x.rules.length === y.rules.length &&
-                    x.rules.every((r, j) => r.rule === y.rules[j].rule && r.match === y.rules[j].match && r.command === y.rules[j].command && r.segment === y.rules[j].segment));
+                    x.rules.every((r, j) => ToolApprovalCoordinator.batchMemberEqual(r, y.rules[j])) &&
+                    ToolApprovalCoordinator.uncoveredDetailEqual(x.uncoveredDetail, y.uncoveredDetail));
             }
             return false;
         });
     }
+    static batchMemberEqual(r, s) {
+        if (r.kind !== s.kind)
+            return false;
+        if (r.kind === "command" && s.kind === "command")
+            return r.rule === s.rule && r.match === s.match && r.command === s.command && r.segment === s.segment;
+        if (r.kind === "directoryRead" && s.kind === "directoryRead")
+            return r.rule === s.rule && r.directory === s.directory && r.segment === s.segment;
+        return false;
+    }
+    static uncoveredDetailEqual(a, b) {
+        if (a === undefined || b === undefined)
+            return a === b;
+        return a.length === b.length && a.every((d, i) => d.segment === b[i].segment && d.reason === b[i].reason);
+    }
+    static ruleOfferTextsOverSize(offer) {
+        const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        if (offer.kind === "single")
+            return over(offer.rule) || over(offer.command);
+        return offer.rules.some((r) => {
+            switch (r.kind) {
+                case "command":
+                    return over(r.rule) || over(r.command);
+                case "directoryRead":
+                    return over(r.rule) || over(r.directory);
+                default:
+                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+            }
+        });
+    }
+    static ruleOfferDerivedFactsAgree(offer) {
+        const derive = (rule) => {
+            const p = parseAllowRuleText(rule);
+            return "rule" in p ? p.rule : undefined;
+        };
+        if (offer.kind === "single") {
+            const d = derive(offer.rule);
+            return d !== undefined && d.rule === offer.rule && d.tool === "Bash" && d.match === offer.match && d.command === offer.command;
+        }
+        return offer.rules.every((m) => {
+            const d = derive(m.rule);
+            if (d === undefined || d.rule !== m.rule)
+                return false;
+            switch (m.kind) {
+                case "command":
+                    return d.tool === "Bash" && d.match === m.match && d.command === m.command;
+                case "directoryRead":
+                    return d.tool === "Read" && d.match === "subpath" && d.command === m.directory;
+                default:
+                    throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(m)}`);
+            }
+        });
+    }
     static boundRuleOfferTexts(offers) {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+        const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
         const out = [];
-        for (const offer of offers) {
+        for (const raw of offers) {
+            const parsed = RuleOfferRawSchema.safeParse(screenUncoveredDetailSeat(backfillLegacyBatchMemberKind(raw)));
+            if (!parsed.success) {
+                defaultLogger.warn("rule_offer_dropped_unreadable_shape", {
+                    kind: typeof raw === "object" && raw !== null ? String(raw.kind) : typeof raw,
+                    note: "this offer's shape is outside the closed vocabulary this build reads (member kind / match / reason) — dropped whole; sibling offers still render (core/dist skew?)",
+                });
+                continue;
+            }
+            const offer = parsed.data;
+            if (ToolApprovalCoordinator.ruleOfferTextsOverSize(offer))
+                return undefined;
+            if (!ToolApprovalCoordinator.ruleOfferDerivedFactsAgree(offer)) {
+                defaultLogger.warn("rule_offer_dropped_derived_facts_disagree", {
+                    kind: offer.kind,
+                    note: "an offer's kind/match/command/directory seats do not agree with what the shared validator derives from its rule text — dropped whole so the card never shows one grant while redeeming another (core/dist skew or forged material?)",
+                });
+                continue;
+            }
             switch (offer.kind) {
                 case "single":
-                    if (over(offer.rule) || over(offer.command))
-                        return undefined;
-                    out.push(offer);
+                    out.push({ kind: "single", rule: offer.rule, match: offer.match, command: offer.command });
                     break;
-                case "batch":
-                    if (offer.rules.some((r) => over(r.rule) || over(r.command)))
-                        return undefined;
+                case "batch": {
+                    const rules = [];
+                    for (const r of offer.rules) {
+                        switch (r.kind) {
+                            case "command":
+                                rules.push({ kind: "command", rule: r.rule, match: r.match, command: r.command, segment: clipSegment(r.segment) });
+                                break;
+                            case "directoryRead":
+                                rules.push({ kind: "directoryRead", rule: r.rule, directory: r.directory, segment: clipSegment(r.segment) });
+                                break;
+                            default:
+                                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                        }
+                    }
                     out.push({
                         kind: "batch",
-                        rules: offer.rules.map((r) => (over(r.segment) ? { ...r, segment: r.segment.slice(0, MAX_RULE_TEXT_CHARS) } : r)),
+                        rules,
                         uncoveredSegments: offer.uncoveredSegments,
+                        ...(offer.uncoveredDetail !== undefined ? { uncoveredDetail: offer.uncoveredDetail.map((d) => ({ segment: clipSegment(d.segment), reason: d.reason })) } : {}),
                     });
                     break;
+                }
                 default:
-                    return undefined;
+                    throw new Error(`unknown rule-offer kind: ${JSON.stringify(offer)}`);
             }
         }
         return out;

package/dist/trace/core-keyset-guard.d.ts

@@ -17,11 +17,11 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxStore, TaskSpec, TaskResult } from "@sema-agent/core";
+import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult } from "@sema-agent/core";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure";
-type NotificationExcluded = "peer";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
+type NotificationExcluded = "peer" | "crossSessionMessage";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
@@ -29,14 +29,13 @@ type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, Bg
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
-type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld";
+type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
-type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain";
+type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
-type MailboxAppendMessage = Parameters<MailboxStore["append"]>[2];
-type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain";
+type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
 type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable";
@@ -49,7 +48,7 @@ type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<Permiss
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -15,6 +15,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.capture_optout_unpersisted",
     "task.halt_unconsumed",
     "task.late_approval",
+    "config.durable_gate_unavailable",
+    "peer.inbound_disposition",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/ledger-sink.d.ts

@@ -58,8 +58,14 @@ export interface LedgerSink {
     onForwardEvent(e: {
         type?: string;
     }): void;
-    /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the non-secret `checkpointGate` is
-     *  persisted — never the capability `checkpointToken` (search [18] Q1b). */
+    /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the `checkpointGate` is persisted —
+     *  never the capability `checkpointToken` (search [18] Q1b).
+     *  ⚠️ **"non-secret" was the old wording and it is not true** ([ref] R3, 2026-09-03 — wording only, behaviour
+     *  unchanged; [ref] decides the arm): the gate carries NO capability token, but its `riskDescriptor.summary` /
+     *  `shadowedRule` are model-/human-controlled display text that [ref] measured carrying a PEM private-key
+     *  body verbatim. This durable row replays on every `GET /v1/runs/:id/events` reconnect and is NOT backfilled
+     *  by core [ref]'s mint-point fix — it is the third face of the `checkpointGate` sister item recorded in
+     *  `http/routes/approvals-assistant.ts` (`redactPendingDisclosures` header). */
     appendParked(kind: "suspended" | "needs_review", result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */
@@ -101,7 +107,10 @@ export declare function createLedgerSink(opts: {
      *  ——**text_delta/reasoning_delta 只进内存缓冲、到 flush 边界才 append**(codex S1-F1,2026-08-13:
      *  只打 append 会让长时间流式输出被误读成「无进展」,方向与本键的设计目的正好相反);②`append`
      *  入口——兜住不经 onEvent 的直写路径(appendParked/appendDone/onForwardEvent)。分诊提示性回调:
-     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。 */
-    onActivity?: () => void;
+     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。
+     *  🔴 [ref] 件3:回调带**事件类型**(`kind`)——`cancelContext.lastEventKind` 的数据源。两个打点位
+     *  各传自己看得见的那个词(位①=流事件 `ev.type`,位②=账本行 `type`);拿不到类型的打点方
+     *  (core 的 onActivity 第五席、resume 腿手动打点)省参,`kind` 诚实缺席(见 turn-activity.ts)。 */
+    onActivity?: (kind?: string, statusData?: Record<string, unknown>) => void;
 }): LedgerSink;
 //# sourceMappingURL=ledger-sink.d.ts.map

package/dist/trace/ledger-sink.js

@@ -17,15 +17,15 @@ export function createLedgerSink(opts) {
     let text = "";
     let reasoning = "";
     let textEventId;
-    const beat = () => {
+    const beat = (kind, statusData) => {
         try {
-            opts.onActivity?.();
+            opts.onActivity?.(kind, statusData);
         }
         catch {
         }
     };
     const append = (type, data) => {
-        beat();
+        beat(type);
         const step = chain.then(() => opts.appendEvent(++seq, type, data));
         chain = step.then(() => undefined, () => undefined);
         return step;
@@ -41,7 +41,7 @@ export function createLedgerSink(opts) {
         }
     };
     const onEvent = async (ev) => {
-        beat();
+        beat(ev.type);
         switch (ev.type) {
             case "text_delta": {
                 const td = ev;
@@ -63,7 +63,11 @@ export function createLedgerSink(opts) {
                 break;
             case "status":
                 await flush();
-                await append("status", brainStatusEventData(ev));
+                {
+                    const statusData = brainStatusEventData(ev);
+                    beat("status", statusData);
+                    await append("status", statusData);
+                }
                 break;
             case "context_usage":
                 await flush();
@@ -134,7 +138,11 @@ export function createLedgerSink(opts) {
             void append("tool_end", toolEndEventData(e)).catch(() => undefined);
         }
     };
-    const appendStatus = (ev) => append("status", brainStatusEventData(ev));
+    const appendStatus = (ev) => {
+        const statusData = brainStatusEventData(ev);
+        beat("status", statusData);
+        return append("status", statusData);
+    };
     const appendParked = (kind, result) => append(kind, {
         gate: result?.checkpointGate ?? null,
         ...(typeof result?.toolCallId === "string" ? { toolCallId: result.toolCallId } : {}),

package/dist/trace/project.d.ts

@@ -16,6 +16,7 @@ import type { ApprovalSettledBy, TaskResult, SystemInjectionPriority } from "@se
 import { type AskDenyResolution } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
+import { type SemaProvenanceInput } from "./sema-provenance.js";
 import type { LedgerEventType } from "./ledger-events.js";
 /** 账本写口的统一签名 —— `type` 是**闭集**(`ledger-events.ts`):新型必须先登记,否则调用点编译红
  *  (codex 交叉复审 F2:别名门 `ap("x")` 与动态首参让纯词法门结构性抓不全)。 */
@@ -214,6 +215,18 @@ export declare function taskNotificationEventData(ev: {
             status?: number;
             requestId?: string;
         };
+        /** [ref](a) [ref] 片6 d1(core 7.2.0):子代→主代 uplink 帧的**渲染判别**成员。在场 = 这一帧是
+         *  `SendMessage("main")` 的 agent-message(cli 渲 agent-message 卡;父模型面读的是顶层 `<agent-message from=…>`
+         *  帧而非 task-notification 外壳);缺席 = 老形卡。`body` 是子代文本 = UNTRUSTED(与 `result` 同姿势 redact);
+         *  `from` 是 core 铸的发送方标签(引擎值,verbatim)。铸造点唯一:core `agents/send-message-tool.ts` uplink 腿。 */
+        agentMessage?: {
+            from: string;
+            body: string;
+        };
+        /** 同批:typed 归因侧记(wire 键;core 契约「a host projects it, the model never sees it」)。成员逐个挑取,
+         *  `kind` 过闭集(`trace/sema-provenance.ts` 单点,park 半场同一判据);`agentType` 本 mount 恒缺席(工具无
+         *  agent-type 席),在场即透传(fleet spawn 帧按 taskId 可 join 时上游给)。 */
+        _sema_provenance?: SemaProvenanceInput;
     };
     eventId?: string;
     parentToolCallId?: string;
@@ -330,8 +343,47 @@ export declare function workspaceChangedEventData(ev: {
  *    ⚠️ 与 `storeWired` **不同**:本仓这两条至今未接(`RunnerDeps.permissionRuleSyncWired` /
  *    `permissionRuleOrg` 全树零声明点,2026-08-10 [ref] 复扫亲验)⇒ 今天恒 `false`,这是**真值**不是
  *    缺席。哪天接上其中任一条,连本句一起改 —— 这一行是它的登记处。
+ *  · `modelGate`(可选段 `{ class, removed[], restore }`;core fc52b4d4 [ref] / [ref] 片2b,[ref] 提货件,
+ *    黑板 [ref] @server①)—— **裁:租户可见**。它是 per-session 的**读面**:「我这条 session 因为工具-模型门卸掉了
+ *    哪些工具」——与 operator 通告 `config.tool_model_gate_removed` **同决策同源**(core 从同一张 trim 表铸两面),
+ *    但通告归 operator 车道(engine_notice 白名单,附录 D),本段归租户:消费端(cli L-70 [ref])要在**首帧一次读**
+ *    里知道自己少了哪些工具、怎么恢复,否则只能等到调用被拒才发现。三键都是引擎派生值:`class` = 合并 gate 表的 class 行键
+ *    (prepare-task 对表外 class 响亮拒),`removed` = 工具 wire 名(core 表键,非用户内容),`restore` = core 铸的一句恢复指引(引擎文案)
+ *    ⇒ 不脱敏、逐字。多 class 同卸 ⇒ core 报首 class + removed **并集**(core 合并律;本仓不按 class 过滤)。
+ *    仅本 run 有门卸时在场:**缺席 = 本 run 没卸**,不铸空段、不铸 `removed: []`。畸形(三键任一缺席/形不合)
+ *    ⇒ 整段按缺席 —— 不铸半段,半段会被读成「只卸了这些」。它不构成 governance 四布尔的侧信道(门卸由
+ *    模型/门 class 决定,与 lockedConfig/compliance/memoryAdmission/retention 无函数关系)。
+ *  · `autoMode`(`{ armed: boolean, reason: AutoModeArmReason }`;core 7.3.1 [ref],147③ 提货件,黑板 [ref])
+ *    —— **裁:租户可见**。它是 per-leg 的**读面**:「我这条腿的 auto 模式武装了吗?没武装是卡在哪一臂?」
+ *    ① **同主体同受众**:本仓早已把同一件事投在租户面上 —— `/v1/capabilities.permissionModeAuto.{armed,reason}`
+ *       ([ref],7.57.0 已发)答的是「**若此刻提交**会不会武装」,本段答的是「**这条真跑起来的腿**武装了吗」;
+ *       同一个主体(调用方自己的 run)、同一条轴,只差事前/事后。剥掉它,壳就只能拿事前预测冒充事后事实;
+ *    ② **两个值都是引擎派生的闭形**:`armed` 布尔,`reason` 是 core 的闭集词(`AUTO_MODE_ARM_REASONS`:
+ *       armed / no_intent / no_face / denied / resolver_fault / latch_open)—— 非用户内容,不脱敏、逐字;
+ *    ③ **不是 governance 侧信道**:它描述的是**本腿**的武装结论,与 lockedConfig/compliance/memoryAdmission/
+ *       retention 四位无函数关系;而 `denied` 这一词所披露的「组织把这一位关了」在 [ref] 读面上**本就已经**
+ *       对同一租户可见(`org_denied`),本段没有扩大任何受众。
+ *    🔴 **逐字透传,不映射**:core 的六词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
+ *       —— 两张表回答的是两个问题、粒度也不同(core 的 `denied` 一词对应本仓的 `org_denied` / `local_denied`
+ *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
+ *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):
+ *       settings 层的 kill-switch 折的是**模式**(`effectivePermissionMode`:auto → default),于是 resolve-spec
+ *       阶段④ 压根不写意图座 `TaskSpec.autoModeRequested` ⇒ core 的武装谓词第一项就落空;而本地 env 腿折的是
+ *       **caps**(`applyLocalAutoModeDeny`),模式不动、座照写 ⇒ core 才报 `denied`。两条腿在 manifest 上
+ *       **分不开**,要分辨得读 `/v1/capabilities`。对照表与保鲜钉在 `test/wiring-manifest-projection.test.ts`
+ *       的 147③ 节,分岔的行为面格在 `test/permission-mode-shell-gate-translation.test.ts`;
+ *       本函数**只透传**,一个字都不换。
+ *    ⚠️ 缺席 ≠ 「不适用」:core 顶注逐字「absence here means an older mint or an external derivation, never
+ *       "not applicable"」⇒ 缺席时**不铸** `armed:false`(那会把「老 mint 写的行」谎报成「这条腿确实没武装」)。
+ *    ⚠️ **自相矛盾按缺席**:core 把 `armed ⇔ reason === "armed"` 写成段内不变量并在 derive 点拒(`readAutoModeFact`
+ *       抛)。账本回放/第三方 producer 送来的矛盾对若原样上 wire,按 `armed` 读与按 `reason` 读的消费端会得到
+ *       **相反**的答案 —— 这条轴上(@cli `sema doctor permissions` 正读它)两个答案比没答案更坏 ⇒ 整段不铸。
+ *       这不是改语义:它与本函数「畸形值一律按缺席」是同一条规则,而这条不变量是 core 自己写的段内契约。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
- * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来。
+ * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
+ * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格
+ * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
+ * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
@@ -397,8 +449,9 @@ export declare function humanInputEventData(ev: {
 }): Record<string, unknown>;
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
- *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open),
- *  not a core event replay. Whitelist: the closed phase union + neutral bounded detail (redacted) + retryInSec. */
+ *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open, and
+ *  since core 7.3.1 / [ref] the pre-failure `waiting_first_token` wait), not a core event replay.
+ *  Whitelist: the closed phase union verbatim + neutral bounded detail (redacted) + the bounded numeric seats. */
 export declare function brainStatusEventData(ev: {
     phase: string;
     detail?: string;
@@ -409,6 +462,8 @@ export declare function brainStatusEventData(ev: {
     errClass?: string;
     retryAtMs?: number;
     errorStatus?: number;
+    elapsedMs?: number;
+    timeoutMs?: number;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -1,6 +1,8 @@
+import { redactErrorMessage } from "../observability/run-terminal-log.js";
 import { isApprovalSettledBy, isAskDenyResolution } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
+import { semaProvenanceOrAbsent } from "./sema-provenance.js";
 export async function appendModelUsageDelta(append, modelUsage, taskId) {
     const delta = modelUsage?.drain(taskId);
     if (delta) {
@@ -151,6 +153,13 @@ export function taskNotificationEventData(ev) {
         ...(n.result !== undefined ? { result: redactSecrets(n.result) } : {}),
         ...(n.output_file !== undefined ? { output_file: redactSecrets(n.output_file) } : {}),
         ...(n.usage !== undefined ? { usage: n.usage } : {}),
+        ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: redactSecrets(n.agentMessage.body) } } : {}),
+        ...(() => {
+            if (n._sema_provenance === undefined)
+                return {};
+            const p = semaProvenanceOrAbsent(n._sema_provenance);
+            return p !== undefined ? { _sema_provenance: p } : {};
+        })(),
         ...(() => {
             const tier = injectionTierOrAbsent(ev.priority);
             return tier !== undefined ? { priority: tier } : {};
@@ -241,6 +250,25 @@ export function wiringManifestEventData(ev) {
         ...(bool(rulesIn.syncWired) !== undefined ? { syncWired: rulesIn.syncWired } : {}),
         ...(bool(rulesIn.orgGoverned) !== undefined ? { orgGoverned: rulesIn.orgGoverned } : {}),
     });
+    const gateIn = sec(m.modelGate);
+    const modelGate = (() => {
+        if (gateIn === undefined)
+            return undefined;
+        const cls = str(gateIn.class);
+        const restore = str(gateIn.restore);
+        const removed = Array.isArray(gateIn.removed) && gateIn.removed.every((r) => typeof r === "string") ? [...gateIn.removed] : undefined;
+        return cls !== undefined && restore !== undefined && removed !== undefined ? { class: cls, removed, restore } : undefined;
+    })();
+    const autoIn = sec(m.autoMode);
+    const autoMode = (() => {
+        if (autoIn === undefined)
+            return undefined;
+        const armed = bool(autoIn.armed);
+        const reason = str(autoIn.reason);
+        if (armed === undefined || reason === undefined)
+            return undefined;
+        return armed === (reason === "armed") ? { armed, reason } : undefined;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
@@ -252,6 +280,8 @@ export function wiringManifestEventData(ev) {
         ...(str(sessionIn.store) !== undefined ? { session: { store: sessionIn.store } } : {}),
         ...(fleet !== undefined ? { fleet } : {}),
         ...(permissionRules !== undefined ? { permissionRules } : {}),
+        ...(modelGate !== undefined ? { modelGate } : {}),
+        ...(autoMode !== undefined ? { autoMode } : {}),
         ...identityFields(ev),
     };
 }
@@ -305,6 +335,8 @@ export function brainStatusEventData(ev) {
         ...(num(ev.maxRetries) ? { maxRetries: ev.maxRetries } : {}),
         ...(num(ev.retryInMs) ? { retryInMs: ev.retryInMs } : {}),
         ...(num(ev.retryAtMs) ? { retryAtMs: ev.retryAtMs } : {}),
+        ...(num(ev.elapsedMs) ? { elapsedMs: ev.elapsedMs } : {}),
+        ...(num(ev.timeoutMs) ? { timeoutMs: ev.timeoutMs } : {}),
         ...(num(ev.errorStatus) ? { errorStatus: ev.errorStatus } : {}),
         ...(typeof ev.errClass === "string" && ev.errClass.length > 0 ? { errClass: ev.errClass } : {}),
         ...identityFields(ev),
@@ -522,7 +554,7 @@ function mapTraceEventInner(type, seq, data) {
         case "needs_review":
             return { event: "done", data: { seq, suspended: true } };
         case "failed":
-            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactSecrets(String(data.errorMessage ?? "run failed")) } };
+            return { event: "error", data: { type: "error", errorCode: "WORKER_DOWN", message: redactErrorMessage(String(data.errorMessage ?? "run failed")) ?? "run failed" } };
         case "context_usage":
         case "compaction_outcome":
         case "wiring_manifest":

package/dist/trace/redact.d.ts

@@ -1,17 +1,28 @@
-export declare function setRedactionObserver(fn: ((patternLabel: string, count: number) => void) | undefined): void;
-/**
- * `opts.observe: false` = **照常脱敏,但这一遍不计数**(合并码重扫)。
- *
- * 为什么需要它:本函数对自己的输出**值幂等、计数不幂等** —— URL-userinfo 与 JSON 秘密字段两条 pattern
- * 会命中自己已经替换过的输出并再计一次。于是任何**重扫已脱敏文本**的读路径(耐久待批队列的回读腿,
- * `/v1/approvals/stream` 每 3s 一拍)都会持续给 `redactions_applied_total` 加数,把那个用来识别
- * 「过度脱敏 / pattern 从不触发」的指标灌成不可读。
+/** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
+export declare function ppkScanBytesForTest(): number;
+export declare function resetPpkScanBytesForTest(): void;
+/** Redact unambiguous secret formats from reasoning/CoT before it is persisted to the durable trace log. */
+/** S24 (SILENT-FALLBACK P1): optional redaction observer — rewrites previously had zero fingerprint, so
+ *  over-redaction (mangling legit content) and under-redaction (a pattern that never fires) were both
+ *  invisible. main.ts wires this to `redactions_applied_total{pattern}`. Hot path: the observer only runs
+ *  when a pattern actually matched; the label is derived once per pattern at module load. */
+/** [ref]:第三参 `meta.arm` = 命中的是哪一组臂。加参而不是改参 —— 只读两参的既有观察者原样可用
+ *  (TS 允许少形参),main.ts 把它铺成 `redactions_applied_total{pattern,arm}` 的第二个维度。
  *
- * 🔴 关的是**计数**,不是脱敏:重扫这一遍仍是纵深防御(手改过的行、未来某条写路径漏了脱敏,读面照样
- * 兜住)—— 少脱一次的代价是把凭证投上跨租户可见的运维队列,那条永远不能省。
- */
+ *  🔴 **词义如实**(codex r1 [medium] 三,采纳):这一维说的是「命中的是**哪一条臂**」,**不是**
+ *  「这段文本真的被上游截过」—— server 收到的是纯字节,core 的 `clip()` 是 `slice(0, 80)` **不留标记**
+ *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js:9-11`),截过与天生就短在 wire 上不可区分。
+ *  所以一个 `arm="fragment"` 计数可能来自残片,也可能来自一个恰好落在阈值之上的 look-alike;
+ *  core [ref] 落地后这一支**趋零是证据、不归零不是证明**。别把它当截断事实的度量用。 */
+export type RedactionArm = "full" | "fragment";
+export interface RedactionHitMeta {
+    /** `"fragment"` = {@link FRAGMENT_SECRET_PATTERNS} 里的前缀残片臂;`"full"` = 完整臂。闭集两词。 */
+    arm: RedactionArm;
+}
+export declare function setRedactionObserver(fn: ((patternLabel: string, count: number, meta: RedactionHitMeta) => void) | undefined): void;
 export declare function redactSecrets(text: string, opts?: {
     observe?: boolean;
+    json?: boolean;
 }): string;
 /**
  * 🔴 环 + 深度预算(2026-07-25 补)。原实现是纯递归、**既不记已访问节点也不限深度**,而它的调用位置是