@sema-agent/server 7.57.0 → 7.59.0

package/dist/trace/project.d.ts

@@ -343,8 +343,47 @@ export declare function workspaceChangedEventData(ev: {
  *    ⚠️ 与 `storeWired` **不同**:本仓这两条至今未接(`RunnerDeps.permissionRuleSyncWired` /
  *    `permissionRuleOrg` 全树零声明点,2026-08-10 [ref] 复扫亲验)⇒ 今天恒 `false`,这是**真值**不是
  *    缺席。哪天接上其中任一条,连本句一起改 —— 这一行是它的登记处。
+ *  · `modelGate`(可选段 `{ class, removed[], restore }`;core fc52b4d4 [ref] / [ref] 片2b,[ref] 提货件,
+ *    黑板 [ref] @server①)—— **裁:租户可见**。它是 per-session 的**读面**:「我这条 session 因为工具-模型门卸掉了
+ *    哪些工具」——与 operator 通告 `config.tool_model_gate_removed` **同决策同源**(core 从同一张 trim 表铸两面),
+ *    但通告归 operator 车道(engine_notice 白名单,附录 D),本段归租户:消费端(cli L-70 [ref])要在**首帧一次读**
+ *    里知道自己少了哪些工具、怎么恢复,否则只能等到调用被拒才发现。三键都是引擎派生值:`class` = 合并 gate 表的 class 行键
+ *    (prepare-task 对表外 class 响亮拒),`removed` = 工具 wire 名(core 表键,非用户内容),`restore` = core 铸的一句恢复指引(引擎文案)
+ *    ⇒ 不脱敏、逐字。多 class 同卸 ⇒ core 报首 class + removed **并集**(core 合并律;本仓不按 class 过滤)。
+ *    仅本 run 有门卸时在场:**缺席 = 本 run 没卸**,不铸空段、不铸 `removed: []`。畸形(三键任一缺席/形不合)
+ *    ⇒ 整段按缺席 —— 不铸半段,半段会被读成「只卸了这些」。它不构成 governance 四布尔的侧信道(门卸由
+ *    模型/门 class 决定,与 lockedConfig/compliance/memoryAdmission/retention 无函数关系)。
+ *  · `autoMode`(`{ armed: boolean, reason: AutoModeArmReason }`;core 7.3.1 [ref],147③ 提货件,黑板 [ref])
+ *    —— **裁:租户可见**。它是 per-leg 的**读面**:「我这条腿的 auto 模式武装了吗?没武装是卡在哪一臂?」
+ *    ① **同主体同受众**:本仓早已把同一件事投在租户面上 —— `/v1/capabilities.permissionModeAuto.{armed,reason}`
+ *       ([ref],7.57.0 已发)答的是「**若此刻提交**会不会武装」,本段答的是「**这条真跑起来的腿**武装了吗」;
+ *       同一个主体(调用方自己的 run)、同一条轴,只差事前/事后。剥掉它,壳就只能拿事前预测冒充事后事实;
+ *    ② **两个值都是引擎派生的闭形**:`armed` 布尔,`reason` 是 core 的闭集词(`AUTO_MODE_ARM_REASONS`:
+ *       armed / no_intent / no_face / denied / resolver_fault / latch_open)—— 非用户内容,不脱敏、逐字;
+ *    ③ **不是 governance 侧信道**:它描述的是**本腿**的武装结论,与 lockedConfig/compliance/memoryAdmission/
+ *       retention 四位无函数关系;而 `denied` 这一词所披露的「组织把这一位关了」在 [ref] 读面上**本就已经**
+ *       对同一租户可见(`org_denied`),本段没有扩大任何受众。
+ *    🔴 **逐字透传,不映射**:core 的六词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
+ *       —— 两张表回答的是两个问题、粒度也不同(core 的 `denied` 一词对应本仓的 `org_denied` / `local_denied`
+ *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
+ *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):
+ *       settings 层的 kill-switch 折的是**模式**(`effectivePermissionMode`:auto → default),于是 resolve-spec
+ *       阶段④ 压根不写意图座 `TaskSpec.autoModeRequested` ⇒ core 的武装谓词第一项就落空;而本地 env 腿折的是
+ *       **caps**(`applyLocalAutoModeDeny`),模式不动、座照写 ⇒ core 才报 `denied`。两条腿在 manifest 上
+ *       **分不开**,要分辨得读 `/v1/capabilities`。对照表与保鲜钉在 `test/wiring-manifest-projection.test.ts`
+ *       的 147③ 节,分岔的行为面格在 `test/permission-mode-shell-gate-translation.test.ts`;
+ *       本函数**只透传**,一个字都不换。
+ *    ⚠️ 缺席 ≠ 「不适用」:core 顶注逐字「absence here means an older mint or an external derivation, never
+ *       "not applicable"」⇒ 缺席时**不铸** `armed:false`(那会把「老 mint 写的行」谎报成「这条腿确实没武装」)。
+ *    ⚠️ **自相矛盾按缺席**:core 把 `armed ⇔ reason === "armed"` 写成段内不变量并在 derive 点拒(`readAutoModeFact`
+ *       抛)。账本回放/第三方 producer 送来的矛盾对若原样上 wire,按 `armed` 读与按 `reason` 读的消费端会得到
+ *       **相反**的答案 —— 这条轴上(@cli `sema doctor permissions` 正读它)两个答案比没答案更坏 ⇒ 整段不铸。
+ *       这不是改语义:它与本函数「畸形值一律按缺席」是同一条规则,而这条不变量是 core 自己写的段内契约。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
- * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来。
+ * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
+ * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格
+ * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
+ * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
@@ -410,8 +449,9 @@ export declare function humanInputEventData(ev: {
 }): Record<string, unknown>;
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
- *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open),
- *  not a core event replay. Whitelist: the closed phase union + neutral bounded detail (redacted) + retryInSec. */
+ *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open, and
+ *  since core 7.3.1 / [ref] the pre-failure `waiting_first_token` wait), not a core event replay.
+ *  Whitelist: the closed phase union verbatim + neutral bounded detail (redacted) + the bounded numeric seats. */
 export declare function brainStatusEventData(ev: {
     phase: string;
     detail?: string;
@@ -422,6 +462,8 @@ export declare function brainStatusEventData(ev: {
     errClass?: string;
     retryAtMs?: number;
     errorStatus?: number;
+    elapsedMs?: number;
+    timeoutMs?: number;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -250,6 +250,25 @@ export function wiringManifestEventData(ev) {
         ...(bool(rulesIn.syncWired) !== undefined ? { syncWired: rulesIn.syncWired } : {}),
         ...(bool(rulesIn.orgGoverned) !== undefined ? { orgGoverned: rulesIn.orgGoverned } : {}),
     });
+    const gateIn = sec(m.modelGate);
+    const modelGate = (() => {
+        if (gateIn === undefined)
+            return undefined;
+        const cls = str(gateIn.class);
+        const restore = str(gateIn.restore);
+        const removed = Array.isArray(gateIn.removed) && gateIn.removed.every((r) => typeof r === "string") ? [...gateIn.removed] : undefined;
+        return cls !== undefined && restore !== undefined && removed !== undefined ? { class: cls, removed, restore } : undefined;
+    })();
+    const autoIn = sec(m.autoMode);
+    const autoMode = (() => {
+        if (autoIn === undefined)
+            return undefined;
+        const armed = bool(autoIn.armed);
+        const reason = str(autoIn.reason);
+        if (armed === undefined || reason === undefined)
+            return undefined;
+        return armed === (reason === "armed") ? { armed, reason } : undefined;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
@@ -261,6 +280,8 @@ export function wiringManifestEventData(ev) {
         ...(str(sessionIn.store) !== undefined ? { session: { store: sessionIn.store } } : {}),
         ...(fleet !== undefined ? { fleet } : {}),
         ...(permissionRules !== undefined ? { permissionRules } : {}),
+        ...(modelGate !== undefined ? { modelGate } : {}),
+        ...(autoMode !== undefined ? { autoMode } : {}),
         ...identityFields(ev),
     };
 }
@@ -314,6 +335,8 @@ export function brainStatusEventData(ev) {
         ...(num(ev.maxRetries) ? { maxRetries: ev.maxRetries } : {}),
         ...(num(ev.retryInMs) ? { retryInMs: ev.retryInMs } : {}),
         ...(num(ev.retryAtMs) ? { retryAtMs: ev.retryAtMs } : {}),
+        ...(num(ev.elapsedMs) ? { elapsedMs: ev.elapsedMs } : {}),
+        ...(num(ev.timeoutMs) ? { timeoutMs: ev.timeoutMs } : {}),
         ...(num(ev.errorStatus) ? { errorStatus: ev.errorStatus } : {}),
         ...(typeof ev.errClass === "string" && ev.errClass.length > 0 ? { errClass: ev.errClass } : {}),
         ...identityFields(ev),

package/dist/trace/redact.js

@@ -1,7 +1,7 @@
 import { recordFailOpen } from "../observability/fail-open.js";
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
 const FULL_SECRET_PATTERNS = [
-    [/-----BEGIN[^-]+PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END[^-]+PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
+    [/-----BEGIN[^-](?:[^-](?:[^-]|-(?!-))*)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END[^-](?:[^-](?:[^-]|-(?!-))*)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
     [/\bsk-[A-Za-z0-9_-]{16,}\b/g, "«redacted:key»"],
     [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, "«redacted:gh-token»"],
@@ -220,8 +220,12 @@ function isPemFenceLabel(s, from, to) {
         return false;
     if (!s.startsWith(PEM_KEY_WORD, end - PEM_KEY_WORD.length))
         return false;
-    for (let i = from; i < to; i++)
-        if (s.charCodeAt(i) === 45)
+    if (s.charCodeAt(from) === 45)
+        return false;
+    if (s.charCodeAt(from + 1) === 45)
+        return false;
+    for (let i = from + 1; i < to; i++)
+        if (s.charCodeAt(i) === 45 && s.charCodeAt(i + 1) === 45)
             return false;
     return true;
 }

package/dist/trace/sema-provenance.d.ts

@@ -11,7 +11,22 @@
  * (它是渲染判别,不是 lane 词)。
  */
 import type { SemaProvenance } from "@sema-agent/core";
+/** wire 放行的 lane 词(PROJECTED)。 */
 export declare const SEMA_PROVENANCE_KINDS: readonly ["agent_message"];
+/**
+ * 有意**不**放行的 lane 词(EXCLUDED,逐词记账;运行期落到「丢整键」臂 —— 与闭集外的未知词同臂,但这里的词是
+ * core 词表**内**的、经人裁定不上 wire 的):
+ *  · `cross_session_message` —— core fc52b4d4 [ref] §4.1(session-box drain 铸;`from` 是对端**地址**、`peerMeta`
+ *    携 typed peer 记录)。[ref] 候:本仓不可达(`RunnerDeps.peerDirectory` 零声明点)+ 注入帧渲染形候 [ref] @server③
+ *    表态;与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,接线时三处同翻。
+ *  · `cross_session_notice` —— core 7.4.0 [ref] §4.4/§5.2(片4;本闭集 2026-09-05 真红出它)。**同一条车道的
+ *    第二个载体**,不是新判据:同一个 session-box drain 铸(`agents/peer-session-drain.js` 的 notice 臂),同一个
+ *    `RunnerDeps.peerDirectory` 座前提 ⇒ 本仓同样不可达;渲染形与它的载体 `crossSessionNotice`(core-keyset-guard.ts
+ *    ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的裁定而不是新增特判:
+ *    车道没接线时放行一个 lane 词,等于替 [ref] 预先声明一种 cli 渲染形。[ref] 接线那天三处(本簿、载体键、
+ *    ①-nested 的 `peerMeta`)同批翻。
+ */
+export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message", "cross_session_notice"];
 /** 本仓两条腿入参的**形**(不是 core 类型:入参是运行期载荷,`kind` 先当 string 收、经闭集才成 typed)。 */
 export interface SemaProvenanceInput {
     kind: string;

package/dist/trace/sema-provenance.js

@@ -1,6 +1,9 @@
 export const SEMA_PROVENANCE_KINDS = ["agent_message"];
+export const SEMA_PROVENANCE_KINDS_EXCLUDED = ["cross_session_message", "cross_session_notice"];
 const _semaProvenanceExhaustive = true;
 void _semaProvenanceExhaustive;
+const _semaProvenanceNoDoubleBook = true;
+void _semaProvenanceNoDoubleBook;
 export function semaProvenanceOrAbsent(p) {
     if (!SEMA_PROVENANCE_KINDS.includes(p.kind))
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.57.0",
+  "version": "7.59.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.2.0",
-    "@sema-agent/settings-schema": "1.4.0",
+    "@sema-agent/core": "7.4.0",
+    "@sema-agent/settings-schema": "1.6.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",