@sema-agent/server 7.68.0 → 7.70.0

package/dist/runs.d.ts

@@ -97,57 +97,6 @@ export declare function markChildrenStoppedByUserOnAbort(signal: AbortSignal, ta
 export declare function isSessionConflictResult(result: {
     terminal: TerminalCause;
 }): boolean;
-/**
- * E18 resume-at CALLER error → an HTTP 4xx. A bad/stale resume-at target (the resolved entryId is gone or is not a
- * settled message boundary) surfaces as a FAILED TaskResult carrying a `resume_at.*` errorCode (core swallows the
- * prepare-throw into the result, exactly like a session conflict — runtask catch → status:"failed"+errorCode). The
- * sync path otherwise 200s a failed result; map these to 4xx so a caller mistake reads as one. `not_found` (the
- * entry is genuinely absent) → 404; everything else (not_a_message / conflicts_resume / no_session) → 422.
- *
- * [ref] Phase3: `requireExistingSession` on a genuinely-missing/purged session ALSO surfaces as a failed result
- * (core prepare-task maps the store's `not_found` → `resume.session_not_found`); map it to 404 (the session is gone),
- * the same "caller mistake reads as a 4xx, not a silent 200 fresh run" discipline.
- *
- * [ref] rewind exclusive mode (core 1.292 resumeAtMode:"before"): its two edge rejections ride the same `resume_at.*`
- * prefix (before_target_not_user / before_root_unsupported → 422 via the existing branch, errorCode passed through
- * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
- * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
- * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
- *
- * [ref] 件A([ref] 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
- * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
- * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
- * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
- * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
- * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
- *
- * [ref] (core 7.0.0 片2/3, [ref] S-3): the session capture opt-out's four prepare-throw refusals ride the
- * same pipe. `memory.capture_optout_denied` is TERMINAL (the principal's `allowMemoryOptOut` verdict is an
- * explicit `false`, or the posture is `capture-required` / `governed`-with-absent-verdict — a retry cannot
- * change it) → 403, the `memory.admission_denied` twin. `memory.capture_optout_unpersisted` is the
- * declaration arm's "control-plane record could not be written" refusal — a store outage, retry may succeed
- * → 503 (transient fail-closed, the `memory.admission_required` twin; no retryAfterMs on this one — core
- * mints none, so the sync leg forwards no hint rather than inventing one). `config.memory_capture_spelling`
- * is a TaskSpec authoring mistake (the only legal spelling is the string "off") → 400, the
- * `config.memory_erasure_request` family shape. `config.memory_capture_unsupported` is the DEPLOYMENT SHAPE
- * refusing the declaration (remote/per-run execution with no durable capture-record carrier: the record
- * would not survive to a resume replica) → 409 — the request is well-formed, the deployment's state
- * conflicts with it, the `config.refresh_unavailable` family shape ("change the deployment, not the request").
- * Status choices are pinned by the `config.`/`memory.` family status sets in error-code-catalog-live.test.ts.
- *
- * S-125 件⑥(core 7.4.0 [ref]):`rewind.child_scope_unsupported` —— 这条腿是一个**委派子代**,它的文件编辑
- * 记在**根 session** 的文件历史里,所以「把文件还原到某个 entry」是根 session 的动作、不是子代的;core 在
- * prepare 期响亮拒(零计费,文件一个字节没动)。映射 **422**:请求形式合法、语义上找错了执行者 —— 与
- * `resume_at.*` 的「调用方指错了锚」同一族同一档,而不是 404(目标在,只是不归你)也不是 409(部署状态没冲突)。
- * ⚠️ **前缀不吞**:本码前缀是 `rewind.`,与下面那条 `resume_at.` **开集前缀臂**不同族 —— 它不会被那一臂顺手
- * 兜走(兜走会把一条「找错执行者」的拒答成「锚解析不了」),也不是 `rewind_snapshot.`(那是「快照找不到」)。
- * 三个前缀各自成族,逐码对表见 `test/resume-anchor.test.ts` 的 S-125 `rewind.` 族格。
- * 🔴 **可达性如实**:本仓的 HTTP 面**今天铸不出**这条腿 —— 子代由 core 内部的 Agent 工具派生,
- * `fileHistoryLineage` 是 core prepare 的 internals(不在 `TaskSpec` 上),server 从不直接 prepare 一条带
- * lineage 的子代腿。本臂是**分诊面的完备性**(core 说 X ⇒ wire 形是 Y),不是一条今天在跑的路;将来的
- * 委派入口接线那天零改动即生效。同族其余五码今天**仍落 200-with-failed-body**,那是本批**之前**就存在的
- * 缺口(不是本批回归),已在上述对表格里逐码显式登记为债务,并由那道门看住不许陈腐。
- */
 export declare function resumeAtHttpStatus(result: {
     terminal: TerminalCause;
 }): number | undefined;

package/dist/runs.js

@@ -7,7 +7,7 @@ import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest,
 import { createLedgerSink } from "./trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
-import { buildCancelContext } from "./run-cancel-context.js";
+import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
@@ -66,22 +66,29 @@ export function isSessionConflictResult(result) {
         return result.terminal.code === "conflict";
     return /stale write|concurrent write|conflict/i.test(result.terminal.message ?? "");
 }
+const GOVERNANCE_HTTP_STATUS = {
+    "memory.admission_denied": 403,
+    "memory.admission_required": 503,
+    "memory.capture_optout_denied": 403,
+    "config.tool_mount_denied": 400,
+    "config.locked_key": 400,
+    "usage.window_exhausted": null,
+    "config.compliance_required": null,
+    "config.compliance_denied": null,
+};
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
     if (code === undefined)
         return undefined;
+    if (Object.hasOwn(GOVERNANCE_HTTP_STATUS, code)) {
+        return GOVERNANCE_HTTP_STATUS[code] ?? undefined;
+    }
     if (code === "resume.session_not_found")
         return 404;
     if (code === "rewind_snapshot.unresolvable")
         return 422;
     if (code === "rewind.child_scope_unsupported")
         return 422;
-    if (code === "memory.admission_denied")
-        return 403;
-    if (code === "memory.admission_required")
-        return 503;
-    if (code === "memory.capture_optout_denied")
-        return 403;
     if (code === "memory.capture_optout_unpersisted")
         return 503;
     if (code === "config.memory_capture_spelling")
@@ -164,10 +171,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const preemptCtrl = new AbortController();
     if (preemptEligible)
         preemptable?.set(taskId, preemptCtrl);
-    const cancelledResult = () => {
-        const ctx = buildCancelContext(taskId, startedAt);
-        return { taskId, sessionId: spec.sessionId, terminal: { kind: "failed", code: "cancelled", message: "cancelled by user" }, stats: { turns: 0, tokens: 0 }, ...(ctx ? { cancelContext: ctx } : {}) };
-    };
+    const cancelledResult = (engineResult) => mintCancelledResult({ taskId, sessionId: spec.sessionId ?? "", startedAtMs: startedAt, message: "cancelled by user", ...(engineResult !== undefined ? { engineResult } : {}) });
     const recordDone = (result, status) => {
         metrics?.addGauge("runs_active", -1);
         metrics?.inc("tasks_total", { status });
@@ -214,6 +218,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     heartbeat.unref?.();
     const anchor = new TurnAnchorCapture(captureTurnAnchor, () => metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
     let reached;
+    let observedDone;
+    let cancelledAtDone = false;
+    let settledAsCancel = false;
     let steerableStreamRef;
     let legLive = true;
     const notifiedKeys = new NotifiedKeys();
@@ -341,6 +348,10 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             steerableStreamRef = stream;
             steerable?.set(taskId, stream);
             for await (const ev of stream) {
+                if (ev.type === "done") {
+                    observedDone = ev.result;
+                    cancelledAtDone = cancelCtrl.signal.aborted;
+                }
                 fleetPublisher?.onEvent(ev);
                 await flushPromptManifest();
                 switch (ev.type) {
@@ -375,12 +386,14 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     }
                     evictIfConflict(runner, spec.sessionId, ev.result);
                     {
-                        const safe = await withModelUsage(stripResumeToken(ev.result));
+                        const settled = cancelledAtDone ? cancelledResult(ev.result) : ev.result;
+                        settledAsCancel = failureCodeOf(settled.terminal) === CANCELLED_CODE;
+                        const safe = await withModelUsage(stripResumeToken(settled));
                         await sink.appendDone(safe);
                         reached = { kind: "done", result: safe };
                         const plane = terminalProjection(safe.terminal);
                         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
-                        recordDone(safe, plane.status);
+                        recordDone(safe, failureCodeOf(safe.terminal) === CANCELLED_CODE ? CANCELLED_CODE : plane.status);
                     }
                     continue;
                 }
@@ -427,15 +440,16 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=flush-clean-cancel ${errText(e)}`);
             }
             const c = cancelledResult();
+            settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
             try {
-                await append("failed", { errorMessage: "cancelled by user", errorCode: "cancelled" });
+                await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
             }
             catch (e) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-clean-cancel ${errText(e)}`);
             }
             reached = { kind: "done", result: c };
             await runStore.setTerminal(taskId, "failed", c, terminalProjection(c.terminal).errorMessage ?? null);
-            recordDone(c, "cancelled");
+            recordDone(c, CANCELLED_CODE);
         }
     }
     catch (err) {
@@ -449,6 +463,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             }
             if (reached?.kind === "done") {
                 const plane = terminalProjection(reached.result.terminal);
+                settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
             }
             else if (reached?.kind === "suspended") {
@@ -457,10 +472,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             else if (reached?.kind === "needs_review") {
                 await runStore.setNeedsReview(taskId);
             }
-            else if (cancelCtrl.signal.aborted) {
+            else if (cancelCtrl.signal.aborted && observedDone === undefined) {
                 const c = cancelledResult();
+                settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
                 try {
-                    await append("failed", { errorMessage: "cancelled by user", errorCode: "cancelled" });
+                    await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
                 }
                 catch (e) {
                     recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-thrown-cancel ${errText(e)}`);
@@ -468,6 +484,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 await runStore.setTerminal(taskId, "failed", c, terminalProjection(c.terminal).errorMessage ?? null);
             }
             else {
+                settledAsCancel = false;
                 const safeMsg = redactErrorMessage(message) ?? message;
                 try {
                     await append("failed", { errorMessage: safeMsg });
@@ -481,13 +498,13 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         catch {
         }
         if (reached?.kind === "done")
-            recordDone(reached.result, failureCodeOf(reached.result.terminal) === "cancelled" ? "cancelled" : terminalProjection(reached.result.terminal).status);
+            recordDone(reached.result, failureCodeOf(reached.result.terminal) === CANCELLED_CODE ? CANCELLED_CODE : terminalProjection(reached.result.terminal).status);
         else if (reached?.kind === "suspended") {
             metrics?.addGauge("runs_active", -1);
             metrics?.inc("tasks_total", { status: "suspended" });
         }
-        else if (cancelCtrl.signal.aborted) {
-            recordDone(null, "cancelled");
+        else if (settledAsCancel) {
+            recordDone(null, CANCELLED_CODE);
         }
         else {
             recordDone(null, "failed");
@@ -498,14 +515,14 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         unregisterEngineNotice();
         if (fleetPublisher) {
             if (reached?.kind === "done")
-                fleetPublisher.onTerminal(failureCodeOf(reached.result.terminal) === "cancelled" ? "cancelled" : terminalProjection(reached.result.terminal).status, fleetRunResiduals(reached.result));
+                fleetPublisher.onTerminal(failureCodeOf(reached.result.terminal) === CANCELLED_CODE ? CANCELLED_CODE : terminalProjection(reached.result.terminal).status, fleetRunResiduals(reached.result));
             else if (reached?.kind === "suspended")
                 fleetPublisher.onTerminal("suspended");
             else if (reached?.kind === "needs_review")
                 fleetPublisher.onTerminal("needs_review");
             else
-                fleetPublisher.onTerminal(cancelCtrl.signal.aborted ? "cancelled" : "failed", {
-                    ...(cancelCtrl.signal.aborted ? { stoppedBy: "user" } : {}),
+                fleetPublisher.onTerminal(settledAsCancel ? CANCELLED_CODE : "failed", {
+                    ...(settledAsCancel ? { stoppedBy: "user" } : {}),
                     ...(spec.sessionId ? { transcriptId: spec.sessionId } : {}),
                 });
         }

package/dist/runtime-governance.js

@@ -1,6 +1,7 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, } from "@sema-agent/core";
 import { SAFETY_MERGE_SPEC } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
+import { operatorAsk } from "./operator-ask.js";
 export function isDelegationToolName(name) {
     return name === DEFAULT_SUBAGENT_TOOL_NAME;
 }
@@ -13,18 +14,18 @@ export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const askSet = new Set(askCommands);
     const shellTools = new Set(tools);
-    const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
+    const ask = (message, rule) => operatorAsk(rule, message);
     return {
         check(req) {
             if (!shellTools.has(req.toolName))
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
-                return ask(`tool "${req.toolName}" call has no parseable command string`);
+                return ask(`tool "${req.toolName}" call has no parseable command string`, "commandPolicy(unparseable command)");
             const parsed = parseLeadingCommandName(command);
             if ("reject" in parsed)
-                return ask(`command is not a single simple command (${parsed.reject})`);
-            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`) : { action: "allow" };
+                return ask(`command is not a single simple command (${parsed.reject})`, "commandPolicy(argv[0] unparseable)");
+            return askSet.has(parsed.name) ? ask(`command "${parsed.name}" requires approval by policy`, `commandPolicy(${parsed.name}=ask)`) : { action: "allow" };
         },
     };
 }

package/dist/tool-approval.d.ts

@@ -143,6 +143,27 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
+    /**
+     * **S-185 / [ref]**(core 7.10.0;**ADDITIVE**,`"tool_approval"` only)—— 这一问**为什么**到了人手上:
+     * 分类器被咨询过、而它**跑不了**。`cause` = core 的闭集词
+     * (`AUTO_MODE_UNAVAILABLE_CAUSES`;core 7.12.0 起 = `error` / `timeout`),`AskRequest.classifierUnavailable`
+     * 逐字透传。core 7.12.0 / [ref] 起 ask 上这一位只由**策略层自声明**铸(引擎自己的那份改骑 deny —— 全文
+     * 在 `approval-card.ts` 同名键的顶注)。
+     *
+     * 🔴 **缺席 ≠「分类器好着呢」**:缺席同时覆盖三形 —— 分类器答上了 / 这只 ask 没资格走分类器
+     * (`classifierMayAnswer` 的闭表)/ 本部署压根没接分类器。消费端**禁**把缺席读成对分类器健康的断言。
+     * 另注:`parse_error`(分类器跑了但答得出格)**不盖这一位** —— 那是另一句话,core 顶注逐字。
+     *
+     * 🔴 **不枚举词表**(值形是 `{cause: string}` 而不是本仓自铸的联合):词表单一属主在 core,抄一份会把
+     * core 加的新词吞成缺席。窄读只判「对象 ∧ `cause` 非空串 ∧ 无多余成员」(`readClassifierUnavailable`,
+     * 帧与卡的**唯一**铸造点 ⇒ 两面结构性同值)。
+     *
+     * 🔴 **echo-only,零消费**:熔断/超时的处置全在 core 的分类器站,server 不许据本键自铸第二套回落判据
+     * —— 同 `origin` / `denialLimitFallback` 两条顶注的同一条禁令(同一语义面两个写者)。
+     */
+    classifierUnavailable?: {
+        cause: string;
+    };
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
      * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。
@@ -156,13 +177,18 @@ export interface ToolApprovalFrame {
      * 执行的那串字节(卡上显示的与真跑的不是同一个东西),**比不披露更坏**;所以 server 只报「有」,显形
      * 归壳的渲染面(转义/高亮/加标记,壳自己定)。
      *
-     * **判据素材** = `boundArgs` 那**一次**序列化的结果(脱敏后的 args),且在**字节帽判定之前**算:
+     * **判据素材** = `boundArgs` 里对**原字节**(`redactDeep` 之前)的那一次序列化,且在**字节帽判定之前**算:
      *  · 超帽时 args 以 `argsOmitted:true` 缺席上帧(卡上根本没有 args)—— 那正是人最看不见输入的一格,
      *    更需要知道「你看不到的那份里有隐形字符」,所以帽不影响本键;
-     *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**;
-     *  · 用脱敏后那份而不是原文,是因为它与卡面/`card_json` 是**同一份**素材(一次算定,三面同源),
-     *    且人眼看到的正是它。理论残余如实记:一段**被遮蔽掉的密钥**里的 bidi 会随遮蔽一起消失 —— 已知、
-     *    可忽略(密钥形不含 bidi),且方向安全(少报一次,不会误报干净为脏)。
+     *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**
+     *    (两次 `JSON.stringify` 共用同一个 try/catch —— 顶注反对的是第二个**静默降级点**,不是第二次序列化);
+     *  · 🔴 **7.70.0(S-103)改素材**:此前用的是脱敏后那份(理由=与卡面同源),而本版 `redactSecrets` 入口
+     *    先剥全部 `\p{Cf}` —— bidi 控制符**整族都是** `\p{Cf}` ⇒ 在脱敏后的文本上扫,本键恒缺席、E-14 整条
+     *    失效(六格红先复现)。所以判据素材改回原字节;同源那条理由让位于「信号必须真」。
+     *  · ⚠️ **上面「字节零改」那一条自 7.70.0 起对 `\p{Cf}` 族不再成立**:帧/卡上的 args 是**剥后**字节
+     *    (与 core 显示面 `renderUntrustedCommandText` 同律,显示的是真正执行的逻辑顺序),壳因此**拿不到
+     *    「在哪一位」**、只能按整只 args 打标。这是有意的取舍(夹层密钥的根治要求单一剥点),不是遗漏;
+     *    要恢复定位面需要给脱敏器一条 span/偏移表回填路(S-103 定案明确不做),不是在这条腿上加特判。
      *
      * 判据**不看 `message`**(引擎/策略写的说明文本,不是待执行输入):本键被壳读作「**待执行的输入**可能
      * 在骗你的眼睛」,把两个来源折进一个布尔会让壳无法判断该给哪一段加显形标记。

package/dist/tool-approval.js

@@ -2,13 +2,13 @@ import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
-import { redactDeep, redactSecrets } from "./trace/redact.js";
+import { normalizeForRedaction, redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readClassifierUnavailable, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -34,7 +34,7 @@ const PARKING_RETRY_AFTER_MS = 250;
 function durableRuleMaterial(material) {
     if (material === undefined)
         return { ruleCommand: null, ruleScopeRoot: null };
-    if (redactSecrets(material.command, { observe: false }) !== material.command) {
+    if (redactSecrets(material.command, { observe: false }) !== normalizeForRedaction(material.command)) {
         defaultLogger.warn("approval rule material withheld: the adjudicated command carries credential-shaped bytes", {
             commandChars: material.command.length,
         });
@@ -141,8 +141,8 @@ function boundArgs(args) {
     const redacted = redactDeep(args);
     let hasBidi = false;
     try {
+        hasBidi = hasBidiControls(JSON.stringify(args));
         const text = JSON.stringify(redacted);
-        hasBidi = hasBidiControls(text);
         if (Buffer.byteLength(text, "utf8") > MAX_APPROVAL_ARGS_BYTES)
             return { omitted: true, hasBidi };
     }
@@ -844,6 +844,7 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
+            ...((c) => (c !== undefined ? { classifierUnavailable: c } : {}))(readClassifierUnavailable(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),

package/dist/trace/core-keyset-guard.d.ts

@@ -18,8 +18,12 @@
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, GateOutcome, Settlement, PausedCause } from "@sema-agent/core";
-/** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
-type AssertAllKeysHandled<T extends never> = T;
+/** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
+ *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
+ *  `observability/run-terminal-log.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
+ *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
+ *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
+export type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
 type NotificationExcluded = "peer" | "crossSessionMessage" | "crossSessionNotice";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
@@ -28,7 +32,7 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
@@ -38,14 +42,14 @@ type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxP
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -21,6 +21,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "peer.idle_subscription",
     "classifier.denial_limit",
     "mcp.injection_dropped",
+    "delegation.ask_unresolvable",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/ledger-events.d.ts

@@ -32,7 +32,8 @@
  *  · **腿自己的带外行**:park/终局/失败/建议/用量/装配自证(不来自流事件)。
  */
 export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" | "status" | "context_usage" | "compacted" | "diagnostics" | "steering_injected" | "compaction_outcome" | "workspace_changed" | "wiring_manifest" | "human_input" | "task_progress" | "task_notification" | "turn_end"
-/** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)。 */
+/** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
+ *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"
 /** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
@@ -59,4 +60,19 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  * 由 `test/engine-notice-wire.test.ts` 的腿覆盖门看守,那才是它的对位门。
  */
  | "engine_notice";
+/**
+ * 🔴 **park 行名的运行时闭集**(合并重扫 [4])。
+ *
+ * 此前这两个词在仓里有**三处**并列的字面量:`ledger-sink.ts` 的 `appendParked` 形参与 `onDone` 的分诊、
+ * 以及 `observability/run-terminal-log.ts` 的脱敏臂。`LedgerEventType` 只是类型联合、运行期取不到,
+ * 所以脱敏臂只能自己再抄一份 —— 而抄的那一份**加词不红**:仓里/引擎加第三个 park 词并登记进
+ * `LedgerEventType` 之后,`appendParked` 与 resume 腿的动态首参照写照落,回放时那一行的
+ * `gate.riskDescriptor.summary` 明文,脱敏臂一声不吭。
+ *
+ * ⇒ 词表落成**运行时常量**由消费点派生;下方两条断言把它与类型联合双向锁死(多一词 / 少一词都 tsc 红)。
+ */
+export declare const PARK_LEDGER_EVENT_TYPES: readonly ["suspended", "needs_review"];
+export type ParkLedgerEventType = (typeof PARK_LEDGER_EVENT_TYPES)[number];
+/** park 行名的**收窄谓词**(消费点要的是「这个词是不是 park 词」+ 类型收窄,不是一次裸 includes)。 */
+export declare function isParkLedgerEventType(v: string): v is ParkLedgerEventType;
 //# sourceMappingURL=ledger-events.d.ts.map

package/dist/trace/ledger-events.js

@@ -1,2 +1,7 @@
-export {};
+export const PARK_LEDGER_EVENT_TYPES = ["suspended", "needs_review"];
+const _parkWordsAreLedgerTypes = true;
+void _parkWordsAreLedgerTypes;
+export function isParkLedgerEventType(v) {
+    return PARK_LEDGER_EVENT_TYPES.includes(v);
+}
 //# sourceMappingURL=ledger-events.js.map

package/dist/trace/ledger-sink.d.ts

@@ -1,7 +1,7 @@
 import { type TerminalCause } from "@sema-agent/core";
 import { brainStatusEventData } from "./project.js";
 import { NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import type { LedgerEventType } from "./ledger-events.js";
+import { type LedgerEventType, type ParkLedgerEventType } from "./ledger-events.js";
 /**
  * LedgerSink — the SINGLE "stream event → durable runs-ledger" projection, shared by the background leg
  * (runs.ts `runInBackground`) and the sync `/v1/tasks/stream` detach lane (server.ts, `x-detach-on-disconnect`).
@@ -61,13 +61,15 @@ export interface LedgerSink {
     }): void;
     /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the `checkpointGate` is persisted —
      *  never the capability `checkpointToken` (search [18] Q1b).
-     *  ⚠️ **"non-secret" was the old wording and it is not true** ([ref] R3, 2026-09-03 — wording only, behaviour
-     *  unchanged; [ref] decides the arm): the gate carries NO capability token, but its `riskDescriptor.summary` /
-     *  `shadowedRule` are model-/human-controlled display text that [ref] measured carrying a PEM private-key
-     *  body verbatim. This durable row replays on every `GET /v1/runs/:id/events` reconnect and is NOT backfilled
-     *  by core [ref]'s mint-point fix — it is the third face of the `checkpointGate` sister item recorded in
-     *  `http/routes/approvals-assistant.ts` (`redactPendingDisclosures` header). */
-    appendParked(kind: "suspended" | "needs_review", result: unknown): Promise<void>;
+     *  🔴 **The gate is redacted, not "non-secret"** ([ref], 2026-09-10 — the arm [ref] R3 left open): it carries no
+     *  capability token, but its `reason` and the `riskDescriptor` leaf family are model-/human-controlled display
+     *  text that [ref] measured carrying a PEM private-key body verbatim, and this durable row replays on EVERY
+     *  `GET /v1/runs/:id/events` reconnect (core [ref]'s mint-point fix does not backfill rows already written).
+     *  The redaction owner is NOT this writer: it is `redactLedgerEventData` — the one confluence every ledger row
+     *  crosses at the three store twins' `appendEvent` AND again on the read face (idempotent). Redacting here too
+     *  would put two writers on one semantic surface; the other park writers (`http/server.ts`'s two resume legs)
+     *  would still need it, and a per-writer arm is exactly the shape that drifts. */
+    appendParked(kind: ParkLedgerEventType, result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */
     appendDone(result: unknown): Promise<void>;

package/dist/trace/ledger-sink.js

@@ -2,6 +2,7 @@ import { terminalProjection } from "@sema-agent/core";
 import { redactSecrets } from "./redact.js";
 import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
+import { isParkLedgerEventType } from "./ledger-events.js";
 export function createSerialLedgerAppend(appendEvent, startSeq) {
     let seq = startSeq;
     let chain = Promise.resolve();
@@ -156,7 +157,7 @@ export function createLedgerSink(opts) {
         await flush();
         if (result.terminal.kind === "paused") {
             const parkKind = terminalProjection(result.terminal).status;
-            if (parkKind === "suspended" || parkKind === "needs_review") {
+            if (isParkLedgerEventType(parkKind)) {
                 await appendParked(parkKind, result);
                 return;
             }

package/dist/trace/project.d.ts

@@ -357,11 +357,12 @@ export declare function workspaceChangedEventData(ev: {
  *       ([ref],7.57.0 已发)答的是「**若此刻提交**会不会武装」,本段答的是「**这条真跑起来的腿**武装了吗」;
  *       同一个主体(调用方自己的 run)、同一条轴,只差事前/事后。剥掉它,壳就只能拿事前预测冒充事后事实;
  *    ② **两个值都是引擎派生的闭形**:`armed` 布尔,`reason` 是 core 的闭集词(`AUTO_MODE_ARM_REASONS`:
- *       armed / no_intent / no_face / denied / resolver_fault / latch_open)—— 非用户内容,不脱敏、逐字;
+ *       armed / no_intent / no_face / denied / resolver_fault;core 7.12.0 起 `latch_open` 随熔断/单向闩
+ *       整族退役)—— 非用户内容,不脱敏、逐字;
  *    ③ **不是 governance 侧信道**:它描述的是**本腿**的武装结论,与 lockedConfig/compliance/memoryAdmission/
  *       retention 四位无函数关系;而 `denied` 这一词所披露的「组织把这一位关了」在 [ref] 读面上**本就已经**
  *       对同一租户可见(`org_denied`),本段没有扩大任何受众。
- *    🔴 **逐字透传,不映射**:core 的六词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
+ *    🔴 **逐字透传,不映射**:core 的五词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
  *       —— 两张表回答的是两个问题、粒度也不同(core 的 `denied` 一词对应本仓的 `org_denied` / `local_denied`
  *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
  *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):

package/dist/trace/redact.d.ts

@@ -1,3 +1,31 @@
+/**
+ * Trace thinking-block redaction (service-side). Per core [R57]: the agent's reasoning/CoT is emitted on the
+ * live TaskEvent stream but DELIBERATELY kept out of the metadata Tracer because CoT may contain reasoned-about
+ * secrets (and is large / ToS-sensitive for some providers). Persisting it for the trace UI is the deployment's
+ * call — so when we DO persist it, redact unambiguous secret formats first. Conservative on purpose: only clear
+ * key/token shapes are redacted. ⚠️ It is NOT exhaustive: unrecognised secret formats (a free-text password,
+ * a JWT) pass through, and the broad `Bearer <20+ chars>` rule can over-match legitimate CoT (false positives
+ * tolerated — over-redacting trace text is safe). For sensitive deployments, disable thinking capture entirely
+ * via TRACE_THINKING=false. This is a seam — deployments can extend the patterns.
+ *
+ * 两组臂,顺序即优先序:{@link FULL_SECRET_PATTERNS}(完整形)在前,{@link FRAGMENT_SECRET_PATTERNS}
+ * ([ref] 前缀残片,上游先截后脱的产物 ⇒ 带 `:partial` 后缀的 token)在后。
+ */
+/** 本模块替换 token 的**闭形**正则源(`«redacted»` / `«redacted:aws-key»` / `«redacted:gh-token:partial»` …):
+ *  URL-userinfo 臂用它把「用户名位上已经是本模块 token」整个当一个用户名单元吃掉。模块加载时对
+ *  {@link REDACTION_TOKENS} 逐个校验闭形(表加了新 token 形而这里没跟 ⇒ 加载即抛,fail-closed)。 */
+import { stripFormatCharacters } from "@sema-agent/core";
+/**
+ * `redactSecrets` 的**归一化前置**(S-103 ①):把全部 `\p{Cf}`(零宽空格 / 词连接符 / BOM / 软连字符 / ZWJ / ZWNJ …)
+ * 剥掉。实现单一属主是 core 的 `stripFormatCharacters`(`@sema-agent/core`,7.3.1 起导出,正是为「先扫描后渲染」这一序
+ * 开的口),本模块只**转出**它,不抄第二份 —— 两份实现漂了就等于两个「什么是格式字符」的定义。
+ *
+ * 🔴 **需要判断「这次脱敏到底有没有认出凭据形」的调用方,比较基准是它、不是原文**:
+ * `redactSecrets(x) !== x` 在本版里对**任何**含 Cf 的文本都为真(输出是剥后文本),拿它当谓词会把一条带 emoji ZWJ
+ * 的普通 `git commit` 判成「含凭据形」;正确的谓词是 `redactSecrets(x) !== normalizeForRedaction(x)`。
+ * 现役消费方:`src/tool-approval.ts` 的 `durableRuleMaterial`(规则车道素材闸)与语料的 FP=0 格。
+ */
+export declare const normalizeForRedaction: typeof stripFormatCharacters;
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;