@sema-agent/server 7.69.0 → 7.70.0

package/dist/runs.js

@@ -7,7 +7,7 @@ import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest,
 import { createLedgerSink } from "./trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
-import { buildCancelContext } from "./run-cancel-context.js";
+import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
@@ -66,30 +66,35 @@ export function isSessionConflictResult(result) {
         return result.terminal.code === "conflict";
     return /stale write|concurrent write|conflict/i.test(result.terminal.message ?? "");
 }
+const GOVERNANCE_HTTP_STATUS = {
+    "memory.admission_denied": 403,
+    "memory.admission_required": 503,
+    "memory.capture_optout_denied": 403,
+    "config.tool_mount_denied": 400,
+    "config.locked_key": 400,
+    "usage.window_exhausted": null,
+    "config.compliance_required": null,
+    "config.compliance_denied": null,
+};
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
     if (code === undefined)
         return undefined;
+    if (Object.hasOwn(GOVERNANCE_HTTP_STATUS, code)) {
+        return GOVERNANCE_HTTP_STATUS[code] ?? undefined;
+    }
     if (code === "resume.session_not_found")
         return 404;
     if (code === "rewind_snapshot.unresolvable")
         return 422;
     if (code === "rewind.child_scope_unsupported")
         return 422;
-    if (code === "memory.admission_denied")
-        return 403;
-    if (code === "memory.admission_required")
-        return 503;
-    if (code === "memory.capture_optout_denied")
-        return 403;
     if (code === "memory.capture_optout_unpersisted")
         return 503;
     if (code === "config.memory_capture_spelling")
         return 400;
     if (code === "config.invalid_checkpoint_store")
         return 400;
-    if (code === "config.tool_mount_denied")
-        return 400;
     if (code === "config.memory_capture_unsupported")
         return 409;
     if (!code.startsWith("resume_at."))
@@ -166,10 +171,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const preemptCtrl = new AbortController();
     if (preemptEligible)
         preemptable?.set(taskId, preemptCtrl);
-    const cancelledResult = () => {
-        const ctx = buildCancelContext(taskId, startedAt);
-        return { taskId, sessionId: spec.sessionId, terminal: { kind: "failed", code: "cancelled", message: "cancelled by user" }, stats: { turns: 0, tokens: 0 }, ...(ctx ? { cancelContext: ctx } : {}) };
-    };
+    const cancelledResult = (engineResult) => mintCancelledResult({ taskId, sessionId: spec.sessionId ?? "", startedAtMs: startedAt, message: "cancelled by user", ...(engineResult !== undefined ? { engineResult } : {}) });
     const recordDone = (result, status) => {
         metrics?.addGauge("runs_active", -1);
         metrics?.inc("tasks_total", { status });
@@ -216,6 +218,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     heartbeat.unref?.();
     const anchor = new TurnAnchorCapture(captureTurnAnchor, () => metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
     let reached;
+    let observedDone;
+    let cancelledAtDone = false;
+    let settledAsCancel = false;
     let steerableStreamRef;
     let legLive = true;
     const notifiedKeys = new NotifiedKeys();
@@ -343,6 +348,10 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             steerableStreamRef = stream;
             steerable?.set(taskId, stream);
             for await (const ev of stream) {
+                if (ev.type === "done") {
+                    observedDone = ev.result;
+                    cancelledAtDone = cancelCtrl.signal.aborted;
+                }
                 fleetPublisher?.onEvent(ev);
                 await flushPromptManifest();
                 switch (ev.type) {
@@ -377,12 +386,14 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     }
                     evictIfConflict(runner, spec.sessionId, ev.result);
                     {
-                        const safe = await withModelUsage(stripResumeToken(ev.result));
+                        const settled = cancelledAtDone ? cancelledResult(ev.result) : ev.result;
+                        settledAsCancel = failureCodeOf(settled.terminal) === CANCELLED_CODE;
+                        const safe = await withModelUsage(stripResumeToken(settled));
                         await sink.appendDone(safe);
                         reached = { kind: "done", result: safe };
                         const plane = terminalProjection(safe.terminal);
                         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
-                        recordDone(safe, plane.status);
+                        recordDone(safe, failureCodeOf(safe.terminal) === CANCELLED_CODE ? CANCELLED_CODE : plane.status);
                     }
                     continue;
                 }
@@ -429,15 +440,16 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=flush-clean-cancel ${errText(e)}`);
             }
             const c = cancelledResult();
+            settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
             try {
-                await append("failed", { errorMessage: "cancelled by user", errorCode: "cancelled" });
+                await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
             }
             catch (e) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-clean-cancel ${errText(e)}`);
             }
             reached = { kind: "done", result: c };
             await runStore.setTerminal(taskId, "failed", c, terminalProjection(c.terminal).errorMessage ?? null);
-            recordDone(c, "cancelled");
+            recordDone(c, CANCELLED_CODE);
         }
     }
     catch (err) {
@@ -451,6 +463,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             }
             if (reached?.kind === "done") {
                 const plane = terminalProjection(reached.result.terminal);
+                settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
             }
             else if (reached?.kind === "suspended") {
@@ -459,10 +472,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             else if (reached?.kind === "needs_review") {
                 await runStore.setNeedsReview(taskId);
             }
-            else if (cancelCtrl.signal.aborted) {
+            else if (cancelCtrl.signal.aborted && observedDone === undefined) {
                 const c = cancelledResult();
+                settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
                 try {
-                    await append("failed", { errorMessage: "cancelled by user", errorCode: "cancelled" });
+                    await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
                 }
                 catch (e) {
                     recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-thrown-cancel ${errText(e)}`);
@@ -470,6 +484,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 await runStore.setTerminal(taskId, "failed", c, terminalProjection(c.terminal).errorMessage ?? null);
             }
             else {
+                settledAsCancel = false;
                 const safeMsg = redactErrorMessage(message) ?? message;
                 try {
                     await append("failed", { errorMessage: safeMsg });
@@ -483,13 +498,13 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         catch {
         }
         if (reached?.kind === "done")
-            recordDone(reached.result, failureCodeOf(reached.result.terminal) === "cancelled" ? "cancelled" : terminalProjection(reached.result.terminal).status);
+            recordDone(reached.result, failureCodeOf(reached.result.terminal) === CANCELLED_CODE ? CANCELLED_CODE : terminalProjection(reached.result.terminal).status);
         else if (reached?.kind === "suspended") {
             metrics?.addGauge("runs_active", -1);
             metrics?.inc("tasks_total", { status: "suspended" });
         }
-        else if (cancelCtrl.signal.aborted) {
-            recordDone(null, "cancelled");
+        else if (settledAsCancel) {
+            recordDone(null, CANCELLED_CODE);
         }
         else {
             recordDone(null, "failed");
@@ -500,14 +515,14 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         unregisterEngineNotice();
         if (fleetPublisher) {
             if (reached?.kind === "done")
-                fleetPublisher.onTerminal(failureCodeOf(reached.result.terminal) === "cancelled" ? "cancelled" : terminalProjection(reached.result.terminal).status, fleetRunResiduals(reached.result));
+                fleetPublisher.onTerminal(failureCodeOf(reached.result.terminal) === CANCELLED_CODE ? CANCELLED_CODE : terminalProjection(reached.result.terminal).status, fleetRunResiduals(reached.result));
             else if (reached?.kind === "suspended")
                 fleetPublisher.onTerminal("suspended");
             else if (reached?.kind === "needs_review")
                 fleetPublisher.onTerminal("needs_review");
             else
-                fleetPublisher.onTerminal(cancelCtrl.signal.aborted ? "cancelled" : "failed", {
-                    ...(cancelCtrl.signal.aborted ? { stoppedBy: "user" } : {}),
+                fleetPublisher.onTerminal(settledAsCancel ? CANCELLED_CODE : "failed", {
+                    ...(settledAsCancel ? { stoppedBy: "user" } : {}),
                     ...(spec.sessionId ? { transcriptId: spec.sessionId } : {}),
                 });
         }

package/dist/tool-approval.d.ts

@@ -145,9 +145,10 @@ export interface ToolApprovalFrame {
     origin?: string;
     /**
      * **S-185 / [ref]**(core 7.10.0;**ADDITIVE**,`"tool_approval"` only)—— 这一问**为什么**到了人手上:
-     * auto 档的分类器被咨询过、而它**跑不了**。`cause` = core 的闭三词
-     * (`AUTO_MODE_UNAVAILABLE_CAUSES` = `error` / `timeout` / `breaker_open`),`AskRequest.classifierUnavailable`
-     * 逐字透传。
+     * 分类器被咨询过、而它**跑不了**。`cause` = core 的闭集词
+     * (`AUTO_MODE_UNAVAILABLE_CAUSES`;core 7.12.0 起 = `error` / `timeout`),`AskRequest.classifierUnavailable`
+     * 逐字透传。core 7.12.0 / [ref] 起 ask 上这一位只由**策略层自声明**铸(引擎自己的那份改骑 deny —— 全文
+     * 在 `approval-card.ts` 同名键的顶注)。
      *
      * 🔴 **缺席 ≠「分类器好着呢」**:缺席同时覆盖三形 —— 分类器答上了 / 这只 ask 没资格走分类器
      * (`classifierMayAnswer` 的闭表)/ 本部署压根没接分类器。消费端**禁**把缺席读成对分类器健康的断言。
@@ -176,13 +177,18 @@ export interface ToolApprovalFrame {
      * 执行的那串字节(卡上显示的与真跑的不是同一个东西),**比不披露更坏**;所以 server 只报「有」,显形
      * 归壳的渲染面(转义/高亮/加标记,壳自己定)。
      *
-     * **判据素材** = `boundArgs` 那**一次**序列化的结果(脱敏后的 args),且在**字节帽判定之前**算:
+     * **判据素材** = `boundArgs` 里对**原字节**(`redactDeep` 之前)的那一次序列化,且在**字节帽判定之前**算:
      *  · 超帽时 args 以 `argsOmitted:true` 缺席上帧(卡上根本没有 args)—— 那正是人最看不见输入的一格,
      *    更需要知道「你看不到的那份里有隐形字符」,所以帽不影响本键;
-     *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**;
-     *  · 用脱敏后那份而不是原文,是因为它与卡面/`card_json` 是**同一份**素材(一次算定,三面同源),
-     *    且人眼看到的正是它。理论残余如实记:一段**被遮蔽掉的密钥**里的 bidi 会随遮蔽一起消失 —— 已知、
-     *    可忽略(密钥形不含 bidi),且方向安全(少报一次,不会误报干净为脏)。
+     *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**
+     *    (两次 `JSON.stringify` 共用同一个 try/catch —— 顶注反对的是第二个**静默降级点**,不是第二次序列化);
+     *  · 🔴 **7.70.0(S-103)改素材**:此前用的是脱敏后那份(理由=与卡面同源),而本版 `redactSecrets` 入口
+     *    先剥全部 `\p{Cf}` —— bidi 控制符**整族都是** `\p{Cf}` ⇒ 在脱敏后的文本上扫,本键恒缺席、E-14 整条
+     *    失效(六格红先复现)。所以判据素材改回原字节;同源那条理由让位于「信号必须真」。
+     *  · ⚠️ **上面「字节零改」那一条自 7.70.0 起对 `\p{Cf}` 族不再成立**:帧/卡上的 args 是**剥后**字节
+     *    (与 core 显示面 `renderUntrustedCommandText` 同律,显示的是真正执行的逻辑顺序),壳因此**拿不到
+     *    「在哪一位」**、只能按整只 args 打标。这是有意的取舍(夹层密钥的根治要求单一剥点),不是遗漏;
+     *    要恢复定位面需要给脱敏器一条 span/偏移表回填路(S-103 定案明确不做),不是在这条腿上加特判。
      *
      * 判据**不看 `message`**(引擎/策略写的说明文本,不是待执行输入):本键被壳读作「**待执行的输入**可能
      * 在骗你的眼睛」,把两个来源折进一个布尔会让壳无法判断该给哪一段加显形标记。

package/dist/tool-approval.js

@@ -2,7 +2,7 @@ import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
-import { redactDeep, redactSecrets } from "./trace/redact.js";
+import { normalizeForRedaction, redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
@@ -34,7 +34,7 @@ const PARKING_RETRY_AFTER_MS = 250;
 function durableRuleMaterial(material) {
     if (material === undefined)
         return { ruleCommand: null, ruleScopeRoot: null };
-    if (redactSecrets(material.command, { observe: false }) !== material.command) {
+    if (redactSecrets(material.command, { observe: false }) !== normalizeForRedaction(material.command)) {
         defaultLogger.warn("approval rule material withheld: the adjudicated command carries credential-shaped bytes", {
             commandChars: material.command.length,
         });
@@ -141,8 +141,8 @@ function boundArgs(args) {
     const redacted = redactDeep(args);
     let hasBidi = false;
     try {
+        hasBidi = hasBidiControls(JSON.stringify(args));
         const text = JSON.stringify(redacted);
-        hasBidi = hasBidiControls(text);
         if (Buffer.byteLength(text, "utf8") > MAX_APPROVAL_ARGS_BYTES)
             return { omitted: true, hasBidi };
     }

package/dist/trace/core-keyset-guard.d.ts

@@ -18,8 +18,12 @@
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, GateOutcome, Settlement, PausedCause } from "@sema-agent/core";
-/** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
-type AssertAllKeysHandled<T extends never> = T;
+/** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
+ *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
+ *  `observability/run-terminal-log.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
+ *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
+ *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
+export type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
 type NotificationExcluded = "peer" | "crossSessionMessage" | "crossSessionNotice";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
@@ -38,7 +42,7 @@ type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxP
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;

package/dist/trace/ledger-events.d.ts

@@ -32,7 +32,8 @@
  *  · **腿自己的带外行**:park/终局/失败/建议/用量/装配自证(不来自流事件)。
  */
 export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" | "status" | "context_usage" | "compacted" | "diagnostics" | "steering_injected" | "compaction_outcome" | "workspace_changed" | "wiring_manifest" | "human_input" | "task_progress" | "task_notification" | "turn_end"
-/** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)。 */
+/** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
+ *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"
 /** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
@@ -59,4 +60,19 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  * 由 `test/engine-notice-wire.test.ts` 的腿覆盖门看守,那才是它的对位门。
  */
  | "engine_notice";
+/**
+ * 🔴 **park 行名的运行时闭集**(合并重扫 [4])。
+ *
+ * 此前这两个词在仓里有**三处**并列的字面量:`ledger-sink.ts` 的 `appendParked` 形参与 `onDone` 的分诊、
+ * 以及 `observability/run-terminal-log.ts` 的脱敏臂。`LedgerEventType` 只是类型联合、运行期取不到,
+ * 所以脱敏臂只能自己再抄一份 —— 而抄的那一份**加词不红**:仓里/引擎加第三个 park 词并登记进
+ * `LedgerEventType` 之后,`appendParked` 与 resume 腿的动态首参照写照落,回放时那一行的
+ * `gate.riskDescriptor.summary` 明文,脱敏臂一声不吭。
+ *
+ * ⇒ 词表落成**运行时常量**由消费点派生;下方两条断言把它与类型联合双向锁死(多一词 / 少一词都 tsc 红)。
+ */
+export declare const PARK_LEDGER_EVENT_TYPES: readonly ["suspended", "needs_review"];
+export type ParkLedgerEventType = (typeof PARK_LEDGER_EVENT_TYPES)[number];
+/** park 行名的**收窄谓词**(消费点要的是「这个词是不是 park 词」+ 类型收窄,不是一次裸 includes)。 */
+export declare function isParkLedgerEventType(v: string): v is ParkLedgerEventType;
 //# sourceMappingURL=ledger-events.d.ts.map

package/dist/trace/ledger-events.js

@@ -1,2 +1,7 @@
-export {};
+export const PARK_LEDGER_EVENT_TYPES = ["suspended", "needs_review"];
+const _parkWordsAreLedgerTypes = true;
+void _parkWordsAreLedgerTypes;
+export function isParkLedgerEventType(v) {
+    return PARK_LEDGER_EVENT_TYPES.includes(v);
+}
 //# sourceMappingURL=ledger-events.js.map

package/dist/trace/ledger-sink.d.ts

@@ -1,7 +1,7 @@
 import { type TerminalCause } from "@sema-agent/core";
 import { brainStatusEventData } from "./project.js";
 import { NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import type { LedgerEventType } from "./ledger-events.js";
+import { type LedgerEventType, type ParkLedgerEventType } from "./ledger-events.js";
 /**
  * LedgerSink — the SINGLE "stream event → durable runs-ledger" projection, shared by the background leg
  * (runs.ts `runInBackground`) and the sync `/v1/tasks/stream` detach lane (server.ts, `x-detach-on-disconnect`).
@@ -61,13 +61,15 @@ export interface LedgerSink {
     }): void;
     /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the `checkpointGate` is persisted —
      *  never the capability `checkpointToken` (search [18] Q1b).
-     *  ⚠️ **"non-secret" was the old wording and it is not true** ([ref] R3, 2026-09-03 — wording only, behaviour
-     *  unchanged; [ref] decides the arm): the gate carries NO capability token, but its `riskDescriptor.summary` /
-     *  `shadowedRule` are model-/human-controlled display text that [ref] measured carrying a PEM private-key
-     *  body verbatim. This durable row replays on every `GET /v1/runs/:id/events` reconnect and is NOT backfilled
-     *  by core [ref]'s mint-point fix — it is the third face of the `checkpointGate` sister item recorded in
-     *  `http/routes/approvals-assistant.ts` (`redactPendingDisclosures` header). */
-    appendParked(kind: "suspended" | "needs_review", result: unknown): Promise<void>;
+     *  🔴 **The gate is redacted, not "non-secret"** ([ref], 2026-09-10 — the arm [ref] R3 left open): it carries no
+     *  capability token, but its `reason` and the `riskDescriptor` leaf family are model-/human-controlled display
+     *  text that [ref] measured carrying a PEM private-key body verbatim, and this durable row replays on EVERY
+     *  `GET /v1/runs/:id/events` reconnect (core [ref]'s mint-point fix does not backfill rows already written).
+     *  The redaction owner is NOT this writer: it is `redactLedgerEventData` — the one confluence every ledger row
+     *  crosses at the three store twins' `appendEvent` AND again on the read face (idempotent). Redacting here too
+     *  would put two writers on one semantic surface; the other park writers (`http/server.ts`'s two resume legs)
+     *  would still need it, and a per-writer arm is exactly the shape that drifts. */
+    appendParked(kind: ParkLedgerEventType, result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */
     appendDone(result: unknown): Promise<void>;

package/dist/trace/ledger-sink.js

@@ -2,6 +2,7 @@ import { terminalProjection } from "@sema-agent/core";
 import { redactSecrets } from "./redact.js";
 import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
+import { isParkLedgerEventType } from "./ledger-events.js";
 export function createSerialLedgerAppend(appendEvent, startSeq) {
     let seq = startSeq;
     let chain = Promise.resolve();
@@ -156,7 +157,7 @@ export function createLedgerSink(opts) {
         await flush();
         if (result.terminal.kind === "paused") {
             const parkKind = terminalProjection(result.terminal).status;
-            if (parkKind === "suspended" || parkKind === "needs_review") {
+            if (isParkLedgerEventType(parkKind)) {
                 await appendParked(parkKind, result);
                 return;
             }

package/dist/trace/project.d.ts

@@ -357,11 +357,12 @@ export declare function workspaceChangedEventData(ev: {
  *       ([ref],7.57.0 已发)答的是「**若此刻提交**会不会武装」,本段答的是「**这条真跑起来的腿**武装了吗」;
  *       同一个主体(调用方自己的 run)、同一条轴,只差事前/事后。剥掉它,壳就只能拿事前预测冒充事后事实;
  *    ② **两个值都是引擎派生的闭形**:`armed` 布尔,`reason` 是 core 的闭集词(`AUTO_MODE_ARM_REASONS`:
- *       armed / no_intent / no_face / denied / resolver_fault / latch_open)—— 非用户内容,不脱敏、逐字;
+ *       armed / no_intent / no_face / denied / resolver_fault;core 7.12.0 起 `latch_open` 随熔断/单向闩
+ *       整族退役)—— 非用户内容,不脱敏、逐字;
  *    ③ **不是 governance 侧信道**:它描述的是**本腿**的武装结论,与 lockedConfig/compliance/memoryAdmission/
  *       retention 四位无函数关系;而 `denied` 这一词所披露的「组织把这一位关了」在 [ref] 读面上**本就已经**
  *       对同一租户可见(`org_denied`),本段没有扩大任何受众。
- *    🔴 **逐字透传,不映射**:core 的六词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
+ *    🔴 **逐字透传,不映射**:core 的五词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
  *       —— 两张表回答的是两个问题、粒度也不同(core 的 `denied` 一词对应本仓的 `org_denied` / `local_denied`
  *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
  *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):

package/dist/trace/redact.d.ts

@@ -1,3 +1,31 @@
+/**
+ * Trace thinking-block redaction (service-side). Per core [R57]: the agent's reasoning/CoT is emitted on the
+ * live TaskEvent stream but DELIBERATELY kept out of the metadata Tracer because CoT may contain reasoned-about
+ * secrets (and is large / ToS-sensitive for some providers). Persisting it for the trace UI is the deployment's
+ * call — so when we DO persist it, redact unambiguous secret formats first. Conservative on purpose: only clear
+ * key/token shapes are redacted. ⚠️ It is NOT exhaustive: unrecognised secret formats (a free-text password,
+ * a JWT) pass through, and the broad `Bearer <20+ chars>` rule can over-match legitimate CoT (false positives
+ * tolerated — over-redacting trace text is safe). For sensitive deployments, disable thinking capture entirely
+ * via TRACE_THINKING=false. This is a seam — deployments can extend the patterns.
+ *
+ * 两组臂,顺序即优先序:{@link FULL_SECRET_PATTERNS}(完整形)在前,{@link FRAGMENT_SECRET_PATTERNS}
+ * ([ref] 前缀残片,上游先截后脱的产物 ⇒ 带 `:partial` 后缀的 token)在后。
+ */
+/** 本模块替换 token 的**闭形**正则源(`«redacted»` / `«redacted:aws-key»` / `«redacted:gh-token:partial»` …):
+ *  URL-userinfo 臂用它把「用户名位上已经是本模块 token」整个当一个用户名单元吃掉。模块加载时对
+ *  {@link REDACTION_TOKENS} 逐个校验闭形(表加了新 token 形而这里没跟 ⇒ 加载即抛,fail-closed)。 */
+import { stripFormatCharacters } from "@sema-agent/core";
+/**
+ * `redactSecrets` 的**归一化前置**(S-103 ①):把全部 `\p{Cf}`(零宽空格 / 词连接符 / BOM / 软连字符 / ZWJ / ZWNJ …)
+ * 剥掉。实现单一属主是 core 的 `stripFormatCharacters`(`@sema-agent/core`,7.3.1 起导出,正是为「先扫描后渲染」这一序
+ * 开的口),本模块只**转出**它,不抄第二份 —— 两份实现漂了就等于两个「什么是格式字符」的定义。
+ *
+ * 🔴 **需要判断「这次脱敏到底有没有认出凭据形」的调用方,比较基准是它、不是原文**:
+ * `redactSecrets(x) !== x` 在本版里对**任何**含 Cf 的文本都为真(输出是剥后文本),拿它当谓词会把一条带 emoji ZWJ
+ * 的普通 `git commit` 判成「含凭据形」;正确的谓词是 `redactSecrets(x) !== normalizeForRedaction(x)`。
+ * 现役消费方:`src/tool-approval.ts` 的 `durableRuleMaterial`(规则车道素材闸)与语料的 FP=0 格。
+ */
+export declare const normalizeForRedaction: typeof stripFormatCharacters;
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;

package/dist/trace/redact.js

@@ -1,22 +1,34 @@
+import { stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
+export const normalizeForRedaction = stripFormatCharacters;
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
-const FULL_SECRET_PATTERNS = [
-    [/-----BEGIN[^-](?:[^-](?:[^-]|-(?!-))*)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END[^-](?:[^-](?:[^-]|-(?!-))*)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
+const ENTROPY_SCAN_MAX = 96;
+const twoStrongAhead = (valueClass) => String.raw `(?=${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z]${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z])`;
+const valueArm = (prefixSrc, valueClass, min) => new RegExp(`${prefixSrc}${twoStrongAhead(valueClass)}${valueClass}{${min},}`, "g");
+const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${valueClass}{${min},}${tailSrc}` +
+    `|(?<!${valueClass})${keywordSrc}${twoStrongAhead(valueClass)}${valueClass}{${min},}${tailSrc})`, "g");
+const STRUCTURAL_SECRET_PATTERNS = [
+    [/-----BEGIN(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
-    [/\bsk-[A-Za-z0-9_-]{16,}\b/g, "«redacted:key»"],
-    [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, "«redacted:gh-token»"],
-    [/\bgithub_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}\b/g, "«redacted:gh-token»"],
-    [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "«redacted:slack-token»"],
-    [/\bAKIA[0-9A-Z]{16}\b/g, "«redacted:aws-key»"],
-    [/\bASIA[0-9A-Z]{16}\b/g, "«redacted:aws-key»"],
-    [/\b(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test|org)_[A-Za-z0-9]{24,}|pypi-[A-Za-z0-9_-]{85,})\b/g, "«redacted:key»"],
-    [/\bxapp-\d-[A-Za-z0-9-]{20,}\b/g, "«redacted:slack-token»"],
-    [/\b[Bb]earer\s+[A-Za-z0-9._~+/-]{20,}=*/g, "Bearer «redacted»"],
-    [/\bBasic\s+[A-Za-z0-9+/]{16,}={0,2}/g, "Basic «redacted»"],
-    [/:(?<=\b[A-Za-z][A-Za-z0-9+.-]*:)\/\//g, "$1:«redacted»@"],
-    [/\b[Tt]oken\s+[A-Za-z0-9._~+/-]{20,}/g, "token «redacted»"],
+    [/:(?<=[A-Za-z][A-Za-z0-9+.-]*:)\/\//g, "$1:«redacted»@"],
     [/("(?:private_key|client_secret|password|api[_-]?key|secret|token)"\s*:\s*)"[^"\\]*(?:\\.[^"\\]*)*"/gi, '$1"«redacted»"'],
 ];
+const KEYWORD_SECRET_PATTERNS = [
+    [keywordArm("[Bb]earer", "[A-Za-z0-9._~+/-]", 20, "=*"), "Bearer «redacted»"],
+    [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}"), "Basic «redacted»"],
+    [keywordArm("[Tt]oken", "[A-Za-z0-9._~+/-]", 20), "token «redacted»"],
+];
+const SHAPE_SECRET_PATTERNS = [
+    [valueArm("sk-", "[A-Za-z0-9_-]", 16), "«redacted:key»"],
+    [/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, "«redacted:gh-token»"],
+    [/github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59,}/g, "«redacted:gh-token»"],
+    [/xox[baprs]-[A-Za-z0-9-]{10,}/g, "«redacted:slack-token»"],
+    [/AKIA[0-9A-Z]{16,}/g, "«redacted:aws-key»"],
+    [/ASIA[0-9A-Z]{16,}/g, "«redacted:aws-key»"],
+    [/(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test|org)_[A-Za-z0-9]{24,}|pypi-[A-Za-z0-9_-]{85,})/g, "«redacted:key»"],
+    [/xapp-\d-[A-Za-z0-9-]{20,}/g, "«redacted:slack-token»"],
+];
+const FULL_SECRET_PATTERNS = [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS];
 const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
 const PEM_HEADER_IDENT_MAX = 31;
 const PEM_BODY_RUN_MIN = 8;
@@ -216,7 +228,7 @@ function isPemFenceLabel(s, from, to) {
     let end = to;
     if (end - from > PEM_BLOCK_WORD.length && s.startsWith(PEM_BLOCK_WORD, end - PEM_BLOCK_WORD.length))
         end -= PEM_BLOCK_WORD.length;
-    if (end - from <= PEM_KEY_WORD.length)
+    if (end - from < PEM_KEY_WORD.length)
         return false;
     if (!s.startsWith(PEM_KEY_WORD, end - PEM_KEY_WORD.length))
         return false;
@@ -399,14 +411,14 @@ function redactHeadlessPpkBodies(text) {
     return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
 const FRAGMENT_SECRET_PATTERNS = [
-    [/\bsk-(?=[A-Za-z0-9_-]{6,})(?=[A-Za-z0-9_-]{0,64}[0-9A-Z][A-Za-z0-9_-]{0,64}[0-9A-Z])[A-Za-z0-9_-]{6,}/g, "«redacted:key:partial»"],
-    [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{8,}/g, "«redacted:gh-token:partial»"],
-    [/\bgithub_pat_[A-Za-z0-9_]{8,}/g, "«redacted:gh-token:partial»"],
-    [/\bxox[baprs]-[A-Za-z0-9-]{4,}/g, "«redacted:slack-token:partial»"],
-    [/\bAKIA[0-9A-Z]{6,}/g, "«redacted:aws-key:partial»"],
-    [/\bASIA[0-9A-Z]{8,}/g, "«redacted:aws-key:partial»"],
-    [/\b(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-)(?=[A-Za-z0-9_-]{8,})(?=[A-Za-z0-9_-]{0,90}[0-9A-Z][A-Za-z0-9_-]{0,90}[0-9A-Z])[A-Za-z0-9_-]{8,}/g, "«redacted:key:partial»"],
-    [/\bxapp-\d-[A-Za-z0-9-]{4,}/g, "«redacted:slack-token:partial»"],
+    [valueArm("sk-", "[A-Za-z0-9_-]", 6), "«redacted:key:partial»"],
+    [valueArm("(?:ghp|gho|ghu|ghs|ghr)_", "[A-Za-z0-9]", 8), "«redacted:gh-token:partial»"],
+    [/github_pat_[A-Za-z0-9_]{8,}/g, "«redacted:gh-token:partial»"],
+    [valueArm("xox[baprs]-", "[A-Za-z0-9-]", 4), "«redacted:slack-token:partial»"],
+    [valueArm("AKIA", "[0-9A-Z]", 6), "«redacted:aws-key:partial»"],
+    [valueArm("ASIA", "[0-9A-Z]", 8), "«redacted:aws-key:partial»"],
+    [valueArm("(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-)", "[A-Za-z0-9_-]", 8), "«redacted:key:partial»"],
+    [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4), "«redacted:slack-token:partial»"],
 ];
 const REDACTION_TOKENS = new Set([...FULL_SECRET_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
@@ -490,21 +502,33 @@ function scanUserinfoRun(text, i, kind, json) {
     return i;
 }
 const REDACTION_TOKEN_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
+const SHAPE_STICKY = SHAPE_SECRET_PATTERNS.map(([re]) => new RegExp(re.source, "y"));
+function keyShapedUsernameEnd(text, p) {
+    for (const re of SHAPE_STICKY) {
+        re.lastIndex = p;
+        if (re.test(text))
+            return re.lastIndex;
+    }
+    return -1;
+}
 function matchUserinfoAt(text, p, json) {
     REDACTION_TOKEN_Y.lastIndex = p;
     const tokEnd = REDACTION_TOKEN_Y.test(text) ? REDACTION_TOKEN_Y.lastIndex : -1;
     const afterTok = tokEnd >= 0 ? text.charCodeAt(tokEnd) : -1;
     if (afterTok === 64)
         return null;
-    let userEnd;
+    let userEnd = -1;
     let kind;
     if (afterTok === 58) {
         userEnd = tokEnd;
         kind = "token-pass";
     }
+    else if ((() => { const e = keyShapedUsernameEnd(text, p); return e >= 0 && text.charCodeAt(e) === 58 ? ((userEnd = e), true) : false; })()) {
+        kind = "token-pass";
+    }
     else {
         userEnd = scanUserinfoRun(text, p, "plain-user", json);
-        if (userEnd === p || text.charCodeAt(userEnd) !== 58)
+        if (text.charCodeAt(userEnd) !== 58)
             return null;
         kind = "plain-pass";
     }
@@ -670,8 +694,7 @@ function reportHits(hits) {
 export function redactSecrets(text, opts) {
     const wantCount = onRedaction !== undefined && (opts?.observe ?? true);
     const json = opts?.json === true;
-    let r;
-    r = applyRules(text, wantCount, json, opts?.observe ?? true);
+    const r = applyRules(normalizeForRedaction(text), wantCount, json, opts?.observe ?? true);
     reportHits(r.hits);
     return r.out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.69.0",
+  "version": "7.70.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.11.2",
+    "@sema-agent/core": "7.12.0",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.8.0",
+    "@sema-agent/sdk": "9.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",