@sema-agent/server 7.69.0 → 7.71.0

package/dist/leader/wire.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
+import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
 import { presignS3Url } from "../plugins/s3-presign.js";
 import { buildUploadScript, uploadStepSuffix, fetchUploadedDiff, withStaging } from "./diffup.js";
@@ -376,7 +377,7 @@ export function createLeaderRunner(cfg) {
             }
             if (!cfg.e2bApiKey)
                 throw new Error("leader wire: no envFactory+s3 (factory mode) and no e2bApiKey (static mode)");
-            const env = new RemoteContainerExecutionEnv({ apiKey: cfg.e2bApiKey, timeoutMs: leaderTimeoutMs });
+            const env = new RemoteContainerExecutionEnv({ apiKey: cfg.e2bApiKey, timeoutMs: leaderTimeoutMs, homeDir: E2B_SANDBOX_HOME });
             if (!(await env.connect()).ok)
                 throw new Error(`connect failed for ${sub.workerId}`);
             await sh(env)(`${body.seedCmd}; cd ${repo}; git checkout -q -b ${sub.branch}`);
@@ -410,7 +411,7 @@ export function createLeaderRunner(cfg) {
             }
             if (!cfg.e2bApiKey)
                 throw new Error("leader wire: no envFactory and no e2bApiKey");
-            const env = new RemoteContainerExecutionEnv({ apiKey: cfg.e2bApiKey, timeoutMs: leaderTimeoutMs });
+            const env = new RemoteContainerExecutionEnv({ apiKey: cfg.e2bApiKey, timeoutMs: leaderTimeoutMs, homeDir: E2B_SANDBOX_HOME });
             if (!(await env.connect()).ok) {
                 await env.destroy().catch(() => { });
                 throw new Error("integ connect failed");
@@ -449,7 +450,7 @@ export function createLeaderRunner(cfg) {
             else {
                 if (!cfg.e2bApiKey)
                     throw new Error("leader wire: repair-loop grader needs an envFactory or e2bApiKey");
-                const e2b = new RemoteContainerExecutionEnv({ apiKey: cfg.e2bApiKey, timeoutMs: leaderTimeoutMs });
+                const e2b = new RemoteContainerExecutionEnv({ apiKey: cfg.e2bApiKey, timeoutMs: leaderTimeoutMs, homeDir: E2B_SANDBOX_HOME });
                 if (!(await e2b.connect()).ok) {
                     await e2b.destroy().catch(() => { });
                     throw new Error("repair-loop grader connect failed");

package/dist/main.js

@@ -131,7 +131,8 @@ async function main() {
     await configCenter.applyLocalRemoteExec();
     const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
     const instanceId = uuidv7();
-    const sessionCaptureRecordStore = backend?.sessionCaptureRecords();
+    const sessionCaptureRecords = backend?.sessionCaptureRecords();
+    const sessionCaptureRecordStore = sessionCaptureRecords?.();
     const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}) }) : undefined;
     const memoryComplianceFaces = memoryEngine
         ? createMemoryComplianceFaces(memoryEngine, {
@@ -271,8 +272,8 @@ async function main() {
         sessionShellGateExplicitlyOff: sessionShellGateRegistry.explicitlyOff,
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
-        sessionCaptureRecordStore,
-        memorySyncRunner, toolResultStore: runnerOffloadStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
+        sessionCaptureRecords,
+        memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
         legacyRewindBoundaryProbe: backend?.legacyRewindBoundaryProbe ? backend.legacyRewindBoundaryProbe.bind(backend) : undefined,
         permissionRuleStore: permissionRuleProvider,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
@@ -330,6 +331,7 @@ async function main() {
     const subRunnerSessions = new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 }));
     const subRunnerDeps = {
         ...createSharedRunnerDeps({
+            metrics,
             config,
             logger,
             hands: commitHands,
@@ -345,6 +347,7 @@ async function main() {
             rosterStore,
             deploymentHooks,
             toolResultStore: runnerOffloadStore,
+            checkpointStore,
             sessionPolicyStore,
             usageWindowStore,
             orgMemoryAdmission,
@@ -356,7 +359,6 @@ async function main() {
         loadProjectMemory: runnerDeps.loadProjectMemory ? runnerDeps.loadProjectMemory : undefined,
         probeInstructionSources: runnerDeps.probeInstructionSources ? runnerDeps.probeInstructionSources : undefined,
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
-        checkpointStore: checkpointStore ? checkpointStore : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));

package/dist/memory-operator-faces.d.ts

@@ -227,7 +227,7 @@ export interface SessionMemoryStatusFace {
  *
  * `captureRecordStore` = [ref]② 的 SQL 载体(main.ts 单实例,与 Runner/其余引擎同源 —— 全站同批注入律,
  * 机器钉 capture-optout-lane ②):`captureOptedOut` / `optOutSource` 两键经它读,多副本部署上答的才是
- * 跨副本的真记录。缺席(local 车道)⇒ core 文件三腿,单机字节不变。
+ * 跨副本的真记录。S-215 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面,单机字节不变);缺席 ⇒ 记忆面暗。
  *
  * 面**不抛**(core 契约:sessionMemoryStatus never throws —— 每个事实源各自 catch 折缺席键);
  * 不接 onIncident:这条只读路径上今天零 sink 站点,而且缺席键本身就是它的披露形。

package/dist/memory-scope.d.ts

@@ -104,6 +104,30 @@ export declare function memoryEngineRootFor(config: Pick<ServiceConfig, "memoryE
  *  所以它的根必须走这条链而不是 `memoryEngineRootFor` 的分派(codex 修复验证轮 [medium]:分派会把 run-local 的
  *  记忆搬到 `<localDataRoot>/memory-work`,存量记忆与控制面升级后隐形)。 */
 export declare function fileMemoryEngineRoot(config: Pick<ServiceConfig, "memoryEngineDir">, fallbackRoot?: string): string;
+/** 本部署 file 记忆引擎的**平面三坐标**(根 / 记忆目录 / 控制面目录)—— {@link fileMemoryPlaneFor} 一次算齐。 */
+export interface FileMemoryPlane {
+    readonly root: string;
+    readonly memoryDir: string;
+    readonly controlDir: string;
+}
+/**
+ * S-215(B-085)—— **file 记忆引擎平面的单铸点**,兼这条腿的**接线门**。
+ *
+ * 为什么是一只函数而不是两处各自推导:平面坐标有**两个**消费者 —— ① {@link memoryEngineBackendFor}
+ * 钉给 `FileMemoryEngineBackend` 的 `memoryDir` + `controlDir`;② local 车道的 capture opt-out **记录店**
+ * (`StoreBackend.sessionCaptureRecords()` 喂 core 的 `fileSessionCaptureRecordStore(controlDir)`)。
+ * 两者必须是**同一只目录**,否则声明写进 A、引擎读 B ⇒ 一条被「受理」的隐私声明在引擎面根本不存在,
+ * 那比一句诚实的 409 更坏。两处各写一份推导链 = 哪天根链改了只改一处的必然漂移,所以推导(根 → 记忆目录 →
+ * 控制面目录,三步都在这里、只写一遍)与门合并在此(合并复审 R37:此前 `join(root, "memory")` 在本函数与
+ * `memoryEngineBackendFor` 各写一份 —— 记忆目录规则有了第二个写者,现已收回一处)。
+ *
+ * 返回 `undefined` ⇔ 本部署上 file 记忆引擎**不接线**(多租户 / `MEMORY_ENGINE=off` / 平面分裂车道未 allow)。
+ * 门与 `memoryEngineBackendFor` 逐字同源(它就读本函数),所以「有引擎 ⇔ 有控制面 ⇔ 供记录店」三者
+ * 在构造上不可能分家。
+ */
+export declare function fileMemoryPlaneFor(config: ServiceConfig, fallbackRoot?: string): FileMemoryPlane | undefined;
+/** 控制面目录那一坐标(local 车道 capture 记录店的依托)—— 只是 {@link fileMemoryPlaneFor} 的投影,不是第二条推导。 */
+export declare function fileMemoryControlDirFor(config: ServiceConfig, fallbackRoot?: string): string | undefined;
 export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRoot?: string): {
     backend: FileMemoryEngineBackend;
     root: string;

package/dist/memory-scope.js

@@ -68,14 +68,23 @@ export function memoryEngineRootFor(config, fallbackRoot) {
 export function fileMemoryEngineRoot(config, fallbackRoot) {
     return resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
 }
-export function memoryEngineBackendFor(config, fallbackRoot) {
+export function fileMemoryPlaneFor(config, fallbackRoot) {
     if (config.requirePrincipal === true || !config.memoryEngineEnabled)
         return undefined;
     if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
         return undefined;
     const root = fileMemoryEngineRoot(config, fallbackRoot);
-    const dir = join(root, "memory");
-    return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
+    const memoryDir = join(root, "memory");
+    return { root, memoryDir, controlDir: deriveControlPlaneDir(root, memoryDir) };
+}
+export function fileMemoryControlDirFor(config, fallbackRoot) {
+    return fileMemoryPlaneFor(config, fallbackRoot)?.controlDir;
+}
+export function memoryEngineBackendFor(config, fallbackRoot) {
+    const plane = fileMemoryPlaneFor(config, fallbackRoot);
+    if (plane === undefined)
+        return undefined;
+    return { backend: new FileMemoryEngineBackend(plane.memoryDir, { controlDir: plane.controlDir }), root: plane.root };
 }
 export function memorySpecForRequest(scope, memoryWrite, defaultScopes, originPolicy, memoryCapture) {
     if (!scope)

package/dist/observability/metrics.d.ts

@@ -1,9 +1,3 @@
-/**
- * Tiny in-process metrics registry with Prometheus text exposition — no dependency.
- *
- * Per-instance (each container exposes its own counters); aggregate across instances at the scraper.
- * Supports labeled counters, gauges (static + dynamic), and duration histograms.
- */
 export type Labels = Record<string, string>;
 export declare class Metrics {
     private counters;
@@ -51,6 +45,10 @@ export interface MetricsSummary {
     rateLimited: number;
     costQuotaRejected: number;
     budgetExceeded: Record<string, number>;
+    /** 答后撞顶(walltime/turns)的计数。⚠️ 与 {@link budgetExceeded} **口径不同**:本枚在 deps 级通告席上铸,
+     *  覆盖**每一条**引擎 run(后台子代 / 委派嵌套腿 / leader 车道);`budgetExceeded` 只由 HTTP 提交腿的
+     *  `finalizeTaskResult` 递增(= 顶层 HTTP 提交的 run)。两枚相加只在后者那个较窄的总体里成立。 */
+    limitCeilingAfterAnswer: Record<string, number>;
     degraded: Record<string, number>;
     degenerate: Record<string, number>;
     memoryConsolidationOps: Record<string, number>;

package/dist/observability/metrics.js

@@ -1,3 +1,4 @@
+import { buildPermissionRuleEventsHelp } from "./permission-rule-events.js";
 const DEFAULT_BUCKETS = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60];
 function labelKey(labels) {
     return Object.keys(labels)
@@ -173,6 +174,7 @@ export class Metrics {
             rateLimited: ctotal("rate_limited_total"),
             costQuotaRejected: ctotal("cost_quota_rejected_total"),
             budgetExceeded: cby("budget_exceeded_total", "code"),
+            limitCeilingAfterAnswer: cby("limit_ceiling_after_answer_total", "origin"),
             degraded: cby("degraded_total", "reason"),
             degenerate: cby("degenerate_total", "class"),
             memoryConsolidationOps: cby("memory_consolidation_ops_total", "op"),
@@ -214,6 +216,7 @@ export function createMetrics() {
     ]);
     m.counter("tool_calls_total", "Tool invocations by name and outcome");
     m.counter("budget_exceeded_total", "Tasks failed by a budget/limit ceiling, by errorCode");
+    m.counter("limit_ceiling_after_answer_total", "Runs where a walltime/turns ceiling fired AFTER the run had already answered (engine 7.13.0: these end completed with NO limits.* code). Dual of budget_exceeded_total, but NOT over the same population: this one is minted on the deps-level notice sink so it sees EVERY engine run (background children, delegated/nested legs, leader lanes); budget_exceeded_total is incremented only by the HTTP submit legs finalizeTaskResult, i.e. top-level HTTP-submitted runs. Sum them only within that narrower population; see the forwarder comment, by origin");
     m.counter("cost_quota_rejected_total", "Tasks refused because the principal is over its cumulative cost quota");
     m.counter("degraded_total", "Tasks degraded to a cheaper model (1.40), by reason (budget/rate_limit/breaker_open)");
     m.counter("task_model_not_allowlisted_resume_total", "Resumed legs whose model/compactionModel is outside the @-mention allowlist (allowed to keep running by design — the allowlist gates fresh picks only)");
@@ -260,8 +263,9 @@ export function createMetrics() {
     m.counter("stale_cache_conflict_total", "Warm session-cache entries evicted by a cross-instance write while cached (S25)");
     m.counter("breaker_writethrough_failed_total", "Circuit-breaker cross-replica write-through failures (LOW), by backend");
     m.counter("web_search_bad_payload_total", "Web-search provider responses whose results field was not an array (LOW), by provider");
+    m.counter("auto_mode_classifier_unavailable_total", "Auto-mode gate denials caused by a classifier OUTAGE, by cause (core AUTO_MODE_UNAVAILABLE_CAUSES: error/timeout; 'other' = this build cannot name the word). Distinct from permission_denied_total{deniedBy=\"classifier\"}, which also counts genuine safety blocks — a spike here means the classifier itself is failing (gateway/credential fault, or too slow), not that the model kept asking for dangerous things");
     m.counter("permission_denied_total", "Tool-gate denials by the LAYER whose verdict is the deny (core's DeniedBy: policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution/persisted_rule; 'other' = this build cannot name the layer; label is `deniedBy` since server 7.64.0 — it was `source` over core's retired PermissionDeniedSource; goal B4 always-on deny meter)");
-    m.counter("permission_rule_events_total", "Persisted allow-rule seam events by event (persisted_rule_allowed = a rule authorized a call with nobody asked; rule_store_unreadable = the store failed to read so the call was adjudicated with ZERO rules)");
+    m.counter("permission_rule_events_total", buildPermissionRuleEventsHelp());
     m.counter("compaction_events_total", "Compaction lifecycle events by outcome (started/completed/failed/skipped) and trigger");
     m.counter("hook_llm_calls_total", "prompt/agent hook entries that completed a model call (hooks 3b), by type");
     m.counter("auth_bridge_verify_total", "Registry SSO JWT verifications (auth-bridge), by outcome");

package/dist/observability/permission-rule-events.d.ts

@@ -0,0 +1,20 @@
+/** 计量面的 `event` 词表(顺序 = HELP 行里的出现顺序)。 */
+export declare const PERMISSION_RULE_EVENT_TABLE: readonly [{
+    readonly event: "persisted_rule_allowed";
+    readonly meaning: "a persisted allow rule authorized the call and nobody was asked";
+}, {
+    readonly event: "rule_store_unreadable";
+    readonly meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)";
+}, {
+    readonly event: "read_only_allowed";
+    readonly meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)";
+}];
+/** 词表里的一个词(闭集)。 */
+export type PermissionRuleEventWord = (typeof PERMISSION_RULE_EVENT_TABLE)[number]["event"];
+/** 这一帧是否进 `permission_rule_events_total`(判别式与词表同源,不再手抄第二串 `===`)。 */
+export declare function isPermissionRuleEventKind(kind: string): boolean;
+/** 帧名 → `event` 标签值。调用方须先过 {@link isPermissionRuleEventKind}。 */
+export declare function permissionRuleEventWordOf(kind: string): string;
+/** `/metrics` 的 HELP 行文案(从词表派生 —— 加词自动出现,不存在「第二份会漂的散文」)。 */
+export declare function buildPermissionRuleEventsHelp(): string;
+//# sourceMappingURL=permission-rule-events.d.ts.map

package/dist/observability/permission-rule-events.js

@@ -0,0 +1,28 @@
+const PERMISSION_TRACE_PREFIX = "permission.";
+export const PERMISSION_RULE_EVENT_TABLE = [
+    {
+        event: "persisted_rule_allowed",
+        meaning: "a persisted allow rule authorized the call and nobody was asked",
+    },
+    {
+        event: "rule_store_unreadable",
+        meaning: "the rule store failed to read, so the call was adjudicated with ZERO rules (expect an approval storm whose cause is the store, not the model)",
+    },
+    {
+        event: "read_only_allowed",
+        meaning: "the engine's read-only shell verdict cleared an ask that was NOT an operator-written rule (core decisionReason \"read_only\"; an operator-declared ask carries matchedAskRule and is never cleared this way)",
+    },
+];
+const PERMISSION_RULE_EVENT_KINDS = new Set(PERMISSION_RULE_EVENT_TABLE.map((r) => `${PERMISSION_TRACE_PREFIX}${r.event}`));
+export function isPermissionRuleEventKind(kind) {
+    return PERMISSION_RULE_EVENT_KINDS.has(kind);
+}
+export function permissionRuleEventWordOf(kind) {
+    return kind.slice(PERMISSION_TRACE_PREFIX.length);
+}
+export function buildPermissionRuleEventsHelp() {
+    return ("Permission allow-layer attribution events by event — the ONE answer to \"why was I not asked this time?\" (" +
+        PERMISSION_RULE_EVENT_TABLE.map((r) => `${r.event} = ${r.meaning}`).join("; ") +
+        ")");
+}
+//# sourceMappingURL=permission-rule-events.js.map

package/dist/observability/run-terminal-log.d.ts

@@ -1,4 +1,4 @@
-import type { RunRecord } from "../plugins/store-contracts.js";
+import { type RunRecord } from "../plugins/store-contracts.js";
 /** 一次终局写口交给观测面的原料(store 侧装配,**未脱敏** —— 脱敏在本模块内做,见 {@link notifyRunTerminal})。 */
 export interface RunTerminalRecord {
     /** 这条 run 的账本 id = `GET /v1/runs/:id` 的 id(本仓 run 行主键名为 taskId,同一个值)。 */
@@ -20,8 +20,9 @@ export type RunTerminalObserver = (level: "error" | "info", fields: Record<strin
 /**
  * 终局行的级别判据。`undefined` = 不打行。
  *
- * `blocked` 刻意不打:它是**治理判决**(门拒绝了这次执行),不是失败——它有自己的门遥测与
- * `GET /v1/runs/:id` 读面,混进 `run_failed` 会把「模型/网络出事了」这条读法冲淡。
+ * 一句话:**非成功终局才出声**(`failed` / `blocked`),用户主动取消降 `info`。词的分类不在本模块做 ——
+ * 它的唯一属主是 `plugins/store-contracts.ts` 的 `RUN_STATUS_CLASS` 表(S-213③:本模块此前手抄了一张
+ * 穷举 switch,并在 `blocked` 那一格给出与 fleet 读面互斥的答案)。表的编译期双向钉在属主处。
  */
 export declare function runTerminalLogLevel(status: RunRecord["status"], errorCode: string | undefined): "error" | "info" | undefined;
 /** 装配点(`main.ts` 唯一)。传 `undefined` 卸载(测试隔离)。 */
@@ -52,26 +53,15 @@ export declare const REDACT_INPUT_CAP = 65536;
  *  脱敏**之后**按字节封顶(占位已替换完,切在占位中间不是泄漏)并带标记。 */
 export declare const REDACT_OUTPUT_MAX_BYTES = 65000;
 export declare function redactErrorMessage(raw: string | undefined): string | undefined;
-/**
- * 同口:终态 `result` 整块也持久化(`GET /v1/runs/:id` 直出),写入前把里面的**自由文本座**脱敏,其余键
- * 逐字不动;`undefined`/`null` 透传。
- *
- * 🔴 S-136(core 7.6.0 [ref] D-8):自由文本座**搬家了** —— 失败文案与阻塞理由从顶层平面键
- * (`errorMessage` / `blockedReason`)搬进因由 `terminal` 的两条臂(`failed.message` / `blocked.reason`)。
- * 本函数**两种形都认**,而这不是「兼容读臂」(codex 对抗复审 r1 [high],亲读验真后**改判**;首版删掉了旧键
- * 臂,那是错的):本函数是**读盘面**,而 `task_run.result` / `task_event(done).result` 里躺着 7.63.0 及以前
- * 写下的**真字节**,它们本来就是平面形。写口只剩因由一条(没有任何东西会再写出旧形),所以这里不存在
- * 「两个写者」;而不认旧形的代价是**可复现的凭据回放**:上线前落盘的原文经 `GET /v1/runs/:id/events` 重新
- * 明文外发(读面这一层纵深正是为那批行存在的)。⇒ 规则仍只有一条:**读盘认盘上真有的形,写盘只写一种形**。
- *
- * 读面也走本函数,所以 `terminal` 形上取 `unknown`:旧持久 blob 与非 core 的 Runner 实现给的形不可信,
- * 运行期逐臂判形、不抛(与 `remoteEnvFailures` / `editedFiles` 两座同款不信任)。
- */
+/** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形的 `"redacted"` 行 ∪ 旧形平面键;
+ *  `memoRedactTerminalResult` 的记忆键由它派生(两处同源,见 `RESULT_KEY_TREATMENT` 顶注)。 */
+export declare const REDACTABLE_RESULT_LEAVES: readonly string[];
 export declare function redactTerminalResult<T extends {
     terminal?: unknown;
-    /** 旧形(≤7.63.0)的两个顶层自由文本座;形上取 `unknown` —— 读盘面对盘上字节不作假设。 */
+    /** 旧形(≤7.63.0)的三个顶层座;形上取 `unknown` —— 读盘面对盘上字节不作假设。 */
     errorMessage?: unknown;
     blockedReason?: unknown;
+    checkpointGate?: unknown;
     remoteEnvFailures?: readonly {
         message?: string | undefined;
     }[] | undefined;
@@ -94,9 +84,10 @@ export declare function redactWorkerReportError<T extends {
     error?: string | undefined;
     checkpointGate?: unknown;
 }>(report: T): T;
-/** codex r5 [high]:`WorkerReport.checkpointGate`(core `CheckpointGate`)整块随 LeaderResult 落库/直出——`reason` 与
- *  `riskDescriptor.summary`/`shadowedRule` 是自由文本([ref] 实测 summary 带 PEM 明文;[ref] R3 登记),按类型表脱这三叶;
- *  `kind`/`toolName`/`axes`/`severity`/`touchedPaths` 闭集或路径,逐字。非对象形原样返回。 */
+export declare function redactRiskDescriptor(rd: unknown): unknown;
+/** `CheckpointGate`(core 类型)整块上 wire —— `reason` 与 `riskDescriptor` 的叶族是自由文本
+ *  ([ref] 实测 summary 带 PEM 明文;[ref] R3 登记;[ref] 把它扩到结果/账本两面)。逐键**按表**处置,
+ *  叶表属主见 {@link redactRiskDescriptor}。非对象形原样返回(同一引用);字节没变也回同一引用。 */
 export declare function redactCheckpointGate(gate: unknown): unknown;
 /** 工件字节(patch / *.rej 拒绝块):codex r6 [high]——拒绝块能带 `git clone https://u:TOKEN@host` 或 `_authToken=` 行,
  *  「工件保真」不能让原凭据上元数据读面。做**原位密钥形替换**(与预览同一张规则表,字节只在密钥处变)、**不截断**;

package/dist/observability/run-terminal-log.js

@@ -1,24 +1,14 @@
 import { createHash } from "node:crypto";
 import { redactSecrets } from "../trace/redact.js";
+import { isParkLedgerEventType } from "../trace/ledger-events.js";
+import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
 import { errorText } from "./err-text.js";
 import { recordFailOpen } from "./fail-open.js";
 const MESSAGE_CAP = 1024;
 export function runTerminalLogLevel(status, errorCode) {
-    switch (status) {
-        case "failed":
-            return errorCode === "cancelled" ? "info" : "error";
-        case "blocked":
-        case "completed":
-        case "running":
-        case "suspended":
-        case "needs_review":
-            return undefined;
-        default: {
-            const unhandled = status;
-            void unhandled;
-            return undefined;
-        }
-    }
+    if (!isUnsuccessfulRunStatus(status))
+        return undefined;
+    return errorCode === "cancelled" ? "info" : "error";
 }
 let observer;
 export function setRunTerminalObserver(fn) {
@@ -75,6 +65,37 @@ export function redactErrorMessage(raw) {
     }
 }
 const MAX_EDITED_FILES = 1000;
+const RESULT_KEY_TREATMENT = {
+    terminal: "redacted",
+    remoteEnvFailures: "redacted",
+    editedFiles: "redacted",
+    taskId: "verbatim",
+    runId: "verbatim",
+    sessionId: "verbatim",
+    model: "verbatim",
+    effectiveReasoning: "verbatim",
+    result: "verbatim",
+    salvagedOutput: "verbatim",
+    apiFailure: "verbatim",
+    retryAfterMs: "verbatim",
+    degraded: "verbatim",
+    structuredOutput: "verbatim",
+    rewindNotes: "verbatim",
+    haltedOnUserRejection: "verbatim",
+    haltedByUser: "verbatim",
+    strandedHumanAnswers: "verbatim",
+    pendingApproval: "verbatim",
+    approvalWaitedMs: "verbatim",
+    effectiveReadFace: "verbatim",
+    effectiveReadDenyPatterns: "verbatim",
+    effectiveMemoryScopes: "verbatim",
+    stats: "verbatim",
+};
+const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
+export const REDACTABLE_RESULT_LEAVES = [
+    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "redacted").map(([k]) => k),
+    ...LEGACY_RESULT_LEAVES,
+];
 export function redactTerminalResult(result) {
     if (result === undefined || result === null)
         return result;
@@ -89,14 +110,41 @@ export function redactTerminalResult(result) {
         out.blockedReason = redactErrorMessage(r.blockedReason);
         changed = true;
     }
+    if (r.checkpointGate !== undefined) {
+        const legacyGate = redactCheckpointGate(r.checkpointGate);
+        if (legacyGate !== r.checkpointGate) {
+            out.checkpointGate = legacyGate;
+            changed = true;
+        }
+    }
     if (r.terminal !== null && typeof r.terminal === "object") {
         const t = r.terminal;
-        if (t.kind === "failed" && typeof t.message === "string") {
-            out.terminal = { ...t, message: redactErrorMessage(t.message) };
-            changed = true;
+        let nt;
+        if (t.kind === "failed" && typeof t.message === "string")
+            nt = { ...t, message: redactErrorMessage(t.message) };
+        else if (t.kind === "blocked" && typeof t.reason === "string")
+            nt = { ...t, reason: redactErrorMessage(t.reason) };
+        const gateOf = (cause) => {
+            if (cause === null || typeof cause !== "object" || !("gate" in cause))
+                return undefined;
+            const g = cause.gate;
+            const ng = redactCheckpointGate(g);
+            return { gate: ng, changed: ng !== g };
+        };
+        const base = nt ?? t;
+        if (t.kind === "paused") {
+            const g = gateOf(base);
+            if (g?.changed === true)
+                nt = { ...base, gate: g.gate };
         }
-        else if (t.kind === "blocked" && typeof t.reason === "string") {
-            out.terminal = { ...t, reason: redactErrorMessage(t.reason) };
+        else if (t.kind === "failed") {
+            const np = base.nestedPause;
+            const g = gateOf(np);
+            if (g?.changed === true)
+                nt = { ...base, nestedPause: { ...np, gate: g.gate } };
+        }
+        if (nt !== undefined) {
+            out.terminal = nt;
             changed = true;
         }
     }
@@ -136,6 +184,11 @@ export function redactLedgerEventData(type, data) {
             return data;
         return { ...data, errorMessage: redactErrorMessage(msg) };
     }
+    if (isParkLedgerEventType(type)) {
+        const gate = data.gate;
+        const next = redactCheckpointGate(gate);
+        return next === gate ? data : { ...data, gate: next };
+    }
     return data;
 }
 export function redactWorkerReportError(report) {
@@ -145,38 +198,123 @@ export function redactWorkerReportError(report) {
         return report;
     return { ...report, ...(error !== report.error ? { error } : {}), ...(gate !== report.checkpointGate ? { checkpointGate: gate } : {}) };
 }
+const RISK_DESCRIPTOR_TREATMENT = {
+    severity: "verbatim",
+    axes: "verbatim",
+    toolName: "verbatim",
+    shellGateDoctrine: "verbatim",
+    summary: "text",
+    touchedPaths: "text[]",
+    shadowedRule: "text",
+    probeReason: "text",
+    probeCause: "probe-cause",
+};
+const PROBE_CAUSE_TREATMENT = {
+    code: "verbatim",
+    roots: "operands",
+    further: "operands",
+};
+const PROBE_CAUSE_OPERANDS_TREATMENT = {
+    shown: "text[]",
+    total: "verbatim",
+};
+export function redactRiskDescriptor(rd) {
+    if (rd === null || typeof rd !== "object" || Array.isArray(rd))
+        return rd;
+    const r = rd;
+    let changed = false;
+    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
+    const out = { ...r };
+    for (const [key, treatment] of Object.entries(RISK_DESCRIPTOR_TREATMENT)) {
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "text":
+                if (typeof r[key] === "string")
+                    out[key] = str(r[key]);
+                break;
+            case "text[]":
+                if (Array.isArray(r[key]))
+                    out[key] = strs(r[key]);
+                break;
+            case "probe-cause": {
+                const pc = r[key];
+                if (pc === null || typeof pc !== "object" || Array.isArray(pc))
+                    break;
+                const p = pc;
+                const np = { ...p };
+                for (const [ck, ct] of Object.entries(PROBE_CAUSE_TREATMENT)) {
+                    if (ct === "verbatim")
+                        continue;
+                    const ops = p[ck];
+                    if (ops === null || typeof ops !== "object" || Array.isArray(ops))
+                        continue;
+                    const o = ops;
+                    const no = { ...o };
+                    for (const [ok, ot] of Object.entries(PROBE_CAUSE_OPERANDS_TREATMENT)) {
+                        if (ot === "text[]" && Array.isArray(o[ok]))
+                            no[ok] = strs(o[ok]);
+                    }
+                    np[ck] = no;
+                }
+                out[key] = np;
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled leaf treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return changed ? out : rd;
+}
+const CHECKPOINT_GATE_TREATMENT = {
+    kind: "verbatim",
+    reason: "text",
+    toolName: "verbatim",
+    riskDescriptor: "risk-descriptor",
+    safetyAxis: "verbatim",
+    realApproval: "verbatim",
+    resumeAfterMs: "verbatim",
+};
 export function redactCheckpointGate(gate) {
     if (gate === null || typeof gate !== "object" || Array.isArray(gate))
         return gate;
     const g = gate;
-    let changed = false;
     const out = { ...g };
-    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
-        changed = true; return o; };
-    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
-    if (typeof g.reason === "string")
-        out.reason = str(g.reason);
-    const rd = g.riskDescriptor;
-    if (rd && typeof rd === "object" && !Array.isArray(rd)) {
-        const r = rd;
-        const nr = { ...r };
-        for (const k of ["summary", "shadowedRule", "probeReason"])
-            if (typeof r[k] === "string")
-                nr[k] = str(r[k]);
-        if (Array.isArray(r.touchedPaths))
-            nr.touchedPaths = strs(r.touchedPaths);
-        const pc = r.probeCause;
-        if (pc && typeof pc === "object" && !Array.isArray(pc)) {
-            const p = pc;
-            const np = { ...p };
-            for (const k of ["roots", "further"]) {
-                const ops = p[k];
-                if (ops && typeof ops === "object" && !Array.isArray(ops) && Array.isArray(ops.shown))
-                    np[k] = { ...ops, shown: strs(ops.shown) };
+    let changed = false;
+    for (const [key, treatment] of Object.entries(CHECKPOINT_GATE_TREATMENT)) {
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "text": {
+                const v = g[key];
+                if (typeof v !== "string")
+                    break;
+                const next = redactErrorMessage(v) ?? "";
+                if (next !== v) {
+                    out[key] = next;
+                    changed = true;
+                }
+                break;
+            }
+            case "risk-descriptor": {
+                if (!(key in g))
+                    break;
+                const next = redactRiskDescriptor(g[key]);
+                if (next !== g[key]) {
+                    out[key] = next;
+                    changed = true;
+                }
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled gate field treatment: ${String(unhandled)}`);
             }
-            nr.probeCause = np;
         }
-        out.riskDescriptor = nr;
     }
     return changed ? out : gate;
 }
@@ -366,9 +504,11 @@ export function memoRedactTerminalResult(seat, result) {
     if (result === undefined || result === null)
         return result;
     const r = result;
-    if (r.terminal === undefined && r.errorMessage === undefined && r.blockedReason === undefined && r.remoteEnvFailures === undefined)
+    if (REDACTABLE_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;
-    const leaves = { terminal: r.terminal, errorMessage: r.errorMessage, blockedReason: r.blockedReason, remoteEnvFailures: r.remoteEnvFailures };
+    const leaves = {};
+    for (const k of REDACTABLE_RESULT_LEAVES)
+        leaves[k] = r[k];
     const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
     if (redacted === leaves)
         return result;

package/dist/observability/tool-trace.d.ts

@@ -14,6 +14,18 @@ import type { Metrics } from "./metrics.js";
  * 🔴 BREAKING(server 7.64.0,core 7.6.0 提货):标签名 `source` → `deniedBy`,词表从七词
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
  * (`policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution`)。仪表盘/告警规则要改。
+ *
+ * 🔴 **第二个计数器 `auto_mode_classifier_unavailable_total{cause}`(server 7.70.0,core 7.12.0 [ref])**
+ * —— 分类器**停摆**的常开信号。7.12.0 之前这件事有两条可观测路:熔断跳闸时的
+ * `auto_mode_breaker_open_total`,以及「`unavailable` 的 ask 会走到人面前」(审批 inbox 里看得见)。
+ * 该版把熔断族整族退役、又把 `unavailable` 改成**当场 deny** ⇒ 两条路同时没了,而
+ * `permission_denied_total{deniedBy}` 对它是**瞎的**:分类器停摆与分类器正常拦下一次危险调用,
+ * 两者都记 `deniedBy:"classifier"`。一次持续停摆于是在默认监控上与「今天安全拦截多了点」不可区分
+ * (`TOOL_TRACE` 默认关,拿不到那半边)。core 同批把事实加在了 deny 上
+ * (`PermissionDeniedPayload.classifierUnavailable`),本仓就在**这同一只常开观察者**上消费它。
+ * 两个计数刻意**不合并成一个标签**:它们答两个问题(「谁拒的」vs「这次拒是不是因为分类器停摆、哪一类」),
+ * 而运维对停摆要立刻动手(改配置 / 等重试 / 看后端),对安全拦截不要。
+ * ⛔ 纯计量:不改任何裁决、不新开观察面、事实缺席时**不铸**(缺席 ≠ 「分类器好着呢」,只是这次拒不是它)。
  */
 export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc">): Hooks;
 /**