@sema-agent/server 7.70.0 → 7.72.0

package/dist/trace/redact.js

@@ -4,15 +4,21 @@ export const normalizeForRedaction = stripFormatCharacters;
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
 const ENTROPY_SCAN_MAX = 96;
 const twoStrongAhead = (valueClass) => String.raw `(?=${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z]${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z])`;
+const IDENT_CONNECTORS = "[_./-]";
+const noConnectorAhead = (valueClass) => String.raw `(?!${valueClass}{0,${ENTROPY_SCAN_MAX}}${IDENT_CONNECTORS}${valueClass})`;
 const valueArm = (prefixSrc, valueClass, min) => new RegExp(`${prefixSrc}${twoStrongAhead(valueClass)}${valueClass}{${min},}`, "g");
+const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${valueClass}{${min},}${tailSrc}` +
-    `|(?<!${valueClass})${keywordSrc}${twoStrongAhead(valueClass)}${valueClass}{${min},}${tailSrc})`, "g");
+    `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${valueClass}{${min},}${tailSrc})`, "g");
 const STRUCTURAL_SECRET_PATTERNS = [
     [/-----BEGIN(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
     [/:(?<=[A-Za-z][A-Za-z0-9+.-]*:)\/\//g, "$1:«redacted»@"],
     [/("(?:private_key|client_secret|password|api[_-]?key|secret|token)"\s*:\s*)"[^"\\]*(?:\\.[^"\\]*)*"/gi, '$1"«redacted»"'],
 ];
+const PPK_CONTAINER_TOKEN = "«redacted:private-key»";
+const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
+const HEADLESS_PPK_TOKEN = "«redacted:private-key:partial»";
 const KEYWORD_SECRET_PATTERNS = [
     [keywordArm("[Bb]earer", "[A-Za-z0-9._~+/-]", 20, "=*"), "Bearer «redacted»"],
     [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}"), "Basic «redacted»"],
@@ -29,7 +35,6 @@ const SHAPE_SECRET_PATTERNS = [
     [/xapp-\d-[A-Za-z0-9-]{20,}/g, "«redacted:slack-token»"],
 ];
 const FULL_SECRET_PATTERNS = [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS];
-const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
 const PEM_HEADER_IDENT_MAX = 31;
 const PEM_BODY_RUN_MIN = 8;
 const CH_TAB = 9, CH_LF = 10, CH_CR = 13, CH_SPACE = 32, CH_PLUS = 43, CH_MINUS = 45, CH_SLASH = 47;
@@ -301,7 +306,6 @@ function redactPemFragments(text, json) {
     out.push(text.slice(copied));
     return { out: out.join(""), count };
 }
-const HEADLESS_PPK_TOKEN = "«redacted:private-key:partial»";
 function redactHeadlessPpkBodies(text) {
     const KEY = "Private-Lines: ";
     const n = text.length;
@@ -558,7 +562,6 @@ function redactUrlUserinfo(text, json) {
     }
     return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
-const PPK_CONTAINER_TOKEN = "«redacted:private-key»";
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
@@ -658,10 +661,12 @@ function redactPpkContainers(text, record) {
 }
 const urlUserinfoRule = { label: labelOfToken(URL_USERINFO_PATTERN[1]), arm: "full", run: (text, _wantCount, json) => redactUrlUserinfo(text, json) };
 const SECRET_RULES = [
-    ...FULL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p, "full"))),
+    ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p, "full"))),
     { label: labelOfToken(PPK_CONTAINER_TOKEN), arm: "full", run: (text, _wantCount, _json, observe) => redactPpkContainers(text, observe) },
     { label: labelOfToken(PEM_FRAGMENT_TOKEN), arm: "fragment", run: (text, _wantCount, json) => redactPemFragments(text, json) },
     { label: labelOfToken(HEADLESS_PPK_TOKEN), arm: "fragment", run: (text) => redactHeadlessPpkBodies(text) },
+    ...KEYWORD_SECRET_PATTERNS.map((p) => regexRule(p, "full")),
+    ...SHAPE_SECRET_PATTERNS.map((p) => regexRule(p, "full")),
     ...FRAGMENT_SECRET_PATTERNS.map((p) => regexRule(p, "fragment")),
     { ...urlUserinfoRule, run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, count: 0 }) },
 ];

package/dist/usage-analytics.d.ts

@@ -26,6 +26,11 @@ export interface UsageRow {
     stats?: {
         tokens?: number;
         modelUsage?: Record<string, UsageModelEntry>;
+        /** core 7.14.0 [ref] C-b(`TaskResult.stats.usageMissing`):这一行的用量数字是**下界**不是测量值
+         *  —— 至少有一轮模型没报用量,或整条结果是宿主/编排车道自铸的(一个模型轮都没跑过)。
+         *  `true` 或缺席,**永不 `false`**;缺席 ⇔ 每轮都报了用量。fold 侧翻成既有的
+         *  {@link UsageTotals.estimated}(见 `foldRow`),**不开第二条不精确轴**。 */
+        usageMissing?: true;
     };
 }
 /**
@@ -57,7 +62,10 @@ export interface UsageTotals {
      *  ②有 per-model echo 行**缺数值键**(该键按 0 计入,总量偏低;成本键缺席时尤其:少算 ≠ 免费);
      *  ③(S10/V2-⑤)有行的 {@link UsageModelEntry.usageBasis} 缺席或非本读端认识的分量制——存量行某族
      *  历史上把 cache 计入 inputTokens,tokensIn 求和会**双算**,口径不可分辨。
-     *  三者都只表达「别把这个总数当精确值」,消费端一视同仁。 */
+     *  ④(7.72.0 / core 7.14.0 [ref] C-b)有行自陈 `stats.usageMissing` —— 那一行的数字是**下界**:至少一轮
+   *  模型没报用量,或整条结果是宿主自铸的零结果(取消打断 / 零执行的治理拒绝)。`tokens: 0` 在那种行上读作
+   *  「未知」而不是「免费」。
+   *  四者都只表达「别把这个总数当精确值」,消费端一视同仁。 */
     estimated: boolean;
 }
 /** GET /v1/usage/summary — 窗内总量。 */

package/dist/usage-analytics.js

@@ -17,8 +17,13 @@ function foldModelEntry(t, d) {
     if (d.usageBasis !== "uncached-components-v1")
         t.estimated = true;
 }
+function markRowLowerBound(t, row) {
+    if (row.stats?.usageMissing === true)
+        t.estimated = true;
+}
 function foldRow(t, row) {
     t.tasks += 1;
+    markRowLowerBound(t, row);
     const mu = row.stats?.modelUsage;
     if (mu && Object.keys(mu).length > 0) {
         for (const d of Object.values(mu))
@@ -70,6 +75,7 @@ export function usageBreakdown(rows, dimension) {
                 const t = bucket(model);
                 t.tasks += 1;
                 foldModelEntry(t, d);
+                markRowLowerBound(t, r);
             }
         }
         else {
@@ -92,6 +98,8 @@ export function projectUsageStats(result) {
         const mu = stats.modelUsage;
         if (mu && typeof mu === "object" && !Array.isArray(mu))
             out.modelUsage = mu;
+        if (stats.usageMissing === true)
+            out.usageMissing = true;
         return out;
     }
     catch {

package/dist/wire-name-bound.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 这个申报名能用吗 —— 四个收口共用的**那一只**谓词。
+ *
+ * 严判:非串、空串、超 `TOOL_WIRE_NAME_MAX_CHARS` 一律不可用。本层不做截断/规范化 —— 截短一个名字
+ * 就是**换一个身份**(core 自己 7.13.0 起正是为此把截断改成拒),而被换掉身份的那台 server 上挂的
+ * allowTools / toolFaces 收窄声明会一起对不上号。
+ */
+export declare function isUsableWireName(v: unknown): v is string;
+/**
+ * 坏名的**可打印**摘要(进 warn 元数据)——中和 + 截长,绝不把任意长度的申报串原样回显进日志。
+ * 长度如实带上:运维要的是「我那个名字长了多少」,不是一屏乱码。
+ */
+export declare function describeBadWireName(v: unknown): string;
+//# sourceMappingURL=wire-name-bound.d.ts.map

package/dist/wire-name-bound.js

@@ -0,0 +1,13 @@
+import { TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
+export function isUsableWireName(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS;
+}
+export function describeBadWireName(v) {
+    if (typeof v !== "string")
+        return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    if (v.length === 0)
+        return "empty";
+    const head = v.length > 32 ? `${JSON.stringify(v.slice(0, 32))}…` : JSON.stringify(v);
+    return `${head} (${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS})`;
+}
+//# sourceMappingURL=wire-name-bound.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.70.0",
+  "version": "7.72.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.12.0",
+    "@sema-agent/core": "7.14.0",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.0.0",
+    "@sema-agent/sdk": "9.1.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",