@sema-agent/server 7.74.0 → 7.75.0

package/dist/http/server.js

@@ -3,7 +3,7 @@ import { redactErrorMessage, redactHead } from "../observability/run-terminal-lo
 import { once } from "node:events";
 import { createHash } from "node:crypto";
 import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, denyWorkflowParkIdentityLost, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
+import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
 import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
@@ -1211,9 +1211,9 @@ export function createHttpServer(rawDeps) {
                 noteLateSettleIfAccepted(parked);
                 return parked;
             }
-            if (origin?.kind === "workflow_identity_lost") {
+            if (origin?.kind === "workflow_parks_unreadable") {
                 void ctxPromise.catch(() => { });
-                return denyWorkflowParkIdentityLost(origin);
+                return denyWorkflowParksUnreadable(origin);
             }
             if (origin?.kind === "workflow") {
                 void ctxPromise.catch(() => { });

package/dist/observability/fail-open.d.ts

@@ -199,7 +199,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.run-terminal.redact-threw": {
         readonly cls: "F";
-        readonly note: "四个发射座(errorMessage 终态文案 / 诊断文本 diag / 补丁头 patch-head / 工件 artifact,probe 前缀判别;普查 56 行):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(关键字/前缀臂对 ≥2^23 单段 RangeError,既有,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
+        readonly note: "四个发射座(errorMessage 终态文案 / 诊断文本 diag / 补丁头 patch-head / 工件 artifact,probe 前缀判别;普查 56 行):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
     };
     readonly "server.run-terminal.redact-capped": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -190,7 +190,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.run-terminal.redact-threw": {
         cls: "F",
-        note: "四个发射座(errorMessage 终态文案 / 诊断文本 diag / 补丁头 patch-head / 工件 artifact,probe 前缀判别;普查 56 行):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(关键字/前缀臂对 ≥2^23 单段 RangeError,既有,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
+        note: "四个发射座(errorMessage 终态文案 / 诊断文本 diag / 补丁头 patch-head / 工件 artifact,probe 前缀判别;普查 56 行):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
     },
     "server.run-terminal.redact-capped": { cls: "F", note: "S-107:终态自由文本(errorMessage/blockedReason/remoteEnvFailures[].message/error 列/done·failed 行)长度 > REDACT_INPUT_CAP(64KB)⇒ 整段换 «redacted:oversized»(fail-closed 取证丢弃,不截断不扫);计数=多少条终态文案被整段丢弃" },
     "server.run-terminal.artifact-capped": { cls: "F", note: "S-107:leader_run 行上的工件字节(salvaged[].patch / candidatePatch.patch / merge.candidatePatch / merge.rej)长度 > ARTIFACT_INPUT_CAP(256KB)⇒ 整份换 «redacted:oversized-artifact»(fail-closed 取证丢弃;原字节仍在 worker 分支/merge 咽喉);计数=多少份工件被整份丢弃" },

package/dist/observability/run-terminal-log.d.ts

@@ -38,7 +38,8 @@ export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
 /** S-105(test [ref] 旁生):终态**持久化**的 `errorMessage` 与日志副本同一脱敏口——provider 错误体(403 体带回显请求头/
  *  订阅链接)里的密钥形不得原文落 run 行再由 `GET /v1/runs/:id` 直出。三 run store 的 `setTerminal` 写入前同调此函数;
  *  `undefined` 透传(缺席仍缺席),不截断(日志上限是日志的事,行上保留全文供取证)。 */
-/** r4 最终轮 [medium]:`redactSecrets` 的关键字/前缀臂对 ≥2^23 单段仍会抛 `RangeError`(既有,S-106 登记);S-105 把脱敏
+/** r4 最终轮 [medium]:`redactSecrets` 会抛 `RangeError`(关键字/前缀臂那一形已由 S-219 的 `atLeast` 铸点闭掉;仍能抛的是
+ *  JSON 秘密字段臂的转义对循环,既有未闭,S-106 登记);S-105 把脱敏
  *  挪到 `setTerminal` **入口**后,这个抛会先于 CAS/claim 释放 ⇒ run 卡 `running`、会话 claim 悬挂到 reaper。这里 **fail-closed
  *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。 */
 export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -1,3 +1,4 @@
+import type { WorkflowRun } from "@sema-agent/core";
 /** 一条索引行:**子会话 id 是主键**(会话 id 全局唯一 ⇒ 读口天然是单行精确查,无分页假阴性)。 */
 export interface WorkflowAgentSessionRow {
     /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = 那条 checkpoint 行的 `sessionId`;
@@ -20,101 +21,57 @@ export interface WorkflowAgentSessionIndex {
     syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;
     findByAgentSession(sessionId: string): Promise<WorkflowAgentSessionRow | null>;
 }
-/** 一条 wa* 行在**恢复面**上的读形(本模块两个派生点共用的最小入参 —— 只声明恢复判据用得到的位)。 */
-export interface ParkedAgentReadFace {
-    label?: unknown;
-    status?: unknown;
-    sessionId?: unknown;
-    callKey?: unknown;
-    queuedAt?: unknown;
-    startedAt?: unknown;
-    parkedCheckpointToken?: unknown;
-}
 /**
- * 🔴 **「这一行是不是一条可赎回的 park」的唯一判据**(S-192 提取;此前只内联在
- * {@link buildParkedAgentSessionRows} 里,而店层的瘦身腿需要**同一条**判据 —— 两处各写一遍就是两份会漂的
- * 定义,而它们的消费面是同一件事:park 的赎回路由)。
+ * 🔴 **park 恢复身份的单一真源**(core 7.17.0 [ref])—— 引擎写在记录上的 `parks[]` 的元素形。
  *
- * 三位缺任何一个都不算:缺 `sessionId` 的 park 行 join 不到(checkpoint 那侧的键就是它),缺
- * `parkedCheckpointToken` 的行不是一条可赎回的 park(core 契约:在场 ⟺ `status:"parked"`)。
+ * 型从 core 的那一位取、不在本仓复述:core 往元素上加一位 ⇒ `trace/core-keyset-guard.ts` 的 ⑬b 成员门
+ * 与下面那只读者的构造式**同时**红,加键的人二选一,没有第三条静默的路。
  */
-export declare function isRecoverableParkedAgent<T extends ParkedAgentReadFace>(a: T): a is T & {
-    sessionId: string;
-    parkedCheckpointToken: string;
-};
-/** LLM 撰写的 `label` 在**恢复身份行**上的字符上界。core 的铸点对它零钳零脱(脚本经 `opts.label` 供,
- *  缺席才落 auto 名;`parked-decide.ts` 拒把它内插进可信帧时亲核过这一点),而这条行存在的理由是**装得下**
- *  —— 把一段无界展示文本原样带进来会让「留身份」这件事本身把行撑爆。 */
-export declare const PARKED_IDENTITY_LABEL_MAX = 200;
+export type WorkflowRunParkKey = NonNullable<WorkflowRun["parks"]>[number];
 /**
- * 🔴 **一条 parked 行的「恢复身份」形**(S-192)—— 店层瘦身时**最后才放弃**的那一份。
- *
- * 它是一条**合法的** `WorkflowAgentRun`(core 的必填四位 `label`/`callKey`/`status`/`queuedAt` 齐全),
- * 加上赎回路由要的两位(`sessionId` = 那条 checkpoint 行的 `sessionId`,`parkedCheckpointToken` = 赎回键)。
- * 展示载荷(`prompt`/`output`/`activity`/`errorMessage`/`phase`/`model`…)一律不带 —— 那正是被裁掉的东西。
+ * 盘上 run blob → `parks[]` 的**唯一读者**(宪法 [ref] §2:进程外字节禁裸 `as` 铸形;与本文件
+ * {@link readAgentSessionLedgerLine} 同一条姿态)。
  *
- * 返回的是**普通数据**(build*),消费方是 `plugins/workflow-run-store-sql.ts` 的 `slimOversizeRun`。
- */
-export declare function buildParkedRecoveryIdentity(a: ParkedAgentReadFace & {
-    sessionId: string;
-    parkedCheckpointToken: string;
-}, // 准入判据 {@link isRecoverableParkedAgent} 的守卫输出:类型上绕不开
-labelMax?: number): Record<string, unknown>;
-/**
- * 一只 run 的 parked 行的恢复身份集(顺序 = 原行序;非 park / 无身份的行不产出)。
+ * 判据与 core 的 resume 准入**同源**(亲读安装树 `dist/orchestration/workflow.js:2217-2226`):
+ *  · 这一位**不是数组**(旧引擎写的记录 / 被投影剥掉)⇒ 读不出来。core 对这样的记录整条拒 resume
+ *    (`workflow.park_truth_unreadable` / `parks_unreadable`),本仓因此也兑付不了它 —— 答缺席,由调用方响亮拒;
+ *  · **任一条目形不合 ⇒ 整只读不出来**(整档成败制,与本文件账本行同判)。core 对同一形抛
+ *    `park_binding_broken` 整条拒 resume;「丢掉坏的、留下好的」会静默铸出一份**比真相少几条 park** 的行集,
+ *    而这只读者的消费面正是 park 的赎回路由。
  *
- * `labelMax` 是**展示名的预算**,不是第二种形:身份四位(`callKey` / `sessionId` /
- * `parkedCheckpointToken` / `status`)恒在,`label` 是这条行上唯一可弃的展示物。店的瘦身阶梯据此把
- * 「放弃展示名」排在「放弃身份」**之前** —— 传 0 即得只剩身份的最小行(`redactHead(x, 0)` 恒得空串)。
+ * ⚠️ 「读不出来」与「读得出来、只是空的」是**两个状态**:后者 = 这条 run 不负责任何 park(诚实 miss),
+ * 前者 = 证不了,两者的处置相反 ⇒ 缺席永远不折成 `[]`。
  */
-export declare function buildParkedRecoveryIdentities(agents: ReadonlyArray<ParkedAgentReadFace> | undefined, labelMax?: number): Array<Record<string, unknown>>;
-/**
- * 🔴 **park 恢复身份「保不住」的显式标记**(S-192)。
- *
- * ## 为什么它住在 run 的 blob 上、而且键名带 `server` 前缀
- * core 的 `WorkflowRun`(`orchestration/workflow-types.d.ts`)**没有合法座** —— 亲读全部可选成员
- * (`agentFailures` / `budgetOvershoot` / `timeoutInterruption` / `resume` / `journalSkips` …)全是 core 自己的
- * 观测席,没有一个说得了「本仓的店把这条 run 的 park 身份裁掉了」。而这条事实的**唯一知情点**是
- * `plugins/workflow-run-store-sql.ts` 的瘦身腿(店内),它的**唯一消费点**是 `/decide` 的 workflow 车道
- * (读 `WorkflowRunStore.get`)—— 两点之间已经有的、且只有的那条通路就是 run 的 blob。
- * (本仓的 park join 索引 {@link WorkflowAgentSessionIndex} 承载不了它:索引的**单写者**是
- * `JournalingWorkflowRunStore` 的 put/update 观察点,它拿到的是**内存里的整只 run**,结构上看不见店内那次
- * 瘦身;把这条事实塞过去要么加第二个写者、要么把店的字节上界漏进装饰器,两者都比现在这条更坏。)
- * 键名前缀 `server` 是**诚实标注**:它是本仓铸的位,不是 core 契约的一部分,也因此永远不会与 core 后来加的
- * 成员撞名。
+export declare function readRunParks(run: unknown): WorkflowRunParkKey[] | undefined;
+/** 派生的**唯一属主**:一只 `WorkflowRun` 的 park **路由**行。
  *
- * ## 闭集
- * `reason` 只有一个词(单一成因:店的字节上界)。`parks` 是被丢掉的 parked 行数 —— **只有计数,不带任何
- * 身份位**(带了就等于没裁)。
- */
-export declare const PARK_IDENTITY_LOSS_KEY = "serverParkIdentityLoss";
-export interface ParkIdentityLoss {
-    /** 闭集单值:行被店的字节上界裁掉。 */
-    reason: "oversize_slim";
-    /** 被裁掉的 parked 行数(诊断口径,不含身份位)。 */
-    parks: number;
-}
-/** 铸点(普通数据)。 */
-export declare function buildParkIdentityLoss(parks: number): ParkIdentityLoss;
-/**
- * 盘上 run blob → {@link ParkIdentityLoss} 的**唯一读者**(宪法 [ref] §2:进程外字节禁裸 `as` 铸形;
- * 与本文件 {@link readAgentSessionLedgerLine} 同一条姿态)。
+ *  🔴 **S-252 的分工线**(两轮 codex [high] 各证伪了一次「把这两件事并成一件」的尝试,红格在
+ *  `test/workflow-park-decide-lane.test.ts`):
+ *   · **路由**(本函数)回答「**哪一跑**把这个子会话 park 了」—— 一件关于**这一跑执行过什么**的事实。
+ *     它只有一个可靠的载体:`agents[]` 上那一行的执行状态(core 的 `parkAgentLeg` 在写 `parks` 条目的
+ *     同一拍把 `rec.status = "parked"` / `rec.sessionId` 落上去)。
+ *   · **赎回权威**(「这个 token 是不是这条 run 负责的一条 park」)只由记录上的 `parks[]` 回答
+ *     ——{@link readRunParks} 是它唯一的读者,消费点是 `parked-decide.ts` 的判别式。
+ *  ⇒ 恢复身份(赎回键)自此**只有一个家**;本函数一个 token 字节都不读、也不存(索引只回答「去哪条 run 找」)。
  *
- * 形不合(缺键 / 词出闭集 / 计数不是有限数)⇒ **缺席**,而不是「铸一个默认标记出来」:标记在场的后果是
- * `/decide` 响亮拒,一个凭空铸出来的标记会把一条**可赎回**的 park 拒死。
- */
-export declare function readParkIdentityLoss(run: unknown): ParkIdentityLoss | undefined;
-/** 派生的**唯一属主**:一只 `WorkflowRun` 当前的 parked 索引行。
+ *  为什么路由不能改读 `parks[]`(两条都是真跑复现出来的,别再合并):
+ *   · `parks` 含**继承而未由本跑执行**的条目:core 在读 checkpoint 真值**之前**就把它们写进新一跑的记录
+ *     (`dist/orchestration/workflow.js:2244`,读真值的循环在 `:2251` 起),那一读抛 ⇒ `:2340` 的 catch 落一条
+ *     **带 parks 而 journal 为空**的 `failed` 记录。跟着 `parks` 走 ⇒ 坐标被它抢走 ⇒ `/decide` 让宿主 resume 它
+ *     ⇒ 已完成的前缀**整段重跑**(非幂等副作用重复执行)。
+ *   · 而「只收 `originRunId === runId`」同样不成立:re-park 时 core 按 callKey 就地替换条目、`originRunId`
+ *     **沿用继承来的那一个**,只在 `journalAppendParked` 成功之后才改写成本跑 id(`:1027-1042`),而
+ *     `persist("update")` 打在 append **之前**。⇒ 那条判据会在 append 失败(以及 append 前的那一拍)上把
+ *     真正持有**新 token** 的那一跑整只排除,而上一跑的记录里只有**旧** token ⇒ 这条审批再也送不出去。
  *
- *  行的准入判据 = {@link isRecoverableParkedAgent}(与店层瘦身腿**同一条**)。
- *  ⚠️ token **不进索引行**:它是赎回能力,家在 run 的 blob 里(与 bg 行同判),索引只回答「去哪条 run 找」。 */
+ *  准入判据(两位,与 `parkAgentLeg` 的落位一一对应):行 `status === "parked"` ∧ 有非空 `sessionId`
+ *  (checkpoint 那一侧的 join 键就是它)。`callKey` 缺席写空串 —— 它是行自描述,不是 join 键。 */
 export declare function buildParkedAgentSessionRows(runId: string, run: {
     scope: string;
     agents?: ReadonlyArray<{
-        status?: string;
-        sessionId?: string;
-        callKey?: string;
-        parkedCheckpointToken?: string;
+        status?: unknown;
+        sessionId?: unknown;
+        callKey?: unknown;
     }>;
 }): WorkflowAgentSessionRow[];
 /** 两处(装饰器的变更检测、local 后端的重放)共用的行集等值判据 —— 顺序无关的集合比较,单一属主。 */

package/dist/orchestration/workflow-agent-session-index.js

@@ -1,46 +1,27 @@
 import { existsSync, fsyncSync, mkdirSync, openSync, readFileSync, truncateSync, writeSync } from "node:fs";
 import { join } from "node:path";
-import { redactHead } from "../observability/run-terminal-log.js";
 const nonEmptyString = (v) => typeof v === "string" && v !== "";
-export function isRecoverableParkedAgent(a) {
-    return a.status === "parked" && nonEmptyString(a.sessionId) && nonEmptyString(a.parkedCheckpointToken);
-}
-export const PARKED_IDENTITY_LABEL_MAX = 200;
-export function buildParkedRecoveryIdentity(a, labelMax = PARKED_IDENTITY_LABEL_MAX) {
-    return {
-        label: typeof a.label === "string" ? redactHead(a.label, labelMax) : "",
-        callKey: typeof a.callKey === "string" ? a.callKey : "",
-        status: "parked",
-        queuedAt: typeof a.queuedAt === "number" && Number.isFinite(a.queuedAt) ? a.queuedAt : 0,
-        ...(typeof a.startedAt === "number" && Number.isFinite(a.startedAt) ? { startedAt: a.startedAt } : {}),
-        sessionId: a.sessionId,
-        parkedCheckpointToken: a.parkedCheckpointToken,
-    };
-}
-export function buildParkedRecoveryIdentities(agents, labelMax = PARKED_IDENTITY_LABEL_MAX) {
-    return (agents ?? []).filter(isRecoverableParkedAgent).map((a) => buildParkedRecoveryIdentity(a, labelMax));
-}
-export const PARK_IDENTITY_LOSS_KEY = "serverParkIdentityLoss";
-export function buildParkIdentityLoss(parks) {
-    return { reason: "oversize_slim", parks };
-}
-export function readParkIdentityLoss(run) {
+export function readRunParks(run) {
     if (typeof run !== "object" || run === null)
         return undefined;
-    const v = run[PARK_IDENTITY_LOSS_KEY];
-    if (typeof v !== "object" || v === null || Array.isArray(v))
-        return undefined;
-    const { reason, parks } = v;
-    if (reason !== "oversize_slim")
+    const v = run.parks;
+    if (!Array.isArray(v))
         return undefined;
-    if (typeof parks !== "number" || !Number.isFinite(parks) || parks <= 0)
-        return undefined;
-    return { reason, parks };
+    const out = [];
+    for (const raw of v) {
+        if (typeof raw !== "object" || raw === null)
+            return undefined;
+        const { callKey, sessionId, token, originRunId } = raw;
+        if (!nonEmptyString(callKey) || !nonEmptyString(sessionId) || !nonEmptyString(token) || !nonEmptyString(originRunId))
+            return undefined;
+        out.push({ callKey, sessionId, token, originRunId });
+    }
+    return out;
 }
 export function buildParkedAgentSessionRows(runId, run) {
     const rows = [];
     for (const a of run.agents ?? []) {
-        if (!isRecoverableParkedAgent(a))
+        if (a.status !== "parked" || !nonEmptyString(a.sessionId))
             continue;
         rows.push({ sessionId: a.sessionId, runId, agentKey: typeof a.callKey === "string" ? a.callKey : "", scope: run.scope });
     }

package/dist/parked-decide.d.ts

@@ -9,8 +9,8 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolSpec, WorkflowAgentRun, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
-import { type ParkIdentityLoss, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolSpec, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
+import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
 export interface ParkedAgentMatch {
     handle: string;
     row: BackgroundAgentRecord;
@@ -40,37 +40,37 @@ export type ParkOrigin = {
     handle: string;
     row: BackgroundAgentRecord;
 }
-/** `agent` 是**权威实体**(从 run 的 blob 里按赎回键复核出来的那一行);身份位一律从它读 —— 索引行
- *  是可被改盘的派生投影,不做第二个身份写者(7.69.0 合并重扫 c1 同族收口)。 */
+/** `park` 是**权威条目**(从 run 记录的真源 `parks[]` 里按赎回键复核出来的那一条);身份位一律从它读
+ *  —— 索引行是可被改盘的派生投影,不做第二个身份写者(7.69.0 合并重扫 c1 同族收口)。 */
  | {
     kind: "workflow";
     runId: string;
     run: WorkflowRun;
-    agent: WorkflowAgentRun;
+    park: WorkflowRunParkKey;
 }
 /**
- * S-192 —— **恢复身份被店的字节上界裁掉**的那条 park(第四种出身,不是第四条车道)。
+ * S-252 —— **这条记录的 park 真源读不出来**(第四种出身,不是第四条车道)。
  *
- * 索引行还在(它由**内存里的整只 run** 派生,店内的瘦身它看不见),run 行也还在,但 blob 里已经没有
- * 那一行 —— 而 blob 里的 `parkedCheckpointToken` 是 server 侧**复核**「这条 park 仍在此 token 下」的唯一
- * 依据(引擎自己的那份赎回键住在 resume journal 的 parked 条目里,resume 时从那里取,见
- * {@link denyWorkflowParkIdentityLost} 顶注亲读的 core 坐标)。此前这一格与「索引落后一拍 / 行已在新
- * token 下 re-park」两种**正常** miss 完全同形,于是落 legacy 腿拿一个错因 409。
- * 现在店在裁掉它的同时落一个闭集标记({@link readParkIdentityLoss}),判别式据它把这一格分出来,
- * 三个消费点各自响亮处置(decide 拒 + 不驱动宿主续跑;SLA sweep 照旧静默跳过——它同样复核不了)。
+ * 索引行还在、run 行也还在,但记录上没有一份读得出来的 `parks[]`:旧引擎(core < 7.17.0)写下的存量行
+ * 根本没有这一位,或者某一条条目的形坏了。而这一位是**引擎自己**的 park 责任表 —— core 的 resume 准入
+ * 读不到它就整条拒(`workflow.park_truth_unreadable` / `parks_unreadable`,亲读安装树
+ * `dist/orchestration/workflow.js:2217-2218`;条目形坏 ⇒ `park_binding_broken`,`:2222-2224`)。
+ * ⇒ 这条决定**结构上**送不出去:答 200「已交给宿主的下一跑」就是一张兑付不了的回执。
+ * 此前这一格与「索引落后一拍 / 这条 run 已不再负责它」两种**正常** miss 完全同形,于是落 legacy 腿拿
+ * 一个错因 409。判别式据真源的**可读性**把这一格分出来,三个消费点各自响亮处置(decide 拒 + 不驱动
+ * 宿主续跑;SLA sweep 照旧静默跳过——它同样复核不了)。
  */
  | {
-    kind: "workflow_identity_lost";
+    kind: "workflow_parks_unreadable";
     runId: string;
     run: WorkflowRun;
-    loss: ParkIdentityLoss;
 };
 /** 判别式的两个源。各自可缺席(部署没接就是没接)—— 缺席 ⇒ 那条臂不判,不是失败。 */
 export interface ParkOriginSources {
     agentStore?: BackgroundAgentStore;
     /** S-185:workflow 出身的**有界** join 索引(契约见 orchestration/workflow-agent-session-index.ts)。 */
     workflowIndex?: WorkflowAgentSessionIndex;
-    /** 索引只回答「去哪条 run 找」,行本体(含赎回键)仍以 run 的 blob 为准 ⇒ 两件必须成对在场。 */
+    /** 索引只回答「去哪条 run 找」,条目本体(含赎回键)仍以 run 记录的 `parks[]` 为准 ⇒ 两件必须成对在场。 */
     workflowRunStore?: Pick<WorkflowRunStore, "get">;
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
@@ -226,26 +226,23 @@ export type WorkflowParkedDecidePlan = {
     deny: ParkedDecideResult;
 };
 /**
- * S-192 —— **恢复身份已被裁掉的 workflow park 的响亮拒**(与上面那族拒臂同一种返回形)。
+ * S-252 —— **park 真源读不出来的那条记录的响亮拒**(与上面那族拒臂同一种返回形)。
  *
- * 为什么是拒而不是「尽力而为地投递一次」(机理按 core 7.13.0 `dist/orchestration/workflow.js` 亲读,合并复审
- * R9/R23 推翻本注此前「引擎手上没有赎回键 ⇒ 重跑」的推断):
- *  · 投递用的 token 是调用方 checkpoint 的 `cp.token`(路由拿到的那枚),**不是** blob 里那一行;blob 行在本
- *    车道的用途只有一个 —— 复核「这条 park 此刻仍在此 token 下」(`agent.parkedCheckpointToken === cp.token`,
- *    行已在新 token 下 re-park ⇒ miss 不错配)。行被裁掉 = 这道复核**失明**,200「决定已交给宿主的下一跑」
- *    就证不出它兑付的是哪一条 park。
- *  · 引擎 resume 时的赎回键取自 **resume journal** 的 parked 条目(`parkedResumeFor(cached.parked.terminal.token)`,
- *    :1327/:1727),不取自 run blob;不带决定的 resume 用同一 token **重新 park**(`parkAgentLeg(reparkRec, …)`,
- *    :1345/:1738),不是重跑。blob 的 parked 行在引擎侧唯一的读点是 `prior.agents` 那道「journal 缺条目」防线
- *    (:2118-2130)—— 身份被裁掉后失明的正是它:**只有 journal 也缺该条目时**,resume 才会把那次调用活跑。
- *  ⇒ 拒,并把真话与真恢复路径说出来:先不带决定 resume(引擎按 journal re-park 进一只新的、小的 run 行),
- *    再对同一 checkpoint decide;re-park 后能否再赎回取决于新 blob 是否装得下身份行(不下 ⇒ 再落本臂)。
- *    码是新的,与既有 `decide.workflow_*` 同族。
+ * 为什么是拒而不是「尽力而为地投递一次」(机理按安装树 core 7.17.1 `dist/orchestration/workflow.js` 亲读):
+ *  · 记录上的 `parks[]` 是**引擎自己**的 park 责任表,而且是**下一次 resume 的准入输入**:
+ *    `!Array.isArray(prior.parks)` ⇒ 整条拒 resume(`workflow.park_truth_unreadable` / `parks_unreadable`,
+ *    :2217-2218);某一条条目形坏 ⇒ `park_binding_broken`(:2222-2224)。两者都不是「少一条 park」,
+ *    是**这条 run 再也 resume 不了** —— 而本车道的投递腿恰恰是让宿主去 `Workflow({resumeFromRunId})`。
+ *  ⇒ 决定结构上送不出去。答 200「已交给宿主的下一跑」就是一张兑付不了的回执:卡还 pending、人以为决完了。
+ *  ⇒ 拒,并把真话说出来:这条 run 恢复不了,开一条新的;卡仍 pending,什么都没有被伪造。
  *
- * 体上带 `runId` 与被裁掉的 park 数(`parks`)—— 后者是店给的计数,**不含任何身份位**(带了就等于没裁)。
+ * 这条臂的受害集 = **存量持久数据**(core < 7.17.0 的引擎写下、升级后还 parked 着的 run 记录)。硬 breaking
+ * 三句里持久数据那一句要的就是这个形:响亮拒,不做静默双读(读 `agents[]` 补一份身份正是被退役的双算)。
+ *
+ * 体上只带 `runId`(那是操作员唯一用得上的坐标;真源都读不出来,任何计数都是编的)。
  */
-export declare function denyWorkflowParkIdentityLost(origin: Extract<ParkOrigin, {
-    kind: "workflow_identity_lost";
+export declare function denyWorkflowParksUnreadable(origin: Extract<ParkOrigin, {
+    kind: "workflow_parks_unreadable";
 }>): ParkedDecideResult;
 export declare function planWorkflowParkedDecide(origin: Extract<ParkOrigin, {
     kind: "workflow";

package/dist/parked-decide.js

@@ -1,4 +1,4 @@
-import { readParkIdentityLoss } from "./orchestration/workflow-agent-session-index.js";
+import { readRunParks } from "./orchestration/workflow-agent-session-index.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
@@ -25,14 +25,13 @@ export async function findParkOrigin(sources, cp) {
         const run = await runStore.get(row.runId);
         if (run === null)
             return undefined;
-        const agent = (run.agents ?? []).find((a) => a.sessionId === cp.sessionId && a.status === "parked");
-        if (agent === undefined) {
-            const loss = readParkIdentityLoss(run);
-            return loss === undefined ? undefined : { kind: "workflow_identity_lost", runId: row.runId, run, loss };
-        }
-        if (agent.parkedCheckpointToken !== cp.token)
+        const parks = readRunParks(run);
+        if (parks === undefined)
+            return { kind: "workflow_parks_unreadable", runId: row.runId, run };
+        const park = parks.find((p) => p.sessionId === cp.sessionId && p.token === cp.token);
+        if (park === undefined)
             return undefined;
-        return { kind: "workflow", runId: row.runId, run, agent };
+        return { kind: "workflow", runId: row.runId, run, park };
     }
     catch (e) {
         quiet(sources.warn, "workflow_park_probe_failed", { error: e instanceof Error ? e.message : String(e) });
@@ -86,14 +85,13 @@ export function buildParkedResumeOutcome(req) {
         hostDecision: req.hostDecision,
     };
 }
-export function denyWorkflowParkIdentityLost(origin) {
+export function denyWorkflowParksUnreadable(origin) {
     return {
         status: 409,
         body: {
-            error: "this parked workflow agent's recovery identity was dropped when the run store slimmed an oversize run blob — the server can no longer verify that the row is still parked under this checkpoint token, so the decision is not delivered. The park itself is kept by the engine's resume journal, not by this blob: resume the run without a decision (the engine re-parks the child under the same token into a fresh run row), then decide again; only if that journal entry is also missing would a resume run the call live",
-            errorCode: "decide.workflow_park_identity_lost",
+            error: "this parked workflow agent's run record carries no readable list of the parks the run owns — the engine writes that list when it parks, and it is the only proof that this checkpoint token belongs to that run. A record written by an engine older than the one deployed here (or one whose entries are damaged) is refused by a resume of the run itself for the same reason, so the decision is NOT delivered rather than answered with a receipt nothing can redeem. The approval card stays pending and nothing is forged: this run cannot be resumed — start a new run",
+            errorCode: "decide.workflow_parks_unreadable",
             runId: origin.runId,
-            parksDropped: origin.loss.parks,
         },
     };
 }
@@ -131,7 +129,7 @@ export function planWorkflowParkedDecide(origin, req) {
         hostSessionId,
         runId: origin.runId,
         outcome: buildParkedResumeOutcome(req),
-        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.agent.callKey}") has been ${verdict}. ` +
+        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.park.callKey}") has been ${verdict}. ` +
             `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
             `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
             `agent; completed steps replay from the journal. Do not re-issue the original call.`,

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -78,38 +78,29 @@ export declare function withRedactedError<T extends {
  *  write (including the TERMINAL one) keeps failing → the durable row is stuck `running` forever and the 24h
  *  orphan sweep finalizes a genuinely-completed run as `abandoned`. Instead degrade the PAYLOAD, not the write.
  *
- *  🔴 **S-192(7.71.0):瘦身只裁展示载荷,parked 行的恢复身份是最后才放弃的东西。**
- *  病(修前逐字):step2 写作 `agents: []` ⇒ 一只 parked 的 workflow 子代的 `callKey` / `sessionId` /
- *  `parkedCheckpointToken` 随整段消失。server 侧复核「这条 park 仍在此 token 下」的依据**只有这一行**(join 索引
- *  刻意不存它——它是能力;引擎自己的赎回键另住 resume journal),于是 `/decide` 的 workflow 车道在 `run.agents`
- *  里找不到那一行 ⇒ 落 legacy 腿拿一个**错因**的 409 `conflict.resume_context_unavailable`,人的批准无处兑付;
- *  同时 core resume 路径上那道「blob 里 parked 而 journal 缺条目 ⇒ 拒 resume」的防线(`prior.agents`)也随之失明。
- *
- *  🔴 **7.74.0(core 7.17.0 [ref] 义务②):`parks[]` 排在恢复身份之上 —— 一级都不裁。**
+ *  🔴 **`parks[]` 是这条阶梯唯一不许碰的东西**(core 7.17.0 [ref] 义务②)。
  *  它不是观测位,是**下一次 resume 的准入输入**:core 的 resume 准入在任何 agent 被派发之前读记录上的
  *  这一位,读不到就整条拒(`workflow.park_truth_unreadable` / `parks_unreadable`)——不是「少一条 park」,
- *  是**这条 run 再也 resume 不了**。所以阶梯的判据现在是两条,按这个次序:①`parks` 永不放弃;
- *  ②恢复身份行最后放弃。实现上五级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
- *  `test/slim-oversize-run.test.ts` 里那两格(最狠的 step 5 上 `parks` 仍逐字完整 + 负控:记录本来没有
+ *  是**这条 run 再也 resume 不了**;它同时也是本仓 `/decide` 的 workflow 车道复核「这条 park 属于这条 run」
+ *  的**单一真源**(S-252)。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
+ *  `test/slim-oversize-run.test.ts` 里那两格(最狠的一级上 `parks` 仍逐字完整 + 负控:记录本来没有
  *  这一位时不许凭空补 `[]`)。缺席 ⇒ 不补:补 `[]` 会把「这版引擎没写这个位」伪造成「这条 run 没有 park」,
  *  而 core 对两者的处置相反。
  *
- *  阶梯 = 一张**按价值排序的放弃清单**,一级一级试到装得下为止(**判据只有一条:恢复身份最后放弃**):
+ *  🔴 **S-252(7.75.0):阶梯不再为 park 另存第二份恢复身份。** 7.71.0 的 S-192 曾在 `agents[]` 里逐行保住
+ *  `callKey`/`sessionId`/`parkedCheckpointToken`(外加两级 `label` 预算与一枚不可恢复标记),因为当时
+ *  `/decide` 的复核只认那一行。core 7.17.0 之后同一条记录上有了 `parks[]`,那份保留就成了**第二个会漂的
+ *  定义**(真案:最后一级清空 `agents` 之后 token 仍躺在同一个 blob 的 `parks` 里,而 `/decide` 照拒)。
+ *  ⇒ 整段退役,判别式改读单一真源。退役后的阶梯每一级都**不大于**退役前的对应级,物理下界不劣化。
+ *
+ *  阶梯 = 一张**按价值排序的放弃清单**,一级一级试到装得下为止:
  *    step 1 —— 两个无界字符串(`result` / `error`)截断带标记;
- *    step 2 —— `phases` / `groups` 整段丢,`agents` 收敛成**恢复身份行**
- *              ({@link buildParkedRecoveryIdentities};非 parked 的行不带恢复身份 ⇒ 整行丢,与修前同);
- *    step 3 —— 顶层**观测载荷**(codex r1-[high],红先复现后修):`effectiveArgs` 与 `resultFull` 整段丢、
- *              `name` / `description` 先脱后切。core 对 `effectiveArgs` 的成文口径逐字是 OBSERVATION-ONLY
- *              (never a gate input,never re-read by the engine;resume 的身份由 journal 的 callKey 携带,
- *              不是这个字段),`resultFull` 同类(取回面),两者都**无界**。修前这一级不存在,于是阶梯
- *              一边原样留着它们、一边把唯一那条 parked 行删掉盖标记 —— 自己违反了自己那条判据,
- *              一条本来赎得回的审批被判死(生产上界 4 MiB 上真复现);
- *    step 4 —— 恢复身份行上的**展示名**(`label`)—— 它是这条行上唯一可弃的展示物,身份四位恒在
- *              (codex r2-[high],红先复现后修:修前阶梯一边留着每行 200 字符的 label、一边把**全部**身份
- *              删掉盖标记 —— 同一条判据第二次被自己违反;6000 条 CJK label 的 parked 行在生产上界上
- *              实测 `agents:[]` + `parks:6000`,而清空 label 后 6000 条身份**全都装得下**);
- *    step 5 —— 连只剩身份的行都装不下 ⇒ 丢掉它们并落**显式不可恢复标记**({@link PARK_IDENTITY_LOSS_KEY}),
- *              `/decide` 与 SLA sweep 读到它就**响亮拒**,而不是让一条赎回不了的 park 看起来像普通 miss。
+ *    step 2 —— 展示载荷整段丢(`phases` / `agents` / `groups`),`error` 收成短串;
+ *    step 3 —— 顶层**观测载荷**:`effectiveArgs` 与 `resultFull` 整段丢、`name` / `description` 先脱后切。
+ *              core 对 `effectiveArgs` 的成文口径逐字是 OBSERVATION-ONLY(never a gate input,never re-read by
+ *              the engine;resume 的身份由 journal 的 callKey 携带,不是这个字段),`resultFull` 同类(取回面),
+ *              两者都**无界**;`name` / `description` 是脚本(LLM 撰写)经 `export const meta` 供的展示头,
+ *              同样无界 ⇒ **先脱后切**(切口会把读面脱敏所依赖的闭合引号一起切掉,半截凭据原样上 wire)。
  *  Returns null only when even the marked skeleton is oversize (physics — caller keeps the prior revision,
  *  matching the old behavior for that corner). Dialect-neutral (pure JS, no SQL) — shared verbatim by both twins. */
 export declare function slimOversizeRun(run: WorkflowRun & {

package/dist/plugins/workflow-run-store-sql.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { summarizeWorkflowRun, isTerminalWorkflowStatus, WorkflowRunStoreError } from "@sema-agent/core";
 import { foldKeyFamily, MAX_PENDING_PER_SESSION, PURGE_FENCE_MS, SERVED_FENCE_MS, } from "../orchestration/workflow-completion-inbox.js";
-import { buildParkedRecoveryIdentities, buildParkIdentityLoss, PARK_IDENTITY_LOSS_KEY } from "../orchestration/workflow-agent-session-index.js";
+import {} from "../orchestration/workflow-agent-session-index.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 export const MAX_RUN_BLOB_BYTES = 4 * 1024 * 1024;
@@ -24,9 +24,8 @@ export function slimOversizeRun(run, maxBytes) {
     let blob = JSON.stringify(step1);
     if (Buffer.byteLength(blob) <= maxBytes)
         return blob;
-    const identities = buildParkedRecoveryIdentities(run.agents);
     const shortError = step1.error ? String(step1.error).slice(0, 1000) + MARK : MARK;
-    const step2 = { ...step1, phases: [], agents: identities, groups: [], error: shortError };
+    const step2 = { ...step1, phases: [], agents: [], groups: [], error: shortError };
     blob = JSON.stringify(step2);
     if (Buffer.byteLength(blob) <= maxBytes)
         return blob;
@@ -38,19 +37,6 @@ export function slimOversizeRun(run, maxBytes) {
     if (typeof step3.description === "string")
         step3.description = redactHead(step3.description, SLIM_HEADER_MAX);
     blob = JSON.stringify(step3);
-    if (Buffer.byteLength(blob) <= maxBytes)
-        return blob;
-    const bareIdentities = buildParkedRecoveryIdentities(run.agents, 0);
-    const step4 = { ...step3, agents: bareIdentities };
-    blob = JSON.stringify(step4);
-    if (Buffer.byteLength(blob) <= maxBytes)
-        return blob;
-    const step5 = {
-        ...step4,
-        agents: [],
-        ...(identities.length > 0 ? { [PARK_IDENTITY_LOSS_KEY]: buildParkIdentityLoss(identities.length) } : {}),
-    };
-    blob = JSON.stringify(step5);
     return Buffer.byteLength(blob) <= maxBytes ? blob : null;
 }
 export class SqlWorkflowRunStore {

package/dist/trace/project.d.ts

@@ -122,8 +122,9 @@ export declare function toolStartEventData(ev: {
 /**
  * 🔴 **筛子是一只总函数**(S-239,codex 对抗复审 r1 [medium] 亲核复现后修)—— 上面纪律②许诺的
  * 「坏形 ⇒ report + withhold,**不抛**」此前是靠**逐条枚举**坏形兑现的,枚举不到的那些照样抛:
- * `projectSettlement` 对 `note` / `who.approver` 先 `redactSecrets` 再截断,而 `redactSecrets` 在 ≥2^23
- * 的单段上爆回溯栈(`RangeError`,S-102/S-106 登记的既有上界,见 `redact.ts` 该行顶注),两条叶各能抛一次。
+ * `projectSettlement` 对 `note` / `who.approver` 先 `redactSecrets` 再截断,而 `redactSecrets` 会在
+ * 病态输入上爆回溯栈(`RangeError`:≥2^23 单段那一形已由 S-219 的 `atLeast` 铸点闭掉,仍能抛的是 JSON 秘密字段臂的
+ * 转义对循环,S-102/S-106 登记的既有上界,见 `redact.ts` 该行顶注),两条叶各能抛一次。
  *
  * 抛出去的代价按腿算,而且一条比一条重:写腿落账那处的 `.catch` 看不到**同步**投影期的异常;读腿上它
  * 直接逃出 `formatEvent` / 投影函数 —— 账本裸回放腿的那一次会当场断流(那一行不上帧、游标不前进、后面的

package/dist/trace/redact.js

@@ -2,18 +2,292 @@ import { stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
+const atLeast = (cls, min) => `${cls}{${min}}${cls}*`;
 const ENTROPY_SCAN_MAX = 96;
 const twoStrongAhead = (valueClass) => String.raw `(?=${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z]${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z])`;
 const IDENT_CONNECTORS = "[_./-]";
 const noConnectorAhead = (valueClass) => String.raw `(?!${valueClass}{0,${ENTROPY_SCAN_MAX}}${IDENT_CONNECTORS}${valueClass})`;
 const WORD_INTERIOR_CLASS = "[A-Za-z0-9]";
-const ANSI_CSI = String.raw `(?:\x1b\[|\\u001[bB]\[|\x9b|\\u009[bB])[0-?]*[ -/]*[@-~]`;
-const ESCAPED_SEPARATOR_TAIL = String.raw `(?<=\\(?:[bfnrt]|u[0-9a-fA-F]{4})|${ANSI_CSI})`;
-const VALUE_ARM_LEFT_BOUNDARY = String.raw `(?:(?<!${WORD_INTERIOR_CLASS})|${ESCAPED_SEPARATOR_TAIL})`;
-const valueArm = (prefixSrc, valueClass, min) => new RegExp(`${VALUE_ARM_LEFT_BOUNDARY}${prefixSrc}${twoStrongAhead(valueClass)}${valueClass}{${min},}`, "g");
+const CH_TAB = 9, CH_LF = 10, CH_CR = 13, CH_ESC = 27, CH_SPACE = 32, CH_PLUS = 43, CH_MINUS = 45, CH_SLASH = 47;
+const CH_0 = 48, CH_9 = 57, CH_COLON = 58, CH_EQ = 61, CH_AT = 64, CH_A = 65, CH_Z = 90;
+const CH_LBRACKET = 91, CH_BACKSLASH = 92, CH_UNDERSCORE = 95;
+const CH_a = 97, CH_b = 98, CH_f = 102, CH_n = 110, CH_r = 114, CH_t = 116, CH_u = 117, CH_z = 122, CH_TILDE = 126;
+const CH_QUOTE = 34;
+const CH_CSI8 = 155;
+const CH_LAQUO = 171;
+const ESC_CHAR = String.fromCharCode(CH_ESC);
+const CSI8_CHAR = String.fromCharCode(CH_CSI8);
+const WORD_INTERIOR_BYTES = (() => {
+    const one = new RegExp(`^${WORD_INTERIOR_CLASS}$`);
+    const table = new Uint8Array(256);
+    for (let c = 0; c < table.length; c++)
+        if (one.test(String.fromCharCode(c)))
+            table[c] = 1;
+    return table;
+})();
+function hexDigitValue(c) {
+    if (c >= CH_0 && c <= CH_9)
+        return c - CH_0;
+    if (c >= CH_A && c <= CH_A + 5)
+        return c - CH_A + 10;
+    if (c >= CH_a && c <= CH_a + 5)
+        return c - CH_a + 10;
+    return -1;
+}
+function c1LeadLen(s, i, code) {
+    if (s.charCodeAt(i) === code)
+        return 1;
+    if (s.charCodeAt(i) !== CH_BACKSLASH || s.charCodeAt(i + 1) !== CH_u)
+        return 0;
+    let v = 0;
+    for (let k = i + 2; k < i + 6; k++) {
+        const d = hexDigitValue(s.charCodeAt(k));
+        if (d < 0)
+            return 0;
+        v = v * 16 + d;
+    }
+    return v === code ? 6 : 0;
+}
+const CSI_PARAM_RUN = /[0-?]*/y;
+const INTERMEDIATE_RUN = /[ -/]*/y;
+function skipClassRun(re, s, p) {
+    if (p >= s.length)
+        return p;
+    re.lastIndex = p;
+    return re.exec(s) === null ? p : re.lastIndex;
+}
+function scanIntermediateChain(s, p, termLo, termHi, mark) {
+    const n = s.length;
+    for (;;) {
+        p = skipClassRun(INTERMEDIATE_RUN, s, p);
+        if (p >= n)
+            return p;
+        const c = s.charCodeAt(p);
+        if (c >= termLo && c <= termHi)
+            mark(p + 1);
+        if (c !== CH_BACKSLASH)
+            return p;
+        let k = p;
+        while (k < n && s.charCodeAt(k) === CH_BACKSLASH)
+            k += 1;
+        if (k >= n || s.charCodeAt(k) !== CH_QUOTE)
+            return p;
+        p = k + 1;
+    }
+}
+const ESCAPED_SEPARATOR_UNITS = [
+    {
+        leads: ["\\b", "\\f", "\\n", "\\r", "\\t", "\\u"],
+        scan: (s, i, mark) => {
+            if (s.charCodeAt(i) !== CH_BACKSLASH)
+                return i;
+            const c = s.charCodeAt(i + 1);
+            if (c === CH_b || c === CH_f || c === CH_n || c === CH_r || c === CH_t)
+                mark(i + 2);
+            else if (c === CH_u && hexDigitValue(s.charCodeAt(i + 2)) >= 0 && hexDigitValue(s.charCodeAt(i + 3)) >= 0
+                && hexDigitValue(s.charCodeAt(i + 4)) >= 0 && hexDigitValue(s.charCodeAt(i + 5)) >= 0)
+                mark(i + 6);
+            return i;
+        },
+    },
+    {
+        leads: [ESC_CHAR, CSI8_CHAR, "\\u"],
+        scan: (s, i, mark) => {
+            const esc = c1LeadLen(s, i, CH_ESC);
+            let p;
+            if (esc > 0) {
+                if (s.charCodeAt(i + esc) !== CH_LBRACKET)
+                    return i;
+                p = i + esc + 1;
+            }
+            else {
+                const csi8 = c1LeadLen(s, i, CH_CSI8);
+                if (csi8 === 0)
+                    return i;
+                p = i + csi8;
+            }
+            return scanIntermediateChain(s, skipClassRun(CSI_PARAM_RUN, s, p), CH_AT, CH_TILDE, mark);
+        },
+    },
+    {
+        leads: [ESC_CHAR, "\\u"],
+        scan: (s, i, mark) => {
+            const esc = c1LeadLen(s, i, CH_ESC);
+            return esc === 0 ? i : scanIntermediateChain(s, i + esc, CH_0, CH_TILDE, mark);
+        },
+    },
+];
+const ESCAPED_SEPARATOR_NEEDLES = [...new Set(ESCAPED_SEPARATOR_UNITS.flatMap((u) => u.leads))];
+const NEEDLE_FIRST_CHARS = [...new Set(ESCAPED_SEPARATOR_NEEDLES.map((n) => n.slice(0, 1)))];
+const RUN_SKIPPABLE_BYTES = (() => {
+    const table = new Uint8Array(256);
+    for (const first of NEEDLE_FIRST_CHARS) {
+        const code = first.charCodeAt(0);
+        if (code >= table.length)
+            continue;
+        const single = ESCAPED_SEPARATOR_NEEDLES.some((n) => n.length === 1 && n.charCodeAt(0) === code);
+        const selfPair = ESCAPED_SEPARATOR_NEEDLES.some((n) => n.length > 1 && n.charCodeAt(0) === code && n.charCodeAt(1) === code);
+        if (!single && !selfPair)
+            table[code] = 1;
+    }
+    return table;
+})();
+function markEscapedSeparatorTails(s) {
+    const any = anyValueArmRe();
+    let ends;
+    let ascending = true;
+    const mark = (end) => {
+        if (end > s.length)
+            return;
+        const tail = s.charCodeAt(end - 1);
+        if (tail < WORD_INTERIOR_BYTES.length && WORD_INTERIOR_BYTES[tail] !== 1)
+            return;
+        any.lastIndex = end;
+        if (any.exec(s) === null)
+            return;
+        if (ends === undefined)
+            ends = [end];
+        else {
+            if (end < ends[ends.length - 1])
+                ascending = false;
+            ends.push(end);
+        }
+    };
+    const nextAt = new Array(NEEDLE_FIRST_CHARS.length).fill(-1);
+    const nextLead = (from) => {
+        let best = Number.POSITIVE_INFINITY;
+        for (let k = 0; k < NEEDLE_FIRST_CHARS.length; k++) {
+            if (nextAt[k] < from) {
+                const hit = s.indexOf(NEEDLE_FIRST_CHARS[k], from);
+                nextAt[k] = hit === -1 ? Number.POSITIVE_INFINITY : hit;
+            }
+            if (nextAt[k] < best)
+                best = nextAt[k];
+        }
+        return best === Number.POSITIVE_INFINITY ? -1 : best;
+    };
+    const n = s.length;
+    for (let i = nextLead(0); i >= 0;) {
+        let resume = i;
+        for (const unit of ESCAPED_SEPARATOR_UNITS) {
+            const consumed = unit.scan(s, i, mark);
+            if (consumed > resume)
+                resume = consumed;
+        }
+        if (resume === i) {
+            const code = s.charCodeAt(i);
+            if (code < RUN_SKIPPABLE_BYTES.length && RUN_SKIPPABLE_BYTES[code] === 1) {
+                let j = i + 1;
+                while (j < n && s.charCodeAt(j) === code)
+                    j += 1;
+                if (j > i + 1)
+                    resume = j - 1;
+            }
+        }
+        i = nextLead(resume > i ? resume : i + 1);
+    }
+    if (ends === undefined)
+        return undefined;
+    if (!ascending)
+        ends.sort((x, y) => x - y);
+    return ends;
+}
+let escapedTailsText;
+let escapedTailsValue;
+function escapedSeparatorTails(s) {
+    if (escapedTailsText !== s) {
+        escapedTailsValue = markEscapedSeparatorTails(s);
+        escapedTailsText = s;
+    }
+    return escapedTailsValue;
+}
+function forgetEscapedSeparatorTails() {
+    escapedTailsText = undefined;
+    escapedTailsValue = undefined;
+}
+const VALUE_ARM_STICKY = new Map();
+const VALUE_ARM_BODIES = [];
+const valueArm = (prefixSrc, valueClass, min) => {
+    const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
+    const g = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
+    VALUE_ARM_STICKY.set(g, new RegExp(body, "y"));
+    VALUE_ARM_BODIES.push(body);
+    return g;
+};
+let anyValueArm;
+function anyValueArmRe() {
+    return (anyValueArm ??= new RegExp(`(?:${VALUE_ARM_BODIES.join("|")})`, "y"));
+}
+function runValueArm(g, y, repl, text, wantCount) {
+    const tails = escapedSeparatorTails(text);
+    if (tails === undefined) {
+        if (!wantCount)
+            return { out: text.replace(g, repl), count: 0 };
+        let hits = 0;
+        const replaced = text.replace(g, () => {
+            hits += 1;
+            return repl;
+        });
+        return { out: replaced, count: hits };
+    }
+    let out;
+    let copied = 0;
+    let count = 0;
+    let pos = 0;
+    let ti = 0;
+    let bIdx = -1;
+    let bEnd = -1;
+    const nextB = (from) => {
+        while (ti < tails.length) {
+            const p = tails[ti];
+            ti += 1;
+            if (p < from)
+                continue;
+            y.lastIndex = p;
+            const m = y.exec(text);
+            if (m !== null) {
+                bIdx = p;
+                bEnd = p + m[0].length;
+                return;
+            }
+        }
+        bIdx = -1;
+    };
+    nextB(0);
+    g.lastIndex = 0;
+    let a = g.exec(text);
+    for (;;) {
+        if (a !== null && a.index < pos) {
+            g.lastIndex = pos;
+            a = g.exec(text);
+        }
+        if (bIdx >= 0 && bIdx < pos)
+            nextB(pos);
+        let idx;
+        let end;
+        if (a !== null && (bIdx < 0 || a.index <= bIdx)) {
+            idx = a.index;
+            end = a.index + a[0].length;
+        }
+        else if (bIdx >= 0) {
+            idx = bIdx;
+            end = bEnd;
+        }
+        else
+            break;
+        (out ??= []).push(text.slice(copied, idx), repl);
+        copied = end;
+        count += 1;
+        pos = end;
+    }
+    if (out === undefined)
+        return { out: text, count: 0 };
+    out.push(text.slice(copied));
+    return { out: out.join(""), count };
+}
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
-const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${valueClass}{${min},}${tailSrc}` +
-    `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${valueClass}{${min},}${tailSrc})`, "g");
+const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
+    `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${atLeast(valueClass, min)}${tailSrc})`, "g");
 const STRUCTURAL_SECRET_PATTERNS = [
     [/-----BEGIN(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
@@ -30,22 +304,17 @@ const KEYWORD_SECRET_PATTERNS = [
 ];
 const SHAPE_SECRET_PATTERNS = [
     [valueArm("sk-", "[A-Za-z0-9_-]", 16), "«redacted:key»"],
-    [/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, "«redacted:gh-token»"],
-    [/github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59,}/g, "«redacted:gh-token»"],
-    [/xox[baprs]-[A-Za-z0-9-]{10,}/g, "«redacted:slack-token»"],
-    [/AKIA[0-9A-Z]{16,}/g, "«redacted:aws-key»"],
-    [/ASIA[0-9A-Z]{16,}/g, "«redacted:aws-key»"],
-    [/(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test|org)_[A-Za-z0-9]{24,}|pypi-[A-Za-z0-9_-]{85,})/g, "«redacted:key»"],
-    [/xapp-\d-[A-Za-z0-9-]{20,}/g, "«redacted:slack-token»"],
+    [new RegExp(String.raw `(?:ghp|gho|ghu|ghs|ghr)_${atLeast("[A-Za-z0-9]", 20)}`, "g"), "«redacted:gh-token»"],
+    [new RegExp(String.raw `github_pat_[A-Za-z0-9]{22}_${atLeast("[A-Za-z0-9]", 59)}`, "g"), "«redacted:gh-token»"],
+    [new RegExp(String.raw `xox[baprs]-${atLeast("[A-Za-z0-9-]", 10)}`, "g"), "«redacted:slack-token»"],
+    [new RegExp(String.raw `AKIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
+    [new RegExp(String.raw `ASIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
+    [new RegExp(String.raw `(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-${atLeast("[A-Za-z0-9_-]", 20)}|(?:sk|rk)_(?:live|test|org)_${atLeast("[A-Za-z0-9]", 24)}|pypi-${atLeast("[A-Za-z0-9_-]", 85)})`, "g"), "«redacted:key»"],
+    [new RegExp(String.raw `xapp-\d-${atLeast("[A-Za-z0-9-]", 20)}`, "g"), "«redacted:slack-token»"],
 ];
 const FULL_SECRET_PATTERNS = [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS];
 const PEM_HEADER_IDENT_MAX = 31;
 const PEM_BODY_RUN_MIN = 8;
-const CH_TAB = 9, CH_LF = 10, CH_CR = 13, CH_SPACE = 32, CH_PLUS = 43, CH_MINUS = 45, CH_SLASH = 47;
-const CH_0 = 48, CH_9 = 57, CH_COLON = 58, CH_EQ = 61, CH_A = 65, CH_Z = 90, CH_BACKSLASH = 92, CH_UNDERSCORE = 95;
-const CH_a = 97, CH_n = 110, CH_r = 114, CH_t = 116, CH_z = 122;
-const CH_QUOTE = 34;
-const CH_LAQUO = 171;
 const isSepCode = (c) => c === CH_SPACE || c === CH_TAB || c === CH_CR || c === CH_LF;
 const isBase64Code = (c) => (c >= CH_A && c <= CH_Z) || (c >= CH_a && c <= CH_z) || (c >= CH_0 && c <= CH_9) || c === CH_PLUS || c === CH_SLASH || c === CH_EQ;
 const isIdentStartCode = (c) => (c >= CH_A && c <= CH_Z) || (c >= CH_a && c <= CH_z);
@@ -421,7 +690,7 @@ function redactHeadlessPpkBodies(text) {
 const FRAGMENT_SECRET_PATTERNS = [
     [valueArm("sk-", "[A-Za-z0-9_-]", 6), "«redacted:key:partial»"],
     [valueArm("(?:ghp|gho|ghu|ghs|ghr)_", "[A-Za-z0-9]", 8), "«redacted:gh-token:partial»"],
-    [/github_pat_[A-Za-z0-9_]{8,}/g, "«redacted:gh-token:partial»"],
+    [new RegExp(String.raw `github_pat_${atLeast("[A-Za-z0-9_]", 8)}`, "g"), "«redacted:gh-token:partial»"],
     [valueArm("xox[baprs]-", "[A-Za-z0-9-]", 4), "«redacted:slack-token:partial»"],
     [valueArm("AKIA", "[0-9A-Z]", 6), "«redacted:aws-key:partial»"],
     [valueArm("ASIA", "[0-9A-Z]", 8), "«redacted:aws-key:partial»"],
@@ -454,10 +723,15 @@ const regexRule = ([re, repl], arm) => {
             throw new Error(`redact: replacement ${JSON.stringify(repl)} uses unsupported ref $${d}`);
     }
     const expand = refs.length === 0 ? undefined : (args) => repl.replace(/\$([1-9])/g, (_, d) => args[Number(d)] ?? "");
+    const sticky = VALUE_ARM_STICKY.get(re);
+    if (sticky !== undefined && refs.length > 0)
+        throw new Error(`redact: value arm replacement ${JSON.stringify(repl)} must not use $N refs`);
     return {
         label: labelOfToken(repl),
         arm,
         run: (text, wantCount, json) => {
+            if (sticky !== undefined)
+                return runValueArm(re, sticky, repl, text, wantCount);
             const rx = re;
             if (!wantCount)
                 return { out: text.replace(rx, repl), count: 0 };
@@ -704,6 +978,7 @@ export function redactSecrets(text, opts) {
     const wantCount = onRedaction !== undefined && (opts?.observe ?? true);
     const json = opts?.json === true;
     const r = applyRules(normalizeForRedaction(text), wantCount, json, opts?.observe ?? true);
+    forgetEscapedSeparatorTails();
     reportHits(r.hits);
     return r.out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.74.0",
+  "version": "7.75.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.1",
+    "@sema-agent/core": "7.17.2",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.1.0",
+    "@sema-agent/sdk": "9.2.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",