@sema-agent/server 7.75.1 → 7.75.3

package/dist/fleet/subagent-tail-bus.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "../trace/redact.js";
-import { taskProgressEventData, toolStartEventData, toolEndEventData } from "../trace/project.js";
+import { taskProgressEventData, toolStartEventData, toolEndEventData, textEndEventData } from "../trace/project.js";
 const TAIL_QUEUE_CAP = 512;
 export function projectTailFrame(e) {
     const t = e.type;
@@ -19,14 +19,8 @@ export function projectTailFrame(e) {
         return { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) };
     }
     if (t === "text_end") {
-        if (typeof e.content !== "string" || e.content.length === 0)
-            return null;
-        return {
-            type: "text_end",
-            content: e.content,
-            ...(typeof e.eventId === "string" ? { eventId: e.eventId } : {}),
-            ...(typeof e.parentToolCallId === "string" ? { parentToolCallId: e.parentToolCallId } : {}),
-        };
+        const f = textEndEventData(e);
+        return f === null ? null : { type: "text_end", ...f };
     }
     if (t === "reasoning_delta") {
         const rd = e;

package/dist/http/routes/tasks.js

@@ -12,7 +12,7 @@ import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../..
 import { mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -347,8 +347,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         sseData(res, { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) });
                                     }
                                     else if (t === "text_end") {
-                                        const tend = e;
-                                        sseData(res, { type: "text_end", content: tend.content, ...(tend.eventId ? { eventId: tend.eventId } : {}), ...(tend.parentToolCallId ? { parentToolCallId: tend.parentToolCallId } : {}) });
+                                        const tend = textEndEventData(e);
+                                        if (tend !== null)
+                                            sseData(res, { type: "text_end", ...tend });
                                     }
                                     else if (t === "reasoning_delta") {
                                         const rd = e;
@@ -493,16 +494,19 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         ...(e.sourceTaskId !== undefined ? { sourceTaskId: e.sourceTaskId } : {}),
                                         ...(e.bgAgentId !== undefined ? { bgAgentId: e.bgAgentId } : {}),
                                     };
+                                    const textEnd = ev.type === "text_end" ? textEndEventData(e) : undefined;
                                     const arm = ev.type === "text_delta"
                                         ? { type: "text_delta", delta: e.delta, ...ident }
                                         : ev.type === "text_end"
-                                            ? { type: "text_end", content: e.content, ...ident }
+                                            ?
+                                                textEnd === null || textEnd === undefined ? null : { type: "text_end", ...textEnd }
                                             : ev.type === "turn_end"
                                                 ? { type: "turn_end", ...(e.usage !== undefined ? { usage: e.usage } : {}), ...(e.usageMissing !== undefined ? { usageMissing: e.usageMissing } : {}), ...(e.stopReason !== undefined ? { stopReason: e.stopReason } : {}), ...ident }
                                                 : ev.type === "message_committed"
                                                     ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
                                                     : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
-                                    sseData(res, arm);
+                                    if (arm !== null)
+                                        sseData(res, arm);
                                 }
                                 else {
                                     sseData(res, ev);

package/dist/trace/project.d.ts

@@ -187,6 +187,13 @@ export declare function screenedGate(v: unknown): GateOutcome | undefined;
  * 不改原对象(调用方与账本共享引用):有变更时换一只信封,原记录一个字节不动。
  */
 export declare function screenedStoredEventData(type: string, data: unknown): unknown;
+/** `text_end` 段末帧的**唯一**铸点(三腿共用:top stream / 转发子代腿 / 子代 tail 面)。content = 段权威全文 ⇒ 与
+ *  durable 面(`result` / 账本 `text` 行)同一只 {@link redactModelText}(认出才改写、抛则占位、不设上限)。
+ *  此前三处各自逐字透传 —— 同一份文本毫秒后在 `done.result.result` 上已脱,live 面却在凭据生成瞬间明文(B-114)。
+ *  `text_delta` 仍逐字:跨 chunk 的凭据无法就地判,流式脱敏是独立设计件(S-270)。
+ *  坏形(content 非串/空串)⇒ null(丢帧,不铸「权威空段」:core 契约明言空段不发本帧,消费端收到空段会清掉已攒 delta)。
+ *  身份四键零字节变换(live 现状带全四键,消费端可能已依赖)。 */
+export declare function textEndEventData(ev: Record<string, unknown>): Record<string, unknown> | null;
 /** The durable `tool_end` payload (shared by both append sites). E1: the model-facing `output` is UNTRUSTED RAW
  *  from core (file/shell/API bodies) — core only SIZE-bounds it (`truncated`), REDACTION is ours (same contract as
  *  `tool_start.args`); never re-fed to a model. E2: identity. Absent `output` ⇒ the tool produced no content body.

package/dist/trace/project.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactModelText } from "../observability/run-terminal-log.js";
 import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -173,6 +173,17 @@ function projectSettlement(st) {
         ...(typeof st.note === "string" ? { note: redactSecrets(st.note).slice(0, SETTLEMENT_NOTE_MAX) } : {}),
     };
 }
+export function textEndEventData(ev) {
+    if (typeof ev.content !== "string" || ev.content.length === 0)
+        return null;
+    return {
+        content: redactModelText(ev.content),
+        ...(ev.eventId !== undefined ? { eventId: ev.eventId } : {}),
+        ...(ev.parentToolCallId !== undefined ? { parentToolCallId: ev.parentToolCallId } : {}),
+        ...(ev.sourceTaskId !== undefined ? { sourceTaskId: ev.sourceTaskId } : {}),
+        ...(ev.bgAgentId !== undefined ? { bgAgentId: ev.bgAgentId } : {}),
+    };
+}
 export function toolEndEventData(ev) {
     const gate = ev.gate === undefined ? undefined : screenedGate(ev.gate);
     return {

package/dist/trace/redact.d.ts

@@ -30,6 +30,8 @@
  *
  * 两组臂,顺序即优先序:{@link FULL_SECRET_PATTERNS}(完整形)在前,{@link FRAGMENT_SECRET_PATTERNS}
  * ([ref] 前缀残片,上游先截后脱的产物 ⇒ 带 `:partial` 后缀的 token)在后。
+ * ⚠️ **一个例外,自 7.75.2**:完整臂里的**裸形段**内部没有优先序 —— 该段全臂一次收候选跨度、解重叠、一次替换
+ * ({@link shapeSectionRule}),段内臂序对输出无语义。段**之间**的先后照旧是契约。
  */
 /** 本模块替换 token 的**闭形**正则源(`«redacted»` / `«redacted:aws-key»` / `«redacted:gh-token:partial»` …):
  *  URL-userinfo 臂用它把「用户名位上已经是本模块 token」整个当一个用户名单元吃掉。模块加载时对

package/dist/trace/redact.js

@@ -207,32 +207,65 @@ function forgetEscapedSeparatorTails() {
 }
 const VALUE_ARM_STICKY = new Map();
 const VALUE_ARM_BODIES = [];
-const valueArm = (prefixSrc, valueClass, min) => {
+const valueArm = (prefixSrc, valueClass, min, evidence) => {
     const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
-    const g = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
-    VALUE_ARM_STICKY.set(g, new RegExp(body, "y"));
     VALUE_ARM_BODIES.push(body);
-    return g;
+    switch (evidence) {
+        case "self-evident":
+            return new RegExp(body, "g");
+        case "needs-left-boundary": {
+            const g = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
+            VALUE_ARM_STICKY.set(g, new RegExp(body, "y"));
+            return g;
+        }
+        default: {
+            const unhandled = evidence;
+            throw new Error(`redact: unhandled value-arm evidence ${String(unhandled)}`);
+        }
+    }
 };
 let anyValueArm;
 function anyValueArmRe() {
     return (anyValueArm ??= new RegExp(`(?:${VALUE_ARM_BODIES.join("|")})`, "y"));
 }
-function runValueArm(g, y, repl, text, wantCount) {
+function collectRegexSpans(g, repl, order, text, out) {
+    g.lastIndex = 0;
+    for (let m = g.exec(text); m !== null; m = g.exec(text)) {
+        const end = m.index + m[0].length;
+        out.push({ start: m.index, end, repl, order });
+        g.lastIndex = end > m.index ? end : m.index + 1;
+    }
+}
+function resolveSpanOverlaps(spans) {
+    spans.sort((a, b) => a.start - b.start || b.end - a.end || a.order - b.order);
+    const kept = [];
+    let covered = 0;
+    for (const s of spans) {
+        if (s.end <= covered)
+            continue;
+        kept.push(s.start >= covered ? s : { ...s, start: covered });
+        covered = s.end;
+    }
+    return kept;
+}
+function applySpans(text, spans) {
+    if (spans.length === 0)
+        return { out: text, count: 0 };
+    const parts = [];
+    let copied = 0;
+    for (const s of spans) {
+        parts.push(text.slice(copied, s.start), s.repl);
+        copied = s.end;
+    }
+    parts.push(text.slice(copied));
+    return { out: parts.join(""), count: spans.length };
+}
+function collectValueArmSpans(g, y, repl, order, text, out) {
     const tails = escapedSeparatorTails(text);
     if (tails === undefined) {
-        if (!wantCount)
-            return { out: text.replace(g, repl), count: 0 };
-        let hits = 0;
-        const replaced = text.replace(g, () => {
-            hits += 1;
-            return repl;
-        });
-        return { out: replaced, count: hits };
+        collectRegexSpans(g, repl, order, text, out);
+        return;
     }
-    let out;
-    let copied = 0;
-    let count = 0;
     let pos = 0;
     let ti = 0;
     let bIdx = -1;
@@ -275,15 +308,14 @@ function runValueArm(g, y, repl, text, wantCount) {
         }
         else
             break;
-        (out ??= []).push(text.slice(copied, idx), repl);
-        copied = end;
-        count += 1;
+        out.push({ start: idx, end, repl, order });
         pos = end;
     }
-    if (out === undefined)
-        return { out: text, count: 0 };
-    out.push(text.slice(copied));
-    return { out: out.join(""), count };
+}
+function runValueArm(g, y, repl, text) {
+    const spans = [];
+    collectValueArmSpans(g, y, repl, 0, text, spans);
+    return applySpans(text, spans);
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
@@ -303,7 +335,6 @@ const KEYWORD_SECRET_PATTERNS = [
     [keywordArm("[Tt]oken", "[A-Za-z0-9._~+/-]", 20), "token «redacted»"],
 ];
 const SHAPE_SECRET_PATTERNS = [
-    [valueArm("sk-", "[A-Za-z0-9_-]", 16), "«redacted:key»"],
     [new RegExp(String.raw `(?:ghp|gho|ghu|ghs|ghr)_${atLeast("[A-Za-z0-9]", 20)}`, "g"), "«redacted:gh-token»"],
     [new RegExp(String.raw `github_pat_[A-Za-z0-9]{22}_${atLeast("[A-Za-z0-9]", 59)}`, "g"), "«redacted:gh-token»"],
     [new RegExp(String.raw `xox[baprs]-${atLeast("[A-Za-z0-9-]", 10)}`, "g"), "«redacted:slack-token»"],
@@ -311,6 +342,7 @@ const SHAPE_SECRET_PATTERNS = [
     [new RegExp(String.raw `ASIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
     [new RegExp(String.raw `(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-${atLeast("[A-Za-z0-9_-]", 20)}|(?:sk|rk)_(?:live|test|org)_${atLeast("[A-Za-z0-9]", 24)}|pypi-${atLeast("[A-Za-z0-9_-]", 85)})`, "g"), "«redacted:key»"],
     [new RegExp(String.raw `xapp-\d-${atLeast("[A-Za-z0-9-]", 20)}`, "g"), "«redacted:slack-token»"],
+    [valueArm("sk-", "[A-Za-z0-9_-]", 16, "self-evident"), "«redacted:key»"],
 ];
 const FULL_SECRET_PATTERNS = [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS];
 const PEM_HEADER_IDENT_MAX = 31;
@@ -688,14 +720,14 @@ function redactHeadlessPpkBodies(text) {
     return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
 const FRAGMENT_SECRET_PATTERNS = [
-    [valueArm("sk-", "[A-Za-z0-9_-]", 6), "«redacted:key:partial»"],
-    [valueArm("(?:ghp|gho|ghu|ghs|ghr)_", "[A-Za-z0-9]", 8), "«redacted:gh-token:partial»"],
+    [valueArm("sk-", "[A-Za-z0-9_-]", 6, "needs-left-boundary"), "«redacted:key:partial»"],
+    [valueArm("(?:ghp|gho|ghu|ghs|ghr)_", "[A-Za-z0-9]", 8, "needs-left-boundary"), "«redacted:gh-token:partial»"],
     [new RegExp(String.raw `github_pat_${atLeast("[A-Za-z0-9_]", 8)}`, "g"), "«redacted:gh-token:partial»"],
-    [valueArm("xox[baprs]-", "[A-Za-z0-9-]", 4), "«redacted:slack-token:partial»"],
-    [valueArm("AKIA", "[0-9A-Z]", 6), "«redacted:aws-key:partial»"],
-    [valueArm("ASIA", "[0-9A-Z]", 8), "«redacted:aws-key:partial»"],
-    [valueArm("(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-)", "[A-Za-z0-9_-]", 8), "«redacted:key:partial»"],
-    [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4), "«redacted:slack-token:partial»"],
+    [valueArm("xox[baprs]-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
+    [valueArm("AKIA", "[0-9A-Z]", 6, "needs-left-boundary"), "«redacted:aws-key:partial»"],
+    [valueArm("ASIA", "[0-9A-Z]", 8, "needs-left-boundary"), "«redacted:aws-key:partial»"],
+    [valueArm("(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-)", "[A-Za-z0-9_-]", 8, "needs-left-boundary"), "«redacted:key:partial»"],
+    [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
 ];
 const REDACTION_TOKENS = new Set([...FULL_SECRET_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
@@ -715,6 +747,8 @@ function redactionTokenEndAt(s, p, limit) {
     return 0;
 }
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
+const NO_HITS = [];
+const singleHit = (label, arm, r) => r.count > 0 ? { out: r.out, hits: [{ label, count: r.count, arm }] } : { out: r.out, hits: NO_HITS };
 const regexRule = ([re, repl], arm) => {
     const groupCount = (new RegExp(`${re.source}|`).exec("")?.length ?? 1) - 1;
     const refs = [...repl.matchAll(/\$(.)/g)].map(([, d]) => d ?? "");
@@ -726,23 +760,20 @@ const regexRule = ([re, repl], arm) => {
     const sticky = VALUE_ARM_STICKY.get(re);
     if (sticky !== undefined && refs.length > 0)
         throw new Error(`redact: value arm replacement ${JSON.stringify(repl)} must not use $N refs`);
-    return {
-        label: labelOfToken(repl),
-        arm,
-        run: (text, wantCount, json) => {
-            if (sticky !== undefined)
-                return runValueArm(re, sticky, repl, text, wantCount);
-            const rx = re;
-            if (!wantCount)
-                return { out: text.replace(rx, repl), count: 0 };
-            let n = 0;
-            const out = text.replace(rx, (...args) => {
-                n += 1;
-                return expand === undefined ? repl : expand(args);
-            });
-            return { out, count: n };
-        },
+    const label = labelOfToken(repl);
+    const applyOnce = (text, wantCount) => {
+        if (sticky !== undefined)
+            return runValueArm(re, sticky, repl, text);
+        if (!wantCount)
+            return { out: text.replace(re, repl), count: 0 };
+        let n = 0;
+        const out = text.replace(re, (...args) => {
+            n += 1;
+            return expand === undefined ? repl : expand(args);
+        });
+        return { out, count: n };
     };
+    return { run: (text, wantCount) => singleHit(label, arm, applyOnce(text, wantCount)) };
 };
 const URL_USERINFO_PATTERN = (() => {
     const row = FULL_SECRET_PATTERNS.find(([, repl]) => repl.endsWith("»@"));
@@ -937,16 +968,43 @@ function redactPpkContainers(text, record) {
     }
     return count === 0 ? { out: text, count: 0 } : { out: out + text.slice(last), count };
 }
-const urlUserinfoRule = { label: labelOfToken(URL_USERINFO_PATTERN[1]), arm: "full", run: (text, _wantCount, json) => redactUrlUserinfo(text, json) };
+const URL_USERINFO_LABEL = labelOfToken(URL_USERINFO_PATTERN[1]);
+const urlUserinfoRule = { run: (text, _wantCount, json) => singleHit(URL_USERINFO_LABEL, "full", redactUrlUserinfo(text, json)) };
+const shapeSectionRule = (() => {
+    const arms = SHAPE_SECRET_PATTERNS.map(([re, repl], order) => {
+        if (/\$./.test(repl))
+            throw new Error(`redact: shape-section replacement ${JSON.stringify(repl)} must not use $N refs`);
+        return { g: re, y: VALUE_ARM_STICKY.get(re), repl, order };
+    });
+    return {
+        run: (text, wantCount) => {
+            const spans = [];
+            for (const a of arms) {
+                if (a.y === undefined)
+                    collectRegexSpans(a.g, a.repl, a.order, text, spans);
+                else
+                    collectValueArmSpans(a.g, a.y, a.repl, a.order, text, spans);
+            }
+            const kept = resolveSpanOverlaps(spans);
+            const out = applySpans(text, kept).out;
+            if (!wantCount || kept.length === 0)
+                return { out, hits: NO_HITS };
+            const byToken = new Map();
+            for (const sp of kept)
+                byToken.set(sp.repl, (byToken.get(sp.repl) ?? 0) + 1);
+            return { out, hits: [...byToken].map(([token, count]) => ({ label: labelOfToken(token), count, arm: "full" })) };
+        },
+    };
+})();
 const SECRET_RULES = [
     ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p, "full"))),
-    { label: labelOfToken(PPK_CONTAINER_TOKEN), arm: "full", run: (text, _wantCount, _json, observe) => redactPpkContainers(text, observe) },
-    { label: labelOfToken(PEM_FRAGMENT_TOKEN), arm: "fragment", run: (text, _wantCount, json) => redactPemFragments(text, json) },
-    { label: labelOfToken(HEADLESS_PPK_TOKEN), arm: "fragment", run: (text) => redactHeadlessPpkBodies(text) },
+    { run: (text, _wantCount, _json, observe) => singleHit(labelOfToken(PPK_CONTAINER_TOKEN), "full", redactPpkContainers(text, observe)) },
+    { run: (text, _wantCount, json) => singleHit(labelOfToken(PEM_FRAGMENT_TOKEN), "fragment", redactPemFragments(text, json)) },
+    { run: (text) => singleHit(labelOfToken(HEADLESS_PPK_TOKEN), "fragment", redactHeadlessPpkBodies(text)) },
     ...KEYWORD_SECRET_PATTERNS.map((p) => regexRule(p, "full")),
-    ...SHAPE_SECRET_PATTERNS.map((p) => regexRule(p, "full")),
+    shapeSectionRule,
     ...FRAGMENT_SECRET_PATTERNS.map((p) => regexRule(p, "fragment")),
-    { ...urlUserinfoRule, run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, count: 0 }) },
+    { run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, hits: NO_HITS }) },
 ];
 let onRedaction;
 export function setRedactionObserver(fn) {
@@ -958,8 +1016,8 @@ function applyRules(text, wantCount, json, observe) {
     for (const rule of SECRET_RULES) {
         const r = rule.run(out, wantCount, json, observe);
         out = r.out;
-        if (wantCount && r.count > 0)
-            hits.push({ label: rule.label, count: r.count, arm: rule.arm });
+        if (wantCount && r.hits.length > 0)
+            hits.push(...r.hits);
     }
     return { out, hits };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.75.1",
+  "version": "7.75.3",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.4",
+    "@sema-agent/core": "7.17.5",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",