@sema-agent/server 7.75.3 → 7.76.0

package/dist/trace/redact.js

@@ -206,23 +206,28 @@ function forgetEscapedSeparatorTails() {
     escapedTailsValue = undefined;
 }
 const VALUE_ARM_STICKY = new Map();
+const VALUE_ARMS = new Set();
 const VALUE_ARM_BODIES = [];
 const valueArm = (prefixSrc, valueClass, min, evidence) => {
     const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
     VALUE_ARM_BODIES.push(body);
-    switch (evidence) {
-        case "self-evident":
-            return new RegExp(body, "g");
-        case "needs-left-boundary": {
-            const g = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
-            VALUE_ARM_STICKY.set(g, new RegExp(body, "y"));
-            return g;
-        }
-        default: {
-            const unhandled = evidence;
-            throw new Error(`redact: unhandled value-arm evidence ${String(unhandled)}`);
+    const g = (() => {
+        switch (evidence) {
+            case "self-evident":
+                return new RegExp(body, "g");
+            case "needs-left-boundary": {
+                const re = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
+                VALUE_ARM_STICKY.set(re, new RegExp(body, "y"));
+                return re;
+            }
+            default: {
+                const unhandled = evidence;
+                throw new Error(`redact: unhandled value-arm evidence ${String(unhandled)}`);
+            }
         }
-    }
+    })();
+    VALUE_ARMS.add(g);
+    return g;
 };
 let anyValueArm;
 function anyValueArmRe() {
@@ -312,10 +317,19 @@ function collectValueArmSpans(g, y, repl, order, text, out) {
         pos = end;
     }
 }
-function runValueArm(g, y, repl, text) {
-    const spans = [];
-    collectValueArmSpans(g, y, repl, 0, text, spans);
-    return applySpans(text, spans);
+function collectStickySpans(y, repl, order, text, at, out) {
+    let pos = 0;
+    for (const p of at) {
+        if (p < pos)
+            continue;
+        y.lastIndex = p;
+        const m = y.exec(text);
+        if (m === null)
+            continue;
+        const end = p + m[0].length;
+        out.push({ start: p, end, repl, order });
+        pos = end;
+    }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
@@ -747,9 +761,10 @@ function redactionTokenEndAt(s, p, limit) {
     return 0;
 }
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
+const armOfToken = (repl) => (repl.match(/«[^»]*»/g) ?? [repl]).some((t) => t.endsWith(":partial»")) ? "fragment" : "full";
 const NO_HITS = [];
 const singleHit = (label, arm, r) => r.count > 0 ? { out: r.out, hits: [{ label, count: r.count, arm }] } : { out: r.out, hits: NO_HITS };
-const regexRule = ([re, repl], arm) => {
+const regexRule = ([re, repl]) => {
     const groupCount = (new RegExp(`${re.source}|`).exec("")?.length ?? 1) - 1;
     const refs = [...repl.matchAll(/\$(.)/g)].map(([, d]) => d ?? "");
     for (const d of refs) {
@@ -757,13 +772,11 @@ const regexRule = ([re, repl], arm) => {
             throw new Error(`redact: replacement ${JSON.stringify(repl)} uses unsupported ref $${d}`);
     }
     const expand = refs.length === 0 ? undefined : (args) => repl.replace(/\$([1-9])/g, (_, d) => args[Number(d)] ?? "");
-    const sticky = VALUE_ARM_STICKY.get(re);
-    if (sticky !== undefined && refs.length > 0)
-        throw new Error(`redact: value arm replacement ${JSON.stringify(repl)} must not use $N refs`);
+    const arm = armOfToken(repl);
+    if (VALUE_ARMS.has(re) || arm === "fragment")
+        throw new Error(`redact: rule ${JSON.stringify(repl)} belongs in the arm pool, not a per-arm section`);
     const label = labelOfToken(repl);
     const applyOnce = (text, wantCount) => {
-        if (sticky !== undefined)
-            return runValueArm(re, sticky, repl, text);
         if (!wantCount)
             return { out: text.replace(re, repl), count: 0 };
         let n = 0;
@@ -970,12 +983,13 @@ function redactPpkContainers(text, record) {
 }
 const URL_USERINFO_LABEL = labelOfToken(URL_USERINFO_PATTERN[1]);
 const urlUserinfoRule = { run: (text, _wantCount, json) => singleHit(URL_USERINFO_LABEL, "full", redactUrlUserinfo(text, json)) };
-const shapeSectionRule = (() => {
-    const arms = SHAPE_SECRET_PATTERNS.map(([re, repl], order) => {
+const armPoolRule = (() => {
+    const arms = [...SHAPE_SECRET_PATTERNS, ...FRAGMENT_SECRET_PATTERNS].map(([re, repl], order) => {
         if (/\$./.test(repl))
-            throw new Error(`redact: shape-section replacement ${JSON.stringify(repl)} must not use $N refs`);
+            throw new Error(`redact: arm-pool replacement ${JSON.stringify(repl)} must not use $N refs`);
         return { g: re, y: VALUE_ARM_STICKY.get(re), repl, order };
     });
+    const boundaryArms = arms.flatMap((a) => (a.y === undefined ? [] : [{ y: a.y, repl: a.repl, order: a.order }]));
     return {
         run: (text, wantCount) => {
             const spans = [];
@@ -985,6 +999,24 @@ const shapeSectionRule = (() => {
                 else
                     collectValueArmSpans(a.g, a.y, a.repl, a.order, text, spans);
             }
+            const tried = new Set();
+            const freshEnds = (from) => {
+                const at = [];
+                for (let k = from; k < spans.length; k++) {
+                    const e = spans[k].end;
+                    if (tried.has(e))
+                        continue;
+                    tried.add(e);
+                    at.push(e);
+                }
+                return at.sort((x, y) => x - y);
+            };
+            for (let at = freshEnds(0); at.length > 0;) {
+                const before = spans.length;
+                for (const a of boundaryArms)
+                    collectStickySpans(a.y, a.repl, a.order, text, at, spans);
+                at = freshEnds(before);
+            }
             const kept = resolveSpanOverlaps(spans);
             const out = applySpans(text, kept).out;
             if (!wantCount || kept.length === 0)
@@ -992,18 +1024,17 @@ const shapeSectionRule = (() => {
             const byToken = new Map();
             for (const sp of kept)
                 byToken.set(sp.repl, (byToken.get(sp.repl) ?? 0) + 1);
-            return { out, hits: [...byToken].map(([token, count]) => ({ label: labelOfToken(token), count, arm: "full" })) };
+            return { out, hits: [...byToken].map(([token, count]) => ({ label: labelOfToken(token), count, arm: armOfToken(token) })) };
         },
     };
 })();
 const SECRET_RULES = [
-    ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p, "full"))),
-    { run: (text, _wantCount, _json, observe) => singleHit(labelOfToken(PPK_CONTAINER_TOKEN), "full", redactPpkContainers(text, observe)) },
-    { run: (text, _wantCount, json) => singleHit(labelOfToken(PEM_FRAGMENT_TOKEN), "fragment", redactPemFragments(text, json)) },
-    { run: (text) => singleHit(labelOfToken(HEADLESS_PPK_TOKEN), "fragment", redactHeadlessPpkBodies(text)) },
-    ...KEYWORD_SECRET_PATTERNS.map((p) => regexRule(p, "full")),
-    shapeSectionRule,
-    ...FRAGMENT_SECRET_PATTERNS.map((p) => regexRule(p, "fragment")),
+    ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p))),
+    { run: (text, _wantCount, _json, observe) => singleHit(labelOfToken(PPK_CONTAINER_TOKEN), armOfToken(PPK_CONTAINER_TOKEN), redactPpkContainers(text, observe)) },
+    { run: (text, _wantCount, json) => singleHit(labelOfToken(PEM_FRAGMENT_TOKEN), armOfToken(PEM_FRAGMENT_TOKEN), redactPemFragments(text, json)) },
+    { run: (text) => singleHit(labelOfToken(HEADLESS_PPK_TOKEN), armOfToken(HEADLESS_PPK_TOKEN), redactHeadlessPpkBodies(text)) },
+    ...KEYWORD_SECRET_PATTERNS.map((p) => regexRule(p)),
+    armPoolRule,
     { run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, hits: NO_HITS }) },
 ];
 let onRedaction;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.75.3",
+  "version": "7.76.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.5",
+    "@sema-agent/core": "7.17.6",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",