@sema-agent/server 7.75.4 → 7.76.1

package/dist/tool-approval.js

@@ -31,10 +31,13 @@ const DEFAULT_PARK_TOMBSTONE_MAX = 2000;
 const DEFAULT_PARK_TOMBSTONE_TTL_MS = 60 * 60_000;
 const DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX = 128;
 const PARKING_RETRY_AFTER_MS = 250;
+function ruleMaterialCarriesCredentialShape(command) {
+    return redactSecrets(command, { observe: false }) !== normalizeForRedaction(command);
+}
 function durableRuleMaterial(material) {
     if (material === undefined)
         return { ruleCommand: null, ruleScopeRoot: null };
-    if (redactSecrets(material.command, { observe: false }) !== normalizeForRedaction(material.command)) {
+    if (ruleMaterialCarriesCredentialShape(material.command)) {
         defaultLogger.warn("approval rule material withheld: the adjudicated command carries credential-shaped bytes", {
             commandChars: material.command.length,
         });
@@ -1799,6 +1802,10 @@ export class ToolApprovalCoordinator {
             return withFlag(false, "rule_store_error");
         if (inputWasEdited)
             return withFlag(false, "rule_input_edited");
+        if (ruleMaterialCarriesCredentialShape(material.command)) {
+            defaultLogger.warn("approval rule material withheld on the live leg: the adjudicated command carries credential-shaped bytes", { commandChars: material.command.length });
+            return withFlag(false, "rule_material_absent");
+        }
         if (persistRule.kind === "batch") {
             const offer = material.offers[persistRule.batchOfferIndex];
             if (offer === undefined || offer.kind !== "batch")

package/dist/trace/redact.d.ts

@@ -28,10 +28,13 @@
  * `redactModelText`(四座同调:结果两叶经 `redactTerminalResult`,账本两行经 `redactLedgerEventData`);
  * 它定的是**写回**判据(认出凭据形才改字节、抛则占位),不是第二张规则表。
  *
- * 两组臂,顺序即优先序:{@link FULL_SECRET_PATTERNS}(完整形)在前,{@link FRAGMENT_SECRET_PATTERNS}
- * ([ref] 前缀残片,上游先截后脱的产物 ⇒ 带 `:partial` 后缀的 token)在后。
- * ⚠️ **一个例外,自 7.75.2**:完整臂里的**裸形段**内部没有优先序 —— 该段全臂一次收候选跨度、解重叠、一次替换
- * ({@link shapeSectionRule}),段内臂序对输出无语义。段**之间**的先后照旧是契约。
+ * 臂分**三段 + 一个候选池**,段之间的先后是契约(上下文越多越靠前):结构段(PEM/URL/JSON + 三条体扫描器)
+ * → 词法关键字段(`Bearer`/`Basic`/`token`)→ **候选池** → URL 收尾归一化。
+ * ⚠️ **池内没有优先序,自 7.76.0**:{@link SHAPE_SECRET_PATTERNS}(裸形八条)与 {@link FRAGMENT_SECRET_PATTERNS}
+ * ([ref] 前缀残片八条,上游先截后脱的产物 ⇒ 带 `:partial` 后缀的 token)并进**同一个**候选池
+ * ({@link armPoolRule}):全臂看同一份未改写文本收候选跨度 → 不动点 → 并集律解重叠 → 一次替换,
+ * **池内臂序对输出无语义**(7.75.2 只做到裸形一段,残片段仍逐臂改写 ⇒ S-282 的两条漏形)。
+ * 左边界律因此有**三种**边界:非词内字符 ∨ 转义分隔单元尾 ∨ **一枚已收候选跨度的尾**(= 凭据尾)。
  */
 /** 本模块替换 token 的**闭形**正则源(`«redacted»` / `«redacted:aws-key»` / `«redacted:gh-token:partial»` …):
  *  URL-userinfo 臂用它把「用户名位上已经是本模块 token」整个当一个用户名单元吃掉。模块加载时对

package/dist/trace/redact.js

@@ -206,23 +206,28 @@ function forgetEscapedSeparatorTails() {
     escapedTailsValue = undefined;
 }
 const VALUE_ARM_STICKY = new Map();
+const VALUE_ARMS = new Set();
 const VALUE_ARM_BODIES = [];
 const valueArm = (prefixSrc, valueClass, min, evidence) => {
     const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
     VALUE_ARM_BODIES.push(body);
-    switch (evidence) {
-        case "self-evident":
-            return new RegExp(body, "g");
-        case "needs-left-boundary": {
-            const g = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
-            VALUE_ARM_STICKY.set(g, new RegExp(body, "y"));
-            return g;
-        }
-        default: {
-            const unhandled = evidence;
-            throw new Error(`redact: unhandled value-arm evidence ${String(unhandled)}`);
+    const g = (() => {
+        switch (evidence) {
+            case "self-evident":
+                return new RegExp(body, "g");
+            case "needs-left-boundary": {
+                const re = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
+                VALUE_ARM_STICKY.set(re, new RegExp(body, "y"));
+                return re;
+            }
+            default: {
+                const unhandled = evidence;
+                throw new Error(`redact: unhandled value-arm evidence ${String(unhandled)}`);
+            }
         }
-    }
+    })();
+    VALUE_ARMS.add(g);
+    return g;
 };
 let anyValueArm;
 function anyValueArmRe() {
@@ -312,10 +317,19 @@ function collectValueArmSpans(g, y, repl, order, text, out) {
         pos = end;
     }
 }
-function runValueArm(g, y, repl, text) {
-    const spans = [];
-    collectValueArmSpans(g, y, repl, 0, text, spans);
-    return applySpans(text, spans);
+function collectStickySpans(y, repl, order, text, at, out) {
+    let pos = 0;
+    for (const p of at) {
+        if (p < pos)
+            continue;
+        y.lastIndex = p;
+        const m = y.exec(text);
+        if (m === null)
+            continue;
+        const end = p + m[0].length;
+        out.push({ start: p, end, repl, order });
+        pos = end;
+    }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
@@ -747,9 +761,10 @@ function redactionTokenEndAt(s, p, limit) {
     return 0;
 }
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
+const armOfToken = (repl) => (repl.match(/«[^»]*»/g) ?? [repl]).some((t) => t.endsWith(":partial»")) ? "fragment" : "full";
 const NO_HITS = [];
 const singleHit = (label, arm, r) => r.count > 0 ? { out: r.out, hits: [{ label, count: r.count, arm }] } : { out: r.out, hits: NO_HITS };
-const regexRule = ([re, repl], arm) => {
+const regexRule = ([re, repl]) => {
     const groupCount = (new RegExp(`${re.source}|`).exec("")?.length ?? 1) - 1;
     const refs = [...repl.matchAll(/\$(.)/g)].map(([, d]) => d ?? "");
     for (const d of refs) {
@@ -757,13 +772,11 @@ const regexRule = ([re, repl], arm) => {
             throw new Error(`redact: replacement ${JSON.stringify(repl)} uses unsupported ref $${d}`);
     }
     const expand = refs.length === 0 ? undefined : (args) => repl.replace(/\$([1-9])/g, (_, d) => args[Number(d)] ?? "");
-    const sticky = VALUE_ARM_STICKY.get(re);
-    if (sticky !== undefined && refs.length > 0)
-        throw new Error(`redact: value arm replacement ${JSON.stringify(repl)} must not use $N refs`);
+    const arm = armOfToken(repl);
+    if (VALUE_ARMS.has(re) || arm === "fragment")
+        throw new Error(`redact: rule ${JSON.stringify(repl)} belongs in the arm pool, not a per-arm section`);
     const label = labelOfToken(repl);
     const applyOnce = (text, wantCount) => {
-        if (sticky !== undefined)
-            return runValueArm(re, sticky, repl, text);
         if (!wantCount)
             return { out: text.replace(re, repl), count: 0 };
         let n = 0;
@@ -970,12 +983,13 @@ function redactPpkContainers(text, record) {
 }
 const URL_USERINFO_LABEL = labelOfToken(URL_USERINFO_PATTERN[1]);
 const urlUserinfoRule = { run: (text, _wantCount, json) => singleHit(URL_USERINFO_LABEL, "full", redactUrlUserinfo(text, json)) };
-const shapeSectionRule = (() => {
-    const arms = SHAPE_SECRET_PATTERNS.map(([re, repl], order) => {
+const armPoolRule = (() => {
+    const arms = [...SHAPE_SECRET_PATTERNS, ...FRAGMENT_SECRET_PATTERNS].map(([re, repl], order) => {
         if (/\$./.test(repl))
-            throw new Error(`redact: shape-section replacement ${JSON.stringify(repl)} must not use $N refs`);
+            throw new Error(`redact: arm-pool replacement ${JSON.stringify(repl)} must not use $N refs`);
         return { g: re, y: VALUE_ARM_STICKY.get(re), repl, order };
     });
+    const boundaryArms = arms.flatMap((a) => (a.y === undefined ? [] : [{ y: a.y, repl: a.repl, order: a.order }]));
     return {
         run: (text, wantCount) => {
             const spans = [];
@@ -985,6 +999,24 @@ const shapeSectionRule = (() => {
                 else
                     collectValueArmSpans(a.g, a.y, a.repl, a.order, text, spans);
             }
+            const tried = new Set();
+            const freshEnds = (from) => {
+                const at = [];
+                for (let k = from; k < spans.length; k++) {
+                    const e = spans[k].end;
+                    if (tried.has(e))
+                        continue;
+                    tried.add(e);
+                    at.push(e);
+                }
+                return at.sort((x, y) => x - y);
+            };
+            for (let at = freshEnds(0); at.length > 0;) {
+                const before = spans.length;
+                for (const a of boundaryArms)
+                    collectStickySpans(a.y, a.repl, a.order, text, at, spans);
+                at = freshEnds(before);
+            }
             const kept = resolveSpanOverlaps(spans);
             const out = applySpans(text, kept).out;
             if (!wantCount || kept.length === 0)
@@ -992,18 +1024,17 @@ const shapeSectionRule = (() => {
             const byToken = new Map();
             for (const sp of kept)
                 byToken.set(sp.repl, (byToken.get(sp.repl) ?? 0) + 1);
-            return { out, hits: [...byToken].map(([token, count]) => ({ label: labelOfToken(token), count, arm: "full" })) };
+            return { out, hits: [...byToken].map(([token, count]) => ({ label: labelOfToken(token), count, arm: armOfToken(token) })) };
         },
     };
 })();
 const SECRET_RULES = [
-    ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p, "full"))),
-    { run: (text, _wantCount, _json, observe) => singleHit(labelOfToken(PPK_CONTAINER_TOKEN), "full", redactPpkContainers(text, observe)) },
-    { run: (text, _wantCount, json) => singleHit(labelOfToken(PEM_FRAGMENT_TOKEN), "fragment", redactPemFragments(text, json)) },
-    { run: (text) => singleHit(labelOfToken(HEADLESS_PPK_TOKEN), "fragment", redactHeadlessPpkBodies(text)) },
-    ...KEYWORD_SECRET_PATTERNS.map((p) => regexRule(p, "full")),
-    shapeSectionRule,
-    ...FRAGMENT_SECRET_PATTERNS.map((p) => regexRule(p, "fragment")),
+    ...STRUCTURAL_SECRET_PATTERNS.map((p) => (p === URL_USERINFO_PATTERN ? urlUserinfoRule : regexRule(p))),
+    { run: (text, _wantCount, _json, observe) => singleHit(labelOfToken(PPK_CONTAINER_TOKEN), armOfToken(PPK_CONTAINER_TOKEN), redactPpkContainers(text, observe)) },
+    { run: (text, _wantCount, json) => singleHit(labelOfToken(PEM_FRAGMENT_TOKEN), armOfToken(PEM_FRAGMENT_TOKEN), redactPemFragments(text, json)) },
+    { run: (text) => singleHit(labelOfToken(HEADLESS_PPK_TOKEN), armOfToken(HEADLESS_PPK_TOKEN), redactHeadlessPpkBodies(text)) },
+    ...KEYWORD_SECRET_PATTERNS.map((p) => regexRule(p)),
+    armPoolRule,
     { run: (text, _wantCount, json) => ({ out: redactUrlUserinfo(text, json).out, hits: NO_HITS }) },
 ];
 let onRedaction;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.75.4",
+  "version": "7.76.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.6",
+    "@sema-agent/core": "7.17.7",
     "@sema-agent/settings-schema": "1.10.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",