@sema-agent/server 7.76.1 → 7.76.2

package/dist/http/routes/sessions.js

@@ -5,7 +5,7 @@ import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
@@ -36,7 +36,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
         if (im && req.method === "GET") {
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             sendJson(res, 200, {
@@ -52,7 +52,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
         if (stm && req.method === "GET") {
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             sendJson(res, 200, {
@@ -72,7 +72,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
         const mm = /^\/v1\/sessions\/([^/]+)\/mcp$/.exec(url);
         if (mm && req.method === "GET") {
             if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             const specs = mcpForScenario(deps.config.mcpServers, deps.config.defaultScenario);
@@ -122,7 +122,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
         const am = /^\/v1\/sessions\/([^/]+)\/a2a$/.exec(url);
         if (am && req.method === "GET") {
             if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             const specs = a2aForScenario(deps.config.a2aPeers, deps.config.defaultScenario);
@@ -420,7 +420,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 return;
             }
             if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             if (!deps.sessionAudit) {
@@ -480,7 +480,7 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 return;
             }
             if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             if (!deps.sessionAudit) {

package/dist/http/routes/side-query.js

@@ -3,7 +3,7 @@ import { HttpError } from "../../security.js";
 import { isModelAllowlisted } from "../../model-select.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
-import { gatedPrincipal } from "../principal-gate.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 const CORE_PREFLIGHT_VALIDATION_PREFIXES = ["Unknown model ref ", "No model for role "];
 export function isCorePreflightValidationError(message) {
     return CORE_PREFLIGHT_VALIDATION_PREFIXES.some((prefix) => message.startsWith(prefix));
@@ -43,7 +43,7 @@ async function handleSideQueryBody(req, res, url, ctx, miss) {
                 return;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
-                sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+                sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
             let body;

package/dist/http/routes/workflows.js

@@ -9,7 +9,7 @@ import { redactErrorMessage, redactHead } from "../../observability/run-terminal
 const JOURNAL_PROJECTION_MEMO_CAP = 1024;
 const journalProjectionMemo = new Map();
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 const WORKFLOWS_RE = /^\/v1\/workflows(?:\/([^/]+)(\/stream|\/journal)?)?$/;
 const WORKFLOW_AGENT_STEER_RE = /^\/v1\/workflows\/([^/]+)\/agents\/([^/]+)\/steer$/;
 export async function handleWorkflows(req, res, url, ctx) {
@@ -29,7 +29,7 @@ async function handleWorkflowsReadBody(req, res, url, ctx, miss) {
     if (wfMatch) {
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && !principal) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+            sendPrincipalRefusal(res, req, deps.config);
             return;
         }
         if (!deps.workflowRunStore) {
@@ -163,7 +163,7 @@ async function handleWorkflowAgentSteerBody(req, res, url, ctx, miss) {
         }
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && principal === undefined) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+            sendPrincipalRefusal(res, req, deps.config);
             return;
         }
         const wfRunId = safeDecode(wfSteerMatch[1]);

package/dist/http/server.js

@@ -85,7 +85,7 @@ export { cascadeConfig };
 import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 import { sendJson, sendError, httpErrorCode, msg, isSseResponse } from "./send.js";
-import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator } from "./principal-gate.js";
+import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 export { explicitOperatorOk, isOperator };
@@ -2331,7 +2331,7 @@ export function createHttpServer(rawDeps) {
     function runOwnerOk(req, res, owner, notFoundForm = "run") {
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && !principal) {
-            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+            sendPrincipalRefusal(res, req, deps.config);
             return false;
         }
         const legacyShellOwner = !deps.config.requirePrincipal && owner === "anon:shell-live" && (principal === undefined || principal === null);

package/dist/parent-watch.d.ts

@@ -9,23 +9,31 @@
  * (core `FileStorageBackend` 的 pidfile,失效判定是 `process.kill(pid,0)` ⇒ **活孤儿是合法持锁人**),
  * 于是此后每一只新壳起自己的引擎都撞锁 fatal「another instance (pid N) owns this data dir」—— 用户看到
  * 的是「壳崩过一次以后就再也起不来了」。持锁 pid 不存在时 core 已自动剪陈旧锁,缺的只有「父死、子活」
- * 这一形。所以引擎给自己装一只**自查**腿:定期问一句"生我的那个还在吗",不在就**自己**走正常停机。
+ * 这一形。所以引擎给自己装一只**自查**腿:定期问一句"生我的那个还在吗"。
+ *
+ * ## 本腿**不**做什么(S-306,硬 breaking)
+ *
+ * 它**不判死、不 drain、不退进程**。父没了只说明这台引擎成了**孤儿**,而「孤儿该不该退」是**租约**
+ * 的问题:还有没有人附着、有没有在飞的 turn、静默够不够久 —— 那是 `boot/engine-lease.ts` 那一条腿,
+ * 孤儿态只是把它的窗从 `ENGINE_LINGER_MS` 换成 `ENGINE_ORPHAN_LINGER_MS`(默认 2s)。
+ * 旧出口(父死**即** drain,单拍、零附着感知)在「A 起引擎、B 按 engine.port 复用、A 正常退出」这一形
+ * 下会在 B 的 turn 中间把引擎拆掉 —— 自退律从此**只有一条**,本腿退化成它的一个输入。
  *
  * ## 机制(逐条都是契约)
  *
  *  1. **opt-in**:`SEMA_PARENT_PID` 缺席 ⇒ 整件不装配(`boot/shutdown.ts` 连 `createParentWatch` 都不调)。
  *     存量部署逐字零变化 —— systemd / launchd / 容器托管的引擎本来就 reparent 到 1,自退是事故。
  *     坏值(非正整数 / 超 int32)⇒ **启动期拒**,在 `config.ts` 的 `parentPidEnv()`。
- *  2. **判死 = 两支合取口一句,任一成立即判死**,每 {@link PARENT_WATCH_INTERVAL_MS} 一拍:
+ *  2. **判据 = 两支合取口一句,任一成立即标孤儿**,每 {@link PARENT_WATCH_INTERVAL_MS} 一拍:
  *
  *       · **强身份支 `reparented`**:`process.ppid` 不再是装配那一刻的那个值。生我的进程没了,内核就把
  *         我过继给 init(或容器里的 subreaper)—— 这是**内核对亲子关系的直答**,不依赖 pid 的身份。
  *         判据刻意**不写成 `ppid === 1`**:① 收养者未必是 1(PID 1 是 subreaper 的容器里不是);
  *         ② 壳本身就是 pid 1 的容器形里(`SEMA_PARENT_PID=1`),`=== 1` 会在**开机第一拍**把一台健康
- *         引擎判死。「不再是生我的那个」两种形都答得对,而且不需要任何特判。
+ *         引擎标成孤儿。「不再是生我的那个」两种形都答得对,而且不需要任何特判。
  *         🔴 **前提**(codex 复审 R1 [high],验真后修):这一支只有在「被监视的 pid 就是生我的那个」时
  *         才等价于「它没了」。壳经一层 wrapper spawn 引擎却仍传**自己**的 pid 时,引擎的直接父是
- *         wrapper —— wrapper 先退会让这一支把一台**壳还活着**的健康引擎连同 in-flight run 一起关掉。
+ *         wrapper —— wrapper 先退会让这一支把一台**壳还活着**的健康引擎标成孤儿(于是它的租约窗被无故收短)。
  *         前提在**装配那一刻**就能一次判完(`ppidAtArm === pid`),所以它是**装配期的开关**而不是每拍
  *         的特判:不成立 ⇒ 强身份支整条不装,只留弱身份支(它在那一形下语义仍然正确),并且 armed 那行
  *         改打 **warn** —— 覆盖面被降级了不许静默。
@@ -37,16 +45,16 @@
  *
  *     强身份支**先判**:它成立时这一拍连探活都不发 —— 弱判据没有资格给一个已经被过继走的进程改口
  *     (僵尸父那一形里 `kill(pid,0)` 恰恰恒成功)。
- *  3. **单拍即判,不去抖**。[ref] 定稿是「15s 一拍、连续两拍才判死」(上界 30s),S-292 整条退役:
- *     部署面的判据是「壳挂了 ≤5s 内数据根重新可用」,而 `ESRCH` / `ppid` 都不是会抖的读数(两者都是
- *     内核的直答,不是采样值)。去抖买不到确定性,只买到 15s 的延迟和一个 30s 长的 pid-复用窗口。
- *  4. **判死后走 `drain`**,即 `boot/shutdown.ts` 里 SIGTERM 用的那一条 `drainThenShutdown` —— in-flight
- *     run 的结算 / park 语义与人工停机**逐字一致**,而且收尾链里的 `backend.close()` 才是把 `LOCK`
- *     真正还回去的那一步。本模块自己**从不** `process.exit`。已有停机属主(`isStopped`)时站下不重入。
+ *  3. **单拍即判,不去抖**。[ref] 定稿是「15s 一拍、连续两拍才判定」(上界 30s),S-292 整条退役:
+ *     部署面的判据是「壳挂了以后数据根要在秒级重新可用」,而 `ESRCH` / `ppid` 都不是会抖的读数(两者
+ *     都是内核的直答,不是采样值)。去抖买不到确定性,只买到 15s 的延迟和一个 30s 长的 pid-复用窗口。
+ *  4. **命中一次即停探**(父不会复活),出口是 {@link ParentWatchDeps.onOrphaned} —— 装配层据此记下
+ *     「孤儿了 + 是哪一支判的」,租约腿下一拍读到它就换窗。本模块自己**从不** drain、**从不**
+ *     `process.exit`。已有停机属主(`isStopped`)时站下不重入(一次正在进行的优雅停机不必再被标孤儿)。
  *  5. **interval 必须 unref**:监视腿不得成为"进程本该退出却退不掉"的理由(与 drain tick 刻意不 unref
  *     的取向相反 —— 那一只 tick 就是停机驱动,这一只只是观察者)。
- *  6. **日志分档**([ref] 响亮律):装配 = `info`;判死与探活自坏 = `warn`(非计划内的停机、以及"这条腿
- *     此刻是失效的",都不许混在 info 流里)。档位是**闭集** {@link ParentWatchLogLevel},装配层用
+ *  6. **日志分档**([ref] 响亮律):装配 = `info`;标孤儿与探活自坏 = `warn`(非计划内的生命周期事件、
+ *     以及"这条腿此刻是失效的",都不许混在 info 流里)。档位是**闭集** {@link ParentWatchLogLevel},装配层用
  *     `Record<ParentWatchLogLevel, …>` 派发 ⇒ 新增一档是编译错,不会静默落进 info。
  *
  * ## 已知残余(成文,现版不收窄)
@@ -64,8 +72,9 @@
 export declare const PARENT_WATCH_INTERVAL_MS = 2000;
 /** 日志档位闭集。装配层按 `Record<ParentWatchLogLevel, …>` 派发 —— 新增一档必须在那里显式安置(编译错)。 */
 export type ParentWatchLogLevel = "info" | "warn";
-/** 判死缘由闭集(上 `parent_watch_exit` 的 `reason` 键,运维按它区分两支)。 */
-export type ParentDeathReason = "reparented" | "esrch";
+/** 成孤儿的缘由闭集(上 `parent_watch_orphaned` 的 `reason` 键,运维按它区分两支;也是租约自退留痕
+ *  `exit-last.json` 与 `engine_lease_auto_exit` 事件里 `reason` 的孤儿那两个词)。 */
+export type ParentOrphanReason = "reparented" | "esrch";
 export interface ParentWatchDeps {
     /** 被监视的父 pid(`config.parentPid`,已在 config 层校验为正整数)。 */
     pid: number;
@@ -75,11 +84,16 @@ export interface ParentWatchDeps {
     /** 亲子关系 seam:缺省 = `process.ppid`(**活读**,不是 boot 时的快照 —— 实测过继后当场变)。
      *  存在的理由与 `probe` 相同:reparent 在进程内测试里没有确定性的触发法。 */
     readPpid?: () => number;
-    /** 已有停机属主(`closing || draining`)时监视腿站下:一次正在进行的优雅 drain 不该被"父也没了"
-     *  升级成第二信号硬停(那会斩掉 in-flight leg —— 与本件"和人工停机逐字一致"的取向相反)。 */
+    /** 已有停机属主(`closing || draining`)时监视腿站下:停机已经在走了,再标一次孤儿改变不了任何事,
+     *  只会给一次计划内的停机添一条误导的 warn。 */
     isStopped: () => boolean;
-    /** 判死出口 = SIGTERM 那条 graceful drain。 */
-    drain: () => void;
+    /**
+     * **唯一出口**(S-306):父不在了 ⇒ 把这台引擎标成孤儿。**至多调用一次**(命中即停探)。
+     *
+     * 🔴 它**不是** drain:退不退由 `boot/engine-lease.ts` 的租约律按「无附着 ∧ 无在飞 ∧ 静默满
+     * `orphanLingerMs`」判。装配层拿到 reason 之后要做的只有一件事 —— 记下孤儿态(时刻 + 缘由)。
+     */
+    onOrphaned: (reason: ParentOrphanReason) => void;
     log: (level: ParentWatchLogLevel, event: string, fields: Record<string, unknown>) => void;
 }
 /** 装配并**立刻**起监视(装配即 `parent_watch_armed`)。返回停机链用的 `stop()`。 */

package/dist/parent-watch.js

@@ -12,11 +12,11 @@ export function createParentWatch(deps) {
         directParent,
         intervalMs: PARENT_WATCH_INTERVAL_MS,
         note: directParent
-            ? "engine watches this pid; it enters the same graceful drain as SIGTERM as soon as EITHER the engine is " +
-                "reparented away from it OR process.kill(pid,0) reports ESRCH (EPERM = alive). " +
-                "Unset SEMA_PARENT_PID to disable."
+            ? "engine watches this pid; it marks ITSELF an orphan as soon as EITHER the engine is reparented away from " +
+                "it OR process.kill(pid,0) reports ESRCH (EPERM = alive). Being orphaned does NOT shut the engine down — " +
+                "it only shortens the attachment-lease window to ENGINE_ORPHAN_LINGER_MS. Unset SEMA_PARENT_PID to disable."
             : "SEMA_PARENT_PID is NOT this engine's direct parent (ppid differs at arm time) — a wrapper process sits " +
-                "in between. The reparent arm is therefore NOT armed (it would stop a healthy engine when the wrapper " +
+                "in between. The reparent arm is therefore NOT armed (it would orphan a healthy engine when the wrapper " +
                 "exits while the watched process is still alive); only the process.kill(pid,0)/ESRCH arm is active, so a " +
                 "watched parent that exits WITHOUT being reaped (zombie) will not be detected. Spawn the engine directly " +
                 "from the process whose pid you pass.",
@@ -30,7 +30,7 @@ export function createParentWatch(deps) {
         }
         const ppid = readPpid();
         if (directParent && ppid !== ppidAtArm) {
-            fire("reparented", { ppidAtArm, ppid });
+            markOrphaned("reparented", { ppidAtArm, ppid });
             return;
         }
         try {
@@ -39,7 +39,7 @@ export function createParentWatch(deps) {
         catch (err) {
             const code = err?.code;
             if (code === "ESRCH") {
-                fire("esrch", { ppid });
+                markOrphaned("esrch", { ppid });
                 return;
             }
             if (code !== "EPERM" && !probeErrorReported) {
@@ -56,15 +56,17 @@ export function createParentWatch(deps) {
         }
     }, PARENT_WATCH_INTERVAL_MS);
     timer.unref?.();
-    function fire(reason, fields) {
+    function markOrphaned(reason, fields) {
         stop();
-        deps.log("warn", "parent_watch_exit", {
+        deps.log("warn", "parent_watch_orphaned", {
             pid: deps.pid,
             reason,
             ...fields,
-            note: "the parent that spawned this engine is gone — entering the SIGTERM graceful drain path",
+            note: "the parent that spawned this engine is gone — this engine is now an ORPHAN. It does NOT shut down here: " +
+                "it stays up while anything is attached or in flight, and self-exits via the SIGTERM graceful drain once " +
+                "the attachment lease has been idle for ENGINE_ORPHAN_LINGER_MS (see engine_lease_auto_exit).",
         });
-        deps.drain();
+        deps.onOrphaned(reason);
     }
     function stop() {
         if (stopped)

package/dist/tool-approval.js

@@ -2,7 +2,7 @@ import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
-import { normalizeForRedaction, redactDeep, redactSecrets } from "./trace/redact.js";
+import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
@@ -32,7 +32,7 @@ const DEFAULT_PARK_TOMBSTONE_TTL_MS = 60 * 60_000;
 const DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX = 128;
 const PARKING_RETRY_AFTER_MS = 250;
 function ruleMaterialCarriesCredentialShape(command) {
-    return redactSecrets(command, { observe: false }) !== normalizeForRedaction(command);
+    return redactSecretsWithArms(command, { observe: false }).arms.has("full");
 }
 function durableRuleMaterial(material) {
     if (material === undefined)

package/dist/trace/redact.d.ts

@@ -69,7 +69,9 @@ export declare function resetPpkScanBytesForTest(): void;
  *  core [ref] 落地后这一支**趋零是证据、不归零不是证明**。别把它当截断事实的度量用。 */
 export type RedactionArm = "full" | "fragment";
 export interface RedactionHitMeta {
-    /** `"fragment"` = {@link FRAGMENT_SECRET_PATTERNS} 里的前缀残片臂;`"full"` = 完整臂。闭集两词。 */
+    /** 命中臂的**判别力档位**(闭集两词,S-303):`"fragment"` = {@link FRAGMENT_SECRET_PATTERNS} 那一族
+     *  「短前缀 + 长度/熵阈值」的弱证据臂;`"full"` = 其余全部(结构锚 / 词法关键字 / 定长裸形)。
+     *  判据 = 表归属,不是 token 的 `:partial` 后缀 —— 两条轴的分家逐字见 {@link armOfToken}。 */
     arm: RedactionArm;
 }
 export declare function setRedactionObserver(fn: ((patternLabel: string, count: number, meta: RedactionHitMeta) => void) | undefined): void;
@@ -77,6 +79,26 @@ export declare function redactSecrets(text: string, opts?: {
     observe?: boolean;
     json?: boolean;
 }): string;
+/**
+ * 脱敏 + **这一遍命中了哪些档位的臂**({@link RedactionArm} 闭集两词)—— 与 {@link redactSecrets} 同一只
+ * 脱敏器、同一张表、同一遍扫描的另一个出口。
+ *
+ * 🔴 **为什么要这个出口**(S-303):下游有一类消费方问的不是「脱完长什么样」而是「这段文本里有没有
+ * **强证据**的凭据形」——`tool-approval.ts` 的规则素材闸是头一个。旧形只能拿「字节变了没有」当谓词,
+ * 于是弱证据臂(短前缀 + 阈值启发式)的一次多脱就等于一次「素材整只扣下」,用户拿不到常驻放行。
+ * 出口开在脱敏器**自己**身上是硬约束:全仓只该有一个「什么算凭据」的属主,消费方**不许**按 token 字面
+ * (`includes(":partial»")`)或另跑一遍正则去反推 —— 那就是第二只脱敏器。
+ *
+ * `arms` 是**这一遍真命中的档位集合**:空集 = 一条臂都没命中(文本可能仍被归一化剥了 `\p{Cf}`,
+ * 所以「`text !== 入参`」与「`arms` 非空」不是一回事,后者才是凭据形的证据)。
+ */
+export declare function redactSecretsWithArms(text: string, opts?: {
+    observe?: boolean;
+    json?: boolean;
+}): {
+    text: string;
+    arms: ReadonlySet<RedactionArm>;
+};
 /**
  * 🔴 环 + 深度预算(2026-07-25 补)。原实现是纯递归、**既不记已访问节点也不限深度**,而它的调用位置是
  * **最不可信的边界**:`toolStart`/`toolEnd` 把工具的 `args`/`output`/`structured` 直接喂进来。后果两条:

package/dist/trace/redact.js

@@ -761,7 +761,20 @@ function redactionTokenEndAt(s, p, limit) {
     return 0;
 }
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
-const armOfToken = (repl) => (repl.match(/«[^»]*»/g) ?? [repl]).some((t) => t.endsWith(":partial»")) ? "fragment" : "full";
+const FRAGMENT_ARM_TOKENS = new Set(FRAGMENT_SECRET_PATTERNS.map(([, repl]) => repl));
+{
+    const partialSuffix = ":partial»";
+    const hasPartialToken = (repl) => (repl.match(/«[^»]*»/g) ?? [repl]).some((t) => t.endsWith(partialSuffix));
+    for (const [, repl] of FRAGMENT_SECRET_PATTERNS) {
+        if (!hasPartialToken(repl))
+            throw new Error(`redact: fragment-arm replacement ${JSON.stringify(repl)} must end with ${partialSuffix}`);
+    }
+    for (const [, repl] of [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS]) {
+        if (hasPartialToken(repl))
+            throw new Error(`redact: strong-arm replacement ${JSON.stringify(repl)} must not end with ${partialSuffix}`);
+    }
+}
+const armOfToken = (repl) => (FRAGMENT_ARM_TOKENS.has(repl) ? "fragment" : "full");
 const NO_HITS = [];
 const singleHit = (label, arm, r) => r.count > 0 ? { out: r.out, hits: [{ label, count: r.count, arm }] } : { out: r.out, hits: NO_HITS };
 const regexRule = ([re, repl]) => {
@@ -1021,10 +1034,24 @@ const armPoolRule = (() => {
             const out = applySpans(text, kept).out;
             if (!wantCount || kept.length === 0)
                 return { out, hits: NO_HITS };
-            const byToken = new Map();
-            for (const sp of kept)
-                byToken.set(sp.repl, (byToken.get(sp.repl) ?? 0) + 1);
-            return { out, hits: [...byToken].map(([token, count]) => ({ label: labelOfToken(token), count, arm: armOfToken(token) })) };
+            const strong = spans.filter((sp) => armOfToken(sp.repl) === "full").sort((a, b) => a.start - b.start);
+            const byArmedToken = new Map();
+            let si = 0;
+            let strongMaxEnd = -1;
+            for (const sp of kept) {
+                while (si < strong.length && strong[si].start < sp.end) {
+                    strongMaxEnd = Math.max(strongMaxEnd, strong[si].end);
+                    si += 1;
+                }
+                const arm = strongMaxEnd > sp.start ? "full" : armOfToken(sp.repl);
+                const key = `${sp.repl}\u0000${arm}`;
+                const cur = byArmedToken.get(key);
+                if (cur === undefined)
+                    byArmedToken.set(key, { token: sp.repl, arm, count: 1 });
+                else
+                    cur.count += 1;
+            }
+            return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })) };
         },
     };
 })();
@@ -1063,13 +1090,20 @@ function reportHits(hits) {
         }
     }
 }
-export function redactSecrets(text, opts) {
-    const wantCount = onRedaction !== undefined && (opts?.observe ?? true);
-    const json = opts?.json === true;
-    const r = applyRules(normalizeForRedaction(text), wantCount, json, opts?.observe ?? true);
+function runRedaction(text, observe, json, wantHits) {
+    const wantCount = wantHits || (onRedaction !== undefined && observe);
+    const r = applyRules(normalizeForRedaction(text), wantCount, json, observe);
     forgetEscapedSeparatorTails();
-    reportHits(r.hits);
-    return r.out;
+    if (observe)
+        reportHits(r.hits);
+    return { text: r.out, hits: r.hits };
+}
+export function redactSecrets(text, opts) {
+    return runRedaction(text, opts?.observe ?? true, opts?.json === true, false).text;
+}
+export function redactSecretsWithArms(text, opts) {
+    const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true);
+    return { text: r.text, arms: new Set(r.hits.map((h) => h.arm)) };
 }
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.76.1",
+  "version": "7.76.2",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",