@sema-agent/server 7.77.0 → 7.78.1

package/dist/trace/project.js

@@ -78,10 +78,13 @@ export function aggregateModelUsage(events) {
 }
 function identityFields(src) {
     return {
-        ...(src.eventId ? { eventId: String(src.eventId) } : {}),
-        ...(src.parentToolCallId ? { parentToolCallId: String(src.parentToolCallId) } : {}),
+        ...(identityKey(src.eventId) !== undefined ? { eventId: identityKey(src.eventId) } : {}),
+        ...(identityKey(src.parentToolCallId) !== undefined ? { parentToolCallId: identityKey(src.parentToolCallId) } : {}),
     };
 }
+function identityKey(v) {
+    return typeof v === "string" && v !== "" ? v : undefined;
+}
 export function modelTextEventData(ev) {
     return { text: ev.text, ...(ev.eventId ? { eventId: ev.eventId } : {}) };
 }
@@ -110,8 +113,12 @@ function screenedGateOrThrow(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
         return undefined;
     }
+    const classifierFallbackRaw = d.classifier !== null && typeof d.classifier === "object" ? d.classifier.fallback : undefined;
     const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
         (d.kind === "denied" && d.cause !== undefined && typeof d.cause !== "string" && "disposition.cause is not a string") ||
+        (d.classifier !== undefined && (d.classifier === null || typeof d.classifier !== "object") && "disposition.classifier is not an object") ||
+        (classifierFallbackRaw !== undefined && (classifierFallbackRaw === null || typeof classifierFallbackRaw !== "object") && "disposition.classifier.fallback is not an object") ||
+        (classifierFallbackRaw !== undefined && classifierFallbackRaw !== null && typeof classifierFallbackRaw === "object" && typeof classifierFallbackRaw.cause !== "string" && "disposition.classifier.fallback.cause is not a string") ||
         (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
         (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
         (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
@@ -125,6 +132,16 @@ function screenedGateOrThrow(v) {
         recordFailOpen("server.trace.gate-outcome-defective", defects.join("; "));
         return undefined;
     }
+    const attribution = d.classifier;
+    const classifier = attribution === undefined
+        ? undefined
+        : {
+            modelRequested: attribution.modelRequested,
+            modelUsed: attribution.modelUsed,
+            ...(attribution.fallback === undefined
+                ? {}
+                : { fallback: { from: attribution.fallback.from, to: attribution.fallback.to, cause: attribution.fallback.cause } }),
+        };
     const settlement = g.settlement === undefined ? undefined : projectSettlement(g.settlement);
     if (g.settlement !== undefined && settlement === undefined) {
         recordFailOpen("server.trace.gate-outcome-defective", "settlement.who is not an object with a party in the closed set");
@@ -132,8 +149,8 @@ function screenedGateOrThrow(v) {
     }
     return {
         disposition: d.kind === "denied"
-            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }) }
-            : { kind: "allowed" },
+            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }), ...(classifier === undefined ? {} : { classifier }) }
+            : { kind: "allowed", ...(classifier === undefined ? {} : { classifier }) },
         ...(settlement === undefined ? {} : { settlement }),
         ...(g.origin === undefined ? {} : { origin: g.origin }),
     };
@@ -178,15 +195,17 @@ export function textEndEventData(ev) {
         return null;
     return segmentEndFields(ev.content, ev);
 }
-function segmentEndFields(content, ev) {
+export function liveIdentityFields(ev) {
     return {
-        content: redactModelText(content),
-        ...(ev.eventId !== undefined ? { eventId: ev.eventId } : {}),
-        ...(ev.parentToolCallId !== undefined ? { parentToolCallId: ev.parentToolCallId } : {}),
-        ...(ev.sourceTaskId !== undefined ? { sourceTaskId: ev.sourceTaskId } : {}),
-        ...(ev.bgAgentId !== undefined ? { bgAgentId: ev.bgAgentId } : {}),
+        ...(identityKey(ev.eventId) !== undefined ? { eventId: identityKey(ev.eventId) } : {}),
+        ...(identityKey(ev.parentToolCallId) !== undefined ? { parentToolCallId: identityKey(ev.parentToolCallId) } : {}),
+        ...(identityKey(ev.sourceTaskId) !== undefined ? { sourceTaskId: identityKey(ev.sourceTaskId) } : {}),
+        ...(identityKey(ev.bgAgentId) !== undefined ? { bgAgentId: identityKey(ev.bgAgentId) } : {}),
     };
 }
+function segmentEndFields(content, ev) {
+    return { content: redactModelText(content), ...liveIdentityFields(ev) };
+}
 export function reasoningEndEventData(ev) {
     if (typeof ev.content !== "string" || ev.content.trim().length === 0)
         return null;
@@ -210,6 +229,43 @@ export function toolEndEventData(ev) {
         ...identityFields(ev),
     };
 }
+const dropProjectedFace = (what) => {
+    recordFailOpen("server.trace.projection-input-malformed", what);
+    return undefined;
+};
+export function toolProgressEventData(ev) {
+    const id = typeof ev.toolCallId === "string" && ev.toolCallId !== "" ? ev.toolCallId : undefined;
+    const name = typeof ev.toolName === "string" && ev.toolName !== "" ? ev.toolName : undefined;
+    if (id === undefined || name === undefined)
+        return dropProjectedFace("tool_progress is missing toolCallId/toolName");
+    const n = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    const hasOutput = typeof ev.output === "string";
+    return {
+        toolCallId: id,
+        toolName: name,
+        ...(n(ev.elapsedTimeSeconds) !== undefined ? { elapsedTimeSeconds: n(ev.elapsedTimeSeconds) } : {}),
+        ...(hasOutput ? { output: redactDeep(ev.output) } : {}),
+        ...(hasOutput && n(ev.totalLines) !== undefined ? { totalLines: n(ev.totalLines) } : {}),
+        ...(hasOutput && n(ev.totalBytes) !== undefined ? { totalBytes: n(ev.totalBytes) } : {}),
+        ...identityFields(ev),
+    };
+}
+export function toolDisclosureEventData(ev) {
+    const policy = typeof ev.policy === "string" && ev.policy !== "" ? ev.policy : undefined;
+    const names = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : undefined);
+    const deferred = names(ev.deferred);
+    const activated = names(ev.activated);
+    if (policy === undefined || deferred === undefined || activated === undefined)
+        return dropProjectedFace("tool_disclosure is missing policy/deferred/activated");
+    const threshold = typeof ev.thresholdPercent === "number" && Number.isFinite(ev.thresholdPercent) ? ev.thresholdPercent : undefined;
+    return {
+        policy,
+        ...(threshold !== undefined ? { thresholdPercent: threshold } : {}),
+        deferred,
+        activated,
+        ...identityFields(ev),
+    };
+}
 export function taskProgressEventData(ev) {
     return {
         taskId: ev.taskId,
@@ -390,6 +446,41 @@ export function wiringManifestEventData(ev) {
     })();
     const toolsIn = m.tools;
     const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
+    const hooksIn = m.hooks;
+    const hooks = (() => {
+        if (hooksIn === undefined)
+            return undefined;
+        if (!Array.isArray(hooksIn))
+            return dropProjectedFace("wiring_manifest.hooks is not an array");
+        const rows = [];
+        for (const raw of hooksIn) {
+            const e = sec(raw);
+            if (e === undefined) {
+                dropProjectedFace("wiring_manifest.hooks[] row is not an object");
+                continue;
+            }
+            const family = str(e.family);
+            const owner = str(e.owner);
+            if (family === undefined || owner === undefined) {
+                dropProjectedFace("wiring_manifest.hooks[] row is missing family/owner");
+                continue;
+            }
+            rows.push({ family, owner, ...(e.observational === true ? { observational: true } : {}) });
+        }
+        return rows.length > 0 ? rows : undefined;
+    })();
+    const lspIn = sec(m.lsp);
+    const lsp = (() => {
+        if (m.lsp === undefined)
+            return undefined;
+        if (lspIn === undefined)
+            return dropProjectedFace("wiring_manifest.lsp is not an object");
+        const mounted = bool(lspIn.mounted);
+        if (mounted === undefined)
+            return dropProjectedFace("wiring_manifest.lsp.mounted is not a boolean");
+        const lane = str(lspIn.lane);
+        return { mounted, ...(lane === undefined ? {} : { lane }) };
+    })();
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -430,6 +521,8 @@ export function wiringManifestEventData(ev) {
         ...(autoMode !== undefined ? { autoMode } : {}),
         ...(tools !== undefined ? { tools } : {}),
         ...(mcp !== undefined ? { mcp } : {}),
+        ...(hooks !== undefined ? { hooks } : {}),
+        ...(lsp !== undefined ? { lsp } : {}),
         ...identityFields(ev),
     };
 }
@@ -505,8 +598,7 @@ export function compactedEventData(ev) {
         return Object.keys(out).length > 0 ? out : undefined;
     })();
     return {
-        ...(ev.eventId !== undefined ? { eventId: ev.eventId } : {}),
-        ...(ev.parentToolCallId !== undefined ? { parentToolCallId: ev.parentToolCallId } : {}),
+        ...identityFields(ev),
         ...(typeof ev.trigger === "string" ? { trigger: ev.trigger } : {}),
         ...(num(ev.tokensBefore) !== undefined ? { tokensBefore: num(ev.tokensBefore) } : {}),
         ...(ev.preserved_segment?.firstKeptEntryId ? { preserved_segment: { firstKeptEntryId: ev.preserved_segment.firstKeptEntryId } } : {}),
@@ -535,9 +627,32 @@ export function contextUsageEventData(ev) {
         ...(n(ev.usedTokens) !== undefined ? { usedTokens: n(ev.usedTokens) } : {}),
         ...(n(ev.windowTokens) !== undefined ? { windowTokens: n(ev.windowTokens) } : {}),
         ...(n(ev.compactAtTokens) !== undefined ? { compactAtTokens: n(ev.compactAtTokens) } : {}),
+        ...contextUsageSectionsField(ev.sections),
         ...identityFields(ev),
     };
 }
+function contextUsageSectionsField(sections) {
+    if (sections === undefined)
+        return {};
+    if (!Array.isArray(sections)) {
+        dropProjectedFace("context_usage.sections is not an array");
+        return {};
+    }
+    const out = [];
+    for (const raw of sections) {
+        if (typeof raw !== "object" || raw === null) {
+            dropProjectedFace("context_usage.sections[] element is not an object");
+            continue;
+        }
+        const { id, tokens, kind } = raw;
+        if (typeof id !== "string" || id === "" || typeof tokens !== "number" || !Number.isFinite(tokens)) {
+            dropProjectedFace("context_usage.sections[] element is missing id/tokens");
+            continue;
+        }
+        out.push({ id, tokens, ...(typeof kind === "string" && kind !== "" ? { kind } : {}) });
+    }
+    return out.length > 0 ? { sections: out } : {};
+}
 export function turnEndEventData(ev) {
     return {
         ...(ev.usage ? { usage: ev.usage } : {}),
@@ -711,6 +826,7 @@ function mapTraceEventInner(type, seq, data) {
         case "wiring_manifest":
         case "human_input":
         case "tool_roster_delta":
+        case "tool_disclosure":
             return null;
         default:
             return null;

package/dist/trace/redact.js

@@ -233,12 +233,150 @@ let anyValueArm;
 function anyValueArmRe() {
     return (anyValueArm ??= new RegExp(`(?:${VALUE_ARM_BODIES.join("|")})`, "y"));
 }
-function collectRegexSpans(g, repl, order, text, out) {
+const HEAD_CLASS_ESCAPES = new Set(["d", "D", "w", "W", "s", "S"]);
+const HEAD_LITERAL_ESCAPES = new Set(["\\", "/", "-", ".", "+", "*", "?", "(", ")", "[", "]", "{", "}", "|", "^", "$"]);
+function headOfAtoms(atoms, src) {
+    const tail = atoms[atoms.length - 1];
+    if (tail === undefined || !tail.unbounded || tail.cls === undefined) {
+        throw new Error(`redact: arm-pool pattern /${src}/ must end in a greedy unbounded single-class value run`);
+    }
+    let pos = 0;
+    let head = 0;
+    for (let k = 0; k < atoms.length - 1; k++) {
+        const a = atoms[k];
+        if (a.cls !== tail.cls)
+            head = pos + a.len;
+        pos += a.len;
+    }
+    return head;
+}
+const HEAD_GROUP_OPEN = /^\((\?:|\?=|\?!|\?<=|\?<!)/;
+function parseHeadAlternative(src, from) {
+    let seqs = [[]];
+    let i = from;
+    let closed = false;
+    while (i < src.length) {
+        const c = src[i];
+        if (c === "|" || c === ")")
+            break;
+        if (closed)
+            throw new Error(`redact: arm-pool pattern /${src}/ has trailing syntax after its value run`);
+        let base;
+        if (c === "(") {
+            const open = HEAD_GROUP_OPEN.exec(src.slice(i));
+            if (open === null)
+                throw new Error(`redact: head derivation cannot bound group at ${i} in /${src}/`);
+            const mark = open[1];
+            const inner = parseHeadAlternatives(src, i + 1 + mark.length);
+            if (src[inner.next] !== ")")
+                throw new Error(`redact: unbalanced group at ${i} in /${src}/`);
+            i = inner.next + 1;
+            if (mark !== "?:")
+                continue;
+            if (inner.alts.some((alt) => alt.some((a) => a.unbounded))) {
+                seqs = inner.alts.flatMap((alt) => seqs.map((s) => [...s, ...alt]));
+                closed = true;
+                continue;
+            }
+            base = { len: Math.max(...inner.alts.map((alt) => alt.reduce((n, a) => n + a.len, 0))), cls: undefined };
+        }
+        else if (c === "[") {
+            let k = i + 1;
+            while (k < src.length && src[k] !== "]")
+                k += src[k] === "\\" ? 2 : 1;
+            if (k >= src.length)
+                throw new Error(`redact: unterminated character class at ${i} in /${src}/`);
+            base = { len: 1, cls: src.slice(i, k + 1) };
+            i = k + 1;
+        }
+        else if (c === "\\") {
+            const e = src[i + 1];
+            if (e === undefined)
+                throw new Error(`redact: dangling escape at ${i} in /${src}/`);
+            if (HEAD_CLASS_ESCAPES.has(e))
+                base = { len: 1, cls: `\\${e}` };
+            else if (HEAD_LITERAL_ESCAPES.has(e))
+                base = { len: 1, cls: undefined };
+            else
+                throw new Error(`redact: head derivation cannot bound escape \\${e} at ${i} in /${src}/`);
+            i += 2;
+        }
+        else if (c === "." || c === "^" || c === "$" || c === "*" || c === "+" || c === "?" || c === "{") {
+            throw new Error(`redact: head derivation cannot bound ${JSON.stringify(c)} at ${i} in /${src}/`);
+        }
+        else {
+            base = { len: 1, cls: undefined };
+            i += 1;
+        }
+        let atom = { ...base, unbounded: false };
+        const q = src[i];
+        if (q === "*" || q === "+") {
+            atom = { ...base, unbounded: true };
+            i += 1;
+        }
+        else if (q === "?") {
+            i += 1;
+        }
+        else if (q === "{") {
+            const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
+            if (m === null)
+                throw new Error(`redact: head derivation cannot bound quantifier at ${i} in /${src}/`);
+            const lo = Number(m[1]);
+            const hi = m[2] === undefined ? lo : m[3] === "" ? -1 : Number(m[3]);
+            atom = hi < 0 ? { ...base, unbounded: true } : { len: base.len * hi, cls: base.cls, unbounded: false };
+            i += m[0].length;
+        }
+        if (src[i] === "?")
+            throw new Error(`redact: head derivation cannot bound a lazy quantifier at ${i} in /${src}/`);
+        if (atom.unbounded)
+            closed = true;
+        for (const s of seqs)
+            s.push(atom);
+    }
+    return { seqs, next: i };
+}
+function parseHeadAlternatives(src, from) {
+    const alts = [];
+    let i = from;
+    for (;;) {
+        const one = parseHeadAlternative(src, i);
+        alts.push(...one.seqs);
+        i = one.next;
+        if (src[i] !== "|")
+            break;
+        i += 1;
+    }
+    return { alts, next: i };
+}
+function literalHeadLength(re) {
+    if (/[uv]/.test(re.flags))
+        throw new Error(`redact: head derivation does not support the u/v flags on /${re.source}/`);
+    const src = re.source;
+    const parsed = parseHeadAlternatives(src, 0);
+    if (parsed.next !== src.length)
+        throw new Error(`redact: head derivation stopped at ${parsed.next} in /${src}/`);
+    return Math.max(...parsed.alts.map((alt) => headOfAtoms(alt, src)));
+}
+function scanResumeAfterHit(start, end, head) {
+    return Math.max(start + 1, end - Math.max(head - 1, 0));
+}
+function headWindowCandidates(at, maxHead) {
+    const out = [];
+    let last = -1;
+    for (const e of at) {
+        for (let p = Math.max(e - Math.max(maxHead - 1, 0), last + 1, 0); p <= e; p++) {
+            out.push({ p, back: e - p });
+            last = p;
+        }
+    }
+    return out;
+}
+function collectRegexSpans(g, head, repl, order, text, out) {
     g.lastIndex = 0;
     for (let m = g.exec(text); m !== null; m = g.exec(text)) {
         const end = m.index + m[0].length;
         out.push({ start: m.index, end, repl, order });
-        g.lastIndex = end > m.index ? end : m.index + 1;
+        g.lastIndex = scanResumeAfterHit(m.index, end, head);
     }
 }
 function resolveSpanOverlaps(spans) {
@@ -265,10 +403,10 @@ function applySpans(text, spans) {
     parts.push(text.slice(copied));
     return { out: parts.join(""), count: spans.length };
 }
-function collectValueArmSpans(g, y, repl, order, text, out) {
+function collectValueArmSpans(g, y, head, repl, order, text, out) {
     const tails = escapedSeparatorTails(text);
     if (tails === undefined) {
-        collectRegexSpans(g, repl, order, text, out);
+        collectRegexSpans(g, head, repl, order, text, out);
         return;
     }
     let pos = 0;
@@ -314,12 +452,14 @@ function collectValueArmSpans(g, y, repl, order, text, out) {
         else
             break;
         out.push({ start: idx, end, repl, order });
-        pos = end;
+        pos = scanResumeAfterHit(idx, end, head);
     }
 }
-function collectStickySpans(y, repl, order, text, at, out) {
+function collectStickySpans(y, head, repl, order, text, at, out) {
     let pos = 0;
-    for (const p of at) {
+    for (const { p, back } of at) {
+        if (back >= head)
+            continue;
         if (p < pos)
             continue;
         y.lastIndex = p;
@@ -328,7 +468,7 @@ function collectStickySpans(y, repl, order, text, at, out) {
             continue;
         const end = p + m[0].length;
         out.push({ start: p, end, repl, order });
-        pos = end;
+        pos = scanResumeAfterHit(p, end, head);
     }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
@@ -1000,17 +1140,22 @@ const armPoolRule = (() => {
     const arms = [...SHAPE_SECRET_PATTERNS, ...FRAGMENT_SECRET_PATTERNS].map(([re, repl], order) => {
         if (/\$./.test(repl))
             throw new Error(`redact: arm-pool replacement ${JSON.stringify(repl)} must not use $N refs`);
-        return { g: re, y: VALUE_ARM_STICKY.get(re), repl, order };
+        const y = VALUE_ARM_STICKY.get(re);
+        const head = literalHeadLength(re);
+        if (y !== undefined && head === 0)
+            throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the head-window screen would skip every candidate position`);
+        return { g: re, y, head, repl, order };
     });
-    const boundaryArms = arms.flatMap((a) => (a.y === undefined ? [] : [{ y: a.y, repl: a.repl, order: a.order }]));
+    const boundaryArms = arms.flatMap((a) => (a.y === undefined ? [] : [{ y: a.y, head: a.head, repl: a.repl, order: a.order }]));
+    const maxBoundaryHead = Math.max(1, ...boundaryArms.map((a) => a.head));
     return {
         run: (text, wantCount) => {
             const spans = [];
             for (const a of arms) {
                 if (a.y === undefined)
-                    collectRegexSpans(a.g, a.repl, a.order, text, spans);
+                    collectRegexSpans(a.g, a.head, a.repl, a.order, text, spans);
                 else
-                    collectValueArmSpans(a.g, a.y, a.repl, a.order, text, spans);
+                    collectValueArmSpans(a.g, a.y, a.head, a.repl, a.order, text, spans);
             }
             const tried = new Set();
             const freshEnds = (from) => {
@@ -1026,8 +1171,9 @@ const armPoolRule = (() => {
             };
             for (let at = freshEnds(0); at.length > 0;) {
                 const before = spans.length;
+                const cand = headWindowCandidates(at, maxBoundaryHead);
                 for (const a of boundaryArms)
-                    collectStickySpans(a.y, a.repl, a.order, text, at, spans);
+                    collectStickySpans(a.y, a.head, a.repl, a.order, text, cand, spans);
                 at = freshEnds(before);
             }
             const kept = resolveSpanOverlaps(spans);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.77.0",
+  "version": "7.78.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.7",
-    "@sema-agent/settings-schema": "1.10.0",
+    "@sema-agent/core": "7.19.0",
+    "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.3.0",
+    "@sema-agent/sdk": "9.5.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",