@sema-agent/server 7.83.0 → 7.84.0

package/dist/boot/resolve-spec.js

@@ -25,6 +25,7 @@ import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
 import { HttpError, encodeCheckpointScope } from "../security.js";
 import { memorySpecForRequest } from "../memory-scope.js";
+import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { a2aForScenario, mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, deviceCwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
@@ -36,6 +37,7 @@ import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
+import { memoryFaceMounted } from "../memory-scope.js";
 export function createResolveSpec(ctx) {
     const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
@@ -59,9 +61,9 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
             }
         }
-        const rawMemoryCapture = body.memoryCapture;
-        if (rawMemoryCapture !== undefined && rawMemoryCapture !== "off") {
-            throw new HttpError(400, "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)", { code: "request.field_invalid" });
+        const offFieldIssue = singleMemberOffFieldIssue(body);
+        if (offFieldIssue) {
+            throw new HttpError(400, offFieldIssue.message, { code: "request.field_invalid" });
         }
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
@@ -373,7 +375,9 @@ export function createResolveSpec(ctx) {
                 return { ...(Object.keys(merged).length > 0 ? { limits: merged } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
-            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, body.memoryCapture) : undefined,
+            memory: memoryEngine
+                ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, { memory: body.memory, memoryCapture: body.memoryCapture })
+                : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
                 const extra = [...(selectEnvTool ? [selectEnvTool] : []), ...(sendUserFileToolSpec ? [sendUserFileToolSpec] : [])];
@@ -533,7 +537,7 @@ export function createResolveSpec(ctx) {
             governed = { ...governed, tools: stripDelegationTools(governed.tools) };
         }
         if (shouldDiscloseNoPersistentMemory({
-            memory: governed.memory,
+            memoryFaceMounted: memoryFaceMounted(governed.memory),
             declaredCapable: effectiveMemoryPersistenceCapable(config),
             hands: gated.hands,
             handsReadOnly: governed.handsReadOnly === true,

package/dist/capabilities/memory-notice.d.ts

@@ -18,7 +18,7 @@
  *    roster 把落盘路**整批**卸掉时,手带在场也等于没有写通道),但负控仍然成立:必须**全部**已知落盘路
  *    都不在才算断链 —— `excludeTools:["Write"]` 不算(Bash/Edit 还在),请求面摘一个工具名改不动结论。
  */
-import { type PromptProvider, type TaskSpec } from "@sema-agent/core";
+import { type PromptProvider } from "@sema-agent/core";
 import type { ScenarioHands } from "./hands-lane.js";
 /**
  * 「已知落盘路」的工具名闭集 —— 与 core 的 `rosterCanPersist` 同口径:**文件写工具**(Write/Edit/
@@ -35,9 +35,11 @@ export declare const KNOWN_PERSISTENCE_TOOL_NAMES: readonly ["Write", "Edit", "N
 export declare const NO_PERSISTENT_MEMORY_SECTION_ID = "sema/memory.no-persistent";
 /** 判别式的全部输入 —— 每一位都是**部署/装配期事实**,没有一位来自请求体的自我表态。 */
 export interface MemoryFaceFacts {
-    /** 本次任务最终的 `TaskSpec.memory`。`undefined` = 这一腿根本没有引擎记忆面(引擎未接、多租户 dark、
-     *  remote lane 平面分裂 fail-closed……三条路殊途同归:core 不会 prepare 记忆,也就不会挂任何披露)。 */
-    memory: TaskSpec["memory"];
+    /** 这一腿挂不挂记忆面 —— 由唯一属主 `memory-scope.ts` `memoryFaceMounted(spec.memory)` 算出(与 core `prepareMemory`
+     *  同判:`normalizeMemorySpec(...)?.enabled === true`)。`false` = 引擎未接 / 多租户 dark / remote lane fail-closed /
+     *  S-405 `memory:"off"`(键在场但 `enabled:false`)—— 殊途同归:core 不会 prepare 记忆,也就不会挂任何披露。
+     *  🔴 不再收 `TaskSpec.memory` 本体:按「键在不在场」判是 7.84.0 前的病(合并复审 车HF F1)。 */
+    memoryFaceMounted: boolean;
     /** 部署声明 `MEMORY_PERSISTENCE_CAPABLE`(三态)。`true` = operator 自证有推断看不见的持久通道
      *  (自定义 writer / MCP 记忆服务)⇒ 披露会变成假话,撤回;`false` = 强制披露;缺席 ⇒ 走推断。 */
     declaredCapable: boolean | undefined;

package/dist/capabilities/memory-notice.js

@@ -9,7 +9,7 @@ function anyPersistenceToolSurvives(excludeTools) {
     return KNOWN_PERSISTENCE_TOOL_NAMES.some((name) => !excluded.has(name));
 }
 export function shouldDiscloseNoPersistentMemory(facts) {
-    if (facts.memory !== undefined)
+    if (facts.memoryFaceMounted)
         return false;
     if (facts.declaredCapable !== undefined)
         return !facts.declaredCapable;

package/dist/http/admission.js

@@ -3,6 +3,7 @@ import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
+import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
@@ -307,9 +308,12 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
             return null;
         }
-        if (body.memoryCapture !== undefined && body.memoryCapture !== "off") {
-            sendError(res, 400, "request.field_invalid", "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)");
-            return null;
+        {
+            const offFieldIssue = singleMemberOffFieldIssue(body);
+            if (offFieldIssue) {
+                sendError(res, 400, "request.field_invalid", offFieldIssue.message);
+                return null;
+            }
         }
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
             sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");

package/dist/http/wire-types.d.ts

@@ -320,6 +320,28 @@ export interface TaskRequestBody {
      *  记忆面暗的部署(引擎未接线 / 多租户)上本键随 `memory` 整体缺席而无处落 —— 那里本就零采集。
      *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)。 */
     memoryCapture?: "off";
+    /** core [ref] r5 §5 W3(server S-405):**请求级「记忆整面关」声明** —— `"off"` = 这一次运行**不挂记忆面**
+     *  (没有 `# Memory` 段/索引/三只记忆工具/写准入)。单成员闭集,**没有** `"on"`(缺席就是记忆照常挂的唯一形;
+     *  声明只能单向收紧)。透传为 `TaskSpec.memory.enabled:false` —— ⚠️ **保留事实,不折成整键缺席**:core 的
+     *  终局观测面把「有 spec 但被关」读作 `reason:"disabled"`、把「没有 spec」读作 `reason:"no-spec"`,审计上
+     *  不是一件事,所以本仓铸的是 `{ …正常 scopes, enabled:false }`。
+     *  ⚠️ **语义如实**:这是「不挂记忆面」,**不是**文件系统级的禁读禁写 —— 记忆根若落在本次授权的工作区内,
+     *  普通 Read/Write 照走普通围栏(没有记忆面 = 没有记忆写门,不是多了一道禁令)。
+     *  与 `memoryCapture:"off"` **不是一个轴**:那是「记忆照常挂,但本会话的内容永远不进长期记忆」
+     *  (采集面,落一条单向会话记录);这是「本次运行整个记忆面都不挂」(读写整面,逐请求)。
+     *  🔴 **两键同发时不要以为买到了两件事**(亲核 core 7.21.1 `prepare-memory.js:48/:55`):core 把 capture 腿与
+     *  引擎挂载合取,`enabled:false` 下 capture 的**单向会话记录不落**(core 发 `phase:"config"` 一行披露)⇒
+     *  下一 turn 不带本键时采集照常。要「这个会话永久别记」,那一 turn 就**别**同时发本键。详见契约 §12.7。
+     *  与 `memoryWrite:false`(本 run 只读平面:照常挂、照常读、harvest 不提交)同样正交、同样可并存。
+     *  🔴 **与 `GET /v1/capabilities` 的 legacy 能力位 `memory`(恒假)同名不同物**:那一位说的是退役的
+     *  MemoryStore HTTP 动词族,与本键零关系 —— 别按那一位判断本键可不可用。
+     *  ⚠️ 拼写门**两腿同判、响亮拒**:fresh 400 `request.field_invalid`;resume 重放同判(不做 resume 降级 ——
+     *  把一条收紧声明按打字错误静默丢掉是不可逆方向的静默降级)。两腿共用同一只判据
+     *  (`request-value-closure.ts` 的 `singleMemberOffFieldIssue`,与 `memoryCapture` 同表)。
+     *  记忆面暗的部署(引擎未接线 / 多租户)上 `memory` 整键本就缺席,本声明无处落也无事可关。
+     *  Rides the persisted body onto resume legs(与 `memoryWrite` 同姿势)。
+     *  ⏳ 子代地板(`ParentSpecSeat.memoryOff`:父关 ⇒ 子代/孙代同关)候 core 7.22.0,**本版不做**。 */
+    memory?: "off";
     /** 142-S4 projectId 线程化([ref] §2):这个 run 归属的项目(center 登记簿键,generic lowercase
      *  UUID — core S1 `resolveProjectId` marker 或 S3 无仓 mint 的产物;客户端只透传,零铸造权威)。是「哪个
      *  项目」的选择器,不是身份/capability — scope 的 tenant 段永远来自 verified principal。SHAPE 门在

package/dist/memory-scope.d.ts

@@ -1,4 +1,4 @@
-import { FileMemoryEngineBackend } from "@sema-agent/core";
+import { FileMemoryEngineBackend, type TaskSpec } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 /** 前缀词表本体(供门/诊断读;判定一律走 {@link isV2ScopeKey},别在别处重写 startsWith 链)。 */
 export declare const V2_SCOPE_PREFIXES: readonly string[];
@@ -175,6 +175,10 @@ onIncident?: (err: Error & {
  * commits nothing). Absent/true ⇒ normal read+write. No scope (engine off / multi-tenant dark) ⇒ undefined
  * (memory feature off for this run). Pure (testable in isolation) — main.ts's resolveSpec composes it with the
  * engine-backend presence guard.
+ *
+ * 🔴 **三轴正交**(S-405 起;三者可任意并存,互不吞):`memoryWrite:false` = 本 run 只读平面(挂、读、
+ * harvest 不提交)· `memoryCapture:"off"` = 采集面关(挂、读、本会话内容永不进长期记忆)· `memory:"off"` =
+ * **整面关**(`enabled:false`,这一次连记忆面都不挂)。后两者从 `declarations` 进(键名与 wire 逐字同名)。
  */
 export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[], 
 /** [ref] 件A([ref] 件3④):origin 盖章的部署形态维(N2)。`multiTenant=true`(requirePrincipal)
@@ -185,14 +189,38 @@ export declare function memorySpecForRequest(scope: string | undefined, memoryWr
 originPolicy?: {
     multiTenant: boolean;
 }, 
-/** [ref] §2.1([ref]):请求的 `memoryCapture:"off"` 声明 ⇒ `TaskSpec.memory.capture:"off"`(单成员闭集,
- *  拼写门在 prepareSpec 的 400 门 + core 的 `config.memory_capture_spelling`)。缺席 ⇒ 键不铸(缺席就是照常采集
- *  的唯一形)。与 `memoryWrite` 正交:那是「本 run 只读平面」,这是「本会话永远不进长期记忆」。 */
-memoryCapture?: "off"): {
+/** 请求体上的**单成员闭集声明**(键名与 wire 逐字同名,零翻译;拼写门的唯一属主是
+ *  `request-value-closure.ts`,两腿共用 —— 到这里的值已经过门,只可能是 `"off"` 或缺席)。
+ *
+ *  · `memoryCapture:"off"`([ref] §2.1,[ref])⇒ `TaskSpec.memory.capture:"off"`:**采集面**关 ——
+ *    记忆照常挂、照常读,但本会话的内容永远不进长期记忆(core 落一条单向会话记录,按部署姿态 + verdict 裁)。
+ *  · `memory:"off"`(core [ref] r5 §5 W3,S-405)⇒ `TaskSpec.memory.enabled:false`:**整面**关 ——
+ *    这一次运行不挂记忆面。**保留事实不折缺席**(codex r2 #4):core 的终局观测面把「有 spec 但被关」读作
+ *    `reason:"disabled"`、把「整键缺席」读作 `reason:"no-spec"`,审计上不是一件事;而 `normalizeMemorySpec`
+ *    在 scopes 为空时整体返回 `undefined`,所以**关的那一形也必须带正常 scopes**。
+ *
+ *  两键与 `memoryWrite`(本 run 只读平面)在**铸型上**三轴正交、可并存,本函数不替谁做取舍;
+*  整键缺席 ⇒ 都不铸(形状逐字节不变=additive 锁)。
+*  ⚠️ **铸型正交 ≠ 裁决正交**(亲核 core 7.21.1 `dist/core/runner/prepare-memory.js:48/:55`):core 把
+*  capture 腿与引擎挂载**合取**(`captureDeclared = captureDeclaredRaw && useMemoryEngine`),所以
+*  `memory:"off"` 那一 turn 上 capture 的**单向会话记录不落**(core 发 `phase:"config"` 一行响亮披露)。
+*  两键同发要不要一起送、送了买到什么,口径全文在契约 §12.7;钉在 memory-off-request.test.ts ⑤。 */
+declarations?: {
+    memory?: "off";
+    memoryCapture?: "off";
+}): {
     scopes: string[];
     writeScope?: string | null;
     scopeContract?: "v2";
     scopeOrigins?: Record<string, "deployment" | "request">;
     capture?: "off";
+    enabled?: false;
 } | undefined;
+/**
+ * 「这一腿挂不挂记忆面」的**唯一属主**(合并复审 车HF F1,2026-09-18):与 core `prepareMemory` 的判据同源 ——
+ * `normalizeMemorySpec(spec)?.enabled === true`。S-405 之后 `memory:"off"` 铸的是「键在场 + `enabled:false`」(保留事实),
+ * 任何按「键在不在场」判挂没挂的读者从那一天起都读错(改前 `memory-notice` 正是那样,把无记忆面的披露一起吞掉)。
+ * 消费方拿本函数的布尔,不拿 `spec.memory` 自己判。
+ */
+export declare function memoryFaceMounted(memory: TaskSpec["memory"]): boolean;
 //# sourceMappingURL=memory-scope.d.ts.map

package/dist/memory-scope.js

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
+import { FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope, normalizeMemorySpec } from "@sema-agent/core";
 import { assertMemoryScopeWidth } from "./plugins/memory-key-guards.js";
 const V2_SCOPE_PREFIX_BY_KIND = {
     user: "user:",
@@ -96,7 +96,7 @@ export function memoryEngineBackendFor(config, fallbackRoot, onIncident) {
         root: plane.root,
     };
 }
-export function memorySpecForRequest(scope, memoryWrite, defaultScopes, originPolicy, memoryCapture) {
+export function memorySpecForRequest(scope, memoryWrite, defaultScopes, originPolicy, declarations) {
     if (!scope)
         return undefined;
     const isV2 = isV2ScopeKey;
@@ -113,7 +113,13 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes, originPo
         }
     }
     const origins = Object.keys(stamped).length > 0 ? { scopeOrigins: stamped } : {};
-    const capture = memoryCapture === "off" ? { capture: "off" } : {};
-    return memoryWrite === false ? { ...layered, writeScope: null, ...v2, ...origins, ...capture } : { ...layered, ...v2, ...origins, ...capture };
+    const capture = declarations?.memoryCapture === "off" ? { capture: "off" } : {};
+    const enabled = declarations?.memory === "off" ? { enabled: false } : {};
+    return memoryWrite === false
+        ? { ...layered, writeScope: null, ...v2, ...origins, ...capture, ...enabled }
+        : { ...layered, ...v2, ...origins, ...capture, ...enabled };
+}
+export function memoryFaceMounted(memory) {
+    return normalizeMemorySpec(memory)?.enabled === true;
 }
 //# sourceMappingURL=memory-scope.js.map

package/dist/observability/run-terminal-log.d.ts

@@ -102,6 +102,8 @@ export declare function redactTerminalResult<T extends {
      *  声明成 `{path,edits}[]` 会逼每一个喂坏形的调用点铸一次宽松断言 —— 而「坏形从哪来」正是本座要
      *  处理的事(同一份不信任在 `remoteEnvFailures` 的实现里也已成文)。运行期逐项判形,不抛。 */
     editedFiles?: unknown;
+    /** S-394:形上同样 `unknown` —— 本函数是读盘面,`stats` 的树形逐层现判(见 {@link redactStats})。 */
+    stats?: unknown;
 } | null | undefined>(result: T): T;
 /** S-107(第五轮合并重扫 wf_f00c00bc 两根 [high]):同一个 `TaskResult` 除 run 行外还被逐字追加进 run_events 的 `done` 行
  *  (bg/verify/cascade/stream/resume 五腿),`failed` 行带原文 `errorMessage`,`GET /v1/runs/:id/events` 原样回放。

package/dist/observability/run-terminal-log.js

@@ -104,7 +104,7 @@ const RESULT_KEY_TREATMENT = {
     effectiveWriteFace: "verbatim",
     effectiveReadDenyPatterns: "verbatim",
     effectiveMemoryScopes: "verbatim",
-    stats: "verbatim",
+    stats: "redacted",
 };
 const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
 export const REDACTABLE_RESULT_LEAVES = [
@@ -207,6 +207,13 @@ export function redactTerminalResult(result) {
             : r.rewindNotes;
         changed = true;
     }
+    if (r.stats !== undefined) {
+        const next = redactStats(r.stats);
+        if (next !== r.stats) {
+            out.stats = next;
+            changed = true;
+        }
+    }
     return changed ? out : result;
 }
 export function redactLedgerEventData(type, data) {
@@ -317,6 +324,108 @@ export function redactRiskDescriptor(rd) {
     }
     return changed ? out : rd;
 }
+const STATS_KEY_TREATMENT = {
+    turns: "verbatim",
+    tokens: "verbatim",
+    toolCalls: "verbatim",
+    usageMissing: "verbatim",
+    promptTokens: "verbatim",
+    cachedTokens: "verbatim",
+    cacheWriteTokens: "verbatim",
+    cacheHitRate: "verbatim",
+    totalInputTokens: "verbatim",
+    outputTokens: "verbatim",
+    cacheWriteTokensLong: "verbatim",
+    costMicroUsd: "verbatim",
+    nested: "verbatim",
+    memory: "verbatim",
+    suggestions: "verbatim",
+    costBreakdown: "verbatim",
+    mechanisms: "mechanisms",
+    humanReview: "human-review",
+};
+const STATS_MECHANISMS_TREATMENT = {
+    finalVerifyInjected: "verbatim",
+    finalVerifyInjections: "verbatim",
+    attachmentsInjected: "verbatim",
+    approachNoticesSent: "verbatim",
+    repetitionCuts: "verbatim",
+    repetitionSpared: "verbatim",
+    repetitionEvents: "repetition-rows",
+    reminderDisclosures: "verbatim",
+};
+const STATS_HUMAN_REVIEW_TREATMENT = {
+    count: "verbatim",
+    totalWaitMs: "verbatim",
+    gates: "gate-rows",
+};
+const STATS_GATE_ROW_TREATMENT = {
+    kind: "verbatim",
+    waitMs: "verbatim",
+    decision: "verbatim",
+    toolName: "verbatim",
+    toolArg: "model-text",
+};
+const STATS_REPETITION_EVENT_TREATMENT = {
+    turn: "verbatim",
+    action: "verbatim",
+    rule: "verbatim",
+    period: "verbatim",
+    reps: "verbatim",
+    segment: "model-text",
+};
+function redactStatsNode(node, table) {
+    if (node === null || typeof node !== "object" || Array.isArray(node))
+        return node;
+    const n = node;
+    let changed = false;
+    const out = { ...n };
+    const into = (v, t) => redactStatsNode(v, t);
+    const rows = (v, t) => {
+        if (!Array.isArray(v))
+            return v;
+        const next = v.map((row) => redactStatsNode(row, t));
+        return next.every((x, i) => x === v[i]) ? v : next;
+    };
+    for (const [key, treatment] of Object.entries(table)) {
+        const v = n[key];
+        if (v === undefined)
+            continue;
+        let next = v;
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "model-text":
+                if (typeof v === "string")
+                    next = redactModelText(v);
+                break;
+            case "mechanisms":
+                next = into(v, STATS_MECHANISMS_TREATMENT);
+                break;
+            case "human-review":
+                next = into(v, STATS_HUMAN_REVIEW_TREATMENT);
+                break;
+            case "gate-rows":
+                next = rows(v, STATS_GATE_ROW_TREATMENT);
+                break;
+            case "repetition-rows":
+                next = rows(v, STATS_REPETITION_EVENT_TREATMENT);
+                break;
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled stats treatment: ${String(unhandled)}`);
+            }
+        }
+        if (next !== v) {
+            out[key] = next;
+            changed = true;
+        }
+    }
+    return changed ? out : node;
+}
+function redactStats(stats) {
+    return redactStatsNode(stats, STATS_KEY_TREATMENT);
+}
 const CHECKPOINT_GATE_TREATMENT = {
     kind: "verbatim",
     reason: "text",

package/dist/request-key-closure.d.ts

@@ -19,6 +19,13 @@ export declare function scanKeyClosure(bag: object, prefix: string, accepted: Re
 }): void;
 /** 一张分类表的文案片段(封顶后只报数)。 */
 export declare function keyClosureClause(names: string[], label: string): string;
+/** 剥掉索引签名,只留**具名**键 —— `TaskRequestBody` 上那条 `[k: string]: unknown` 会让
+ *  `keyof` 退化成 `string`,双向门就永远恒真(零判别力)。
+ *  🔴 **导出**(S-405):姊妹门 `request-value-closure.ts` 的双向钉要同一个剥法 —— 抄第二份 = 两处哪天
+ *  分岔(一边看得见索引签名、一边看不见)谁都发现不了,而两边的判别力都建立在「剥干净了」这句话上。 */
+export type NamedKeysOf<T> = {
+    [K in keyof T as string extends K ? never : number extends K ? never : K]: T[K];
+};
 /**
  * FRESH 提交面的**顶层**键闭集裁决:受理集之外的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);
  * 全部受理 ⇒ `null`。

package/dist/request-key-closure.js

@@ -22,7 +22,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "enableFork", "excludeTools",
     "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
-    "maxTokens", "mcpServers", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
+    "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",

package/dist/request-value-closure.d.ts

@@ -0,0 +1,31 @@
+/** [ref] §2.1([ref]):`memoryCapture` 的拼写门文案。**wire 可见文本** —— 改一个字就是对端契约漂移
+ *  (SDK/壳/文档锚它),字节冻结在 `test/api-error-text-freeze.test.ts` 的常量锚格。 */
+export declare const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual \u2014 there is no 'on' spelling)";
+/** core [ref] r5 §5 W3(S-405):请求级「记忆整面关」`memory` 的拼写门文案。同上,wire 可见、字节冻结。
+ *  文案刻意点明 capture 的分工 —— 两个键都在记忆轴上、形又一模一样,拿错的人要在同一条回执里读到该用哪个。 */
+export declare const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual \u2014 there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
+/**
+ * **单成员闭集键表** —— 合法值只有 `"off"`,缺席=照常,没有 `"on"`。
+ *
+ * 🔴 顺序 = **裁决顺序**,且是**既存键在前**:一个两键都畸形的存量体,判决与加 `memory` 之前逐字节相同
+ * (新键不许改写既有体的回执)。新增同形键一律**追加在尾部**。
+ */
+declare const SINGLE_MEMBER_OFF_FIELDS: readonly [{
+    readonly field: "memoryCapture";
+    readonly message: "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)";
+}, {
+    readonly field: "memory";
+    readonly message: "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
+}];
+/** 一次值闭集裁决的产物:出问题的键名(机读)+ 一句 wire 文案。 */
+export interface SingleMemberOffFieldIssue {
+    field: (typeof SINGLE_MEMBER_OFF_FIELDS)[number]["field"];
+    message: string;
+}
+/**
+ * 单成员闭集键的值形裁决:表内任一键在场且不是字面 `"off"` ⇒ 返回拒体(调用方 400 `request.field_invalid`);
+ * 全部合法或全部缺席 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。
+ */
+export declare function singleMemberOffFieldIssue(raw: unknown): SingleMemberOffFieldIssue | null;
+export {};
+//# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -0,0 +1,18 @@
+export const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)";
+export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
+const SINGLE_MEMBER_OFF_FIELDS = [
+    { field: "memoryCapture", message: MEMORY_CAPTURE_SPELLING_MESSAGE },
+    { field: "memory", message: MEMORY_OFF_SPELLING_MESSAGE },
+];
+export function singleMemberOffFieldIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const body = raw;
+    for (const { field, message } of SINGLE_MEMBER_OFF_FIELDS) {
+        const value = body[field];
+        if (value !== undefined && value !== "off")
+            return { field, message };
+    }
+    return null;
+}
+//# sourceMappingURL=request-value-closure.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.83.0",
+  "version": "7.84.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",