@sema-agent/server 7.88.2 → 7.90.0

package/dist/hooks/hook-runner.js

@@ -3,7 +3,7 @@ import { hostShell, resolveHostShell } from "../plugins/host-platform.js";
 import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, } from "@sema-agent/settings-schema/hooks";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { redactSecrets } from "../trace/redact.js";
+import { redactSecrets, buildDisplaySafeUrl } from "../trace/redact.js";
 import { ccPromptSystemFor, wrapCondition, parseCcVerdict, CC_EVALUATOR_MAX_OUTPUT_TOKENS } from "./cc-stop-prompt.js";
 import { ccAgentHookSystemFor } from "./cc-agent-hook-prompt.js";
 import { renderBranchTranscript } from "./branch-transcript.js";
@@ -52,7 +52,9 @@ const BRAIN_TO_TURN_ERROR = {
     max_output_tokens: "max_output_tokens",
 };
 function toAssistantTurnError(errorKind) {
-    return (errorKind !== undefined ? BRAIN_TO_TURN_ERROR[errorKind] : undefined) ?? "unknown";
+    if (errorKind === undefined)
+        return "unknown";
+    return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
 export function parseHooksConfig(raw) {
     const parsed = HooksConfig.safeParse(raw);
@@ -495,7 +497,7 @@ async function runHttpHook(entry, payload, ctx) {
             if (trimmed === "")
                 return { code: 0, stdout: "{}", stderr: "", timedOut: false };
             if (!parseHookStdout(body)) {
-                ctx.logger.warn("hook_http_non_json_response", { url: clip(entry.url, 300), preview: clip(trimmed, 200) });
+                ctx.logger.warn("hook_http_non_json_response", { url: buildDisplaySafeUrl(entry.url), preview: clip(trimmed, 200) });
                 noteHookFailure(ctx, {
                     event: eventOfPayload(payload),
                     entry,
@@ -1148,6 +1150,21 @@ export function createTaskHooks(config, ctx) {
     }
     return hooks;
 }
+const HOOK_SLOT_FOLD = {
+    preToolUse: "custom",
+    preToolUseObservational: "custom",
+    postToolUse: "custom",
+    postToolUseFailure: "custom",
+    postToolBatch: "custom",
+    userPromptSubmit: "custom",
+    stop: "custom",
+    preCompact: "custom",
+    timeoutMs: "scalar",
+    postCompact: "observe-void",
+    stopFailure: "observe-void",
+    permissionDenied: "observe-void",
+};
+const OBSERVE_VOID_HOOK_SLOTS = Object.keys(HOOK_SLOT_FOLD).filter((k) => HOOK_SLOT_FOLD[k] === "observe-void");
 export function composeHooks(deployment, task) {
     if (!deployment)
         return task;
@@ -1270,7 +1287,7 @@ export function composeHooks(deployment, task) {
             };
         };
     }
-    for (const slot of ["stopFailure", "postCompact", "permissionDenied"]) {
+    for (const slot of OBSERVE_VOID_HOOK_SLOTS) {
         const ds = d[slot];
         const ts = t[slot];
         if (ds && ts) {

package/dist/http/admission.js

@@ -1,7 +1,7 @@
 import { isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
@@ -430,6 +430,10 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
+        if (body.excludeAllTools !== undefined && typeof body.excludeAllTools !== "boolean") {
+            sendError(res, 400, "request.field_invalid", "excludeAllTools must be a boolean");
+            return null;
+        }
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
@@ -453,8 +457,8 @@ export function createAdmission(ctx) {
         }
         {
             const v = body.permissionMode;
-            if (v !== undefined && v !== "default" && v !== "acceptEdits" && v !== "plan" && v !== "bypassPermissions" && v !== "auto") {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+            if (v !== undefined && !isSettingsPermissionMode(v)) {
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                 return null;
             }
         }
@@ -464,8 +468,8 @@ export function createAdmission(ctx) {
                 const p = s.permissions;
                 if (p !== null && typeof p === "object" && !Array.isArray(p)) {
                     const m = p.defaultMode;
-                    if (m !== undefined && m !== "default" && m !== "acceptEdits" && m !== "plan" && m !== "bypassPermissions" && m !== "auto") {
-                        sendError(res, 400, "request.field_invalid", 'settings.permissions.defaultMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+                    if (m !== undefined && !isSettingsPermissionMode(m)) {
+                        sendError(res, 400, "request.field_invalid", `settings.permissions.defaultMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                         return null;
                     }
                     const d = p.disableAutoMode;

package/dist/http/routes/capabilities.js

@@ -18,7 +18,7 @@ import { projectApprovalsStreamLiveCapability } from "../../capabilities/approva
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict } from "../../task-settings.js";
+import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS } from "../../task-settings.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
@@ -52,7 +52,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const requestedModeRaw = new URLSearchParams(match.search).get("permissionMode");
             const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
             if (requestedModeRaw !== null && requestedMode === undefined) {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);

package/dist/http/routes/session-sync.js

@@ -6,12 +6,14 @@ import { exportSessionManifest, fileHistoryImportFace, replayFileHistory, replay
 import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape } from "../../security.js";
 import { sendJson, sendError, msg } from "../send.js";
+import { buildDisplaySafeUrl } from "../../trace/redact.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -194,7 +196,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     void deps.sessionMirrorRuling(auditPrincipal).then((mirror) => {
                         if (mirror?.required) {
                             deps.metrics?.inc("session_mirror_required_push_total");
-                            deps.logger?.info("session_mirror_required_push_observed", { principal: auditPrincipal, engineUrl: mirror.engineUrl, sessionId });
+                            deps.logger?.info("session_mirror_required_push_observed", { principal: auditPrincipal, engineUrl: buildDisplaySafeUrl(mirror.engineUrl), sessionId });
                         }
                     }).catch(() => { });
                 }
@@ -214,10 +216,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 400, "request.field_invalid", "entryIds must be an array of strings");
                     return;
                 }
-                if (!Array.isArray(body.policy) || !Array.isArray(body.anchors)) {
+                if (!Array.isArray(body.anchors)) {
                     sendError(res, 400, "request.body_shape", "malformed import metadata");
                     return;
                 }
+                const policyRead = readSessionRulesRecords(body.policy);
+                if (policyRead.problem !== undefined) {
+                    sendError(res, 400, "request.field_invalid", `policy: ${describeSessionRulesRecordProblem(policyRead.problem)}`);
+                    return;
+                }
                 let fileHistory = null;
                 if (body.fileHistory !== undefined && body.fileHistory !== null) {
                     const door = validateFileHistoryExport(body.fileHistory);
@@ -234,7 +241,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const resolution = body.resolution;
                 const srcLogDigest = typeof body.logDigest === "string" && body.logDigest.length > 0 ? body.logDigest : undefined;
                 const entryIds = body.entryIds;
-                const policy = body.policy;
+                const policy = policyRead.records;
                 const anchors = body.anchors;
                 const dstIds = (await deps.sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);

package/dist/http/routes/sessions.js

@@ -5,6 +5,7 @@ import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -741,25 +742,26 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.invalid_json", "invalid JSON body");
                 return;
             }
-            if (typeof body.rules !== "object" || body.rules === null || Array.isArray(body.rules)) {
-                sendError(res, 400, "request.body_shape", "rules must be a SessionPermissionRules object");
-                return;
+            const read = readSessionPermissionRules(body.rules);
+            if (read.problem !== undefined) {
+                switch (read.problem.kind) {
+                    case "not-an-object":
+                        sendError(res, 400, "request.body_shape", describeSessionPermissionRulesProblem(read.problem));
+                        return;
+                    case "field-not-string-array":
+                        sendError(res, 400, "request.field_invalid", describeSessionPermissionRulesProblem(read.problem));
+                        return;
+                    default: {
+                        const unhandled = read.problem;
+                        throw new Error(`unhandled SessionPermissionRules problem: ${JSON.stringify(unhandled)}`);
+                    }
+                }
             }
             if (body.expectedRev !== undefined && (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0)) {
                 sendError(res, 400, "request.field_invalid", "expectedRev must be a non-negative integer");
                 return;
             }
-            const raw = body.rules;
-            const rules = {};
-            for (const f of ["toolAllow", "toolDeny", "allowDirs", "commandAllow", "commandDeny"]) {
-                if (raw[f] === undefined)
-                    continue;
-                if (!Array.isArray(raw[f]) || !raw[f].every((x) => typeof x === "string")) {
-                    sendError(res, 400, "request.field_invalid", `${f} must be an array of strings`);
-                    return;
-                }
-                rules[f] = raw[f];
-            }
+            const rules = read.rules;
             try {
                 const stored = await store.putRules(sessionId, target, rules, { ...(typeof body.expectedRev === "number" ? { expectedRev: body.expectedRev } : {}), operator });
                 sendJson(res, 200, { rules: stored });

package/dist/http/wire-types.d.ts

@@ -264,6 +264,18 @@ export interface TaskRequestBody {
      *  it takes the same single-user gate as backgroundShell/hooks (multi-tenant warns + ignores; advertised via
      *  capabilities.retainBackgroundProcesses). Boolean fail-loud at submit; only `true` rides the spec. */
     retainBackgroundProcesses?: boolean;
+    /** S-493(core 7.8.0 [ref] `TaskSpec.excludeAllTools`,cli L-207 / 板 [ref]): **整只工具面卸载**
+     *  —— 调用方工具、脚手架、手、MCP、skills 一个都不挂,模型这一 run 里没有任何工具可调、终局是纯文本。
+     *
+     *  🔴 **与 {@link excludeTools} 是两种语义,刻意不折叠**:`"*"` 是一个合法的调用方工具名,所以「卸全部」
+     *  不能写成一条通配规则(那会把「卸全部」与「卸一只叫 `*` 的工具」塌成一件事)。两键同带 ⇒ 各自生效
+     *  (全卸之后名单里那几只本来也不在,不矛盾、不拒)。
+     *  只 literal `true` 上 spec(`false` / 缺席 = 名册照旧,不挂键保持 byte-compat —— 挂一个 `false` 上去
+     *  等于替引擎重申了一次它自己的缺省);非 boolean 由 HTTP 门 400 `request.field_invalid`,resume 重放
+     *  defensive DROP。per-run 工具面**收窄**无跨租户面 ⇒ 无租户门(`excludeTools` 同姿势)。
+     *  探测:本键在不在受理面由**键闭集**自己回答 —— 没接线的 server 版本对它 400 `request.body_shape`
+     *  并逐字列名,所以**不加能力位**(一个键一条探测路,不长第二条)。 */
+    excludeAllTools?: boolean;
     /** [ref]② (core 1.314 工具面控制批): roster 真卸载清单(schema 不上 wire,manifest 收窄)。wire 工具名;
      *  tighten-only(core 继承不变量 union 进子 spawn)。数组-of-string fail-loud at submit。 */
     excludeTools?: string[];

package/dist/main.js

@@ -1,4 +1,5 @@
 import { createLogger } from "./observability/logger.js";
+import { buildFatalErrorText } from "./boot/fatal-exit.js";
 import { runStage01 } from "./boot/stage-01-config.js";
 import { runStage02 } from "./boot/stage-02-registry-pull.js";
 import { runStage03 } from "./boot/stage-03-store-backend.js";
@@ -22,7 +23,7 @@ async function main() {
     await runStage10(s09);
 }
 void main().catch((err) => {
-    createLogger().error("fatal", { err: String(err) });
+    createLogger().error("fatal", { err: buildFatalErrorText(err) });
     process.exit(1);
 });
 //# sourceMappingURL=main.js.map

package/dist/model-route-url.d.ts

@@ -1,9 +1,33 @@
 /** 机读码(拼法随 `config.<键名蛇形>_*` 既有族:`config.model_provider_invalid` / `config.retention_policy_invalid`)。 */
 export declare const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
-/** 这个 URL 带 userinfo(用户名或密码任一非空)吗?解析不动 ⇒ `false`(「不是 URL」由别的门管,本条只判凭据位)。 */
-export declare function urlCarriesUserinfo(raw: string): boolean;
+/** 同族第二码(S-483 座⑨):这一位根本不是一个层级式绝对 URL。三根键共用一码,与上面那只同纪律
+ *  (码按**规则**命名,不按键名 —— 键名已经逐字在拒因文案里点过了)。 */
+export declare const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
 /**
- * 模型路由 base URL 的拒因(`undefined` = 这一位合法)。
+ * 🔴 **第三条臂的机读码(S-514;core 7.24.2 / [ref] 提货)——请求根带 `#fragment`**。
+ *
+ * 为什么与前两条各自一码:运维要按码行动,而三条臂的**出路不同**(补全 URL / 把凭据搬去旋钮 / 删掉 `#`
+ * 之后的一切)。`fetch` **从不把 fragment 发上线**,所以这一形此前是**静默**打根自己的路径、端点后缀整段
+ * 落进被丢弃的那一半 —— 请求发得出去、也可能 200,只是打错了地方而一个字不说。
+ */
+export declare const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
+/**
+ * 模型路由 base URL 的拒因(`undefined` = 这一位合法)—— **这三根键的唯一判官**。
+ *
+ * 两臂,顺序即语义,**两臂都经 display-safe 铸点**:
+ *  ① **不是一个层级式绝对 URL** ⇒ `config.model_route_url_invalid`;
+ *  ② 是,但带 userinfo ⇒ `config.gateway_url_userinfo`。
+ *
+ * 🔴 ① 为什么必须在这里、而不是「由别的门管」(S-483 座⑨,与 ME/A2A 两座**同病镜像**):本函数此前先问
+ * 凭据位、并把「解析不动」读成**没有**凭据(`urlCarriesUserinfo` 的 `return false`),旁注写着「不是 URL 由
+ * 别的门管」—— 而 config 层对这三根**没有**那道门(`config.ts` 与 `config-invariants.ts` 只调本函数)。
+ * 于是半写 userinfo `http://user:pass@`(`URL.canParse` 假)与 `alice:pw@host:8000`(不透明 URL,
+ * `username`/`password` 恒空)两形被当「无凭据」放行,一路到 brain 装配期才由 core 拒;core 那一臂
+ * 今天不回显原值 —— 但**「恰好不漏」不是防线**,而且拒启点越晚,运维越读不出是哪根旋钮配错了。
+ * ⇒ 判据改成与铸点**同一只** {@link isHierarchicalUrl}:两处再也不可能各判各的。
+ *
+ * 🚧 **未闭环(不在本车射程)**:层级式但**非 http(s)** 的形(`ftp://h/v1`,不带 userinfo)今天仍放行 ——
+ * `fetch` 对它同样必然失败,但那是第三条臂、是一次新的行为面拒启,按三问另开车(S-483 收车档已登记)。
  *
  * 拒因四件齐:**码** + **哪个 env 键** + **洗过的 URL**(host/port/path 逐字,userinfo 与凭据参数成记号 ——
  * 运维要靠 host 认出是哪一条路由,而密码一个字节都不许进启动错误)+ **出路一句**(点名真实旋钮)。

package/dist/model-route-url.js

@@ -1,19 +1,33 @@
-import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { buildDisplaySafeUrl, isHierarchicalUrl } from "./trace/redact.js";
 export const GATEWAY_URL_USERINFO_CODE = "config.gateway_url_userinfo";
-export function urlCarriesUserinfo(raw) {
-    if (raw === "" || !URL.canParse(raw))
-        return false;
-    const u = new URL(raw);
-    return u.username !== "" || u.password !== "";
-}
+export const MODEL_ROUTE_URL_INVALID_CODE = "config.model_route_url_invalid";
+export const MODEL_ROUTE_URL_FRAGMENT_CODE = "config.model_route_url_fragment";
 export function modelRouteUrlRefusal(envKey, raw, credentialKnob) {
-    if (!urlCarriesUserinfo(raw))
+    if (raw === "")
         return undefined;
-    return (`env ${envKey} carries credentials in the URL userinfo (${buildDisplaySafeUrl(raw)}) [${GATEWAY_URL_USERINFO_CODE}] — ` +
-        "WHATWG forbids constructing a fetch Request from a URL with credentials, so EVERY model call on this route " +
-        "fails deterministically at request-construction time (it used to look like a slow network flake: the error was " +
-        "retried for ~3 minutes before surfacing). " +
-        `Put the credential in ${credentialKnob} (or the matching header knob) instead of the URL, and keep the URL to ` +
-        "scheme/host/port/path.");
+    if (!isHierarchicalUrl(raw)) {
+        return (`env ${envKey} is not a parseable absolute URL (${buildDisplaySafeUrl(raw)}) [${MODEL_ROUTE_URL_INVALID_CODE}] — ` +
+            "a model-route base URL is consumed by fetch, which requires an absolute hierarchical URL " +
+            "(scheme://host[:port][/path]); half-written forms like \"http://user:pass@\" and opaque forms like " +
+            "\"host:8000\" are not one, and they also hide any credentials they carry from every credential-position check. " +
+            `Set ${envKey} to a full scheme://host URL (and put the credential in ${credentialKnob}, never in the URL).`);
+    }
+    const u = new URL(raw);
+    if (u.username !== "" || u.password !== "")
+        return (`env ${envKey} carries credentials in the URL userinfo (${buildDisplaySafeUrl(raw)}) [${GATEWAY_URL_USERINFO_CODE}] — ` +
+            "WHATWG forbids constructing a fetch Request from a URL with credentials, so EVERY model call on this route " +
+            "fails deterministically at request-construction time (it used to look like a slow network flake: the error was " +
+            "retried for ~3 minutes before surfacing). " +
+            `Put the credential in ${credentialKnob} (or the matching header knob) instead of the URL, and keep the URL to ` +
+            "scheme/host/port/path.");
+    if (u.hash !== "") {
+        return (`env ${envKey} carries a URL fragment (${buildDisplaySafeUrl(raw)}#…) [${MODEL_ROUTE_URL_FRAGMENT_CODE}] — ` +
+            "a fragment is never sent on the wire, so this route would silently target the root's own path and every " +
+            "endpoint suffix (/chat/completions, /v1/messages) would land inside the discarded part: the request goes out, " +
+            "may even return 200, and points somewhere else without saying so. " +
+            `Drop everything from the "#" on in ${envKey}. A per-deployment QUERY is fully supported and rides every ` +
+            "request (a gateway's `?api-version=…`); a fragment cannot be.");
+    }
+    return undefined;
 }
 //# sourceMappingURL=model-route-url.js.map

package/dist/plugins/memory-embedder.d.ts

@@ -26,12 +26,6 @@ export interface OpenAiCompatEmbedderOptions extends MemoryEmbedderConfig {
  * URL 合法性门,只在运行期炸(而运行期的炸法就是上面那条「写入失败/检索退档」的静默病)。
  */
 export declare function embeddingsUrl(endpoint: string): string;
-/**
- * 诊断面用的**脱敏** URL(codex 复审 F4,已核真):端点里可能带 userinfo(`https://user:pass@h/v1`)
- * 或把凭据放 query(Azure 的 `api-key=`),而错误文本会进日志、进 PatchReport 的 conflict reason。
- * 主机与路径保留(诊断价值全在这里),userinfo 抹掉、query 值一律换成 `***`(键名保留,便于认形)。
- */
-export declare function redactEndpointForLog(raw: string): string;
 /** 造一个 OpenAI 兼容的 `PgEmbedder`(工厂命名律:返回带行为的对象 ⇒ `create*`)。 */
 export declare function createOpenAiCompatEmbedder(opts: OpenAiCompatEmbedderOptions): PgEmbedder;
 /**

package/dist/plugins/memory-embedder.js

@@ -1,13 +1,17 @@
+import { joinRequestUrl } from "@sema-agent/core";
 import { z } from "zod";
+import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "../trace/redact.js";
 const EmbeddingsResponse = z.object({
     data: z.array(z.object({ embedding: z.array(z.number()) })).min(1),
 });
 export function embeddingsUrl(endpoint) {
-    const u = new URL(endpoint);
-    u.hash = "";
-    const path = u.pathname.replace(/\/+$/, "");
-    u.pathname = decodeUnreservedEscapes(path).endsWith("/embeddings") ? path : `${path}/embeddings`;
-    return u.toString();
+    const path = URL.canParse(endpoint) ? new URL(endpoint).pathname.replace(/\/+$/, "") : "";
+    try {
+        return joinRequestUrl(endpoint, decodeUnreservedEscapes(path).endsWith("/embeddings") ? "" : "/embeddings");
+    }
+    catch (e) {
+        throw new Error(buildDisplaySafeRefusal(e instanceof Error ? e.message : String(e), [endpoint]), { cause: undefined });
+    }
 }
 function decodeUnreservedEscapes(s) {
     return s.replace(/%([0-9A-Fa-f]{2})/g, (whole, hex) => {
@@ -15,16 +19,6 @@ function decodeUnreservedEscapes(s) {
         return /[A-Za-z0-9\-._~]/.test(c) ? c : whole;
     });
 }
-export function redactEndpointForLog(raw) {
-    if (!URL.canParse(raw))
-        return "<invalid-url>";
-    const u = new URL(raw);
-    u.username = "";
-    u.password = "";
-    for (const k of [...u.searchParams.keys()])
-        u.searchParams.set(k, "***");
-    return u.toString();
-}
 function credentialsInQuery(endpoint) {
     if (!URL.canParse(endpoint))
         return [];
@@ -32,7 +26,7 @@ function credentialsInQuery(endpoint) {
 }
 export function createOpenAiCompatEmbedder(opts) {
     const url = embeddingsUrl(opts.endpoint);
-    const shownUrl = redactEndpointForLog(url);
+    const shownUrl = buildDisplaySafeUrl(url);
     const fetchImpl = opts.fetchImpl ?? fetch;
     const { model, dimensions, timeoutMs, apiKey, onFailure } = opts;
     const secrets = [...(apiKey !== undefined ? [apiKey] : []), ...credentialsInQuery(opts.endpoint)];

package/dist/plugins/remote-env-adb.d.ts

@@ -84,6 +84,8 @@ export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
      *  同姿态的 ssh 腿早有先例(`remote-env-ssh.ts`「destroy 后一律不复活,显式 connect/reconnect 同禁」),
      *  五条兄弟腿全部 fail-closed,只有 adb 例外 —— 补齐它。 */
     private destroyed;
+    /** 在飞的那一次懒连接(单飞记忆)——见 {@link ensureConnected}。settle 即清,**不缓存败诺**。 */
+    private connectPromise?;
     /** core `ExecutionEnv.homeDir`([ref]):本沙箱/目标机上执行用户的 home。见配置同名字段。 */
     readonly homeDir?: string | undefined;
     private readonly cfg;
@@ -99,6 +101,17 @@ export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
         ok: false;
         error: RemoteExecutionError;
     }>;
+    /**
+     * 懒连接:**首次调用任一面**(exec / execStream / 文件面)时自动 `connect()`(含重试策略),在飞的
+     * 那一次由全部调用者共用,失败**不缓存**(下一次调用重新试),`destroyed` 是终态不复活。
+     *
+     * 🔴 为什么这条必须在 adapter 里:core 的 task/run 车道**没有任何人**替 adapter 调 `connect()` ——
+     * 工厂铸出 env 就直接用它的 exec/文件面(本仓亲核:`src/` 里对执行环境的 `.connect()` 只有 bench 与
+     * 生命周期面自己)。所以一条「设了未连闸、又不自连」的腿,它的每一次工具调用都被自家的闸挡回;
+     * 那不是 adb 特有语义,而是与 ssh([ref] 同一实红点)/ k8s / e2b / local-docker / device 不均匀。
+     * 未连时的错误文案因此从「call connect() first」(这条车道上没人能照做)换成**真试过之后**的拒因。
+     */
+    private ensureConnected;
     private connectOnce;
     suspendVM(_options?: VmLifecycleOptions): Promise<{
         ok: true;

package/dist/plugins/remote-env-adb.js

@@ -13,6 +13,12 @@ const unsupported = (op) => ({
     ok: false,
     error: new RemoteExecutionError("unsupported", `${op} is not supported on an ADB device (real hardware — not snapshotable; capabilities.suspendable=false)`),
 });
+function lazyConnectExecError(e) {
+    return e.code === "aborted" ? new ExecutionError("aborted", e.message, e) : new ExecutionError("shell_unavailable", `ADB lazy-connect failed: ${e.message}`, e);
+}
+function lazyConnectFileError(e, absPath) {
+    return e.code === "aborted" ? new FileError("aborted", e.message, absPath, e) : new FileError("unknown", `ADB lazy-connect failed: ${e.message}`, absPath, e);
+}
 const isTcp = (serial) => /:\d+$/.test(serial);
 export function isAdbTransportLost(stderr) {
     return /device offline|device '.*' not found|no devices\/emulators found|connection reset|protocol fault|device disconnected/i.test(stderr);
@@ -22,6 +28,7 @@ export class RemoteAdbExecutionEnv {
     cwd;
     connected = false;
     destroyed = false;
+    connectPromise;
     homeDir;
     cfg;
     spawnFn;
@@ -57,6 +64,25 @@ export class RemoteAdbExecutionEnv {
         const once = this.injectedConnectOnce ?? ((s) => this.connectOnce(s));
         return withRetry((_attempt) => once(config?.abortSignal), policy, { signal: config?.abortSignal });
     }
+    async ensureConnected() {
+        if (this.destroyed)
+            return { ok: false, error: new RemoteExecutionError("connect_failed", "ADB env destroyed — no lazy reconnect after teardown") };
+        if (this.connected)
+            return { ok: true };
+        const started = this.connectPromise ?? this.connect();
+        this.connectPromise = started;
+        try {
+            const r = await started;
+            return r.ok ? { ok: true } : { ok: false, error: r.error };
+        }
+        catch (err) {
+            return { ok: false, error: new RemoteExecutionError("connect_failed", `adb lazy-connect threw: ${err instanceof Error ? err.message : String(err)}`) };
+        }
+        finally {
+            if (this.connectPromise === started)
+                this.connectPromise = undefined;
+        }
+    }
     async connectOnce(signal) {
         if (signal?.aborted)
             return { ok: false, error: new RemoteExecutionError("aborted", "connect aborted") };
@@ -121,8 +147,9 @@ export class RemoteAdbExecutionEnv {
         return this.destroy();
     }
     async exec(command, options) {
-        if (!this.connected)
-            return { ok: false, error: new ExecutionError("shell_unavailable", "ADB device not connected — call connect() first") };
+        const ready = await this.ensureConnected();
+        if (!ready.ok)
+            return { ok: false, error: lazyConnectExecError(ready.error) };
         const wrapped = this.withCwdEnv(command, options?.cwd, options?.env);
         const r = await this.adb(this.deviceShellArgs(wrapped), {
             signal: options?.abortSignal,
@@ -139,8 +166,11 @@ export class RemoteAdbExecutionEnv {
         return ok(r.value);
     }
     async *execStream(command, options) {
-        if (!this.connected)
-            throw new RemoteExecutionError("connect_failed", "ADB device not connected — call connect() first");
+        const ready = await this.ensureConnected();
+        if (!ready.ok)
+            throw ready.error;
+        if (this.destroyed)
+            throw new RemoteExecutionError("connect_failed", "execution env already destroyed");
         const wrapped = this.withCwdEnv(command, options?.cwd, options?.env);
         const child = this.spawnFn(this.cfg.adbPath, this.deviceShellArgs(wrapped), { stdio: ["ignore", "pipe", "pipe"] });
         const queue = [];
@@ -255,15 +285,16 @@ export class RemoteAdbExecutionEnv {
     async joinPath(parts) {
         return ok(path.posix.join(...parts));
     }
-    fsGate(p) {
+    async fsGate(p) {
         if (this.destroyed)
             return { ok: false, error: new FileError("unknown", "execution env already destroyed", this.resolve(p)) };
-        if (!this.connected)
-            return { ok: false, error: new FileError("unknown", "ADB device not connected — call connect() first", this.resolve(p)) };
+        const ready = await this.ensureConnected();
+        if (!ready.ok)
+            return { ok: false, error: lazyConnectFileError(ready.error, this.resolve(p)) };
         return undefined;
     }
     async readBinaryFile(p, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -290,7 +321,7 @@ export class RemoteAdbExecutionEnv {
         return ok(lines);
     }
     async writeFile(p, content, abortSignal) {
-        const gated = this.fsGate(p);
+        const gated = await this.fsGate(p);
         if (gated)
             return gated;
         const abs = this.resolve(p);
@@ -379,6 +410,8 @@ export class RemoteAdbExecutionEnv {
         return this.posixFs.createTempFile(options);
     }
     adb(args, opts) {
+        if (this.destroyed)
+            return Promise.resolve({ ok: false, error: new ExecutionError("shell_unavailable", "execution env already destroyed") });
         return new Promise((resolve) => {
             let settled = false;
             let forceSettleTimer;

package/dist/plugins/remote-env-device.d.ts

@@ -118,6 +118,8 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
     writeFileExclusive?: (path: string, content: string | Uint8Array, abortSignal?: AbortSignal) => Promise<Result<void, FileError>>;
     writeFileGuarded?: (path: string, content: string | Uint8Array, expect: WriteExpectation, abortSignal?: AbortSignal) => Promise<Result<WriteReceipt, FileError>>;
     private connected;
+    /** 在飞的那一次准入(单飞记忆)——见 {@link admitShared}。settle 即清,**不缓存败诺**。 */
+    private connectPromise?;
     /** 拆除是**终态**(六条兄弟腿同纪律:destroy 之后 connect/exec/读面一律 fail-closed,不复活)。 */
     private destroyed;
     constructor(cfg: DeviceEnvConfig);
@@ -154,7 +156,8 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
     joinPath(parts: string[]): Promise<Result<string, FileError>>;
     workspaceHandle(): WorkspaceHandle;
     /**
-     * 不建连接:做**准入 + 取活连接**(文件头「唯一范式差」)。
+     * 不建连接:做**准入 + 取活连接**(文件头「唯一范式差」)。**显式**入口 —— 首次调用任一面时
+     * {@link ensureConnected} 会自动走同一条路(单飞共享),所以这里重复调用是幂等的。
      *
      * 🔴 **绝不换设备**:准入解出的 deviceId 与本 env 铸造时钉住的那一台不符 ⇒ typed
      * `device.identity_mismatch`(lane 是身份不是偏好,§4.5 步 2)。这一格正是 park 赎回期换绑/吊销的
@@ -167,6 +170,27 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
         ok: false;
         error: RemoteExecutionError;
     }>;
+    /**
+     * 准入的**单飞**入口:在飞的那一次由全部等待者共用(显式 `connect()` 与任意面的懒连接共享同一次),
+     * settle 后记忆即清 —— 成功由 `connected` 位挡住重入,失败让下一次调用重新试(**不缓存败诺**,
+     * 与 k8s/ssh/e2b 三腿逐字同纪律)。
+     */
+    private admitShared;
+    /**
+     * 懒连接:**首次调用任一面**(exec / execStream / 文件面)时自动走一次准入。
+     *
+     * 🔴 为什么这条必须在 adapter 里(而不是「谁用谁先 connect」):task/run 车道**没有任何人**会替
+     * adapter 调 `connect()` —— 工厂铸出 env 就直接用它的 exec/文件面(本仓亲核:`src/` 里对执行环境的
+     * `.connect()` 只有 bench 与生命周期面自己)。所以一条「设了未连闸、又不自连」的腿,它的每一次工具
+     * 调用都被自家的闸挡回,而设备侧一条指令帧都收不到。e2b(首用建 VM)/ k8s(`connectPromise ??=`)/
+     * ssh(single-flight join)/ local-docker 四腿早就是懒连接;本腿从此同形,`connect()` 的语义
+     * (准入 + 取活连接 + 保护面对拍)一个字不动,只是触发时机与兄弟一致。
+     *
+     * 返回 `undefined` = 可以往下走;否则是**三币种**的失败行,由调用面翻成自己那种货币。
+     */
+    private ensureConnected;
+    /** `connect()` 的**本体**(准入 + 身份等值 + 保护面对拍)。失败以三币种形返回,见 {@link DeviceAdmissionFailure}。 */
+    private admit;
     /** 控制面重连(core 在 transport 重挂时调)——语义与 connect 逐字同一条:重新准入 + 身份等值。 */
     reconnect(_sessionToken: SessionToken): Promise<{
         ok: true;
@@ -203,11 +227,23 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
      */
     destroy(): Promise<void>;
     cleanup(): Promise<void>;
-    /** 终态/未连接的 fail-closed 门(exec 面)。 */
+    /**
+     * 终态 fail-closed + **懒连接**门(exec 面)。未连 ⇒ 先走一次准入,失败按 exec 货币报**准入自己的**
+     * 拒因(不再吐一句「call connect() first」—— 这条车道上没有任何人能照做)。
+     */
     private shellGate;
-    /** 终态/未连接的 fail-closed 门(文件面)。 */
+    /** 终态 fail-closed + **懒连接**门(文件面)。语义与 {@link shellGate} 逐字同一条,只换货币。 */
     private fsGate;
     private timeoutMsFor;
+    /**
+     * 投递漏斗。**终态复核就在这里**,不在门上(codex 对抗复审 r1 [high],判真后收)。
+     *
+     * 🔴 为什么门上那一次不够:门是 `async`,所以调用方从门返回到这里之间**让出过执行权** —— 一次
+     * `destroy()` 可以整个跑完再让调用方恢复,于是门读到的「未拆除」在投递那一刻已经过期(懒连接把门
+     * 变成异步的那一刻就开了这个窗;`connected` 快路径也一样让出)。本函数的函数体到 `hub.dispatch(input)`
+     * 之间**没有任何 await**,所以它是投递前最后一个同步点 —— 闸要放在真正不可回退的那一格上。
+     * 三个面各自把这一态翻成自己的货币(穷举 switch,加臂 = 编译红)。
+     */
     private dispatch;
     /**
      * 三态结果 → 文件面的 `Result`。