@sema-agent/server 7.88.2 → 7.90.0

package/dist/task-settings.js

@@ -3,6 +3,11 @@ import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.j
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
+export const SETTINGS_PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
+export const SETTINGS_PERMISSION_MODE_WORDS = SETTINGS_PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
+export function isSettingsPermissionMode(raw) {
+    return typeof raw === "string" && SETTINGS_PERMISSION_MODES.includes(raw);
+}
 export function coercePermissionMode(raw) {
     const strict = coercePermissionModeStrict(raw);
     if (strict !== undefined)
@@ -12,9 +17,7 @@ export function coercePermissionMode(raw) {
     return undefined;
 }
 export function coercePermissionModeStrict(raw) {
-    if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
-        return raw;
-    return undefined;
+    return isSettingsPermissionMode(raw) ? raw : undefined;
 }
 export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
 export function isPlanApprovePermissionModeAfter(raw) {
@@ -154,8 +157,7 @@ export function parseTaskSettings(raw) {
         const allow = cleanStringArray(p.allow);
         const deny = cleanStringArray(p.deny);
         const ask = cleanStringArray(p.ask);
-        const mode = p.defaultMode;
-        const defaultMode = mode === "default" || mode === "acceptEdits" || mode === "plan" || mode === "bypassPermissions" || mode === "auto" ? mode : undefined;
+        const defaultMode = coercePermissionModeStrict(p.defaultMode);
         const rawKill = p.disableAutoMode;
         const disableAutoMode = rawKill === "disable" || rawKill === true || rawKill === false ? rawKill : undefined;
         if (allow || deny || ask || defaultMode || disableAutoMode !== undefined) {

package/dist/trace/core-keyset-guard.d.ts

@@ -130,8 +130,8 @@ type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "seve
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars";
-type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles";

package/dist/trace/project.d.ts

@@ -769,6 +769,13 @@ export declare function compactedEventData(ev: {
     clampReason?: "budget" | "tolerance";
     tokensAfter?: number;
     triggerTokensBefore?: number;
+    /** core 7.24.0 [ref]:引擎**自己**算的结构性净减(pre-messages 的结构和 减去 post-messages 的同一个和,
+     *  铸点处 clamp ≥0),三条压缩车道(turn 边界 / prompt-too-long 恢复 / 任务末 settle)同一只
+     *  `mintCompactedEvent` 出。🔴 **缺席 = post 测量失败,不是 0**:上面那两个旧键(`tokensAfter` /
+     *  `triggerTokensBefore`)自本版起在 core 的类型上写明是**诊断位、不可相减**(触发闸读的是 usage 锚定
+     *  的数、post 恒是结构和 + 固定提示词开销,两者的差混坐标,实测在普通 run 上是负数)。本仓的处置因此
+     *  是**三条都逐字透传、一条都不合成**:谁要画上下文表就读 `freedTokens`,读不到就渲染 unknown。 */
+    freedTokens?: number;
     durationMs?: number;
     phaseDurations?: {
         prepareMs?: number;

package/dist/trace/project.js

@@ -656,6 +656,7 @@ export function compactedEventData(ev) {
         ...(ev.clampReason !== undefined ? { clampReason: ev.clampReason } : {}),
         ...(num(ev.tokensAfter) !== undefined ? { tokensAfter: num(ev.tokensAfter) } : {}),
         ...(num(ev.triggerTokensBefore) !== undefined ? { triggerTokensBefore: num(ev.triggerTokensBefore) } : {}),
+        ...(num(ev.freedTokens) !== undefined ? { freedTokens: num(ev.freedTokens) } : {}),
         ...(num(ev.durationMs) !== undefined ? { durationMs: num(ev.durationMs) } : {}),
         ...(phaseDurations !== undefined ? { phaseDurations } : {}),
     };

package/dist/trace/redact.d.ts

@@ -136,6 +136,27 @@ export declare function redactDeep(value: unknown): unknown;
  * owner-scoped, so this preview is only ever shown to the ask's own principal (or an operator inspecting it).
  */
 export declare function redactedPreview(value: unknown, cap?: number): string | null;
+/**
+ * **这一位是不是一个层级式绝对 URL**(有 authority 的那一族)—— 本铸点与**模型路由三键拒启**
+ * (`model-route-url.ts` 第一臂)共用的**同一只**判据:两处曾各判各的,而 `URL.canParse` 单独为真的
+ * **不透明** URL 恰好是「凭据位看不见」的那一形。
+ *
+ * ⚠️ **射程如实**(车JC 复审去幻觉轮:此处原文写的是「本仓唯一判据」,亲读证伪)—— 仓里**另有一处**仍用
+ * 裸 `URL.canParse` 回答同一个问题,且**刻意不在射程内**(改它是一次新的行为面拒启,按三问另开车):
+ *  `config.ts` 的 `GIT_API_BASEURL`(`parseGitApiKind`):无协议闸 ⇒ 不透明形今天过门(拒因经本铸点,
+ *  所以不回显凭据;可用性由 `fetch` 那侧决定)。
+ * ✅ 原先列在这里的第二处(`config-catalog.ts` 的 `stripUrlUserinfo`:不透明形 `href === 原串` ⇒ 原样回显)
+ * 已在 7.90.0 随 core `displayUrlOf` 到货**闭环** —— 那只函数整只退役,url 型行的回显改走本铸点,
+ * 于是这道闸对它自动成立(catalog wire 行为面变更,CHANGELOG 已对外写明并点名 @web-admin)。
+ *
+ * 🔴 谓词写成 `URL.canParse` 而不是 try/catch:这一臂**不是兜底**(兜底才归静默降级那张表管),它是判据本身 ——
+ * 「不是一个层级式 URL」是一个可判的状态,用异常当控制流只会让它看起来像一次意外。
+ * 🔴 「解析得动」**不够**:`new URL("alice:hunter2@gw.internal:8000")` 是合法的**不透明** URL(`alice:` 当 scheme,
+ * 与 `mailto:` 同族)—— 它没有 authority,URL 律的锚(`scheme://`)对它不成立,`username`/`password` 恒空,
+ * 直接回原串就是密码明文(红先实测)。闸取「**层级式** URL」:`href` 以 `<protocol>//` 起头 ⇒ 有 authority
+ * ⇒ 三个凭据位都在律的射程内。
+ */
+export declare function isHierarchicalUrl(raw: string): boolean;
 /**
  * 🔴 **配置型 URL 上日志 / 诊断面的唯一 display-safe 铸点**(S-475 件B;`build*` = 返回纯数据的一只纯函数)。
  *
@@ -144,16 +165,100 @@ export declare function redactedPreview(value: unknown, cap?: number): string |
  * 网关 URL 的 userinfo / query 里,密码明文落 `engine-*.log`(日志的读者面比 run 错误文本更宽:它落盘、
  * 被采集、进工单)。同类出口不止这两处,类级机器门在 `test/config-url-display-safe.test.ts`。
  *
- * **内部就调 {@link redactSecrets} —— 同一条 URL 律、同一张名表、同一批记号,零第二份实现**:
- * 本函数自己只加两件事,两件都是**配置型 URL 特有**的:
+ * 🔴 **S-483 展示半场(7.90.0 / core 7.24.0):两条正交的律合成一次,名表的射程缩到不可约的那一半**。
+ * 改前内部只有一条:`redactSecrets(new URL(raw).href)` —— 自由文本那条**名单制**的律,query 的值只在键名
+ * 落在 `CREDENTIAL_NAME_WORDS`(或值本身像个密钥)时才遮,于是**没人列过的那个键名**就是它的盲点
+ * (`?sig=…` / `?auth=…` / 部署自定义的网关参数名)。现在前面先跑 core 的 `displayUrlOf`,它是**位置制**的:
+ *  · userinfo **落地**(不是遮成记号 —— 它从**解析**组合 `scheme://host + path + query`,userinfo 结构上
+ *    进不了产物);凭据在 userinfo 这件事本身仍然响亮,只不过是在**声明关口**响
+ *    (`modelRouteUrlRefusal` / `parseA2aServe` / core 的 `assertServableRequestRoot`),不靠展示串暗示;
+ *  · query 的**每一个值**成记号、**键名留着**(键名必须留:两条只在 query 上不同的根若都渲染成同一个串,
+ *    「A 配给了 B」这句拒因会写成「targets X … paired with X」);
+ *  · 无 `=` 的**裸段**整片成一枚记号、连名字都不给(`URLSearchParams` 把它读成「空值的键」,那个读法
+ *    正好把 payload 本身放上了屏);
+ *  · fragment 丢掉(implicit-OAuth 把 bearer 放那儿),尾斜杠与默认端口按配对键的同一把尺折。
+ * 位置律跑完**再跑一次形状律**({@link redactSecrets}):它管的是「一段字面量**长得像**凭据」,而位置律
+ * 对这件事结构性失明 —— `pathname` 被逐字保留,「这个路径段是不是一枚令牌」只能按形认。两条律正交、
+ * 各有一个属主、在铸点里合成一次;因为位置律先跑,名表在 query 上无事可做,它的射程被**缩小**到
+ * host + path 这一不可约的半边。
+ * 换尺的**代价成文、不是意外**:非凭据参数的值(`?model=x`)现在也成记号 —— 排障读不到它了。方向一致:
+ * 一个没人列过的凭据参数名泄出去是不可逆的,少读一个模型名不是。本仓原先**三份**各判各的 URL 脱敏实现
+ * (本铸点 / catalog 的 `stripUrlUserinfo` / embedder 的 `redactEndpointForLog`)合成这一只,记号闭形仍归
+ * 本模块({@link REDACTION_TOKENS};委托边界的闭集校验在下面的加载期检查)。
+ *
+ * 本函数自己只剩两件事,两件都是**配置型 URL 特有**的(core 的渲染器对这两形有自己的答案,而配置面要更严):
  *  ① **有效性闸**:配置里的那一位应当是一个**绝对 URL**。`new URL(raw)` 解析不动 ⇒ 这一位根本不是 URL
  *     (裸 `host:port`、相对路径、手滑的散文),自由文本的 URL 律对它没有定界依据 ⇒ 返回**占位**
  *     {@link DISPLAY_SAFE_URL_TOKEN},**不回落原值**([ref]:安全轴上的兜底必须 fail-closed 或响亮)。
  *     成文代价:`MODEL_GATEWAY_BASEURL=127.0.0.1:8000` 这种缺 scheme 的配置在日志上变成 `«redacted:url»`
  *     —— 而它在 `fetch` 那一侧本来就是必然失败的形(WHATWG 要求绝对 URL),日志上响亮一点方向一致。
  *  ② **空串 = 未设**:里面没有凭据,原样回空串(不铸占位 —— 占位会让「没配」读成「配了但看不见」)。
- * 解析成功后**不重建 URL**(`new URL(...).toString()` 会归一化路径/端口/大小写):保形是这条律的一半,
- * 运维要靠 host / port / path / 非凭据参数逐字排障,所以回的是**原串经脱敏器**的结果。
+ * ⚠️ **保形只到 host / port / path 这一层**(S-483 起如实改口;`test/config-url-display-safe.test.ts`
+ * 的 S-483-o 是这句话的机器读数,别在散文里再抄一遍):scheme / host / port / path 的字节逐字(模 WHATWG
+ * 的 HTTP 等价归一:默认端口省、host 小写、IDN→punycode、点段折叠,再加**整串末尾**的斜杠去掉 ——
+ * 是**整串末尾**不是「路径末尾」:`…/p/` ⇒ `…/p`,而 `…/p/?k=v` 的 `/p/` 保留),query 只留**键名**。
+ */
+/** 位置律的**形** —— 生产路径恒是 core 的 {@link displayUrlOf}。参数化是**为可测性开的唯一一个缝**
+ *  (S-497 的「违反格」要造一个「位置律漏了一段」的世界,而拿上游的现成缺陷当触发器会在它修好那天失效);
+ *  生产调用方**不传**这个参数。 */
+export type PositionalUrlLaw = (url: string) => string;
+/** 测试口(与 `observability/fail-open.ts` 的 `resetFailOpenRecorderForTest` 同姿势):一次性 warn 的闸是
+ *  模块级的,而「只 warn 一次」本身要被钉,所以给测试一个复位口。生产零调用。 */
+export declare function resetDisplaySafeFailClosedWarnForTest(): void;
+/**
+ * 🔴 **S-497 的不变量 —— 形状律在 query / fragment 区间上有一条凭据跨度 ⇒ 那一整段不出门**。
+ *
+ * 为什么需要它(差分实测 650 形里 26 个反例,本车亲跑复现):两条律**串起来**的时候,前一条会把后一条
+ * 赖以认字的**结构**改掉。实测的病形是 `https://h/?next=https://u:&pw@h=` —— 位置律先按 `&` 切段、把
+ * `next=https://u:` 整段换成记号,于是 `&` 之后那半截密码落到了**下一段的键名位**上被保留,而形状律
+ * 此刻已经看不到 `://<userinfo>@` 这个结构、无从下手(`redactSecrets(原串)` 是对的,可它拿不到原串)。
+ *
+ * 🔴 **判据落在「切分之前」,而不是在产物文本里找证据**(这一条是本不变量的全部)。三次尝试都被同一件事
+ * 击穿:①凭据**整段**不得是产物的子串 —— 位置律把它切开了,整段自然不是子串;②切成**片** + 长度下限 ——
+ * 材料能被切成全是单字符(`&a!b!c!d@`)甚至纯标点(`&!$()*+,;@`),任何下限都漏;③**字符集**包含 ——
+ * 密码的每个字符都能在同一条 URL 的 path / host / 别的键名里另外出现一次,包含关系成立而明文骑在产物上
+ * (`https://h/abcdefghijklmnopqrstuvwxyz0123456789?ok=1&next=https://u:&secret123=x@h`,S-497-k)。
+ * 共同的根:**切开之后,「这个字节来自凭据」在文本上不可判**。⇒ 判据搬到切分之前,用形状律自己报的
+ * **跨度坐标**当出处证明({@link shapeLawCredentialInQueryOrFragment})—— 不需要长度下限、字符类白名单
+ * 或任何集合运算,**规则比前三版都少**,而且对「将来出现的新形」天然封闭(新形状照样落在跨度里)。
+ *
+ * 两步(一条规则,不按形状分臂):
+ *  ① 形状律在**归一化视图**上取跨度;凡有一条跨度落进 `?`(或 `#`)之后的区间 ⇒ 整段 query + fragment
+ *     换一枚 {@link REDACTION_TOKENS} 内的占位,`scheme://host[:port]/path` 留着并照旧过一遍形状律;
+ *  ② 否则照旧合成:位置律 → 形状律。
+ * **过度遮的射程如实**:一条 query 里**真的**带凭据的配置型 URL,自本版起读不到它的**其它**参数名了
+ * (改前是逐参数遮)。方向一致,而且干净的根**零影响** —— Azure 式 `?api-version=…&deployment=…` 上
+ * 形状律一条跨度都没有,结构上走不到这一步(S-497-e 单独钉住)。path 区间的凭据**不**走这条路:位置律
+ * 逐字保留 `pathname`,形状律在产物上照常认得它(S-497-f 的并集格)。
+ * 🔴 这是 fail-**closed**(扣下信息),**不**登记 `recordFailOpen` —— 那张表记的是「放行了本该拒的」。
+ *    只打一条一次性 warn(**不含原文**:原文就是那段凭据)。
+ */
+export declare function buildDisplaySafeUrl(raw: string, positionalLaw?: PositionalUrlLaw): string;
+/**
+ * {@link buildDisplaySafeUrl} 的**带判据**出口:除了展示串,还说这一次有没有落到 fail-closed
+ * (= 「query / fragment 因为里面有一条凭据跨度而整段被扣下」)。
+ *
+ * 🔴 **为什么要这个出口**(发前复审):core 的**路由拒因**是一句**自由文本**,里面嵌着 core **已经用
+ * 位置律改写过**的那条 URL —— 到我们手上时 `://<userinfo>@` 的结构早没了,形状律无从下手,于是那条出口
+ * 整个在不变量之外(实测:降级拒因把密码写进 `listening` 行)。这里不去猜怎么把上游那句话重新脱敏
+ * (那会变成第二个写者),而是用**同一条判决**:铸点对这条 URL 都已经守不住了,任何**引用它**的自由文本
+ * 一律扣下(见 {@link buildDisplaySafeRefusal})。判决属主还是这一只函数。
+ */
+export declare function buildDisplaySafeUrlChecked(raw: string, positionalLaw?: PositionalUrlLaw): {
+    text: string;
+    failedClosed: boolean;
+};
+/**
+ * 🔴 **引用了一条「铸点都守不住」的 URL 的自由文本,一律扣下**(S-497 的第二个出口;codex 第三轮 [high] 二)。
+ *
+ * 料 = 上游(core)的路由拒因:一句自由文本,里面嵌着 core **已经用位置律改写过**的那条 URL。到本仓手上时
+ * `://<userinfo>@` 的结构已经没了 ⇒ 形状律认不出那一段 ⇒ 光过一遍 `redactSecrets` 兜不住(实测:降级拒因
+ * 把密码写进 `listening` 行)。
+ *
+ * 判据**不新造**:问 {@link buildDisplaySafeUrlChecked} —— 如果铸点对这几条源 URL 里的任何一条都已经落到
+ * fail-closed,那么**任何引用它的句子**都不许出门,换一句固定文案(零原文)。机器可读的那一半不丢:调用方
+ * 手里有 `verdict.code`(拒因的码),它本来就在同一个投影的**另一个字段**上。
+ * 都守得住 ⇒ 照旧只过一遍形状律(上游的位置律已经把 URL 的凭据位处理过,这一层管的是**形状**那一半)。
  */
-export declare function buildDisplaySafeUrl(raw: string): string;
+export declare function buildDisplaySafeRefusal(text: string, sourceUrls: readonly string[]): string;
 //# sourceMappingURL=redact.d.ts.map

package/dist/trace/redact.js

@@ -1,4 +1,4 @@
-import { stripFormatCharacters } from "@sema-agent/core";
+import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
@@ -1085,6 +1085,7 @@ const FRAGMENT_SECRET_PATTERNS = [
     [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
 ];
 const DISPLAY_SAFE_URL_TOKEN = "«redacted:url»";
+const WITHHELD_VALUE_TOKEN = "«redacted»";
 const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, DISPLAY_SAFE_URL_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
 {
@@ -1092,6 +1093,22 @@ const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FR
     for (const t of REDACTION_TOKENS)
         if (!closed.test(t))
             throw new Error(`redact: token ${t} is outside the closed form ${REDACTION_TOKEN_RE_SRC}`);
+    if (!REDACTION_TOKENS.has(WITHHELD_VALUE_TOKEN)) {
+        throw new Error(`redact: ${WITHHELD_VALUE_TOKEN} is no longer produced by the arm tables — the fail-closed filler must stay a closed-set member`);
+    }
+}
+{
+    for (const probe of ["https://probe.invalid/p?k=v", "https://probe.invalid/p?bare"]) {
+        const toks = displayUrlOf(probe).match(/«[^»]*»/g) ?? [];
+        if (toks.length === 0) {
+            throw new Error(`redact: core displayUrlOf(${probe}) minted no «…» token at all — upstream changed the placeholder spelling; map it at the delegation boundary (never add a second token table)`);
+        }
+        for (const tok of toks) {
+            if (!REDACTION_TOKENS.has(tok)) {
+                throw new Error(`redact: core displayUrlOf minted ${tok}, which is outside this module's token closed set — map it at the delegation boundary (never add a second token table)`);
+            }
+        }
+    }
 }
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
 const FRAGMENT_ARM_TOKENS = new Set(FRAGMENT_SECRET_PATTERNS.map(([, repl]) => repl));
@@ -1598,7 +1615,7 @@ const armPool = (() => {
         const kept = resolveSpanOverlaps(spans);
         const out = applySpans(text, kept).out;
         if (!wantCount || kept.length === 0)
-            return { out, hits: NO_HITS };
+            return { out, hits: NO_HITS, kept };
         const tokenOf = (sp) => members[sp.order].token;
         const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full").sort((a, b) => a.start - b.start);
         const byArmedToken = new Map();
@@ -1618,7 +1635,7 @@ const armPool = (() => {
             else
                 cur.count += 1;
         }
-        return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })) };
+        return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept };
     };
 })();
 let onRedaction;
@@ -1641,11 +1658,12 @@ function reportHits(hits) {
 }
 function runRedaction(text, observe, json, wantHits) {
     const wantCount = wantHits || (onRedaction !== undefined && observe);
-    const r = applyRules(normalizeForRedaction(text), wantCount, json, observe);
+    const normalized = normalizeForRedaction(text);
+    const r = applyRules(normalized, wantCount, json, observe);
     forgetEscapedSeparatorTails();
     if (observe)
         reportHits(r.hits);
-    return { text: r.out, hits: r.hits };
+    return { text: r.out, hits: r.hits, spans: r.kept };
 }
 export function redactSecrets(text, opts) {
     return runRedaction(text, opts?.observe ?? true, opts?.json === true, false).text;
@@ -1712,14 +1730,55 @@ export function redactedPreview(value, cap = 2000) {
     s = redactSecrets(s, { json: true });
     return s.length > cap ? `${s.slice(0, cap)}…[truncated]` : s;
 }
-export function buildDisplaySafeUrl(raw) {
-    if (raw === "")
-        return "";
+export function isHierarchicalUrl(raw) {
     if (!URL.canParse(raw))
-        return DISPLAY_SAFE_URL_TOKEN;
+        return false;
     const u = new URL(raw);
-    if (!u.href.startsWith(`${u.protocol}//`))
-        return DISPLAY_SAFE_URL_TOKEN;
-    return redactSecrets(u.href);
+    return u.href.startsWith(`${u.protocol}//`);
+}
+function shapeLawCredentialInQueryOrFragment(canonical) {
+    const normalized = normalizeForRedaction(canonical);
+    const boundary = normalized.indexOf("?");
+    if (boundary < 0)
+        return false;
+    return runRedaction(canonical, false, false, false).spans.some((sp) => sp.end > boundary);
+}
+let displaySafeFailClosedWarned = false;
+export function resetDisplaySafeFailClosedWarnForTest() {
+    displaySafeFailClosedWarned = false;
+}
+export function buildDisplaySafeUrl(raw, positionalLaw = displayUrlOf) {
+    return buildDisplaySafeUrlChecked(raw, positionalLaw).text;
+}
+export function buildDisplaySafeUrlChecked(raw, positionalLaw = displayUrlOf) {
+    if (raw === "")
+        return { text: "", failedClosed: false };
+    if (!isHierarchicalUrl(raw))
+        return { text: DISPLAY_SAFE_URL_TOKEN, failedClosed: false };
+    const parsed = new URL(raw);
+    if (shapeLawCredentialInQueryOrFragment(parsed.href)) {
+        noteDisplaySafeFailClosed("query-and-fragment-withheld");
+        const root = redactSecrets(`${parsed.protocol}//${parsed.host}${parsed.pathname}`).replace(/\/+$/, "");
+        return { text: `${root}?${WITHHELD_VALUE_TOKEN}`, failedClosed: true };
+    }
+    return { text: redactSecrets(positionalLaw(raw)), failedClosed: false };
+}
+export function buildDisplaySafeRefusal(text, sourceUrls) {
+    if (text === "")
+        return text;
+    if (sourceUrls.some((url) => url !== "" && buildDisplaySafeUrlChecked(url).failedClosed)) {
+        noteDisplaySafeFailClosed("refusal-text-withheld");
+        return REFUSAL_WITHHELD_TEXT;
+    }
+    return redactSecrets(text);
+}
+const REFUSAL_WITHHELD_TEXT = "[route refusal text withheld: it quotes a configured URL that carries a credential, and the upstream wording cannot be re-redacted safely once the URL has been rewritten for display. " +
+    "The machine-readable verdict is on the pairing field beside this one; fix the configuration so the credential is not in the URL.]";
+function noteDisplaySafeFailClosed(level) {
+    if (displaySafeFailClosedWarned)
+        return;
+    displaySafeFailClosedWarned = true;
+    process.emitWarning(`display-safe URL composition fell back to fail-closed (${level}): the positional law reshaped the input so that a fragment the shape law had judged a credential survived into the product. ` +
+        `The product is safe (the offending part is withheld), but this deployment has an input hitting the composition seam — report it upstream. No original bytes are logged.`, "SemaRedactionFailClosed");
 }
 //# sourceMappingURL=redact.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.88.2",
+  "version": "7.90.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.23.5",
+    "@sema-agent/core": "7.24.2",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",