@sema-agent/server 7.89.0 → 7.91.1

package/dist/task-settings.d.ts

@@ -48,7 +48,16 @@ import { type KeyClosureIssue } from "./request-key-closure.js";
  *  deployment approval/governance baseline is composed OUTSIDE this derive and is untouchable from a settings stamp),
  *  and `auto` adds the same ask gate as `default` with core's auto-mode classifier screening the asks upstream
  *  (entitlement-gated in core, [ref]②). */
-export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto";
+export declare const SETTINGS_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
+/** 五模式闭集的型形 —— **从值表派生**(S-496 / [ref]):改前本仓有 **4 份**同一张五词表(本处的手写联合 /
+ *  下面 `coercePermissionModeStrict` 的运行期字面量链 / `http/admission.ts` 顶层 `permissionMode` 的比较链 /
+ *  同文件 `settings.permissions.defaultMode` 的比较链),外加两句错误文案里各抄一遍词。现在值表一份、
+ *  型与文案都从它派生,比较链改调 {@link isSettingsPermissionMode}。 */
+export type SettingsPermissionMode = (typeof SETTINGS_PERMISSION_MODES)[number];
+/** 五词表的 wire 文案形(`"a" | "b" | …`)—— 两条 400 的句子从这里取词,不再各抄一份。 */
+export declare const SETTINGS_PERMISSION_MODE_WORDS: string;
+/** 闭集成员判定(`unknown` 入口用)—— 词表的**唯一**运行期读者:wire 门与 coerce 两族同调。 */
+export declare function isSettingsPermissionMode(raw: unknown): raw is SettingsPermissionMode;
 /**
  * R4: coerce a raw top-level `body.permissionMode` (the LIGHT per-turn wire — the shell sends the
  * CC permission mode RAW, axis-agnostic; the service interprets) to a service-honored mode, or undefined.
@@ -68,7 +77,8 @@ export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypas
  */
 export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
 /** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
- *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
+ *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠。
+ *  S-496:词表单点已上移到 {@link SETTINGS_PERMISSION_MODES},本函数只是它的 `undefined` 形读者。 */
 export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
 /**
  * S-433 —— 一份**被批准的计划**之后,这条会话继续用的 permission mode(`plan_review` 决裁体的

package/dist/task-settings.js

@@ -3,6 +3,11 @@ import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.j
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
+export const SETTINGS_PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
+export const SETTINGS_PERMISSION_MODE_WORDS = SETTINGS_PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
+export function isSettingsPermissionMode(raw) {
+    return typeof raw === "string" && SETTINGS_PERMISSION_MODES.includes(raw);
+}
 export function coercePermissionMode(raw) {
     const strict = coercePermissionModeStrict(raw);
     if (strict !== undefined)
@@ -12,9 +17,7 @@ export function coercePermissionMode(raw) {
     return undefined;
 }
 export function coercePermissionModeStrict(raw) {
-    if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
-        return raw;
-    return undefined;
+    return isSettingsPermissionMode(raw) ? raw : undefined;
 }
 export const PLAN_APPROVE_PERMISSION_MODES_AFTER = ["default", "acceptEdits"];
 export function isPlanApprovePermissionModeAfter(raw) {
@@ -154,8 +157,7 @@ export function parseTaskSettings(raw) {
         const allow = cleanStringArray(p.allow);
         const deny = cleanStringArray(p.deny);
         const ask = cleanStringArray(p.ask);
-        const mode = p.defaultMode;
-        const defaultMode = mode === "default" || mode === "acceptEdits" || mode === "plan" || mode === "bypassPermissions" || mode === "auto" ? mode : undefined;
+        const defaultMode = coercePermissionModeStrict(p.defaultMode);
         const rawKill = p.disableAutoMode;
         const disableAutoMode = rawKill === "disable" || rawKill === true || rawKill === false ? rawKill : undefined;
         if (allow || deny || ask || defaultMode || disableAutoMode !== undefined) {

package/dist/trace/core-keyset-guard.d.ts

@@ -130,8 +130,8 @@ type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "seve
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars";
-type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles";

package/dist/trace/project.d.ts

@@ -769,6 +769,13 @@ export declare function compactedEventData(ev: {
     clampReason?: "budget" | "tolerance";
     tokensAfter?: number;
     triggerTokensBefore?: number;
+    /** core 7.24.0 [ref]:引擎**自己**算的结构性净减(pre-messages 的结构和 减去 post-messages 的同一个和,
+     *  铸点处 clamp ≥0),三条压缩车道(turn 边界 / prompt-too-long 恢复 / 任务末 settle)同一只
+     *  `mintCompactedEvent` 出。🔴 **缺席 = post 测量失败,不是 0**:上面那两个旧键(`tokensAfter` /
+     *  `triggerTokensBefore`)自本版起在 core 的类型上写明是**诊断位、不可相减**(触发闸读的是 usage 锚定
+     *  的数、post 恒是结构和 + 固定提示词开销,两者的差混坐标,实测在普通 run 上是负数)。本仓的处置因此
+     *  是**三条都逐字透传、一条都不合成**:谁要画上下文表就读 `freedTokens`,读不到就渲染 unknown。 */
+    freedTokens?: number;
     durationMs?: number;
     phaseDurations?: {
         prepareMs?: number;

package/dist/trace/project.js

@@ -656,6 +656,7 @@ export function compactedEventData(ev) {
         ...(ev.clampReason !== undefined ? { clampReason: ev.clampReason } : {}),
         ...(num(ev.tokensAfter) !== undefined ? { tokensAfter: num(ev.tokensAfter) } : {}),
         ...(num(ev.triggerTokensBefore) !== undefined ? { triggerTokensBefore: num(ev.triggerTokensBefore) } : {}),
+        ...(num(ev.freedTokens) !== undefined ? { freedTokens: num(ev.freedTokens) } : {}),
         ...(num(ev.durationMs) !== undefined ? { durationMs: num(ev.durationMs) } : {}),
         ...(phaseDurations !== undefined ? { phaseDurations } : {}),
     };

package/dist/trace/redact.d.ts

@@ -141,12 +141,13 @@ export declare function redactedPreview(value: unknown, cap?: number): string |
  * (`model-route-url.ts` 第一臂)共用的**同一只**判据:两处曾各判各的,而 `URL.canParse` 单独为真的
  * **不透明** URL 恰好是「凭据位看不见」的那一形。
  *
- * ⚠️ **射程如实**(车JC 复审去幻觉轮:此处原文写的是「本仓唯一判据」,亲读证伪)—— 仓里另有两处仍用
- * 裸 `URL.canParse` 回答同一个问题,且**刻意不在本批射程内**(改它们各是一次新的行为面拒启,按三问另开车):
- *  · `config.ts` 的 `GIT_API_BASEURL`(`parseGitApiKind`):无协议闸 ⇒ 不透明形今天过门(拒因经本铸点,
- *    所以不回显凭据;可用性由 `fetch` 那侧决定);
- *  · `config-catalog.ts` 的 `stripUrlUserinfo`(url 型行的回显尺):不透明形 `href === 原串` ⇒ **原样回显**
- *    (登记为未闭环 —— 它等 core `displayUrlOf` 落地后与 catalog wire 行为面一起改,表态制点名 web-admin)。
+ * ⚠️ **射程如实**(车JC 复审去幻觉轮:此处原文写的是「本仓唯一判据」,亲读证伪)—— 仓里**另有一处**仍用
+ * 裸 `URL.canParse` 回答同一个问题,且**刻意不在射程内**(改它是一次新的行为面拒启,按三问另开车):
+ *  `config.ts` 的 `GIT_API_BASEURL`(`parseGitApiKind`):无协议闸 ⇒ 不透明形今天过门(拒因经本铸点,
+ *  所以不回显凭据;可用性由 `fetch` 那侧决定)。
+ * ✅ 原先列在这里的第二处(`config-catalog.ts` 的 `stripUrlUserinfo`:不透明形 `href === 原串` ⇒ 原样回显)
+ * 已在 7.90.0 随 core `displayUrlOf` 到货**闭环** —— 那只函数整只退役,url 型行的回显改走本铸点,
+ * 于是这道闸对它自动成立(catalog wire 行为面变更,CHANGELOG 已对外写明并点名 @web-admin)。
  *
  * 🔴 谓词写成 `URL.canParse` 而不是 try/catch:这一臂**不是兜底**(兜底才归静默降级那张表管),它是判据本身 ——
  * 「不是一个层级式 URL」是一个可判的状态,用异常当控制流只会让它看起来像一次意外。
@@ -164,16 +165,100 @@ export declare function isHierarchicalUrl(raw: string): boolean;
  * 网关 URL 的 userinfo / query 里,密码明文落 `engine-*.log`(日志的读者面比 run 错误文本更宽:它落盘、
  * 被采集、进工单)。同类出口不止这两处,类级机器门在 `test/config-url-display-safe.test.ts`。
  *
- * **内部就调 {@link redactSecrets} —— 同一条 URL 律、同一张名表、同一批记号,零第二份实现**:
- * 本函数自己只加两件事,两件都是**配置型 URL 特有**的:
+ * 🔴 **S-483 展示半场(7.90.0 / core 7.24.0):两条正交的律合成一次,名表的射程缩到不可约的那一半**。
+ * 改前内部只有一条:`redactSecrets(new URL(raw).href)` —— 自由文本那条**名单制**的律,query 的值只在键名
+ * 落在 `CREDENTIAL_NAME_WORDS`(或值本身像个密钥)时才遮,于是**没人列过的那个键名**就是它的盲点
+ * (`?sig=…` / `?auth=…` / 部署自定义的网关参数名)。现在前面先跑 core 的 `displayUrlOf`,它是**位置制**的:
+ *  · userinfo **落地**(不是遮成记号 —— 它从**解析**组合 `scheme://host + path + query`,userinfo 结构上
+ *    进不了产物);凭据在 userinfo 这件事本身仍然响亮,只不过是在**声明关口**响
+ *    (`modelRouteUrlRefusal` / `parseA2aServe` / core 的 `assertServableRequestRoot`),不靠展示串暗示;
+ *  · query 的**每一个值**成记号、**键名留着**(键名必须留:两条只在 query 上不同的根若都渲染成同一个串,
+ *    「A 配给了 B」这句拒因会写成「targets X … paired with X」);
+ *  · 无 `=` 的**裸段**整片成一枚记号、连名字都不给(`URLSearchParams` 把它读成「空值的键」,那个读法
+ *    正好把 payload 本身放上了屏);
+ *  · fragment 丢掉(implicit-OAuth 把 bearer 放那儿),尾斜杠与默认端口按配对键的同一把尺折。
+ * 位置律跑完**再跑一次形状律**({@link redactSecrets}):它管的是「一段字面量**长得像**凭据」,而位置律
+ * 对这件事结构性失明 —— `pathname` 被逐字保留,「这个路径段是不是一枚令牌」只能按形认。两条律正交、
+ * 各有一个属主、在铸点里合成一次;因为位置律先跑,名表在 query 上无事可做,它的射程被**缩小**到
+ * host + path 这一不可约的半边。
+ * 换尺的**代价成文、不是意外**:非凭据参数的值(`?model=x`)现在也成记号 —— 排障读不到它了。方向一致:
+ * 一个没人列过的凭据参数名泄出去是不可逆的,少读一个模型名不是。本仓原先**三份**各判各的 URL 脱敏实现
+ * (本铸点 / catalog 的 `stripUrlUserinfo` / embedder 的 `redactEndpointForLog`)合成这一只,记号闭形仍归
+ * 本模块({@link REDACTION_TOKENS};委托边界的闭集校验在下面的加载期检查)。
+ *
+ * 本函数自己只剩两件事,两件都是**配置型 URL 特有**的(core 的渲染器对这两形有自己的答案,而配置面要更严):
  *  ① **有效性闸**:配置里的那一位应当是一个**绝对 URL**。`new URL(raw)` 解析不动 ⇒ 这一位根本不是 URL
  *     (裸 `host:port`、相对路径、手滑的散文),自由文本的 URL 律对它没有定界依据 ⇒ 返回**占位**
  *     {@link DISPLAY_SAFE_URL_TOKEN},**不回落原值**([ref]:安全轴上的兜底必须 fail-closed 或响亮)。
  *     成文代价:`MODEL_GATEWAY_BASEURL=127.0.0.1:8000` 这种缺 scheme 的配置在日志上变成 `«redacted:url»`
  *     —— 而它在 `fetch` 那一侧本来就是必然失败的形(WHATWG 要求绝对 URL),日志上响亮一点方向一致。
  *  ② **空串 = 未设**:里面没有凭据,原样回空串(不铸占位 —— 占位会让「没配」读成「配了但看不见」)。
- * 解析成功后**不重建 URL**(`new URL(...).toString()` 会归一化路径/端口/大小写):保形是这条律的一半,
- * 运维要靠 host / port / path / 非凭据参数逐字排障,所以回的是**原串经脱敏器**的结果。
+ * ⚠️ **保形只到 host / port / path 这一层**(S-483 起如实改口;`test/config-url-display-safe.test.ts`
+ * 的 S-483-o 是这句话的机器读数,别在散文里再抄一遍):scheme / host / port / path 的字节逐字(模 WHATWG
+ * 的 HTTP 等价归一:默认端口省、host 小写、IDN→punycode、点段折叠,再加**整串末尾**的斜杠去掉 ——
+ * 是**整串末尾**不是「路径末尾」:`…/p/` ⇒ `…/p`,而 `…/p/?k=v` 的 `/p/` 保留),query 只留**键名**。
+ */
+/** 位置律的**形** —— 生产路径恒是 core 的 {@link displayUrlOf}。参数化是**为可测性开的唯一一个缝**
+ *  (S-497 的「违反格」要造一个「位置律漏了一段」的世界,而拿上游的现成缺陷当触发器会在它修好那天失效);
+ *  生产调用方**不传**这个参数。 */
+export type PositionalUrlLaw = (url: string) => string;
+/** 测试口(与 `observability/fail-open.ts` 的 `resetFailOpenRecorderForTest` 同姿势):一次性 warn 的闸是
+ *  模块级的,而「只 warn 一次」本身要被钉,所以给测试一个复位口。生产零调用。 */
+export declare function resetDisplaySafeFailClosedWarnForTest(): void;
+/**
+ * 🔴 **S-497 的不变量 —— 形状律在 query / fragment 区间上有一条凭据跨度 ⇒ 那一整段不出门**。
+ *
+ * 为什么需要它(差分实测 650 形里 26 个反例,本车亲跑复现):两条律**串起来**的时候,前一条会把后一条
+ * 赖以认字的**结构**改掉。实测的病形是 `https://h/?next=https://u:&pw@h=` —— 位置律先按 `&` 切段、把
+ * `next=https://u:` 整段换成记号,于是 `&` 之后那半截密码落到了**下一段的键名位**上被保留,而形状律
+ * 此刻已经看不到 `://<userinfo>@` 这个结构、无从下手(`redactSecrets(原串)` 是对的,可它拿不到原串)。
+ *
+ * 🔴 **判据落在「切分之前」,而不是在产物文本里找证据**(这一条是本不变量的全部)。三次尝试都被同一件事
+ * 击穿:①凭据**整段**不得是产物的子串 —— 位置律把它切开了,整段自然不是子串;②切成**片** + 长度下限 ——
+ * 材料能被切成全是单字符(`&a!b!c!d@`)甚至纯标点(`&!$()*+,;@`),任何下限都漏;③**字符集**包含 ——
+ * 密码的每个字符都能在同一条 URL 的 path / host / 别的键名里另外出现一次,包含关系成立而明文骑在产物上
+ * (`https://h/abcdefghijklmnopqrstuvwxyz0123456789?ok=1&next=https://u:&secret123=x@h`,S-497-k)。
+ * 共同的根:**切开之后,「这个字节来自凭据」在文本上不可判**。⇒ 判据搬到切分之前,用形状律自己报的
+ * **跨度坐标**当出处证明({@link shapeLawCredentialInQueryOrFragment})—— 不需要长度下限、字符类白名单
+ * 或任何集合运算,**规则比前三版都少**,而且对「将来出现的新形」天然封闭(新形状照样落在跨度里)。
+ *
+ * 两步(一条规则,不按形状分臂):
+ *  ① 形状律在**归一化视图**上取跨度;凡有一条跨度落进 `?`(或 `#`)之后的区间 ⇒ 整段 query + fragment
+ *     换一枚 {@link REDACTION_TOKENS} 内的占位,`scheme://host[:port]/path` 留着并照旧过一遍形状律;
+ *  ② 否则照旧合成:位置律 → 形状律。
+ * **过度遮的射程如实**:一条 query 里**真的**带凭据的配置型 URL,自本版起读不到它的**其它**参数名了
+ * (改前是逐参数遮)。方向一致,而且干净的根**零影响** —— Azure 式 `?api-version=…&deployment=…` 上
+ * 形状律一条跨度都没有,结构上走不到这一步(S-497-e 单独钉住)。path 区间的凭据**不**走这条路:位置律
+ * 逐字保留 `pathname`,形状律在产物上照常认得它(S-497-f 的并集格)。
+ * 🔴 这是 fail-**closed**(扣下信息),**不**登记 `recordFailOpen` —— 那张表记的是「放行了本该拒的」。
+ *    只打一条一次性 warn(**不含原文**:原文就是那段凭据)。
+ */
+export declare function buildDisplaySafeUrl(raw: string, positionalLaw?: PositionalUrlLaw): string;
+/**
+ * {@link buildDisplaySafeUrl} 的**带判据**出口:除了展示串,还说这一次有没有落到 fail-closed
+ * (= 「query / fragment 因为里面有一条凭据跨度而整段被扣下」)。
+ *
+ * 🔴 **为什么要这个出口**(发前复审):core 的**路由拒因**是一句**自由文本**,里面嵌着 core **已经用
+ * 位置律改写过**的那条 URL —— 到我们手上时 `://<userinfo>@` 的结构早没了,形状律无从下手,于是那条出口
+ * 整个在不变量之外(实测:降级拒因把密码写进 `listening` 行)。这里不去猜怎么把上游那句话重新脱敏
+ * (那会变成第二个写者),而是用**同一条判决**:铸点对这条 URL 都已经守不住了,任何**引用它**的自由文本
+ * 一律扣下(见 {@link buildDisplaySafeRefusal})。判决属主还是这一只函数。
+ */
+export declare function buildDisplaySafeUrlChecked(raw: string, positionalLaw?: PositionalUrlLaw): {
+    text: string;
+    failedClosed: boolean;
+};
+/**
+ * 🔴 **引用了一条「铸点都守不住」的 URL 的自由文本,一律扣下**(S-497 的第二个出口;codex 第三轮 [high] 二)。
+ *
+ * 料 = 上游(core)的路由拒因:一句自由文本,里面嵌着 core **已经用位置律改写过**的那条 URL。到本仓手上时
+ * `://<userinfo>@` 的结构已经没了 ⇒ 形状律认不出那一段 ⇒ 光过一遍 `redactSecrets` 兜不住(实测:降级拒因
+ * 把密码写进 `listening` 行)。
+ *
+ * 判据**不新造**:问 {@link buildDisplaySafeUrlChecked} —— 如果铸点对这几条源 URL 里的任何一条都已经落到
+ * fail-closed,那么**任何引用它的句子**都不许出门,换一句固定文案(零原文)。机器可读的那一半不丢:调用方
+ * 手里有 `verdict.code`(拒因的码),它本来就在同一个投影的**另一个字段**上。
+ * 都守得住 ⇒ 照旧只过一遍形状律(上游的位置律已经把 URL 的凭据位处理过,这一层管的是**形状**那一半)。
  */
-export declare function buildDisplaySafeUrl(raw: string): string;
+export declare function buildDisplaySafeRefusal(text: string, sourceUrls: readonly string[]): string;
 //# sourceMappingURL=redact.d.ts.map

package/dist/trace/redact.js

@@ -1,8 +1,12 @@
-import { stripFormatCharacters } from "@sema-agent/core";
+import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
-const atLeast = (cls, min) => `${cls}{${min}}${cls}*`;
+const ARM_VALUE_CLASSES = [];
+const atLeast = (cls, min) => {
+    ARM_VALUE_CLASSES.push(cls);
+    return `${cls}{${min}}${cls}*`;
+};
 const ENTROPY_SCAN_MAX = 96;
 const twoStrongAhead = (valueClass) => String.raw `(?=${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z]${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z])`;
 const IDENT_CONNECTORS = "[_./-]";
@@ -1085,6 +1089,7 @@ const FRAGMENT_SECRET_PATTERNS = [
     [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
 ];
 const DISPLAY_SAFE_URL_TOKEN = "«redacted:url»";
+const WITHHELD_VALUE_TOKEN = "«redacted»";
 const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, DISPLAY_SAFE_URL_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
 {
@@ -1092,6 +1097,22 @@ const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FR
     for (const t of REDACTION_TOKENS)
         if (!closed.test(t))
             throw new Error(`redact: token ${t} is outside the closed form ${REDACTION_TOKEN_RE_SRC}`);
+    if (!REDACTION_TOKENS.has(WITHHELD_VALUE_TOKEN)) {
+        throw new Error(`redact: ${WITHHELD_VALUE_TOKEN} is no longer produced by the arm tables — the fail-closed filler must stay a closed-set member`);
+    }
+}
+{
+    for (const probe of ["https://probe.invalid/p?k=v", "https://probe.invalid/p?bare"]) {
+        const toks = displayUrlOf(probe).match(/«[^»]*»/g) ?? [];
+        if (toks.length === 0) {
+            throw new Error(`redact: core displayUrlOf(${probe}) minted no «…» token at all — upstream changed the placeholder spelling; map it at the delegation boundary (never add a second token table)`);
+        }
+        for (const tok of toks) {
+            if (!REDACTION_TOKENS.has(tok)) {
+                throw new Error(`redact: core displayUrlOf minted ${tok}, which is outside this module's token closed set — map it at the delegation boundary (never add a second token table)`);
+            }
+        }
+    }
 }
 const labelOfToken = (token) => token.replace(/[«»]/g, "").replace(/^redacted:/, "");
 const FRAGMENT_ARM_TOKENS = new Set(FRAGMENT_SECRET_PATTERNS.map(([, repl]) => repl));
@@ -1598,7 +1619,7 @@ const armPool = (() => {
         const kept = resolveSpanOverlaps(spans);
         const out = applySpans(text, kept).out;
         if (!wantCount || kept.length === 0)
-            return { out, hits: NO_HITS };
+            return { out, hits: NO_HITS, kept };
         const tokenOf = (sp) => members[sp.order].token;
         const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full").sort((a, b) => a.start - b.start);
         const byArmedToken = new Map();
@@ -1618,7 +1639,7 @@ const armPool = (() => {
             else
                 cur.count += 1;
         }
-        return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })) };
+        return { out, hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept };
     };
 })();
 let onRedaction;
@@ -1641,11 +1662,12 @@ function reportHits(hits) {
 }
 function runRedaction(text, observe, json, wantHits) {
     const wantCount = wantHits || (onRedaction !== undefined && observe);
-    const r = applyRules(normalizeForRedaction(text), wantCount, json, observe);
+    const normalized = normalizeForRedaction(text);
+    const r = applyRules(normalized, wantCount, json, observe);
     forgetEscapedSeparatorTails();
     if (observe)
         reportHits(r.hits);
-    return { text: r.out, hits: r.hits };
+    return { text: r.out, hits: r.hits, spans: r.kept };
 }
 export function redactSecrets(text, opts) {
     return runRedaction(text, opts?.observe ?? true, opts?.json === true, false).text;
@@ -1718,12 +1740,134 @@ export function isHierarchicalUrl(raw) {
     const u = new URL(raw);
     return u.href.startsWith(`${u.protocol}//`);
 }
-export function buildDisplaySafeUrl(raw) {
+function decodeToFixedPoint(s, maxRounds = 3) {
+    let cur = s;
+    for (let round = 0; round < maxRounds; round += 1) {
+        if (!cur.includes("%"))
+            return { text: cur, residue: false };
+        const next = cur.replace(/%([0-9A-Fa-f]{2})/g, (_whole, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+        if (next === cur)
+            break;
+        cur = next;
+    }
+    return { text: cur, residue: cur.includes("%") };
+}
+const VIEW_FILLER_PREFERENCE = ["a", "z", "_", "-", "0"];
+let armValueClassViewsCache;
+function armValueClassViews() {
+    armValueClassViewsCache ??= [...new Set(ARM_VALUE_CLASSES)].map((cls) => {
+        const inClass = new RegExp(`^(?:${cls})$`, "u");
+        const filler = VIEW_FILLER_PREFERENCE.find((c) => inClass.test(c));
+        if (filler === undefined)
+            throw new Error(`redact: arm value class ${cls} admits none of the view fillers — add one that it accepts`);
+        return { inClass, filler };
+    });
+    return armValueClassViewsCache;
+}
+function boundedUnitView(unit, inClass, filler) {
+    let out = "";
+    for (const ch of unit)
+        out += inClass.test(ch) ? ch : filler;
+    return out;
+}
+function unitCarriesCredential(unit) {
+    const decoded = decodeToFixedPoint(unit);
+    const views = new Set();
+    for (const spelling of [unit, decoded.text])
+        for (const v of armValueClassViews())
+            views.add(boundedUnitView(spelling, v.inClass, v.filler));
+    views.delete("");
+    const hit = [...views].some((view) => redactSecrets(view) !== view);
+    return { hit, residue: decoded.residue };
+}
+function displaySafePathname(pathname) {
+    const parts = pathname.split("/");
+    let withheld = false;
+    for (let i = 0; i < parts.length; i += 1) {
+        const seg = parts[i];
+        if (seg === "")
+            continue;
+        const verdict = unitCarriesCredential(seg);
+        if (!verdict.hit && !verdict.residue)
+            continue;
+        if (isAllRedactionTokens(redactSecrets(seg)))
+            continue;
+        parts[i] = WITHHELD_PATH_SEGMENT_TOKEN;
+        withheld = true;
+    }
+    return { text: withheld ? parts.join("/") : pathname, withheld };
+}
+const ALL_REDACTION_TOKENS_RE = new RegExp(`^(?:${REDACTION_TOKEN_RE_SRC})+$`);
+const isAllRedactionTokens = (text) => ALL_REDACTION_TOKENS_RE.test(text);
+const WITHHELD_PATH_SEGMENT_TOKEN = "«redacted:key»";
+if (!REDACTION_TOKENS.has(WITHHELD_PATH_SEGMENT_TOKEN)) {
+    throw new Error(`redact: ${WITHHELD_PATH_SEGMENT_TOKEN} is no longer produced by the arm tables — the path-segment filler must stay a closed-set member`);
+}
+function shapeLawCredentialInQueryOrFragment(canonical) {
+    const normalized = normalizeForRedaction(canonical);
+    const boundary = normalized.indexOf("?");
+    if (boundary < 0)
+        return false;
+    if (runRedaction(canonical, false, false, false).spans.some((sp) => sp.end > boundary))
+        return true;
+    for (const unit of normalized.slice(boundary + 1).split("&").flatMap((sg) => {
+        const eq = sg.indexOf("=");
+        return eq === -1 ? [sg] : [sg.slice(0, eq), sg.slice(eq + 1)];
+    })) {
+        if (unit === "")
+            continue;
+        const verdict = unitCarriesCredential(unit);
+        if (verdict.hit || verdict.residue)
+            return true;
+        const decoded = decodeToFixedPoint(unit).text;
+        if (decoded.includes("://") || decoded.includes("@"))
+            return true;
+    }
+    return false;
+}
+let displaySafeFailClosedWarned = false;
+export function resetDisplaySafeFailClosedWarnForTest() {
+    displaySafeFailClosedWarned = false;
+}
+export function buildDisplaySafeUrl(raw, positionalLaw = displayUrlOf) {
+    return buildDisplaySafeUrlChecked(raw, positionalLaw).text;
+}
+export function buildDisplaySafeUrlChecked(raw, positionalLaw = displayUrlOf) {
     if (raw === "")
-        return "";
+        return { text: "", failedClosed: false };
     if (!isHierarchicalUrl(raw))
-        return DISPLAY_SAFE_URL_TOKEN;
-    const u = new URL(raw);
-    return redactSecrets(u.href);
+        return { text: DISPLAY_SAFE_URL_TOKEN, failedClosed: false };
+    const parsed = new URL(raw);
+    const safePath = displaySafePathname(parsed.pathname);
+    if (shapeLawCredentialInQueryOrFragment(parsed.href)) {
+        noteDisplaySafeFailClosed("query-and-fragment-withheld");
+        const root = redactSecrets(`${parsed.protocol}//${parsed.host}${safePath.text}`);
+        return { text: `${root}?${WITHHELD_VALUE_TOKEN}`, failedClosed: true };
+    }
+    if (!safePath.withheld)
+        return { text: redactSecrets(positionalLaw(raw)), failedClosed: false };
+    noteDisplaySafeFailClosed("path-segment-withheld");
+    const positional = positionalLaw(raw);
+    const cut = positional.indexOf("?");
+    const root = redactSecrets(`${parsed.protocol}//${parsed.host}${safePath.text}`);
+    return { text: cut < 0 ? root.replace(/\/+$/, "") : `${root}${positional.slice(cut)}`, failedClosed: true };
+}
+export function buildDisplaySafeRefusal(text, sourceUrls) {
+    if (text === "")
+        return text;
+    if (sourceUrls.some((url) => url !== "" && buildDisplaySafeUrlChecked(url).failedClosed)) {
+        noteDisplaySafeFailClosed("refusal-text-withheld");
+        return REFUSAL_WITHHELD_TEXT;
+    }
+    return redactSecrets(text);
+}
+const REFUSAL_WITHHELD_TEXT = "[route refusal text withheld: it quotes a configured URL that carries a credential, and the upstream wording cannot be re-redacted safely once the URL has been rewritten for display. " +
+    "The machine-readable verdict is on the pairing field beside this one; fix the configuration so the credential is not in the URL.]";
+function noteDisplaySafeFailClosed(level) {
+    if (displaySafeFailClosedWarned)
+        return;
+    displaySafeFailClosedWarned = true;
+    process.emitWarning(`display-safe URL composition fell back to fail-closed (${level}): a part of the configured URL was judged to carry a credential that the composition cannot redact at byte granularity, so that whole part is withheld. ` +
+        `The product is safe, but this deployment has an input hitting the composition seam — report it upstream. No original bytes are logged.`, "SemaRedactionFailClosed");
 }
 //# sourceMappingURL=redact.js.map

package/dist/trace/sema-provenance.d.ts

@@ -17,14 +17,15 @@ export declare const SEMA_PROVENANCE_KINDS: readonly ["agent_message"];
  * 有意**不**放行的 lane 词(EXCLUDED,逐词记账;运行期落到「丢整键」臂 —— 与闭集外的未知词同臂,但这里的词是
  * core 词表**内**的、经人裁定不上 wire 的):
  *  · `cross_session_message` —— core fc52b4d4 [ref] §4.1(session-box drain 铸;`from` 是对端**地址**、`peerMeta`
- *    携 typed peer 记录)。[ref] 候:本仓不可达(`RunnerDeps.peerDirectory` 零声明点)+ 注入帧渲染形候 [ref] @server③
- *    表态;与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,接线时三处同翻。
+ *    携 typed peer 记录)。🔴 **7.91.0 订正**:`RunnerDeps.peerDirectory` 座已接线([ref])⇒ 「本仓不可达」那半句作废,
+ *    有席的部署上这个 lane 词真的会被铸出来;仍不放行的理由只剩**注入帧渲染形候 [ref] @server③ 表态**。
+ *    与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,表态之后三处同翻。
  *  · `cross_session_notice` —— core 7.4.0 [ref] §4.4/§5.2(片4;本闭集 2026-09-05 真红出它)。**同一条车道的
  *    第二个载体**,不是新判据:同一个 session-box drain 铸(`agents/peer-session-drain.js` 的 notice 臂),同一个
- *    `RunnerDeps.peerDirectory` 座前提 ⇒ 本仓同样不可达;渲染形与它的载体 `crossSessionNotice`(core-keyset-guard.ts
- *    ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的裁定而不是新增特判:
- *    车道没接线时放行一个 lane 词,等于替 [ref] 预先声明一种 cli 渲染形。[ref] 接线那天三处(本簿、载体键、
- *    ①-nested 的 `peerMeta`)同批翻。
+ *    `RunnerDeps.peerDirectory` 座前提(同样自 7.91.0 起在场);渲染形与它的载体 `crossSessionNotice`
+ *    (core-keyset-guard.ts ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的
+ *    裁定而不是新增特判:表态未出前放行一个 lane 词,等于替它预先声明一种 cli 渲染形。表态落定那天三处(本簿、
+ *    载体键、①-nested 的 `peerMeta`)同批翻。
  */
 export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message", "cross_session_notice"];
 /** 本仓两条腿入参的**形**(不是 core 类型:入参是运行期载荷,`kind` 先当 string 收、经闭集才成 typed)。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.89.0",
+  "version": "7.91.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.23.5",
+    "@sema-agent/core": "7.24.2",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -74,7 +74,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.6.0",
+    "@sema-agent/sdk": "9.10.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",