@sema-agent/server 7.90.0 → 7.91.1

package/dist/plugins/store-contracts.d.ts

@@ -14,7 +14,7 @@
  *  - The TiDB adapters re-export these names for back-compat (the historical import surface), but new
  *    code should import from this file.
  */
-import type { TaskResult, TaskStatus } from "@sema-agent/core";
+import type { PeerSessionTempo, TaskResult, TaskStatus } from "@sema-agent/core";
 /**
  * **File 店族的 boot 期拒启基类**(S-384;把 `RunStoreStrictHydrateError` 的那条论证升成一条族规)。
  *
@@ -240,6 +240,41 @@ export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): bo
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 会话的**活动词**(core `PeerSessionTempo`)——「这条会话现在在忙还是闲」的**唯一**一张表([ref])。
+ *
+ * 🔴 为什么键是 {@link RunStatusClass} 而不是状态词本身:那张状态词表(`RUN_STATUS_CLASS`)已经是这条
+ * 车道上唯一的词表属主,它的双向编译钉(core 加词 / 删词当场红)是本表白拿的。按状态词再写一张表
+ * 等于给同一族词开第二个写者 —— 正是那张表顶注里 `blocked` 长出两个互斥读法的成因。
+ *
+ * 🔴 两处读、一处定义:core 的 peer 目录席(`src/peer-directory.ts` 的 `PeerSessionRecord.tempo`)与
+ * `GET /v1/sessions` 列表行的 `tempo` 列读的是**同一次调用**的结果 —— 同一条会话在两个面上不可能给出
+ * 两个不同的忙闲。
+ *
+ * 🔴 **未知词 / 无读数 ⇒ 词缺席(`undefined`),不是 `idle`**(诚实缺席,不是静默兜底):
+ *  · `lastStatus === ""` 有两个真来源 ——(a)SQL 双生:这条会话**还没有任何 run**;(b)local 文件车道:
+ *    该 lister **结构上说不出** run 状态(`local-session-store.ts:465` 自陈的诚实降级 `lastStatus: ""`)。
+ *    两者都不是「我知道它闲着」,所以都不许铸出 `idle` 这个断言;
+ *  · 读不懂的词(滚动升级里新副本写入的新状态词经裸 cast 读到本进程)同判 —— 与
+ *    {@link isTerminalRunStatus} 族的保守方向一致。
+ *  · **缺席怎么渲染是 core 的辖域,本仓一个字都不复述**(S-514-JU:此处原写着「core 对缺席渲染成 `idle`」
+ *    并抄了当时 `list-agents-tool.js:58` 的旧三元 —— core 7.24.0 [ref] 把那一臂改成了一张 own-key 表 +
+ *    `unknown` 兜底,于是那句复述当天就成了假话,而它在本仓被抄了六处)。本表只负责**铸不铸键**;
+ *    渲染词由**跑真 core 的黑盒**钉住(`test/peer-lane-e2e.test.ts` 的 G1 格),core 哪天再改那张表,
+ *    红的是那一格而不是一句注释。承重的不变量只有一条,且它与渲染词无关:**缺席绝不铸 `dead`** ——
+ *    `liveness` 才是 core 会拿来**整行隐藏**的那一位(7.24.2 dist 的 `list-agents-tool.js:60/62`),而任何 tempo 词
+ *    (含缺席)都照样列出。
+ */
+export declare const SESSION_TEMPO_BY_RUN_CLASS: {
+    readonly live: "active";
+    readonly parked: "blocked";
+    readonly succeeded: "idle";
+    readonly unsuccessful: "idle";
+};
+/** {@link SESSION_TEMPO_BY_RUN_CLASS} 的查表面 —— 入参是**最近一条 run 的状态词**({@link SessionSummary.lastStatus},
+ *  开集 `string`:它来自无约束的 SQL 文本列 / 诚实降级的空串,收成闭集等于在签名上撒谎)。
+ *  返回词缺席 ⇒ 调用方**不铸键**(不是铸 `idle`),理由逐字见上表头注。 */
+export declare function sessionTempoOfRunStatus(lastStatus: string): PeerSessionTempo | undefined;
 /**
  * 「**证得出**这条 run 活在别的副本上」——「他副本」那一句话的**唯一判据**(S-381 收编;S-430 迁居)。
  *

package/dist/plugins/store-contracts.js

@@ -23,6 +23,16 @@ export function isUnsuccessfulRunStatus(status) {
 export function isParkedRunStatus(status) {
     return runStatusClassOf(status) === "parked";
 }
+export const SESSION_TEMPO_BY_RUN_CLASS = {
+    live: "active",
+    parked: "blocked",
+    succeeded: "idle",
+    unsuccessful: "idle",
+};
+export function sessionTempoOfRunStatus(lastStatus) {
+    const cls = runStatusClassOf(lastStatus);
+    return cls === undefined ? undefined : SESSION_TEMPO_BY_RUN_CLASS[cls];
+}
 export function runProvenElsewhere(run, thisInstanceId) {
     return typeof run.instanceId === "string" && run.instanceId.length > 0 && thisInstanceId !== undefined && run.instanceId !== thisInstanceId;
 }

package/dist/rules-consent.d.ts

@@ -1,3 +1,4 @@
+import { type DirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedRule, type RuleBehavior, type RuleCandidate, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
 import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
@@ -155,7 +156,12 @@ export interface LocalImportRuleKey {
  *
  * 🔴 闭集而不是自由文本:客户端要按拒因分流(「这条是你本机的数据坏了」vs「这条规则本身不合法」是
  * 两句不同的话),而自由文本只能被展示、不能被分支。`detail` 才是给人看的那一半。
- */
+ *
+ * 🔴 S-511 起**两条腿共用这一张表**(导入面的逐行预览 + 单步写口的拒):它们判的是同一件事,而判据
+ * 本身就是同一个函数({@link screenLocalImportRow})。给写口另起一张同形的表,就是给同一个问题立第二个
+ * 说话人 —— 漂的表现会是「同一条规则在一条腿上收、在另一条腿上拒」。写口的**方向**判据不在这张表里:
+ * 它在端点上先判、有自己的整句文案,而且判完就把类型收窄掉(`permission-rule-vocab.ts` 的
+ * `DIRECT_RULE_WRITE_ADMITS`)⇒ 放宽态根本到不了本表所服务的那段代码。 */
 export type LocalImportRefusalCode = 
 /** scope 串读不出形(既不是 `global` 也不是 `project:<非空 root>`)。 */
 "scope_unreadable"
@@ -501,6 +507,22 @@ export declare function parseRuleScope(text: string): DurableRuleScope | undefin
 /** 一条规则在 wire 上的行 = 一个逻辑 (rule, scope) 对([ref] v2 §6 F5)。
  *  `adds` **如实上 wire**、不折叠成单值:同一条规则可以被批准过多次(不同 dot、不同来源、不同时刻),
  *  折成「一个 addedAt」会让「这条规则是我导入的还是我点过卡的」在治理面上不可分。 */
+/**
+ * 一条 wire 行与一份身份三元组是不是**同一条规则**。
+ *
+ * 🔴 **三元组,不是 `(rule, scope)` 二元组**(异源复核 [medium],验真后修):core 的 `sameRuleIdentity`
+ * 头注逐字 ——「a comparison that forgot the behavior member would let a delete aimed at an allow take the
+ * same-text deny」。漏掉 behavior 的比较在 wire 上的表现不是「删错行」,是**报错行的死活**:撤一条从来
+ * 没有过的 `allow` 会因为看见同文本的兄弟 `deny` 而答 `stillLive: true`,那句话说的是另一条规则。
+ *
+ * 凡「这份清单里有没有这条规则」一律走这一只(撤销口的存活回读 / 单步写口的写前问与写后读回)——
+ * 同一个问题有两个说话人,迟早会给两个答案。
+ */
+export declare function sameWireRuleIdentity(row: PersistedRuleWireRow, identity: {
+    behavior: RuleBehavior;
+    rule: string;
+    scope: string;
+}): boolean;
 export interface PersistedRuleWireRow {
     /** core 7.9.0([ref])—— 这一行是哪一态的规则(`deny` / `ask` / `allow`)。**身份的一格**:
      *  规则的身份是 (behavior, text, scope) 三元组,同文本不同态是两条不同的行(core `sameRuleIdentity`),
@@ -557,6 +579,37 @@ export interface PersistedRuleListing {
  * 不可分。判别式联合是唯一诚实的形。
  */
 export type RuleBucketRef = string | RuleOwner;
+/**
+ * S-511 —— 单步写的结果(闭集三臂)。
+ *
+ * 🔴 三臂**刻意不塌成布尔**:「落了」「早就有了」「不知道落没落」对调用方是三种不同的处置,而把第三种
+ * 折进前两种里的任一边都是编一个结论(猜"成了"会谎报一次没发生的写,猜"没成"会让人以为可以重来)。
+ * 与导入面的成员级四态({@link LocalImportMemberOutcome})同一条纪律,词更少是因为本口只有一行。
+ */
+export type RuleWritten = 
+/** `persisted` = 这一次**真的往店里写了**;`no-op` = 这条身份**此前就站在店里**,本次调用**一个字都没写**
+ *  (幂等重写)。两支都带 `row` —— 它是**从店里读出来的**那一行,不是我方按入参拼出来的回声。
+ *
+ *  🔴 两个词的判别位是「**这次调用有没有写**」,不是 core 的 `deduped`(codex 对抗复审 F1,验真后修)。
+ *  core 的 `deduped` 只说「等价规则此前已站」,它**仍然落了一枚新的 dot**(契约逐字:`deduped` counts
+ *  as LANDED;亲读 dist 的成员循环:`res.dot` 无条件进 members)。把它当 `no-op` 上 wire 是一句假话:
+ *  一个照常重试的客户端会让 `adds` 台账无界增长、桶的 rev 逐次推进(在翻页的治理面全体重列)。 */
+{
+    status: "persisted" | "no-op";
+    rev: number;
+    row: PersistedRuleWireRow;
+}
+/** 裁定性不收(内容判据 / 方向判据)。`detail` 是给人看的那一半,`reason` 是给客户端分流的那一半。 */
+ | {
+    status: "rejected";
+    reason: LocalImportRefusalCode;
+    detail: string;
+}
+/** **不知道落没落**:店在这一条上出了状况。如实编,禁猜(端点侧 503 + 指路 `GET /v1/rules` 对账)。 */
+ | {
+    status: "indeterminate";
+    detail: string;
+};
 export interface RuleConsentLane {
     /** 卡道兑付口:一次 ask 决议携规则确认 ⇒ prepare→confirm→redeem 一气呵成。 */
     persistCardRule(input: {
@@ -608,6 +661,26 @@ export interface RuleConsentLane {
         rule: string;
         scope: RuleScope;
     }): Promise<RemoveResult>;
+    /**
+     * S-511 撤销面写半场的**对偶** —— 一条**收紧**规则(deny/ask)的单步写入,无同意仪式往返。
+     *
+     * 它为什么可以没有仪式,与 `removeRule` 为什么可以没有仪式是**同一条理由**(core
+     * `removePersistedRule` 头注逐字:「a host may narrow on a user's behalf, it may not widen」)。放宽
+     * 方向在类型上就到不了这里:`behavior` 收窄成 {@link DirectWritableRuleBehavior}。
+     *
+     * 🔴 **一行都不自造**:行的 tool/match/command 三格是规则文本的**派生事实**,由 core 的
+     * `parseRuleText` 铸;落店走的是导入面那条**同一条**兑付腿(逐行判据 → core 的记录铸造口 → confirm
+     * → 批兑付),于是本口与导入口对「一条规则能不能进店」永远给同一个答案。
+     *
+     * `principal` 是裸串(与 prepare/redeem 两腿同形);local-owner 桶**不在本口**上 —— 那只桶没有
+     * 「谁在写」这个主体,而本口的授权基础就是已验明的 principal。
+     */
+    writeRule(input: {
+        principal: string;
+        behavior: DirectWritableRuleBehavior;
+        rule: string;
+        scope: DurableRuleScope;
+    }): Promise<RuleWritten>;
 }
 export declare function createRuleConsentLane(stores: RuleConsentStores, opts?: {
     ticketTtlMs?: number;

package/dist/rules-consent.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
 import { MAX_CWD_CHARS } from "./task-cwd.js";
+import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
 import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
@@ -59,6 +60,9 @@ export function parseRuleScope(text) {
     const root = text.slice("project:".length);
     return root === "" ? undefined : { kind: "project", root };
 }
+export function sameWireRuleIdentity(row, identity) {
+    return row.behavior === identity.behavior && row.rule === identity.rule && row.scope === identity.scope;
+}
 function storeForBucket(provider, ref) {
     if (typeof ref === "string")
         return provider.forPrincipal(ref);
@@ -256,7 +260,7 @@ export function createRuleConsentLane(stores, opts) {
     const monotonic = opts?.monotonic ?? (() => performance.now());
     const sleep = opts?.sleep ?? (async (ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const localImportLogger = createLogger();
-    return {
+    const lane = {
         async persistCardRule(input) {
             let prepared;
             try {
@@ -710,6 +714,82 @@ export function createRuleConsentLane(stores, opts) {
         async removeRule(input) {
             return await removePersistedRule({ behavior: input.behavior, rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });
         },
+        async writeRule(input) {
+            const written = parseRuleText(input.rule, input.behavior);
+            if ("reject" in written)
+                return { status: "rejected", reason: "rule_rejected", detail: `${written.reject.code}: ${written.reject.message}` };
+            if (input.rule !== written.rule.rule) {
+                return {
+                    status: "rejected",
+                    reason: "rule_rejected",
+                    detail: `this rule text is not the spelling the store would hold: send ${JSON.stringify(written.rule.rule)} instead ` +
+                        `— a rule written under one spelling and held under another cannot be listed or revoked by the bytes you sent`,
+                };
+            }
+            const row = {
+                behavior: input.behavior,
+                rule: input.rule,
+                scope: serializeRuleScope(input.scope),
+                tool: written.rule.tool,
+                match: written.rule.match,
+                command: written.rule.command,
+                adds: [],
+            };
+            const rowOf = (rows) => rows.find((r) => sameWireRuleIdentity(r, { behavior: input.behavior, rule: written.rule.rule, scope: row.scope }));
+            const before = await lane.listRules(input.principal);
+            const standing = rowOf(before.rows);
+            if (standing !== undefined)
+                return { status: "no-op", rev: before.rev, row: standing };
+            const prepared = await lane.prepareLocalImport(input.principal, [row]);
+            if (!prepared.ok) {
+                throw new Error(`a single-rule write hit the batch ceiling (${prepared.reason}) — the write door and the batch caps are out of step`);
+            }
+            if (prepared.ticket === undefined) {
+                const member = prepared.preview.members[0];
+                if (member === undefined || member.admitted) {
+                    throw new Error("the rule screening reported neither an admitted row nor a refusal for this write — refusing to guess which of the two happened");
+                }
+                return { status: "rejected", reason: member.reason, detail: member.detail };
+            }
+            const redeemed = await lane.redeemLocalImport(input.principal, prepared.ticket);
+            if (!redeemed.ok) {
+                localImportLogger.warn("direct_rule_write_ticket_refused", {
+                    reason: redeemed.reason,
+                    detail: redeemed.detail,
+                    note: "a self-minted, immediately redeemed ticket was refused — the outcome of this write is not known",
+                });
+                return { status: "indeterminate", detail: `${redeemed.reason}: ${redeemed.detail}` };
+            }
+            const member = redeemed.outcome.members[0];
+            if (member === undefined) {
+                throw new Error("the redemption of a single-rule write came back with no member — refusing to report an outcome nobody computed");
+            }
+            switch (member.outcome) {
+                case "persisted":
+                    break;
+                case "no-op":
+                    break;
+                case "indeterminate":
+                    return { status: "indeterminate", detail: member.detail ?? member.reason ?? "the store did not say whether this rule landed" };
+                case "refused":
+                    return { status: "indeterminate", detail: member.detail ?? "the store refused this rule without a machine-readable reason" };
+                default: {
+                    const unknown = member.outcome;
+                    throw new Error(`unknown single-rule write outcome: ${JSON.stringify(unknown)}`);
+                }
+            }
+            const landed = rowOf((await lane.listRules(input.principal)).rows);
+            if (landed === undefined) {
+                localImportLogger.warn("direct_rule_write_vanished_before_read_back", {
+                    behavior: input.behavior,
+                    scope: row.scope,
+                    note: "the store reported this rule as landed, and it was already gone when the row was read back — a revocation landed in between",
+                });
+                return { status: "indeterminate", detail: "this rule landed and was already gone when it was read back — a revocation landed in between" };
+            }
+            return { status: "persisted", rev: redeemed.outcome.rev, row: landed };
+        },
     };
+    return lane;
 }
 //# sourceMappingURL=rules-consent.js.map

package/dist/trace/redact.js

@@ -2,7 +2,11 @@ import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
-const atLeast = (cls, min) => `${cls}{${min}}${cls}*`;
+const ARM_VALUE_CLASSES = [];
+const atLeast = (cls, min) => {
+    ARM_VALUE_CLASSES.push(cls);
+    return `${cls}{${min}}${cls}*`;
+};
 const ENTROPY_SCAN_MAX = 96;
 const twoStrongAhead = (valueClass) => String.raw `(?=${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z]${valueClass}{0,${ENTROPY_SCAN_MAX}}[0-9A-Z])`;
 const IDENT_CONNECTORS = "[_./-]";
@@ -1736,12 +1740,90 @@ export function isHierarchicalUrl(raw) {
     const u = new URL(raw);
     return u.href.startsWith(`${u.protocol}//`);
 }
+function decodeToFixedPoint(s, maxRounds = 3) {
+    let cur = s;
+    for (let round = 0; round < maxRounds; round += 1) {
+        if (!cur.includes("%"))
+            return { text: cur, residue: false };
+        const next = cur.replace(/%([0-9A-Fa-f]{2})/g, (_whole, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+        if (next === cur)
+            break;
+        cur = next;
+    }
+    return { text: cur, residue: cur.includes("%") };
+}
+const VIEW_FILLER_PREFERENCE = ["a", "z", "_", "-", "0"];
+let armValueClassViewsCache;
+function armValueClassViews() {
+    armValueClassViewsCache ??= [...new Set(ARM_VALUE_CLASSES)].map((cls) => {
+        const inClass = new RegExp(`^(?:${cls})$`, "u");
+        const filler = VIEW_FILLER_PREFERENCE.find((c) => inClass.test(c));
+        if (filler === undefined)
+            throw new Error(`redact: arm value class ${cls} admits none of the view fillers — add one that it accepts`);
+        return { inClass, filler };
+    });
+    return armValueClassViewsCache;
+}
+function boundedUnitView(unit, inClass, filler) {
+    let out = "";
+    for (const ch of unit)
+        out += inClass.test(ch) ? ch : filler;
+    return out;
+}
+function unitCarriesCredential(unit) {
+    const decoded = decodeToFixedPoint(unit);
+    const views = new Set();
+    for (const spelling of [unit, decoded.text])
+        for (const v of armValueClassViews())
+            views.add(boundedUnitView(spelling, v.inClass, v.filler));
+    views.delete("");
+    const hit = [...views].some((view) => redactSecrets(view) !== view);
+    return { hit, residue: decoded.residue };
+}
+function displaySafePathname(pathname) {
+    const parts = pathname.split("/");
+    let withheld = false;
+    for (let i = 0; i < parts.length; i += 1) {
+        const seg = parts[i];
+        if (seg === "")
+            continue;
+        const verdict = unitCarriesCredential(seg);
+        if (!verdict.hit && !verdict.residue)
+            continue;
+        if (isAllRedactionTokens(redactSecrets(seg)))
+            continue;
+        parts[i] = WITHHELD_PATH_SEGMENT_TOKEN;
+        withheld = true;
+    }
+    return { text: withheld ? parts.join("/") : pathname, withheld };
+}
+const ALL_REDACTION_TOKENS_RE = new RegExp(`^(?:${REDACTION_TOKEN_RE_SRC})+$`);
+const isAllRedactionTokens = (text) => ALL_REDACTION_TOKENS_RE.test(text);
+const WITHHELD_PATH_SEGMENT_TOKEN = "«redacted:key»";
+if (!REDACTION_TOKENS.has(WITHHELD_PATH_SEGMENT_TOKEN)) {
+    throw new Error(`redact: ${WITHHELD_PATH_SEGMENT_TOKEN} is no longer produced by the arm tables — the path-segment filler must stay a closed-set member`);
+}
 function shapeLawCredentialInQueryOrFragment(canonical) {
     const normalized = normalizeForRedaction(canonical);
     const boundary = normalized.indexOf("?");
     if (boundary < 0)
         return false;
-    return runRedaction(canonical, false, false, false).spans.some((sp) => sp.end > boundary);
+    if (runRedaction(canonical, false, false, false).spans.some((sp) => sp.end > boundary))
+        return true;
+    for (const unit of normalized.slice(boundary + 1).split("&").flatMap((sg) => {
+        const eq = sg.indexOf("=");
+        return eq === -1 ? [sg] : [sg.slice(0, eq), sg.slice(eq + 1)];
+    })) {
+        if (unit === "")
+            continue;
+        const verdict = unitCarriesCredential(unit);
+        if (verdict.hit || verdict.residue)
+            return true;
+        const decoded = decodeToFixedPoint(unit).text;
+        if (decoded.includes("://") || decoded.includes("@"))
+            return true;
+    }
+    return false;
 }
 let displaySafeFailClosedWarned = false;
 export function resetDisplaySafeFailClosedWarnForTest() {
@@ -1756,12 +1838,19 @@ export function buildDisplaySafeUrlChecked(raw, positionalLaw = displayUrlOf) {
     if (!isHierarchicalUrl(raw))
         return { text: DISPLAY_SAFE_URL_TOKEN, failedClosed: false };
     const parsed = new URL(raw);
+    const safePath = displaySafePathname(parsed.pathname);
     if (shapeLawCredentialInQueryOrFragment(parsed.href)) {
         noteDisplaySafeFailClosed("query-and-fragment-withheld");
-        const root = redactSecrets(`${parsed.protocol}//${parsed.host}${parsed.pathname}`).replace(/\/+$/, "");
+        const root = redactSecrets(`${parsed.protocol}//${parsed.host}${safePath.text}`);
         return { text: `${root}?${WITHHELD_VALUE_TOKEN}`, failedClosed: true };
     }
-    return { text: redactSecrets(positionalLaw(raw)), failedClosed: false };
+    if (!safePath.withheld)
+        return { text: redactSecrets(positionalLaw(raw)), failedClosed: false };
+    noteDisplaySafeFailClosed("path-segment-withheld");
+    const positional = positionalLaw(raw);
+    const cut = positional.indexOf("?");
+    const root = redactSecrets(`${parsed.protocol}//${parsed.host}${safePath.text}`);
+    return { text: cut < 0 ? root.replace(/\/+$/, "") : `${root}${positional.slice(cut)}`, failedClosed: true };
 }
 export function buildDisplaySafeRefusal(text, sourceUrls) {
     if (text === "")
@@ -1778,7 +1867,7 @@ function noteDisplaySafeFailClosed(level) {
     if (displaySafeFailClosedWarned)
         return;
     displaySafeFailClosedWarned = true;
-    process.emitWarning(`display-safe URL composition fell back to fail-closed (${level}): the positional law reshaped the input so that a fragment the shape law had judged a credential survived into the product. ` +
-        `The product is safe (the offending part is withheld), but this deployment has an input hitting the composition seam — report it upstream. No original bytes are logged.`, "SemaRedactionFailClosed");
+    process.emitWarning(`display-safe URL composition fell back to fail-closed (${level}): a part of the configured URL was judged to carry a credential that the composition cannot redact at byte granularity, so that whole part is withheld. ` +
+        `The product is safe, but this deployment has an input hitting the composition seam — report it upstream. No original bytes are logged.`, "SemaRedactionFailClosed");
 }
 //# sourceMappingURL=redact.js.map

package/dist/trace/sema-provenance.d.ts

@@ -17,14 +17,15 @@ export declare const SEMA_PROVENANCE_KINDS: readonly ["agent_message"];
  * 有意**不**放行的 lane 词(EXCLUDED,逐词记账;运行期落到「丢整键」臂 —— 与闭集外的未知词同臂,但这里的词是
  * core 词表**内**的、经人裁定不上 wire 的):
  *  · `cross_session_message` —— core fc52b4d4 [ref] §4.1(session-box drain 铸;`from` 是对端**地址**、`peerMeta`
- *    携 typed peer 记录)。[ref] 候:本仓不可达(`RunnerDeps.peerDirectory` 零声明点)+ 注入帧渲染形候 [ref] @server③
- *    表态;与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,接线时三处同翻。
+ *    携 typed peer 记录)。🔴 **7.91.0 订正**:`RunnerDeps.peerDirectory` 座已接线([ref])⇒ 「本仓不可达」那半句作废,
+ *    有席的部署上这个 lane 词真的会被铸出来;仍不放行的理由只剩**注入帧渲染形候 [ref] @server③ 表态**。
+ *    与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,表态之后三处同翻。
  *  · `cross_session_notice` —— core 7.4.0 [ref] §4.4/§5.2(片4;本闭集 2026-09-05 真红出它)。**同一条车道的
  *    第二个载体**,不是新判据:同一个 session-box drain 铸(`agents/peer-session-drain.js` 的 notice 臂),同一个
- *    `RunnerDeps.peerDirectory` 座前提 ⇒ 本仓同样不可达;渲染形与它的载体 `crossSessionNotice`(core-keyset-guard.ts
- *    ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的裁定而不是新增特判:
- *    车道没接线时放行一个 lane 词,等于替 [ref] 预先声明一种 cli 渲染形。[ref] 接线那天三处(本簿、载体键、
- *    ①-nested 的 `peerMeta`)同批翻。
+ *    `RunnerDeps.peerDirectory` 座前提(同样自 7.91.0 起在场);渲染形与它的载体 `crossSessionNotice`
+ *    (core-keyset-guard.ts ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的
+ *    裁定而不是新增特判:表态未出前放行一个 lane 词,等于替它预先声明一种 cli 渲染形。表态落定那天三处(本簿、
+ *    载体键、①-nested 的 `peerMeta`)同批翻。
  */
 export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message", "cross_session_notice"];
 /** 本仓两条腿入参的**形**(不是 core 类型:入参是运行期载荷,`kind` 先当 string 收、经闭集才成 typed)。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.90.0",
+  "version": "7.91.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -74,7 +74,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.6.0",
+    "@sema-agent/sdk": "9.10.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",