@sema-agent/server 7.91.1 → 7.92.0

package/dist/session-policy-wire.js

@@ -63,4 +63,15 @@ export function describeSessionRulesRecordProblem(p) {
         }
     }
 }
+export function sessionPolicyErrorHttp(code) {
+    switch (code) {
+        case "conflict": return { status: 409, errorCode: "conflict" };
+        case "loosen_forbidden": return { status: 403, errorCode: "loosen_forbidden" };
+        case "corrupt": return { status: 500, errorCode: "corrupt" };
+        default: {
+            const unhandled = code;
+            throw new Error(`unhandled SessionPolicyError code: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 //# sourceMappingURL=session-policy-wire.js.map

package/dist/spec-fields.d.ts

@@ -65,15 +65,15 @@ export declare function taskAgentsFromBody(raw: unknown, requirePrincipal: boole
 /** [ref]②/[ref](cli 认领消费)—— fresh-submit 的 agents[].model **目录成员资格**门(形状门
  *  {@link validateTaskAgents} 通过之后跑;调用方铸 400 `request.unknown_reference` + `available` 枚举)。
  *  病灶=报错太晚太远:server 持目录却不查,错到 core prepare 才炸 `config.agent.unknown_model`
- *  (dist/agents/subagent.js:1258),以「run failed」形出现而非 400;cli resolver 只挡词法形,目录
+ *  (dist/agents/subagent.js),以「run failed」形出现而非 400;cli resolver 只挡词法形,目录
  *  成员资格只有 server 持有。
  *  三条判定纪律(全部 core dist 亲读):
- *   - **只查 string 形**:core 只对 `typeof a.model === "string"` 走 `resolveModel`(subagent.js:1253);
+ *   - **只查 string 形**:core 只对 `typeof a.model === "string"` 走 `resolveModel`(subagent.js);
  *     Model 对象形 core 原样信任不查目录([ref]④ 契约:自带完整 Model 配置,其 id 本就不必在目录)——
  *     对象形没有「晚失败」病灶,这里同拒会是射程外的行为收紧,不做。
  *   - **`catalog` 必须是 tier 展开形**(调用方传 `expandTiers(config.models, config.tiers) ?? config.models`,
  *     resolve-spec.ts wireCatalog 同源纪律):core Runner 构造期把 deps.models 换成展开目录
- *     (runtask.js:1472),agentCatalog.models 即它 —— 裸 config.models 会把合法档位词/CC 别名误杀 400。
+ *     (runtask.js),agentCatalog.models 即它 —— 裸 config.models 会把合法档位词/CC 别名误杀 400。
  *   - **判定=`Object.hasOwn` 纯键查**,刻意不用 `matchCatalogModel`:那是 body.model 门的四形判
  *     (name/tier/alias/**id**),而 core 的 `resolveModel` 是纯键查(roles.js:`models?.[ref]`)——
  *     多认 id 形会放行一个 core prepare 必炸的值(门假绿,病灶照旧)。hasOwn 顺带挡原型链键。
@@ -111,7 +111,7 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
  *  ⚠️ **这不是一条 defer 注**([ref] 件⑤ 对表结论,core [ref] 同判):本段说的是 `promptProfile` 这根
  *  **呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提 deferTools 只是在借它
  *  的「无租户门」姿势作类比。「引擎缺省 simple」这句本身在 core 5.40.0 上仍逐字为真
- *  (`core/types.d.ts:133`:default "simple"),本批亲验未变。
+ *  (`core/types.d.ts`:default "simple"),本批亲验未变。
  *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建;7.15.0 起它不再是第二道门,
  *  只是把候选集拓宽后走同一道阈值门)记在
  *  `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。

package/dist/task-cwd.d.ts

@@ -35,7 +35,7 @@ export declare function normalizeAbsolutePathLexically(p: string): string;
  * **词法**判域:`dir` 是不是 `target` 本身或它的祖先(= `target` ⊆ `dir`,「等于 ∪ 后代」)。
  *
  * 这是 core `assertExemptDirsDoNotCoverRoot` 那条律的本仓同形(亲读安装树
- * `dist/core/fs-write-gate-policy.js:11-28` → `swallowedFenceRoot` → `isWithin(root, p)`:
+ * `dist/core/fs-write-gate-policy.js` → `swallowedFenceRoot` → `isWithin(root, p)`:
  * 先各自词法归一,再判 `p === root` 或 `p` 以 `root + "/"` 起头)。**两端都只做词法**,不 realpath ——
  * 写门的构造期本来就没有 I/O(core 同理),承诺 canonical 是承诺一件此刻做不到的事。
  *

package/dist/task-settings.d.ts

@@ -396,8 +396,8 @@ export interface FsWriteGateWiring {
      * `boot/resolve-spec.ts` / `boot/parked-revive-gate.ts` 把**同一个值**递成本字段。两处同源是承重的:
      * 各算一份就会出现「422 门放行而引擎判 unreadable」或反过来。
      *
-     * 🔴 **S-213⑦ 改真话**(亲读 core 7.12.0 `dist/core/permission-rule-model.js:365-372` /
-     * `:340-350`,推翻本注此前的两句):
+     * 🔴 **S-213⑦ 改真话**(亲读 core 7.12.0 `dist/core/permission-rule-model.js` /
+     * 的 `resolvePathPattern`,推翻本注此前的两句):
      *  · core 对缺席的 `home` **不**回落 `os.homedir()` —— `resolvePathPattern` 走
      *    `lexicalNormalAbsolutePathOf(baseValueOf("home", bases) ?? "")`,base 缺席 ⇒ `undefined` ⇒ 直接回
      *    `{missingBase:"home"}`,该调用的射程判 `unreadable`(fail-closed 的 ask,人来清),从不猜一个目录。

package/dist/tool-approval.d.ts

@@ -653,7 +653,7 @@ export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput
  *
  * 三源(§8.3)里本仓可执行的是后两源;第一源 `forceDurableGate` 在 HTTP 装配时刻不可解析(§14 §12-5
  * 亲裁:不可读则该源不做,core 自身的 `runtimeCaps?.forceDurableGate` 消费臂结构性兜底——7.0.1
- * `prepare-task.js` 的 durableMandate/contentMandate(:1415/:1417)与 durableQuestionFace(:2136)等),
+ * `prepare-task.js` 的 durableMandate/contentMandate 与 durableQuestionFace 等),
  * 故不在本函数内。
  *
  * 🔴 **[ref](半接线旋钮族)**:`windowZero` 的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在

package/dist/trace/core-keyset-guard.d.ts

@@ -36,7 +36,7 @@ type _GuardProvenanceReverse = AssertAllKeysHandled<Exclude<ProvenanceProjected
 type AgentMessageProjected = "from" | "body";
 type _GuardAgentMessage = AssertAllKeysHandled<Exclude<keyof NonNullable<TaskNotificationPayload["agentMessage"]>, AgentMessageProjected>>;
 type _GuardAgentMessageReverse = AssertAllKeysHandled<Exclude<AgentMessageProjected, keyof NonNullable<TaskNotificationPayload["agentMessage"]>>>;
-type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
+type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId" | "spawnName";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNotifExcluded, keyof BackgroundChildEvent>>;
@@ -94,9 +94,13 @@ type _GuardWiringFleet = AssertAllKeysHandled<Exclude<keyof WiringSection<"fleet
 type _GuardWiringFleetReverse = AssertAllKeysHandled<Exclude<WiringFleetHandled, keyof WiringSection<"fleet">>>;
 type WiringMcpEntry = WiringSection<"mcp">[number];
 type WiringMcpExcluded = "error";
-type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | WiringMcpExcluded;
+type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | "liveness" | WiringMcpExcluded;
 type _GuardWiringMcp = AssertAllKeysHandled<Exclude<keyof WiringMcpEntry, WiringMcpHandled>>;
 type _GuardWiringMcpReverse = AssertAllKeysHandled<Exclude<WiringMcpHandled, keyof WiringMcpEntry>>;
+type WiringMcpLiveness = NonNullable<WiringMcpEntry["liveness"]>;
+type WiringMcpLivenessHandled = "state" | "observedAt" | "errorCode";
+type _GuardWiringMcpLiveness = AssertAllKeysHandled<Exclude<keyof WiringMcpLiveness, WiringMcpLivenessHandled>>;
+type _GuardWiringMcpLivenessReverse = AssertAllKeysHandled<Exclude<WiringMcpLivenessHandled, keyof WiringMcpLiveness>>;
 type WiringRulesHandled = "storeWired" | "syncWired" | "orgGoverned";
 type _GuardWiringRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"permissionRules">, WiringRulesHandled>>;
 type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled, keyof WiringSection<"permissionRules">>>;
@@ -180,12 +184,12 @@ type _GuardMcpReconnect = AssertAllKeysHandled<Exclude<keyof McpReconnectResult,
 type _NoDoubleBookMcpReconnect = AssertAllKeysHandled<Extract<McpReconnectProjected, McpReconnectWithheld>>;
 type _GuardMcpReconnectReverse = AssertAllKeysHandled<Exclude<McpReconnectProjected | McpReconnectWithheld, keyof McpReconnectResult>>;
 type McpRedialStatusProjected = "name" | "status" | "errorCode" | "httpStatus" | "delivered" | "serverInfo" | "error" | "transportClosed";
-type McpRedialStatusWithheld = "toolNames";
+type McpRedialStatusWithheld = "toolNames" | "liveness";
 type _GuardMcpRedialStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpRedialStatusProjected | McpRedialStatusWithheld>>;
 type _NoDoubleBookMcpRedialStatus = AssertAllKeysHandled<Extract<McpRedialStatusProjected, McpRedialStatusWithheld>>;
 type _GuardMcpRedialStatusReverse = AssertAllKeysHandled<Exclude<McpRedialStatusProjected | McpRedialStatusWithheld, keyof McpServerStatus>>;
 type McpPanelStatusProjected = "name" | "status" | "serverInfo" | "toolNames" | "error";
-type McpPanelStatusWithheld = "errorCode" | "httpStatus" | "delivered" | "transportClosed";
+type McpPanelStatusWithheld = "errorCode" | "httpStatus" | "delivered" | "transportClosed" | "liveness";
 type _GuardMcpPanelStatus = AssertAllKeysHandled<Exclude<keyof McpServerStatus, McpPanelStatusProjected | McpPanelStatusWithheld>>;
 type _NoDoubleBookMcpPanelStatus = AssertAllKeysHandled<Extract<McpPanelStatusProjected, McpPanelStatusWithheld>>;
 type _GuardMcpPanelStatusReverse = AssertAllKeysHandled<Exclude<McpPanelStatusProjected | McpPanelStatusWithheld, keyof McpServerStatus>>;
@@ -288,7 +292,9 @@ export type CoreKeysetGuards = [
     _NoDoubleBookMcpPanelStatus,
     _GuardMcpPanelStatusReverse,
     _GuardMcpListingIncomplete,
-    _GuardMcpListingIncompleteReverse
+    _GuardMcpListingIncompleteReverse,
+    _GuardWiringMcpLiveness,
+    _GuardWiringMcpLivenessReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/project.d.ts

@@ -331,7 +331,9 @@ export declare function toolDisclosureEventData(ev: {
 /** The `task_progress` payload (a subagent's live progress tick) — EXPLICIT WHITELIST shared by all
  *  three legs (bg runs.ts + resume append + the sync live SSE frame): taskId/parent linkage/token rollup verbatim,
  *  `name` UNTRUSTED (core sanitizes for rendering, does NOT secret-redact — a taskName can be secret-shaped) →
- *  `redactSecrets`. Never the delegated objective/args. E2 identity rides (eventId/
+ *  `redactSecrets`; `spawnName` is the TRUSTED-chain teammate KEY beside it (core 7.25.0 [ref] S0 — validated at the
+ *  spawn, so it is an identity, not a label) and rides VERBATIM: redacting an identity key does not make it safe,
+ *  it makes it WRONG (two legal names collapsing onto one value — see the key's own note). Never the delegated objective/args. E2 identity rides (eventId/
  *  parentToolCallId are core-mint uuidv7 identifiers, not content — consumers bind concurrent subagent ticks
  *  exactly by them; the 1.72 whitelist dropped them, leaving a FIFO heuristic). */
 export declare function taskProgressEventData(ev: {
@@ -339,6 +341,7 @@ export declare function taskProgressEventData(ev: {
     taskType?: string;
     parentTaskId?: string;
     name?: string;
+    spawnName?: string;
     status?: string;
     usage?: unknown;
     currentAction?: string;
@@ -585,6 +588,22 @@ export declare function workspaceChangedEventData(ev: {
  *       (「connection state is a fact about this leg's attempt, not about the assembly」)。
  *    ⚠️ 空数组 ≠ 缺席:core 顶注逐字「an empty array is "this leg declared no servers", absence is an older
  *       mint or an external derivation」⇒ 空数组照铸,别折成缺席。
+ *    🔴 **⑤ `liveness`(core 7.24.3 [ref] / S-402 提货件)—— 裁:租户可见,整条记录投,逐键挑**。
+ *       `{state, observedAt, errorCode?}` = 引擎**最后一次观察**到的「这台还够得着吗」。受众判据与同行
+ *       其余键**同一条**(同主体同受众、引擎派生的闭形值、非 governance 侧信道 —— 它同样不进
+ *       `configFingerprint`),所以这一格不需要新的裁定,只需要新的**读法**。
+ *       🔴 **契约一行(client-core CC-36 的那句话):活性位独立于名册申报与 re-dial 结果。**
+ *       `status` 是拨号那一刻的判决且 core **有意冻结**(服务器中途死了仍读 `connected`);re-dial 回执的
+ *       `outcome` 是一次动作的判词;这一格是连接层最后学到的事,自带时戳。三者**合法地可以不一致** ——
+ *       `status:"failed"` 与 `liveness.state:"reachable"` 同行是真行(服务器答了握手、答的是协议错:
+ *       活着,且配错了)。⇒ 本仓**不合并、不互相校验、不据一个推另一个**(与 ① 里「两条 MCP 读面同名
+ *       不同源、合并只会造出『哪个才算数』」逐字同源)。
+ *       ⚠️ **缺席是第四读数,不是一个词**:core 顶注逐字「a consumer must not fold absence into
+ *       `unknown`」——`unknown` 是**更强**的断言(引擎看了、看不出来)。
+ *       🔴 **但本仓出口上的「缺席」比 core 源端的更宽**(codex r1 [medium] 采纳):core 那边是
+ *       压根没有观察(`skipped` 的行没走到 transport / `invalid_config` 的声明从没被拨过 / 老 mint),
+ *       而经过本投影后**判形没过也落缺席**(词出闭集 / `observedAt` 非有限数 / 整只不是对象)。
+ *       ⇒ 对消费端,缺席只能读成「**没有可用的观察记录**」,**不许**据它反推这条腿拨没拨过号。
  *  · `writeProtection`(`{ targetView: "spelling-only" | "target" }`;core 7.20.1 [ref] / clay [ref] 丙,
  *    S-361 提货件)—— **裁:租户可见,逐字透传**。它是 per-leg 的读面:「这条腿的写保护判官,拿到的是
  *    哪一种目标读法」——`"target"` = 判官握着执行环境,拼法没命中时会在**解析后的真目标**上再判一次;
@@ -699,6 +718,27 @@ export declare function wiringManifestOperatorEventData(ev: {
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): Record<string, unknown>;
+/**
+ * `wiring_manifest` 的**唯一分叉点**(S-528)—— 两条知道调用方身份的 live 消费腿共用它:
+ * `/v1/tasks/stream` 的 SSE 帧,与 `POST /v1/tasks`(非流式)200 体里的 `wiringManifest` 起手回执。
+ *
+ * 🔴 **为什么是一只函数,而不是两处 `cond ? operator : tenant`**:那个三元判的是「这份产物给谁看」——
+ * 一件治理面的事([ref] 件一)。写两份就有漂的位置:core 往 operator 面加第 N 段时,跟上的那一处与没跟上
+ * 的那一处会让**同一次提交**在两条腿上投出两种宽度,而错的方向是把 operator-only 面发给租户。两条腿从此
+ * 只认这一只,新的第三条腿照抄它即可(禁再写一次三元)。
+ *
+ * 判据本身(`explicitOperatorOk`)仍由调用腿**每请求求一次**再传进来:身份解析要读请求凭据与部署名单,
+ * 那是 http 层的事,本文件(投影层)不认识 `req`,也不该认识。
+ *
+ * `operatorFace` 的两个值都是**正面事实**,没有第三态(所以是 boolean 不是三值):
+ *  · `true`  = 本请求的调用方经 `explicitOperatorOk` 判为 operator ⇒ 投 {@link wiringManifestOperatorEventData};
+ *  · `false` = 其余全部(**含**「本部署根本没配 operator 名单」)⇒ 投 {@link wiringManifestEventData} 的租户形。
+ */
+export declare function wiringManifestFaceEventData(ev: {
+    manifest?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}, operatorFace: boolean): Record<string, unknown>;
 /**
  * `human_input`(core 5.14.0 [ref] 新 `TaskEvent` 臂)—— 「谁把什么喂进了这条 run」的生命周期账本
  * 帧(objective / 实时 steer / nextTurn / parked-steer 续跑 / wake 五个载体共用一个投影点)。

package/dist/trace/project.js

@@ -1,5 +1,5 @@
 import { redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
-import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -273,6 +273,7 @@ export function taskProgressEventData(ev) {
         ...(typeof ev.taskType === "string" && ev.taskType.length > 0 ? { taskType: ev.taskType } : {}),
         ...(ev.parentTaskId ? { parentTaskId: ev.parentTaskId } : {}),
         ...(ev.name ? { name: redactSecrets(ev.name) } : {}),
+        ...(ev.spawnName ? { spawnName: ev.spawnName } : {}),
         ...(typeof ev.model === "string" && ev.model.length > 0 ? { model: ev.model } : {}),
         ...(ev.status !== undefined ? { status: ev.status } : {}),
         ...(ev.usage ? { usage: ev.usage } : {}),
@@ -507,6 +508,17 @@ export function wiringManifestEventData(ev) {
             const status = str(e.status);
             if (name === undefined || status === undefined)
                 continue;
+            const liveness = (() => {
+                const rec = sec(e.liveness);
+                if (rec === undefined)
+                    return undefined;
+                const state = str(rec.state);
+                const observedAt = num(rec.observedAt);
+                if (state === undefined || !MCP_LIVENESS_STATES.includes(state) || observedAt === undefined)
+                    return undefined;
+                const errorCode = str(rec.errorCode);
+                return { state, observedAt, ...(errorCode === undefined ? {} : { errorCode }) };
+            })();
             rows.push({
                 name,
                 status,
@@ -515,6 +527,7 @@ export function wiringManifestEventData(ev) {
                 ...(str(e.errorCode) !== undefined ? { errorCode: e.errorCode } : {}),
                 ...(typeof e.delivered === "string" && MCP_DELIVERY_VERDICTS.includes(e.delivered) ? { delivered: e.delivered } : {}),
                 ...(num(e.httpStatus) !== undefined ? { httpStatus: e.httpStatus } : {}),
+                ...(liveness !== undefined ? { liveness } : {}),
             });
         }
         return rows;
@@ -585,6 +598,9 @@ export function wiringManifestOperatorEventData(ev) {
         ...(str(m.configFingerprint) !== undefined ? { configFingerprint: m.configFingerprint } : {}),
     };
 }
+export function wiringManifestFaceEventData(ev, operatorFace) {
+    return operatorFace ? wiringManifestOperatorEventData(ev) : wiringManifestEventData(ev);
+}
 export function humanInputEventData(ev) {
     const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
     const a = typeof ev.actor === "object" && ev.actor !== null && !Array.isArray(ev.actor) ? { ...ev.actor } : {};

package/dist/trace/redact.d.ts

@@ -74,7 +74,7 @@ export declare function resetPpkScanBytesForTest(): void;
  *
  *  🔴 **词义如实**(codex r1 [medium] 三,采纳):这一维说的是「命中的是**哪一条臂**」,**不是**
  *  「这段文本真的被上游截过」—— server 收到的是纯字节,core 的 `clip()` 是 `slice(0, 80)` **不留标记**
- *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js:9-11`),截过与天生就短在 wire 上不可区分。
+ *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js`),截过与天生就短在 wire 上不可区分。
  *  所以一个 `arm="fragment"` 计数可能来自残片,也可能来自一个恰好落在阈值之上的 look-alike;
  *  core [ref] 落地后这一支**趋零是证据、不归零不是证明**。别把它当截断事实的度量用。 */
 /**

package/dist/trace/redact.js

@@ -590,9 +590,11 @@ function collectStickySpans(a, text, at, out) {
     }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
+const LEXICAL_KEYWORD_ARMS = new Set();
 const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => {
     const re = new RegExp(`(?:${keywordSrc}\\s+${atLeast(valueClass, min)}${tailSrc}` +
         `|(?<!${WORD_SEGMENT_CLASS})${keywordSrc}(?:${twoStrongAhead(valueClass)}|${noConnectorAhead(valueClass)})${atLeast(valueClass, min)}${tailSrc})`, "g");
+    LEXICAL_KEYWORD_ARMS.add(re);
     return re;
 };
 const CREDENTIAL_NAME_WORDS = [
@@ -1515,6 +1517,7 @@ const armPool = (() => {
             rank,
             order,
             phase: 1,
+            lexical: LEXICAL_KEYWORD_ARMS.has(re),
             collect: boundary === undefined
                 ? (text, _json, _observe, out) => collectRegexSpans(arm, text, out)
                 : (text, _json, _observe, out) => collectValueArmSpans(boundary, text, out),
@@ -1530,6 +1533,7 @@ const armPool = (() => {
             rank: ARM_RANK.structural,
             order,
             phase,
+            lexical: false,
             collect: (text, json, observe, out) => scan(text, json, observe, (start, end) => out.push({ start, end, repl, rank: ARM_RANK.structural, order })),
             retry: undefined,
             headSrc: undefined,
@@ -1554,14 +1558,32 @@ const armPool = (() => {
         members.push(regexMember(row, ARM_RANK.shape, members.length, false));
     for (const row of FRAGMENT_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.fragment, members.length, false));
+    for (const [re] of KEYWORD_SECRET_PATTERNS) {
+        if (!LEXICAL_KEYWORD_ARMS.has(re))
+            throw new Error(`redact: keyword arm /${re.source}/ is not registered as lexical — build it with keywordArm() so the bounded-unit scope can exclude it`);
+    }
     const retryMembers = members.filter((m) => m.retry !== undefined);
     const phase1 = members.filter((m) => m.phase === 1);
     const phase2 = members.filter((m) => m.phase === 2);
+    const laneOf = (scope) => {
+        const inScope = (m) => {
+            switch (scope) {
+                case "free-text": return true;
+                case "bounded-unit": return !m.lexical;
+            }
+        };
+        return { phase1: phase1.filter(inScope), phase2: phase2.filter(inScope), retry: retryMembers.filter(inScope) };
+    };
+    const LANES = {
+        "free-text": laneOf("free-text"),
+        "bounded-unit": laneOf("bounded-unit"),
+    };
     const headScreen = new RegExp(`(?:${retryMembers.map((m) => m.headSrc).join("|")})`, "y");
     const headFirstUnit = unionMembers(retryMembers.map((m) => m.headFirst)) ?? new Uint32Array(0x10000 >>> 5).fill(0xffffffff);
     poolArmCount = members.length;
     poolBoundaryArmCount = retryMembers.length;
-    return (text, wantCount, json, observe) => {
+    return (text, wantCount, json, observe, scope) => {
+        const lane = LANES[scope];
         const spans = [];
         let tried;
         const freshCovered = (from) => {
@@ -1586,25 +1608,25 @@ const armPool = (() => {
             return at.sort((x, y) => x - y);
         };
         const closeCoveragePositions = (from) => {
-            if (retryMembers.length === 0 || spans.length === from)
+            if (lane.retry.length === 0 || spans.length === from)
                 return;
             for (let at = freshCovered(from); at.length > 0;) {
                 const before = spans.length;
-                for (const m of retryMembers)
+                for (const m of lane.retry)
                     m.retry(text, at, spans);
                 at = freshCovered(before);
             }
         };
         setScanEvidence(NO_CREDENTIAL_SPANS);
-        for (const m of phase1)
+        for (const m of lane.phase1)
             m.collect(text, json, observe, spans);
         closeCoveragePositions(0);
-        if (phase2.length > 0) {
+        if (lane.phase2.length > 0) {
             let evidence = credentialSpans(text, spans, false);
             for (let level = 0;; level += 1) {
                 const before = spans.length;
                 setScanEvidence(evidence);
-                for (const m of phase2)
+                for (const m of lane.phase2)
                     m.collect(text, json, observe && level === 0, spans);
                 closeCoveragePositions(before);
                 forensicLevels += 1;
@@ -1646,8 +1668,8 @@ let onRedaction;
 export function setRedactionObserver(fn) {
     onRedaction = fn;
 }
-function applyRules(text, wantCount, json, observe) {
-    return armPool(text, wantCount, json, observe);
+function applyRules(text, wantCount, json, observe, scope) {
+    return armPool(text, wantCount, json, observe, scope);
 }
 function reportHits(hits) {
     if (onRedaction === undefined)
@@ -1660,20 +1682,20 @@ function reportHits(hits) {
         }
     }
 }
-function runRedaction(text, observe, json, wantHits) {
+function runRedaction(text, observe, json, wantHits, scope) {
     const wantCount = wantHits || (onRedaction !== undefined && observe);
     const normalized = normalizeForRedaction(text);
-    const r = applyRules(normalized, wantCount, json, observe);
+    const r = applyRules(normalized, wantCount, json, observe, scope);
     forgetEscapedSeparatorTails();
     if (observe)
         reportHits(r.hits);
     return { text: r.out, hits: r.hits, spans: r.kept };
 }
 export function redactSecrets(text, opts) {
-    return runRedaction(text, opts?.observe ?? true, opts?.json === true, false).text;
+    return runRedaction(text, opts?.observe ?? true, opts?.json === true, false, "free-text").text;
 }
 export function redactSecretsWithArms(text, opts) {
-    const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true);
+    const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true, "free-text");
     return { text: r.text, arms: new Set(r.hits.map((h) => h.arm)) };
 }
 const REDACT_MAX_DEPTH = 64;
@@ -1752,6 +1774,9 @@ function decodeToFixedPoint(s, maxRounds = 3) {
     }
     return { text: cur, residue: cur.includes("%") };
 }
+const MARKER_CHARS = ["«", "»"];
+const MARKER_BYTE_SPELLINGS = MARKER_CHARS.map((ch) => String.fromCharCode(...new TextEncoder().encode(ch)));
+const carriesRedactionMarker = (spelled, byteView) => MARKER_CHARS.some((ch) => spelled.includes(ch)) || MARKER_BYTE_SPELLINGS.some((b) => byteView.includes(b));
 const VIEW_FILLER_PREFERENCE = ["a", "z", "_", "-", "0"];
 let armValueClassViewsCache;
 function armValueClassViews() {
@@ -1772,13 +1797,15 @@ function boundedUnitView(unit, inClass, filler) {
 }
 function unitCarriesCredential(unit) {
     const decoded = decodeToFixedPoint(unit);
+    if (carriesRedactionMarker(unit, decoded.text))
+        return { hit: false, unreadable: true };
     const views = new Set();
     for (const spelling of [unit, decoded.text])
         for (const v of armValueClassViews())
             views.add(boundedUnitView(spelling, v.inClass, v.filler));
     views.delete("");
-    const hit = [...views].some((view) => redactSecrets(view) !== view);
-    return { hit, residue: decoded.residue };
+    const hit = [...views].some((view) => runRedaction(view, true, false, false, "bounded-unit").text !== view);
+    return { hit, unreadable: decoded.residue };
 }
 function displaySafePathname(pathname) {
     const parts = pathname.split("/");
@@ -1788,7 +1815,7 @@ function displaySafePathname(pathname) {
         if (seg === "")
             continue;
         const verdict = unitCarriesCredential(seg);
-        if (!verdict.hit && !verdict.residue)
+        if (!verdict.hit && !verdict.unreadable)
             continue;
         if (isAllRedactionTokens(redactSecrets(seg)))
             continue;
@@ -1808,7 +1835,7 @@ function shapeLawCredentialInQueryOrFragment(canonical) {
     const boundary = normalized.indexOf("?");
     if (boundary < 0)
         return false;
-    if (runRedaction(canonical, false, false, false).spans.some((sp) => sp.end > boundary))
+    if (runRedaction(canonical, false, false, false, "free-text").spans.some((sp) => sp.end > boundary))
         return true;
     for (const unit of normalized.slice(boundary + 1).split("&").flatMap((sg) => {
         const eq = sg.indexOf("=");
@@ -1817,7 +1844,7 @@ function shapeLawCredentialInQueryOrFragment(canonical) {
         if (unit === "")
             continue;
         const verdict = unitCarriesCredential(unit);
-        if (verdict.hit || verdict.residue)
+        if (verdict.hit || verdict.unreadable)
             return true;
         const decoded = decodeToFixedPoint(unit).text;
         if (decoded.includes("://") || decoded.includes("@"))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.91.1",
+  "version": "7.92.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.24.2",
+    "@sema-agent/core": "7.25.0",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -74,7 +74,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.10.0",
+    "@sema-agent/sdk": "10.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",