@sema-agent/server 7.91.2 → 7.92.0

package/dist/session-policy-wire.js

@@ -63,4 +63,15 @@ export function describeSessionRulesRecordProblem(p) {
         }
     }
 }
+export function sessionPolicyErrorHttp(code) {
+    switch (code) {
+        case "conflict": return { status: 409, errorCode: "conflict" };
+        case "loosen_forbidden": return { status: 403, errorCode: "loosen_forbidden" };
+        case "corrupt": return { status: 500, errorCode: "corrupt" };
+        default: {
+            const unhandled = code;
+            throw new Error(`unhandled SessionPolicyError code: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 //# sourceMappingURL=session-policy-wire.js.map

package/dist/spec-fields.d.ts

@@ -65,15 +65,15 @@ export declare function taskAgentsFromBody(raw: unknown, requirePrincipal: boole
 /** [ref]②/[ref](cli 认领消费)—— fresh-submit 的 agents[].model **目录成员资格**门(形状门
  *  {@link validateTaskAgents} 通过之后跑;调用方铸 400 `request.unknown_reference` + `available` 枚举)。
  *  病灶=报错太晚太远:server 持目录却不查,错到 core prepare 才炸 `config.agent.unknown_model`
- *  (dist/agents/subagent.js:1258),以「run failed」形出现而非 400;cli resolver 只挡词法形,目录
+ *  (dist/agents/subagent.js),以「run failed」形出现而非 400;cli resolver 只挡词法形,目录
  *  成员资格只有 server 持有。
  *  三条判定纪律(全部 core dist 亲读):
- *   - **只查 string 形**:core 只对 `typeof a.model === "string"` 走 `resolveModel`(subagent.js:1253);
+ *   - **只查 string 形**:core 只对 `typeof a.model === "string"` 走 `resolveModel`(subagent.js);
  *     Model 对象形 core 原样信任不查目录([ref]④ 契约:自带完整 Model 配置,其 id 本就不必在目录)——
  *     对象形没有「晚失败」病灶,这里同拒会是射程外的行为收紧,不做。
  *   - **`catalog` 必须是 tier 展开形**(调用方传 `expandTiers(config.models, config.tiers) ?? config.models`,
  *     resolve-spec.ts wireCatalog 同源纪律):core Runner 构造期把 deps.models 换成展开目录
- *     (runtask.js:1472),agentCatalog.models 即它 —— 裸 config.models 会把合法档位词/CC 别名误杀 400。
+ *     (runtask.js),agentCatalog.models 即它 —— 裸 config.models 会把合法档位词/CC 别名误杀 400。
  *   - **判定=`Object.hasOwn` 纯键查**,刻意不用 `matchCatalogModel`:那是 body.model 门的四形判
  *     (name/tier/alias/**id**),而 core 的 `resolveModel` 是纯键查(roles.js:`models?.[ref]`)——
  *     多认 id 形会放行一个 core prepare 必炸的值(门假绿,病灶照旧)。hasOwn 顺带挡原型链键。
@@ -111,7 +111,7 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
  *  ⚠️ **这不是一条 defer 注**([ref] 件⑤ 对表结论,core [ref] 同判):本段说的是 `promptProfile` 这根
  *  **呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提 deferTools 只是在借它
  *  的「无租户门」姿势作类比。「引擎缺省 simple」这句本身在 core 5.40.0 上仍逐字为真
- *  (`core/types.d.ts:133`:default "simple"),本批亲验未变。
+ *  (`core/types.d.ts`:default "simple"),本批亲验未变。
  *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建;7.15.0 起它不再是第二道门,
  *  只是把候选集拓宽后走同一道阈值门)记在
  *  `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。

package/dist/task-cwd.d.ts

@@ -35,7 +35,7 @@ export declare function normalizeAbsolutePathLexically(p: string): string;
  * **词法**判域:`dir` 是不是 `target` 本身或它的祖先(= `target` ⊆ `dir`,「等于 ∪ 后代」)。
  *
  * 这是 core `assertExemptDirsDoNotCoverRoot` 那条律的本仓同形(亲读安装树
- * `dist/core/fs-write-gate-policy.js:11-28` → `swallowedFenceRoot` → `isWithin(root, p)`:
+ * `dist/core/fs-write-gate-policy.js` → `swallowedFenceRoot` → `isWithin(root, p)`:
  * 先各自词法归一,再判 `p === root` 或 `p` 以 `root + "/"` 起头)。**两端都只做词法**,不 realpath ——
  * 写门的构造期本来就没有 I/O(core 同理),承诺 canonical 是承诺一件此刻做不到的事。
  *

package/dist/task-settings.d.ts

@@ -396,8 +396,8 @@ export interface FsWriteGateWiring {
      * `boot/resolve-spec.ts` / `boot/parked-revive-gate.ts` 把**同一个值**递成本字段。两处同源是承重的:
      * 各算一份就会出现「422 门放行而引擎判 unreadable」或反过来。
      *
-     * 🔴 **S-213⑦ 改真话**(亲读 core 7.12.0 `dist/core/permission-rule-model.js:365-372` /
-     * `:340-350`,推翻本注此前的两句):
+     * 🔴 **S-213⑦ 改真话**(亲读 core 7.12.0 `dist/core/permission-rule-model.js` /
+     * 的 `resolvePathPattern`,推翻本注此前的两句):
      *  · core 对缺席的 `home` **不**回落 `os.homedir()` —— `resolvePathPattern` 走
      *    `lexicalNormalAbsolutePathOf(baseValueOf("home", bases) ?? "")`,base 缺席 ⇒ `undefined` ⇒ 直接回
      *    `{missingBase:"home"}`,该调用的射程判 `unreadable`(fail-closed 的 ask,人来清),从不猜一个目录。

package/dist/tool-approval.d.ts

@@ -653,7 +653,7 @@ export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput
  *
  * 三源(§8.3)里本仓可执行的是后两源;第一源 `forceDurableGate` 在 HTTP 装配时刻不可解析(§14 §12-5
  * 亲裁:不可读则该源不做,core 自身的 `runtimeCaps?.forceDurableGate` 消费臂结构性兜底——7.0.1
- * `prepare-task.js` 的 durableMandate/contentMandate(:1415/:1417)与 durableQuestionFace(:2136)等),
+ * `prepare-task.js` 的 durableMandate/contentMandate 与 durableQuestionFace 等),
  * 故不在本函数内。
  *
  * 🔴 **[ref](半接线旋钮族)**:`windowZero` 的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在

package/dist/trace/core-keyset-guard.d.ts

@@ -36,7 +36,7 @@ type _GuardProvenanceReverse = AssertAllKeysHandled<Exclude<ProvenanceProjected
 type AgentMessageProjected = "from" | "body";
 type _GuardAgentMessage = AssertAllKeysHandled<Exclude<keyof NonNullable<TaskNotificationPayload["agentMessage"]>, AgentMessageProjected>>;
 type _GuardAgentMessageReverse = AssertAllKeysHandled<Exclude<AgentMessageProjected, keyof NonNullable<TaskNotificationPayload["agentMessage"]>>>;
-type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
+type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId" | "spawnName";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNotifExcluded, keyof BackgroundChildEvent>>;

package/dist/trace/project.d.ts

@@ -331,7 +331,9 @@ export declare function toolDisclosureEventData(ev: {
 /** The `task_progress` payload (a subagent's live progress tick) — EXPLICIT WHITELIST shared by all
  *  three legs (bg runs.ts + resume append + the sync live SSE frame): taskId/parent linkage/token rollup verbatim,
  *  `name` UNTRUSTED (core sanitizes for rendering, does NOT secret-redact — a taskName can be secret-shaped) →
- *  `redactSecrets`. Never the delegated objective/args. E2 identity rides (eventId/
+ *  `redactSecrets`; `spawnName` is the TRUSTED-chain teammate KEY beside it (core 7.25.0 [ref] S0 — validated at the
+ *  spawn, so it is an identity, not a label) and rides VERBATIM: redacting an identity key does not make it safe,
+ *  it makes it WRONG (two legal names collapsing onto one value — see the key's own note). Never the delegated objective/args. E2 identity rides (eventId/
  *  parentToolCallId are core-mint uuidv7 identifiers, not content — consumers bind concurrent subagent ticks
  *  exactly by them; the 1.72 whitelist dropped them, leaving a FIFO heuristic). */
 export declare function taskProgressEventData(ev: {
@@ -339,6 +341,7 @@ export declare function taskProgressEventData(ev: {
     taskType?: string;
     parentTaskId?: string;
     name?: string;
+    spawnName?: string;
     status?: string;
     usage?: unknown;
     currentAction?: string;
@@ -715,6 +718,27 @@ export declare function wiringManifestOperatorEventData(ev: {
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): Record<string, unknown>;
+/**
+ * `wiring_manifest` 的**唯一分叉点**(S-528)—— 两条知道调用方身份的 live 消费腿共用它:
+ * `/v1/tasks/stream` 的 SSE 帧,与 `POST /v1/tasks`(非流式)200 体里的 `wiringManifest` 起手回执。
+ *
+ * 🔴 **为什么是一只函数,而不是两处 `cond ? operator : tenant`**:那个三元判的是「这份产物给谁看」——
+ * 一件治理面的事([ref] 件一)。写两份就有漂的位置:core 往 operator 面加第 N 段时,跟上的那一处与没跟上
+ * 的那一处会让**同一次提交**在两条腿上投出两种宽度,而错的方向是把 operator-only 面发给租户。两条腿从此
+ * 只认这一只,新的第三条腿照抄它即可(禁再写一次三元)。
+ *
+ * 判据本身(`explicitOperatorOk`)仍由调用腿**每请求求一次**再传进来:身份解析要读请求凭据与部署名单,
+ * 那是 http 层的事,本文件(投影层)不认识 `req`,也不该认识。
+ *
+ * `operatorFace` 的两个值都是**正面事实**,没有第三态(所以是 boolean 不是三值):
+ *  · `true`  = 本请求的调用方经 `explicitOperatorOk` 判为 operator ⇒ 投 {@link wiringManifestOperatorEventData};
+ *  · `false` = 其余全部(**含**「本部署根本没配 operator 名单」)⇒ 投 {@link wiringManifestEventData} 的租户形。
+ */
+export declare function wiringManifestFaceEventData(ev: {
+    manifest?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}, operatorFace: boolean): Record<string, unknown>;
 /**
  * `human_input`(core 5.14.0 [ref] 新 `TaskEvent` 臂)—— 「谁把什么喂进了这条 run」的生命周期账本
  * 帧(objective / 实时 steer / nextTurn / parked-steer 续跑 / wake 五个载体共用一个投影点)。

package/dist/trace/project.js

@@ -273,6 +273,7 @@ export function taskProgressEventData(ev) {
         ...(typeof ev.taskType === "string" && ev.taskType.length > 0 ? { taskType: ev.taskType } : {}),
         ...(ev.parentTaskId ? { parentTaskId: ev.parentTaskId } : {}),
         ...(ev.name ? { name: redactSecrets(ev.name) } : {}),
+        ...(ev.spawnName ? { spawnName: ev.spawnName } : {}),
         ...(typeof ev.model === "string" && ev.model.length > 0 ? { model: ev.model } : {}),
         ...(ev.status !== undefined ? { status: ev.status } : {}),
         ...(ev.usage ? { usage: ev.usage } : {}),
@@ -597,6 +598,9 @@ export function wiringManifestOperatorEventData(ev) {
         ...(str(m.configFingerprint) !== undefined ? { configFingerprint: m.configFingerprint } : {}),
     };
 }
+export function wiringManifestFaceEventData(ev, operatorFace) {
+    return operatorFace ? wiringManifestOperatorEventData(ev) : wiringManifestEventData(ev);
+}
 export function humanInputEventData(ev) {
     const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
     const a = typeof ev.actor === "object" && ev.actor !== null && !Array.isArray(ev.actor) ? { ...ev.actor } : {};

package/dist/trace/redact.d.ts

@@ -74,7 +74,7 @@ export declare function resetPpkScanBytesForTest(): void;
  *
  *  🔴 **词义如实**(codex r1 [medium] 三,采纳):这一维说的是「命中的是**哪一条臂**」,**不是**
  *  「这段文本真的被上游截过」—— server 收到的是纯字节,core 的 `clip()` 是 `slice(0, 80)` **不留标记**
- *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js:9-11`),截过与天生就短在 wire 上不可区分。
+ *  (亲读 `@sema-agent/core/dist/agents/subagent-steps.js`),截过与天生就短在 wire 上不可区分。
  *  所以一个 `arm="fragment"` 计数可能来自残片,也可能来自一个恰好落在阈值之上的 look-alike;
  *  core [ref] 落地后这一支**趋零是证据、不归零不是证明**。别把它当截断事实的度量用。 */
 /**

package/dist/trace/redact.js

@@ -1774,6 +1774,9 @@ function decodeToFixedPoint(s, maxRounds = 3) {
     }
     return { text: cur, residue: cur.includes("%") };
 }
+const MARKER_CHARS = ["«", "»"];
+const MARKER_BYTE_SPELLINGS = MARKER_CHARS.map((ch) => String.fromCharCode(...new TextEncoder().encode(ch)));
+const carriesRedactionMarker = (spelled, byteView) => MARKER_CHARS.some((ch) => spelled.includes(ch)) || MARKER_BYTE_SPELLINGS.some((b) => byteView.includes(b));
 const VIEW_FILLER_PREFERENCE = ["a", "z", "_", "-", "0"];
 let armValueClassViewsCache;
 function armValueClassViews() {
@@ -1794,13 +1797,15 @@ function boundedUnitView(unit, inClass, filler) {
 }
 function unitCarriesCredential(unit) {
     const decoded = decodeToFixedPoint(unit);
+    if (carriesRedactionMarker(unit, decoded.text))
+        return { hit: false, unreadable: true };
     const views = new Set();
     for (const spelling of [unit, decoded.text])
         for (const v of armValueClassViews())
             views.add(boundedUnitView(spelling, v.inClass, v.filler));
     views.delete("");
     const hit = [...views].some((view) => runRedaction(view, true, false, false, "bounded-unit").text !== view);
-    return { hit, residue: decoded.residue };
+    return { hit, unreadable: decoded.residue };
 }
 function displaySafePathname(pathname) {
     const parts = pathname.split("/");
@@ -1810,7 +1815,7 @@ function displaySafePathname(pathname) {
         if (seg === "")
             continue;
         const verdict = unitCarriesCredential(seg);
-        if (!verdict.hit && !verdict.residue)
+        if (!verdict.hit && !verdict.unreadable)
             continue;
         if (isAllRedactionTokens(redactSecrets(seg)))
             continue;
@@ -1839,7 +1844,7 @@ function shapeLawCredentialInQueryOrFragment(canonical) {
         if (unit === "")
             continue;
         const verdict = unitCarriesCredential(unit);
-        if (verdict.hit || verdict.residue)
+        if (verdict.hit || verdict.unreadable)
             return true;
         const decoded = decodeToFixedPoint(unit).text;
         if (decoded.includes("://") || decoded.includes("@"))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.91.2",
+  "version": "7.92.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.24.4",
+    "@sema-agent/core": "7.25.0",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -74,7 +74,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.11.0",
+    "@sema-agent/sdk": "10.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",