@sema-agent/server 7.95.0 → 7.96.0

package/dist/plugins/mailbox-store-sql.js

@@ -2,7 +2,7 @@ import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_TOMBSTONED_RECIPIENT_CODE, Mail
 import { pgHasUnstorable, pgSanitizeText, PgUnstorableError } from "./pg-safe-json.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { escapeLike } from "./sql-escape.js";
-import { decodeNullableJsonColumn, foldJsonColumn, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
+import { decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
 export const MAILBOX_TABLE = "mailbox";
 export const MAILBOX_MSG_TABLE = "mailbox_message";
 export const MAILBOX_TOMBSTONE_TABLE = "mailbox_tombstone";
@@ -52,7 +52,7 @@ function decodeHopChain(raw, seq) {
         return decodeNullableJsonColumn(raw, readStringArrayColumn, `${MAILBOX_MSG_TABLE}.hop_chain for seq ${String(seq)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`MailboxStore: ${m} — refusing the lease rather than let a message skip peer admission (an absent chain makes core's judgePeerAdmission not run at all)`));
+        throw foldJsonColumn(e, (m) => `MailboxStore: ${m} — refusing the lease rather than let a message skip peer admission (an absent chain makes core's judgePeerAdmission not run at all)`);
     }
 }
 const PEER_META_MAX_BYTES = 60_000;
@@ -73,7 +73,9 @@ function decodePeerMeta(raw, seq) {
     catch (e) {
         if (e instanceof MailboxStoreError)
             throw e;
-        throw foldJsonColumn(e, (m) => new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore: ${m} — refusing the lease rather than read a corrupt typed record as "no metadata"`));
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        throw new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore: ${e.message} — refusing the lease rather than read a corrupt typed record as "no metadata"`);
     }
 }
 const readPeerMetaColumn = (body) => {

package/dist/plugins/memory-engine-pg.js

@@ -51,7 +51,7 @@ function readFrontmatter(cell, id) {
         return decodeJsonColumn(cell, readFrontmatterColumn, `${PG_MEMORY_ENGINE_TABLES.entry}.frontmatter for entry ${String(id)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`));
+        throw foldJsonColumn(e, (m) => `memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`);
     }
 }
 function readEmbedding(cell, id) {

package/dist/plugins/memory-engine-tidb.js

@@ -48,7 +48,7 @@ function readFrontmatter(cell, id) {
         return decodeJsonColumn(cell, readFrontmatterColumn, `${TIDB_MEMORY_ENGINE_TABLES.entry}.frontmatter for entry ${String(id)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`));
+        throw foldJsonColumn(e, (m) => `memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`);
     }
 }
 export class TiDBMemoryEngineBackend {

package/dist/plugins/memory-sync-store-pg.js

@@ -34,7 +34,7 @@ export function refusingMemorySyncRow(read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`memory-sync store: ${m} — refusing rather than serve a sync row nobody can read`));
+        throw foldJsonColumn(e, (m) => `memory-sync store: ${m} — refusing rather than serve a sync row nobody can read`);
     }
 }
 function toMs(v) {

package/dist/plugins/permission-rule-store-sql.js

@@ -346,7 +346,7 @@ async function refusingUnreadableColumns(what, fn) {
         return await fn();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`${m} — the ${what} does not carry a readable shape; refusing the whole of it rather than report a partial one`));
+        throw foldJsonColumn(e, (m) => `${m} — the ${what} does not carry a readable shape; refusing the whole of it rather than report a partial one`);
     }
 }
 class SqlDurableRulePartition {
@@ -728,7 +728,7 @@ export class SqlRuleImportTicketStore {
                 outcome = decodeJsonColumn(row.redeemedOutcome, readJsonObjectColumn, `${PERMISSION_RULE_TICKET_TABLE}.redeemed_outcome for ticket ${ticketId}`);
             }
             catch (e) {
-                throw foldJsonColumn(e, (m) => new Error(`${m} — refusing rather than read a settled ticket as still open (which re-runs a redemption that already ran)`));
+                throw foldJsonColumn(e, (m) => `${m} — refusing rather than read a settled ticket as still open (which re-runs a redemption that already ran)`);
             }
             return { state: "settled", outcome };
         }

package/dist/plugins/run-store-sql.js

@@ -22,7 +22,7 @@ function refusing(what, read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`SqlRunStore: ${m} — refusing rather than ${what}`));
+        throw foldJsonColumn(e, (m) => `SqlRunStore: ${m} — refusing rather than ${what}`);
     }
 }
 function usageResultBody(v) {

package/dist/plugins/session-event-payload.js

@@ -14,7 +14,7 @@ export function decodeSessionEventPayload(cell, sessionId, rowId) {
         return decodeJsonColumn(cell, readSessionEventPayload, `session_event.payload for session ${sessionId} row ${String(rowId)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`session storage: ${m} — refusing rather than wake a session from a tree with a node nobody can read`));
+        throw foldJsonColumn(e, (m) => `session storage: ${m} — refusing rather than wake a session from a tree with a node nobody can read`);
     }
 }
 //# sourceMappingURL=session-event-payload.js.map

package/dist/plugins/session-policy-store-sql.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
 import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
-import { decodeJsonColumn, foldJsonColumn, jsonColumnText } from "./sql-json-column.js";
+import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText } from "./sql-json-column.js";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDeadlockError, isDupKeyError } from "./sql-errors.js";
@@ -17,7 +17,9 @@ function readRulesBody(text, where) {
         return decodeJsonColumn(text, readSessionRulesBody, where);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new SessionPolicyError("corrupt", `${m} — an unreadable rules body served as an EMPTY rule set would silently drop every tightening this session carries`));
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        throw new SessionPolicyError("corrupt", `${e.message} — an unreadable rules body served as an EMPTY rule set would silently drop every tightening this session carries`);
     }
 }
 function rowToStored(r, where) {

package/dist/plugins/sql-json-column.d.ts

@@ -85,8 +85,17 @@ export declare function jsonColumnTextExpr(dialect: SqlDialect, column: string):
 export declare const SQL_JSON_COLUMN_PROBLEMS: readonly ["not-text", "not-json", "malformed"];
 export type SqlJsonColumnProblem = (typeof SQL_JSON_COLUMN_PROBLEMS)[number];
 /**
- * 店层码,**不上 wire**:各店在自己的错误映射里把它折成该店既有的 corrupt 类码(见 {@link foldJsonColumn})。
- * 终局对外码经 7.92.2 的词法门,永不裸穿。
+ * **体**的两形(`not-text` 之外的全部)—— 「数据坏了」这一族。类型从闭集派生,不手抄。
+ * 存在的理由:{@link StoreCorruptError} 要在**类型面**说出「我携带的种别恒非 `not-text`」。
+ */
+export type SqlJsonColumnBodyProblem = Exclude<SqlJsonColumnProblem, "not-text">;
+/**
+ * 店层码,**不上 wire**:店层折码口 {@link foldJsonColumn} 把它折成 {@link StoreCorruptError}
+ * (有自己闭集契约词的店折成自己的码)。终局对外码经 7.92.2 的词法门,永不裸穿。
+ *
+ * 🔴 **它只许在 `not-text` 那一形上穿过店的边界**(S-608):`not-text` 是读腿自己的缺陷(投影漂),
+ * 按 {@link foldJsonColumn} 的规则不折、原样上抛;而体的两形一旦穿出去,上层就得**按列错误类**分类,
+ * 那正是 S-608 的病 —— 读口按列错误分类、店按店拒绝形折码,两层各说各话,坏体于是落进「店抖动」臂。
  */
 export declare class SqlJsonColumnError extends Error {
     readonly problem: SqlJsonColumnProblem;
@@ -133,13 +142,47 @@ export declare function decodeJsonColumn<T>(text: unknown, read: JsonColumnReade
  */
 export declare function decodeNullableJsonColumn<T>(cell: unknown, read: JsonColumnReader<T>, where: string): T | undefined;
 /**
- * 店层折码的**唯一规则**(`catch (e) { throw foldJsonColumn(e, (m) => new XError("corrupt", m)); }`)。
+ * **「这一格耐久载荷读不出来」的店层拒绝**(整仓唯一一只)—— {@link foldJsonColumn} 的**恒定产物**。
+ *
+ * 🔴 为什么它必须是一只**具名类**而不是 `new Error(…)`(S-608 真案,7.95.1):折码的产物是**店交给
+ * 上层的契约**。折成裸 `Error` 之后,「这一行确定性地读不出来」与「店抖了一下」在上层**没有任何判别位**,
+ * 而两者的处置完全相反(前者要人去修那一行,后者重试 / 保守当缺席)。S-577 给续跑上下文修的正是这条
+ * 分家,可它在 SQL 车道上**结构不可达**整整一版:读口按**列错误类**分类,而店早把列错误折成了裸
+ * `Error` ⇒ 坏体一路掉进「店抖动 ⇒ 当缺席」臂,用户拿到的还是那个 409(local 车道答对,只是因为它
+ * 根本没折码、把列错误漏了出来 —— 巧合式正确,不是同一份契约)。
+ * ⇒ 读口只认**店的拒绝契约**,而店的拒绝契约只有这一只。
+ *
+ * 🔴 {@link kind} 逐字就是消费点那只联合里的那个词(`http/resume-ctx-read.ts` 的 `ResumeCtxRead`):
+ * 店说 `corrupt`,读口原样转述,中间**没有第二张翻译表**。
+ *
+ * 有**自己的闭集契约词**的店(`session-policy` 的 `SessionPolicyError("corrupt")`、`mailbox` 的
+ * `MailboxStoreError`)不经本折码口 —— 它们的消费点按**那个码**判,本类的判别位对它们是多余的第二份。
+ * 那两处用属主谓词 {@link isJsonColumnBodyProblem} 自己写那一句(判别仍只有一个写者)。
+ */
+export declare class StoreCorruptError extends Error {
+    /** 消费点的判别词(与 `ResumeCtxRead` 的那一态同字)。 */
+    readonly kind: "corrupt";
+    /** 体的种别(类型面即保证恒非 `not-text` —— 那一形不折,见 {@link foldJsonColumn})。 */
+    readonly problem: SqlJsonColumnBodyProblem;
+    /** 出事的坐标(`<table>.<column> for <identity>`,由 {@link SqlJsonColumnError.where} 原样带过来)——
+     *  进 wire 的 `where` 字段,人按它去找那一行。 */
+    readonly where: string;
+    constructor(cause: SqlJsonColumnError & {
+        readonly problem: SqlJsonColumnBodyProblem;
+    }, sentence: string);
+}
+/**
+ * 店层折码的**唯一规则**(`catch (e) { throw foldJsonColumn(e, (m) => \`XStore: ${m} — refusing …\`); }`)。
+ *
+ * 🔴 回调交出来的是**一句话**,不是一只错误(S-608 按类改):产物恒是 {@link StoreCorruptError},于是
+ * 「折成一只没有判别位的错」在**构造上**写不出来。此前这一格的签名是 `(message) => Error`,21 个调用点
+ * 里 19 个折成了裸 `Error` —— 每一个都是一枚等着下一个消费方来踩的 S-608。
  *
  * 🔴 `not-text` **不折**:它是读腿自己的缺陷(投影漏了),折成「这一行坏了」会把一次代码漂伪装成一次
- * 数据事故 —— 这条判别只写在这里一处,五个店不各写一遍(各写一遍的下场是某天有一处把程序错也折了)。
- * 非本模块的错误原样透出(连接 / 超时 / 权限本来就该照原样上抛)。
+ * 数据事故 —— 这条判别只写在这里一处(与它的容忍侧孪生 {@link isJsonColumnBodyProblem} 共用),
+ * 各店不各写一遍。非本模块的错误原样透出(连接 / 超时 / 权限本来就该照原样上抛)。
  */
-export declare function foldJsonColumn(e: unknown, corrupt: (message: string) => Error): Error;
+export declare function foldJsonColumn(e: unknown, refusing: (message: string) => string): Error;
 /**
  * 折码的**容忍侧孪生**(与 {@link foldJsonColumn} 同一条判别,只写这一处):这一次失败是不是
  * **数据体**的问题(`not-json` / `malformed`)。
@@ -149,7 +192,9 @@ export declare function foldJsonColumn(e: unknown, corrupt: (message: string) =>
  * 调用点原样上抛:一条读腿漏了投影、或库连不上,绝不许被一条「这一格坏了,跳过它」的容忍臂吞掉 ——
  * 那会让一次代码漂 / 一次故障伪装成「几行数据坏了」,而两者的处置完全不同。
  */
-export declare function isJsonColumnBodyProblem(e: unknown): e is SqlJsonColumnError;
+export declare function isJsonColumnBodyProblem(e: unknown): e is SqlJsonColumnError & {
+    readonly problem: SqlJsonColumnBodyProblem;
+};
 /**
  * **写腿的形闸** —— 一个值**序列化之后**还是不是这一列读得回来的形。判据与读腿**共用同一只形读者**,
  * 所以「写得进」与「读得出」在构造上是同一句话。

package/dist/plugins/sql-json-column.js

@@ -49,9 +49,20 @@ export function decodeJsonColumn(text, read, where) {
 export function decodeNullableJsonColumn(cell, read, where) {
     return cell === null ? undefined : decodeJsonColumn(cell, read, where);
 }
-export function foldJsonColumn(e, corrupt) {
-    if (e instanceof SqlJsonColumnError && e.problem !== "not-text")
-        return corrupt(e.message);
+export class StoreCorruptError extends Error {
+    kind = "corrupt";
+    problem;
+    where;
+    constructor(cause, sentence) {
+        super(sentence, { cause });
+        this.name = "StoreCorruptError";
+        this.problem = cause.problem;
+        this.where = cause.where;
+    }
+}
+export function foldJsonColumn(e, refusing) {
+    if (isJsonColumnBodyProblem(e))
+        return new StoreCorruptError(e, refusing(e.message));
     return e instanceof Error ? e : new Error(String(e));
 }
 export function isJsonColumnBodyProblem(e) {

package/dist/plugins/task-list-store-sql.js

@@ -27,7 +27,7 @@ function parseItem(v, where) {
         return decodeJsonColumn(v, readTaskListItemBody, `${TASK_LIST_ITEM_TABLE}.item_json ${where}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`TaskListStore: ${m} — refusing rather than hand the model a row nobody can read as a task`));
+        throw foldJsonColumn(e, (m) => `TaskListStore: ${m} — refusing rather than hand the model a row nobody can read as a task`);
     }
 }
 function assertListKeyBytes(listKey) {

package/dist/plugins/usage-window-store-sql.js

@@ -18,7 +18,7 @@ function parseRecord(raw, key) {
         return decodeJsonColumn(raw, readUsageWindowRecordBody, `${USAGE_WINDOW_TABLE}.record for key "${key}"`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`${m} — refusing to mis-count a governance window`));
+        throw foldJsonColumn(e, (m) => `${m} — refusing to mis-count a governance window`);
     }
 }
 function validateUsageWindowRecord(v) {

package/dist/plugins/workflow-journal-store-sql.js

@@ -9,7 +9,7 @@ function decodeJournalResult(cell, where) {
         return decodeJsonColumn(cell, readJournalRowBody, where);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`workflow journal: ${m} — refusing rather than replay a journal entry nobody can read`));
+        throw foldJsonColumn(e, (m) => `workflow journal: ${m} — refusing rather than replay a journal entry nobody can read`);
     }
 }
 export class SqlWorkflowJournalStore {

package/dist/plugins/workflow-run-store-sql.js

@@ -46,7 +46,7 @@ function readRunColumn(v, id) {
         return decodeJsonColumn(v, readWorkflowRunBody, `workflow_run.run for run ${id}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`SqlWorkflowRunStore: ${m} — refusing rather than resume a hollow run`));
+        throw foldJsonColumn(e, (m) => `SqlWorkflowRunStore: ${m} — refusing rather than resume a hollow run`);
     }
 }
 export class SqlWorkflowRunStore {

package/dist/trace/core-keyset-guard.d.ts

@@ -138,7 +138,7 @@ type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requi
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
-type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles";
+type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;

package/dist/trace/project.d.ts

@@ -904,11 +904,22 @@ export declare function contextUsageEventData(ev: {
  *     而不是"未知";这正是那种"回放后看起来一切正常"的丢失。
  * 两者**在 live 腿看得见、durable 腿回放后永久消失** —— 与 [ref] 的 `label`、[ref] 的 workflowRunId 同一族
  * (白名单没跟上 core 新增字段)。补 builder 的同时也就把它纳入了 `wire-whitelist-exhaustiveness` 的编译期差集门。
+ *
+ * 🔴 **本构造器是 `turn_end` 帧载荷的唯一铸点**(core 7.29.0 提货批,车LY):三条腿同调 —— live SSE
+ * (`http/routes/tasks.ts` 的 `/v1/tasks/stream` 臂,身份键另由 `liveIdentityFields` 补四键)、durable 账本
+ * (`ledger-sink.ts`)、resume 腿(`resume-legs.ts`)。live 臂此前是一份**手抄**的键集,于是 core 7.29.0 加的
+ * `responseModel` 在 durable 面由这里补上以后,live 面仍会被那份手抄静默剥掉 —— 同一帧两条腿两套键集。
+ *
+ * `responseModel`(core 7.29.0 #1029):**供应商自己**报的、回答这一 turn 的模型名,**只在**它 ≠ 请求所带 id
+ * 时在场。缺席 = 「报了同名」或「没报」,**一个读法**(请求 id 读 `TaskResult.model`)。值是供应商铸的名字
+ * (与 `apiFailure.requestId` 同类:不是模型写的自由文本)⇒ 逐字;非串 / 空串 ⇒ 缺席(core 的读律
+ * `providerReportedModel` 对空串答「没报」,本仓不铸一个看起来合法的空名)。
  */
 export declare function turnEndEventData(ev: {
     usage?: unknown;
     usageMissing?: true;
     stopReason?: string;
+    responseModel?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -717,6 +717,7 @@ export function turnEndEventData(ev) {
         ...(ev.usage ? { usage: ev.usage } : {}),
         ...(ev.usageMissing === true ? { usageMissing: true } : {}),
         ...(typeof ev.stopReason === "string" ? { stopReason: ev.stopReason } : {}),
+        ...(typeof ev.responseModel === "string" && ev.responseModel !== "" ? { responseModel: ev.responseModel } : {}),
         ...identityFields(ev),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.95.0",
+  "version": "7.96.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -18,7 +18,8 @@
       "types": "./dist/device-protocol.d.ts",
       "default": "./dist/device-protocol.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./deploy/sema-up/lanes.json": "./deploy/sema-up/lib/lanes.json"
   },
   "files": [
     "dist",
@@ -59,7 +60,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.28.1",
+    "@sema-agent/core": "7.29.0",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",