@sema-agent/server 4.3.0 → 5.0.1

package/dist/config.d.ts

@@ -116,6 +116,34 @@ export declare const hostExecSpoolEnabled: () => boolean;
  *  is REMOVED (a spread-inherited value from a bigger-window base model would mis-trigger a small window).
  *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): void;
+/**
+ * 一条工具名**永不匹配任何现役工具**的三种拼法,及其修正指引。审批/权限名单是 server 侧 ToolPolicy 的
+ * RAW 逐字比对(canonicalToolName 折叠面已随 core 5.0.0 RB-476 退役),所以写错的名字不会报错、只会静默
+ * 不生效——对 deny/ask 名单而言这是**失守方向**(运维/客户端以为加了门,实际什么都没加)。
+ *
+ * 判据在此**单点成文**,三条腿共用(它们此前各自为政,拼法覆盖面不一致才是真缺口):
+ *   ① env 腿(`APPROVAL_REQUIRE`/`DENY`/`NEVER_AUTO`,下方)—— boot 拒启;
+ *   ② 中心下发腿(`runtime.approvalRequire`,config-center/apply-effective.ts)—— 域级拒绝+保前值+warn
+ *      (常驻进程不 crash);
+ *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts)—— 该请求 422。
+ *
+ * 三种拼法:
+ *   - 退役名(`bash`/`Task`/`KillShell`…):core `RETIRED_TOOL_NAMES` 静态表,指引=现役名。
+ *   - pre-prefix 短名(`figma__x`):v4 自动加前缀的折叠面已删,实挂名恒带 `mcp__`,指引=补全前缀。
+ *   - 不完整 MCP 名(`mcp__`、`mcp__figma`):前缀对但缺段——MCP 实挂名恒是 `mcp__<server>__<tool>` 三段形,
+ *     少一段同样永不匹配。旧判据「含 `__` 且 protocolOf 认不出」放过了这一族(前缀恰好认得出),从另一侧
+ *     漏出去,失守方向与 `figma__x` 完全相同。
+ *
+ * 已接受的权衡(与退役表墓碑同一条):部署自有工具真叫 `figma__x` 的极端形会被误拒——boot 期无 roster 可
+ * 豁免,且失败响亮、指引明确,好过静默失守。
+ */
+export interface UnmatchableToolName {
+    name: string;
+    guidance: string;
+}
+export declare function findUnmatchableToolNames(names: readonly string[]): UnmatchableToolName[];
+/** {@link findUnmatchableToolNames} 的成句形——三条腿的文案同源(只有前缀/出口不同)。 */
+export declare function formatUnmatchableToolNames(source: string, bad: readonly UnmatchableToolName[]): string;
 /** 组名 → 该组取景的平铺键(introspection 面:测试用它钉「每个平铺键恰好被一组取景」)。 */
 export declare const CONFIG_GROUP_KEYS: {
     readonly [G in keyof ServiceConfigGroups]: readonly (keyof ServiceConfigFlat)[];

package/dist/config.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, RECOMMENDED_SENSITIVE_PATTERNS } from "@sema-agent/core";
+import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -60,16 +60,38 @@ function defaultSkillsDir() {
         return "skills"; // import.meta 不可用的兜底(不应发生在 ESM 构建里)
     }
 }
-/** Two-name env with the first set winning (MYSQL_* preferred over the TIDB_* back-compat alias); throws
- *  when neither is set and no fallback is given — same fail-loud contract as `env`. */
-function env2(primary, alias, fallback) {
-    const v = process.env[primary] || process.env[alias];
-    if (v === undefined || v === "") {
-        if (fallback !== undefined)
-            return fallback;
-        throw new Error(`missing required env: ${primary} (or ${alias})`);
+const RETIRED_ENVS = [
+    ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
+    ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
+    ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", "SEMA_REGISTRY_TOKEN", "renamed"],
+    ["CONFIG_CENTER_DRY_RUN", "SEMA_REGISTRY_DRY_RUN", "renamed"], ["CONFIG_CENTER_WORKER", "SEMA_REGISTRY_WORKER", "renamed"],
+    ["ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL", "renamed"],
+    ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"], // [2373]B-1:墓碑族唯一漏网的双读(config-center.ts 发射点)
+    // [2354] OA 场景整体退役(clay 令 2026-08-01):配置本身作废,无替代名 ⇒ removed 族。
+    ["OA_API_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
+    ["OA_SERVICE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
+    ["OA_ISSUE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
+    ["OA_ISSUE_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
+    ["OA_ISSUE_OWNER", "the OA scenario was removed in 5.0.0", "removed"],
+    ["OA_ISSUE_REPO", "the OA scenario was removed in 5.0.0", "removed"],
+    ["OA_ISSUE_LABELS", "the OA scenario was removed in 5.0.0", "removed"],
+    ["APPROVAL_POLL_MS", "the OA poll-approval lane was removed in 5.0.0; the durable checkpoint lane is the only gate", "removed"],
+];
+function rejectRetiredEnvs() {
+    const hit = RETIRED_ENVS.filter(([o]) => process.env[o] !== undefined && process.env[o] !== "");
+    if (hit.length === 0)
+        return;
+    const renamed = hit.filter(([, , k]) => k === "renamed");
+    const removed = hit.filter(([, , k]) => k === "removed");
+    const parts = [];
+    if (renamed.length > 0) {
+        parts.push(`${renamed.map(([o, n]) => `${o} → use ${n}`).join("; ")} — rename the env key(s); the value semantics are unchanged`);
     }
-    return v;
+    if (removed.length > 0) {
+        parts.push(`${removed.map(([o, n]) => `${o} (${n})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
+            `there is no replacement name and no rename that restores it`);
+    }
+    throw new Error(`retired env name(s) set ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
 }
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
@@ -387,11 +409,11 @@ function parseStoreDomain(ctx) {
     // 在场时,dbBackend 的旧默认 "mysql" 是**引擎选择器**(auto 探测/coords 构建都 key 它),默认切
     // local 会把这些既有形错切到文件店(回归钉在 config-coverage)。
     const sqlSignal = (!!process.env.SESSION_BACKEND && process.env.SESSION_BACKEND !== "memory") ||
-        !!(process.env.TIDB_HOST || process.env.MYSQL_HOST || process.env.PG_HOST);
+        !!(process.env.MYSQL_HOST || process.env.PG_HOST);
     const bareBoot = !dbBackendSet && !sqlSignal;
     const multiTenantBareBoot = bareBoot && requirePrincipal;
-    const dbBackendRaw = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", ["mysql", "tidb", "pg", "local", "memory"]);
-    const dbBackend = dbBackendRaw === "tidb" ? "mysql" : dbBackendRaw;
+    // [2354]:公名枚举不再收 "tidb"(enumEnv 对越集值自带拒启);内部逻辑不变。
+    const dbBackend = enumEnv("DB_BACKEND", bareBoot ? (multiTenantBareBoot ? "memory" : "local") : "mysql", ["mysql", "pg", "local", "memory"]);
     if (multiTenantBareBoot) {
         CONFIG_NOTICES.push({
             event: "db_backend_default_memory_multi_tenant",
@@ -407,7 +429,7 @@ function parseStoreDomain(ctx) {
     // backend); an UNSET DB_BACKEND keeps the memory default (no surprise DB requirement on a bare boot).
     // `mysql` is accepted as an alias of the internal durable label `tidb` (see ServiceConfig.sessionBackend).
     const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
-    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "tidb", "auto"]);
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "auto"]); // [2354]:公名 "tidb" 退役
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
     // P0.5 variant-2: the file-backed `local` backend's data root. Same tail as main.ts's `localRoot` and
     // run-local.ts's `root` (CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent), so the HTTP service + a run-local
@@ -421,7 +443,7 @@ function parseStoreDomain(ctx) {
     // `auto` builds the DB coords only when a host is actually configured — otherwise it stays memory with no
     // probe. (Explicit mysql always builds them so a missing host fails loudly.) `needsDb` is engine-agnostic;
     // the connection coords are built for whichever engine `dbBackend` selects (MYSQL_* preferred, TIDB_* alias).
-    const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!(process.env.MYSQL_HOST || process.env.TIDB_HOST);
+    const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;
     return {
@@ -433,14 +455,13 @@ function parseStoreDomain(ctx) {
         localDataRoot,
         tidb: needsDb && dbBackend === "mysql"
             ? {
-                host: env2("MYSQL_HOST", "TIDB_HOST"),
-                // default port follows the env family in use: MYSQL_HOST → 3306 (stock MySQL), TIDB_HOST → 4000 (TiDB)
-                port: Number(env2("MYSQL_PORT", "TIDB_PORT", process.env.MYSQL_HOST ? "3306" : "4000")),
-                user: env2("MYSQL_USER", "TIDB_USER"),
-                password: env2("MYSQL_PASSWORD", "TIDB_PASSWORD", ""),
-                database: env2("MYSQL_DATABASE", "TIDB_DATABASE"),
-                connectionLimit: process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE
-                    ? Number(process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE)
+                host: env("MYSQL_HOST"),
+                port: Number(env("MYSQL_PORT", "3306")),
+                user: env("MYSQL_USER"),
+                password: env("MYSQL_PASSWORD", ""),
+                database: env("MYSQL_DATABASE"),
+                connectionLimit: process.env.MYSQL_POOL_SIZE
+                    ? Number(process.env.MYSQL_POOL_SIZE)
                     : undefined,
             }
             : undefined,
@@ -528,7 +549,7 @@ function parseModelDomain() {
     // credential alone does NOT infer (a bare ANTHROPIC_API_KEY historically only assembles the cloud route for
     // registry-declared anthropic models); neither present ⇒ "gateway", byte-identical to before.
     const explicitProvider = process.env.MODEL_PROVIDER; // env() semantics: "" = unset
-    const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL");
+    const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASE_URL"); // [2354]:无下划线非标名退役(墓碑)
     const inferredAnthropicCred = firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN");
     const provider = (() => {
         if (explicitProvider !== undefined && explicitProvider !== "")
@@ -702,6 +723,11 @@ function parseModelDomain() {
                 ? { model: cur, systemPrompt: CODE_AGENT_PROMPT }
                 : { ...cur, systemPrompt: CODE_AGENT_PROMPT };
     }
+    // A2:词表验证**无条件**执行(此前它挂在下面 `MODEL_DEGRADE_TO ? {...}` 三元的真臂里,TO 缺席时
+    // parseDegradeOn 根本不可达 ⇒ 拼错词静默无效),而 USAGE.md 的「拼错词 boot 拒启,不静默忽略」是对
+    // MODEL_DEGRADE_ON 本身的无条件承诺:设了就验。TO 缺席 + ON 合法 ⇒ 照旧不装配 degrade(行为不变),
+    // 也不报错——ON 只是把那份已在的意图写下来,不是把 degrade 打开。
+    const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
         gatewayBaseUrl,
         gatewayApiKey: process.env.MODEL_API_KEY,
@@ -719,7 +745,7 @@ function parseModelDomain() {
             ? {
                 apiKey: firstSetEnv("ANTHROPIC_API_KEY"),
                 authToken: firstSetEnv("ANTHROPIC_AUTH_TOKEN"),
-                baseUrl: firstSetEnv("ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL"),
+                baseUrl: firstSetEnv("ANTHROPIC_BASE_URL"),
                 version: process.env.ANTHROPIC_VERSION,
                 cacheBreakpoints: (process.env.ANTHROPIC_CACHE_BREAKPOINTS ?? "true") === "true",
                 ...(process.env.ANTHROPIC_MAX_RETRIES ? { maxRetries: Number(env("ANTHROPIC_MAX_RETRIES", "2")) } : {}),
@@ -755,9 +781,10 @@ function parseModelDomain() {
                 to: env("MODEL_DEGRADE_TO"),
                 atCostFraction: Number(env("MODEL_DEGRADE_AT_COST_FRACTION", "0.7")),
                 reactive: boolEnv("MODEL_DEGRADE_REACTIVE", false),
-                downgradeOn: csv("MODEL_DEGRADE_ON").length
-                    ? csv("MODEL_DEGRADE_ON")
-                    : undefined,
+                // core 5.1.0([2390]②):词表=DegradeReason 全集;缺席时 core 默认含 server_error(默认门变宽),
+                // 本 env 是运维收窄/放宽的唯一旋钮。拼错词 boot 响亮拒——盲铸静默折无效成员是 TASK_TIMEOUT_SEC 同族病。
+                // (验词在上方无条件做掉了,见 A2 注;这里只是取用已验过的结果。)
+                downgradeOn: degradeOn,
                 // vision precheck (adversarial-review finding): the degrade TARGET is an external gateway
                 // model NOT in config.models, so resolveSpec's precheck (which only sees the picked model) can't see its
                 // vision capability — a vision-capable main + text-only degrade target would let images reach the text-only
@@ -771,6 +798,43 @@ function parseModelDomain() {
 }
 /** 域:approval(审批/HITL 门)—— 审批名单与预算、durable 面、直连门开关与钥、敏感写门、elicitation。
  *  注:直连门的**激活**(directDoorActive)与 D-G §3 半开门不变量是跨域合取,留在装配层。 */
+/** MODEL_DEGRADE_ON 词表=core `DegradeReason` 全集(集合用该类型铸=锁步:core 删词此处 tsc 红,加词这里
+ *  补一个词即可)。非法词 boot 响亮拒——盲铸静默折无效成员与 TASK_TIMEOUT_SEC 非法值折「无超时」同族。 */
+const DEGRADE_ON_WORDS = new Set(["breaker_open", "rate_limit", "budget", "server_error", "last_resort"]);
+function parseDegradeOn(words) {
+    if (words.length === 0)
+        return undefined;
+    const bad = words.filter((w) => !DEGRADE_ON_WORDS.has(w));
+    if (bad.length > 0) {
+        throw new Error(`MODEL_DEGRADE_ON has unknown trigger word(s): ${bad.join(", ")} (valid: ${[...DEGRADE_ON_WORDS].join(", ")})`);
+    }
+    return words;
+}
+export function findUnmatchableToolNames(names) {
+    const out = [];
+    for (const name of names) {
+        const retired = RETIRED_TOOL_NAMES.get(name);
+        if (retired !== undefined) {
+            out.push({ name, guidance: retired });
+            continue;
+        }
+        const ns = protocolOf(name);
+        if (ns === undefined) {
+            if (name.includes("__"))
+                out.push({ name, guidance: `pre-prefix MCP short form — the live name is mcp__${name}` });
+            continue;
+        }
+        if (ns.parse(name) === undefined) {
+            out.push({ name, guidance: `incomplete ${ns.id} name — the live form is ${ns.prefix}<server>__<tool>` });
+        }
+    }
+    return out;
+}
+/** {@link findUnmatchableToolNames} 的成句形——三条腿的文案同源(只有前缀/出口不同)。 */
+export function formatUnmatchableToolNames(source, bad) {
+    return (`${source} names tool(s) that can never match a live tool (core 5.0.0 RB-476 — the alias/auto-prefix folds are gone): ` +
+        bad.map((b) => `${b.name} → ${b.guidance}`).join("; "));
+}
 function parseApprovalDomain(ctx) {
     const { postureOn } = ctx; // 跨域入参②:posture 三态(single-user turnkey ⇒ HITL 面默认 ON)
     // design/80 D-G: the direct-connect approval door anchors (all must be present to ACTIVATE; fail-closed).
@@ -778,15 +842,24 @@ function parseApprovalDomain(ctx) {
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS);
     // DURABLE_APPROVAL 既是本域字段,也是直连门的硬前置 —— 那条前置的理由与断言在装配层的跨域不变量段。
     const durableApproval = boolEnv("DURABLE_APPROVAL", false);
+    // [2380] core 5.0.0 RB-476:approval 名单里「永不匹配」的名字**装配期拒启**(带修正指引)。core 自己的
+    // prepare 门(config.legacy_tool_name)在提交期才响——boot 期先拒,部署带失效名单不启动而不是首任务炸。
+    // 名单 RAW 直传(canonicalToolName 折叠面已随 core 退役,见 approval.ts);判据单点见
+    // {@link findUnmatchableToolNames}(env / 中心下发 / per-request 三腿共用同一条)。
+    const rejectUnmatchableToolNames = (envName, names) => {
+        const bad = findUnmatchableToolNames(names);
+        if (bad.length > 0)
+            throw new Error(formatUnmatchableToolNames(envName, bad));
+        return names;
+    };
     return {
-        approvalRequire: csv("APPROVAL_REQUIRE"),
-        approvalDeny: csv("APPROVAL_DENY"),
-        approvalPollMs: Number(env("APPROVAL_POLL_MS", "1500")),
+        approvalRequire: rejectUnmatchableToolNames("APPROVAL_REQUIRE", csv("APPROVAL_REQUIRE")),
+        approvalDeny: rejectUnmatchableToolNames("APPROVAL_DENY", csv("APPROVAL_DENY")),
         durableApproval,
         resourceSuspend: boolEnv("RESOURCE_SUSPEND", false),
         resourceSuspendTtlSec: Math.max(0, numEnv("RESOURCE_SUSPEND_TTL_SEC", "0")), // 0 ⇒ core default (30d)
         approvalAutoBudget: Math.min(10000, Math.max(0, numEnv("APPROVAL_AUTO_BUDGET", "0"))), // clamp [0,10000]; 0 = off
-        approvalNeverAuto: csv("APPROVAL_NEVER_AUTO"),
+        approvalNeverAuto: rejectUnmatchableToolNames("APPROVAL_NEVER_AUTO", csv("APPROVAL_NEVER_AUTO")),
         approvalHmacKeys: dgHmacKeys, // D-G: WIRED (see the field's JSDoc); empty ⇒ inactive, not unimplemented
         directApprovalDoor,
         // ③ sensitive-path write deny set: unset = core's recommended set; explicit value = full replacement
@@ -910,11 +983,10 @@ function parseAuthDomain(ctx) {
         .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
         .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
     return {
-        // 绑址([1934]):BIND_HOST 优先,HOST 兼容(cli/桌面传的就是它);空串=未设。
-        bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
-        // [2062]③ 来源记账:HOST 是 zsh 会替用户设的名字(HOST=机器名),{...process.env} 起底的壳会把它
-        // 静默继承给引擎——bind 面被 shell 环境暗配而部署者不知情。main.ts 对 "HOST" 来源打一行启动告警。
-        bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : process.env.HOST ? "HOST" : undefined,
+        // [2354]:HOST 读取臂已删(zsh 恒设 HOST=机器名,不可墓碑——静默不读;cli/桌面 [2053] 起已传
+        // BIND_HOST)。绑址唯一口=BIND_HOST;空串=未设。
+        bindHost: process.env.BIND_HOST || undefined,
+        bindHostSource: process.env.BIND_HOST ? "BIND_HOST" : undefined,
         authToken: process.env.SERVICE_AUTH_TOKEN,
         authTokens,
         allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
@@ -1210,35 +1282,16 @@ function parseIntegrationsDomain() {
         // 编码产品出厂态对标 CC 出厂态,通用域中性 persona 用 DEFAULT_SCENARIO=default 显式选回。
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
-        oaApiBaseUrl: process.env.OA_API_BASEURL,
-        oaServiceToken: process.env.OA_SERVICE_TOKEN,
-        // 开 issue 工具：默认开到 OA 系统仓(AI-Only/oa-asset-system)，写权限 token 走独立 env。
-        oaIssue: process.env.OA_ISSUE_TOKEN
-            ? {
-                // npm 卫生纪律:不再烤内网 git 主机缺省 — 开了 OA_ISSUE_TOKEN 就必须给 host(fail-loud)。
-                baseUrl: (() => {
-                    const u = process.env.OA_ISSUE_BASEURL ?? process.env.GIT_API_BASEURL;
-                    if (!u)
-                        throw new Error("OA_ISSUE_TOKEN is set but no OA_ISSUE_BASEURL / GIT_API_BASEURL — the issue tool needs a git host");
-                    return u;
-                })(),
-                owner: env("OA_ISSUE_OWNER", "AI-Only"),
-                repo: env("OA_ISSUE_REPO", "oa-asset-system"),
-                token: env("OA_ISSUE_TOKEN"),
-                defaultLabels: csv("OA_ISSUE_LABELS").map(Number).filter((n) => Number.isInteger(n)),
-            }
-            : undefined,
+        // [2354] clay 令:OA 场景整体退役(oa-tools/oa 场景/OA 轮询审批车道随 5.0.0 全清)——
+        // OA_* env 全族进 RETIRED_ENVS 墓碑(在场即拒启),此处零读取。
         // sema-registry (control plane) URL/token/worker. The orchestrator renamed the worker-injected env from
-        // CONFIG_CENTER_* → SEMA_REGISTRY_* (the control-plane host was renamed to match); it dual-injects
-        // both names at the SAME value during the transition, so we DUAL-READ here — new name preferred, old name
-        // fallback — and keep working after the orchestrator drops the legacy CONFIG_CENTER_* names. Pure config
-        // plumbing: no API/auth/task-logic change.
-        configCenter: (process.env.SEMA_REGISTRY_URL || process.env.CONFIG_CENTER_URL)
+        // [2354]:CONFIG_CENTER_* 双读已删(墓碑在 rejectRetiredEnvs);SEMA_REGISTRY_* 唯一。
+        configCenter: process.env.SEMA_REGISTRY_URL
             ? {
-                baseUrl: process.env.SEMA_REGISTRY_URL || env("CONFIG_CENTER_URL"),
-                token: process.env.SEMA_REGISTRY_TOKEN || process.env.CONFIG_CENTER_TOKEN || "",
-                dryRun: (process.env.SEMA_REGISTRY_DRY_RUN ?? process.env.CONFIG_CENTER_DRY_RUN) === "true",
-                worker: process.env.SEMA_REGISTRY_WORKER || process.env.CONFIG_CENTER_WORKER || undefined,
+                baseUrl: env("SEMA_REGISTRY_URL"),
+                token: process.env.SEMA_REGISTRY_TOKEN || "",
+                dryRun: process.env.SEMA_REGISTRY_DRY_RUN === "true",
+                worker: process.env.SEMA_REGISTRY_WORKER || undefined,
             }
             : undefined,
         configProvider: process.env.CONFIG_PROVIDER || undefined,
@@ -1254,7 +1307,7 @@ const MODEL_PLANE_GROUP_KEYS = [
     "modelApiKeyEnv", "modelApiKeys", "modelQuotaWeights", "tiers", "projects", "roles", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
-    "approvalRequire", "approvalDeny", "approvalPollMs", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
+    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "askQuestionEnabled", "toolApprovalEnabled", "mcpElicitation", "sensitiveWritePatterns",
     "manualModeShellGate",
@@ -1286,7 +1339,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "defaultScenario",
-    "skillsDir", "oaApiBaseUrl", "oaServiceToken", "oaIssue", "configCenter", "configProvider", "configLocalDir",
+    "skillsDir", "configCenter", "configProvider", "configLocalDir",
 ];
 /** 组名 → 该组取景的平铺键(introspection 面:测试用它钉「每个平铺键恰好被一组取景」)。 */
 export const CONFIG_GROUP_KEYS = {
@@ -1339,6 +1392,7 @@ export function attachConfigGroups(flat) {
     return flat;
 }
 export function loadConfig() {
+    rejectRetiredEnvs(); // [2354] 退役 env 墓碑:在场即拒启带新名指引
     CONFIG_WARNINGS.length = 0; // repeated loadConfig() calls (test setup) must not accumulate stale warnings
     CONFIG_NOTICES.length = 0;
     CONFIG_KNOBS.clear(); // the polarity table describes THIS load, never a previous one's env
@@ -1379,8 +1433,8 @@ export function loadConfig() {
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const { enabled: imageBakesEnabled, runnerPrincipal: bakeRunnerPrincipal } = orchestration.imageBakes;
     // 🔴 the direct-door crypto gate lives ONLY in the durable (checkpointStore) /decide branch — so DURABLE_APPROVAL
-    // is a HARD precondition. Without it, checkpointStore is undefined, that branch is skipped, and the LEGACY
-    // approvalStore /decide (trusted-header, NO crypto) becomes the live path = a full bypass (adversarial CRITICAL).
+    // is a HARD precondition. Without it, checkpointStore is undefined and there is NO decide path at all
+    // ([2354] A-5:legacy trusted-header /decide 车道已在 5.0.0 退役——本不变量从「防旁路」变成「防死门」,保留)。
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
     // 🔴 boot invariant (D-G §3): a half-configured direct door is the WORST state (looks on, verifies nothing) — and
     // an empty OPERATOR_PRINCIPALS makes isOperator() true-for-all (= cross-tenant escalation). Refuse to start.

package/dist/fleet/fleet-bus.d.ts

@@ -54,7 +54,7 @@ export interface FleetTaskRow {
     status: FleetTaskStatus;
     /** core 1.367 δ([1514]/[1515]④):launch 时刻 epoch ms(revive 行=本 revive 周期 wake 时刻)——
      *  cli 的 elapsed 锚直出(比 server 端 elapsedMs 快照更稳,消费方自算不漂)。ADDITIVE / tolerate-absent
-     *  (a* 车道 spawn 即带;旧 core 帧无 startedAt 时回落 server 收帧时刻)。 */
+     *  (a* 车道 spawn 即带;诚实缺席——回落 server 收帧时刻的臂已随 [2354] 删,floor ^4.0.0 下 startedAt 恒在)。 */
     startedAt?: number;
     elapsedMs?: number;
     tokens?: number;

package/dist/fleet/fleet-bus.js

@@ -21,7 +21,6 @@
  * replica-local). A cross-replica fleet roll-up is a fleet-token-gated trace-API concern (separate), not this.
  */
 import { EventEmitter } from "node:events";
-import { canonicalToolName } from "@sema-agent/core";
 import { redactSecrets } from "../trace/redact.js";
 /**
  * The process-local fleet aggregation bus. Holds the current active set + fans out deltas to SSE subscribers.
@@ -231,7 +230,9 @@ export function fleetRunPublisher(bus, run) {
         // `totalInputTokens`,旧核帧(尚未升级到 3.0.0、该键缺席)回落 `inputTokens`(防御性:本引擎恒 ≥3.0.0
         // 时两键并存;异常帧宁少算不 NaN)。Display-only(leader fleet 行的 token 数);billing(costMicroUsd)+
         // context/compaction 走 totalTokens,不受影响;child 行走 task_progress.usage.totalTokens(上面的早退臂)。
-        return (u.totalInputTokens ?? u.inputTokens ?? 0) + (u.outputTokens ?? 0);
+        // [2354] 兼容面全清:旧核帧回落臂(?? u.inputTokens)已删——floor ^4.0.0 下 totalInputTokens 恒在;
+        // 键缺席=越契约帧,按 0 计(宁少算不借异语义键充数)。
+        return (u.totalInputTokens ?? 0) + (u.outputTokens ?? 0);
     };
     return {
         onStart() {
@@ -283,7 +284,7 @@ export function fleetRunPublisher(bus, run) {
                 // PascalCase double-belt (core 1.176): canonicalize so a legacy snake CONTROL verb (e.g. a
                 // pre-1.176 emit / a stray report_blocked) renders as its CC name (ReportBlocked) and the shell's PascalCase
                 // suppression Set still hides it — never re-leaking a control verb as fleet-row activity.
-                bus.publishTask({ id: run.runId, description: canonicalToolName(ev.toolName) });
+                bus.publishTask({ id: run.runId, description: ev.toolName }); // RAW(5.0.0):live 名恒 canonical
             }
         },
         onForwardEvent(ev) {
@@ -595,9 +596,10 @@ export function fleetBackgroundChildPublisher(bus, log) {
             ...(inheritParent && tomb?.resolvedParentId !== undefined ? { resolvedParentId: tomb.resolvedParentId } : {}),
             // session-scoped: registry owner IS the host sessionId (design/129 owner key); fork spawns also carry
             // the child's uuid sessionId — that is the a*↔uuid cross-system anchor, NOT the host session, so it is not used here.
-            // [1522] LOW4:session-scoped 臂同样 root-first(另两臂 1.250 已升)——嵌套 session-scoped 形
-            // 的 owner=中间层子会话 uuid,标它=over-filter;显式 root 到货即锚 root(近死码但一处改齐)。
-            ...(e.sessionScoped && e.owner ? { hostSessionId: e.rootSessionId ?? e.owner } : {}),
+            // [1522] LOW4 root-first。[2378]/[2380] RB-478 到货:三条 revive 发射腿全部无条件带
+            // `root ?? parent` 链 ⇒ `?? e.owner` 回落臂成纯死臂,删([2370] 补审时显式排除在全清宣称外
+            // 等的就是这一天)。rootSessionId 缺席=不打 host 标(over-filter 方向,durable drain 兜)。
+            ...(e.sessionScoped && e.owner && e.rootSessionId ? { hostSessionId: e.rootSessionId } : {}),
             // 🔴 scope DOMAIN mapping: core's registry scope is `ctx.principal ?? deployment scope` —
             // UNDEFINED on a single-user no-principal deployment — while the service fleet domain keys the
             // no-principal caller as "default" (`gatedPrincipal ?? "default"`, streamFleet's callerScope). Without
@@ -606,8 +608,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
             // a principal exists, so the map is exact.
             tenantScope: e.scope ?? "default",
             sessionScoped: e.sessionScoped,
-            // core 1.367 δ:真 launch 锚(revive=wake 时刻)优先;旧 core 帧回落收帧时刻([1338]④ 原形)
-            spawnedAt: e.startedAt ?? Date.now(),
+            // [2354] 兼容面全清:旧 core 帧「回落收帧时刻」臂已删——floor ^4.0.0 下 startedAt 恒在;
+            // 缺席=诚实不发(行键 optional,消费端本就容忍缺席)。
+            ...(e.startedAt !== undefined ? { spawnedAt: e.startedAt } : {}),
             ...(e.rootSessionId ? { rootSessionId: e.rootSessionId } : {}),
             ...(e.parentToolCallId ? { parentToolCallId: e.parentToolCallId } : {}), // P1-2(core 1.432,12 发射点全带)
             ...(e.sessionId ? { aliasUuid: e.sessionId } : {}), // codex R4(M-B):uuid↔a* 别名(fork spawn 带 forkedId)
@@ -617,15 +620,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
             // core 帧的 parentSessionId(发起会话,1.350 声明字段——R2:无 runStore 的瞬态 sync 部署没有宿主
             // fleet 行,行查 fallback 必空);②宿主行 sessionId 查表(同租户)兜底。
             ...(e.workflowRunId && !(e.sessionScoped && e.owner)
-                ? (() => {
-                    // core 1.367 δ:显式 root 锚(spawnAttribution 把 root 传进每个 workflow-agent)——信任源第一
-                    if (e.rootSessionId)
-                        return { hostSessionId: e.rootSessionId };
-                    if (e.parentSessionId)
-                        return { hostSessionId: e.parentSessionId };
-                    const host = e.parentTaskId ? bus.snapshot().tasks.find((r) => r.id === e.parentTaskId && r.scope === (e.scope ?? "default")) : undefined;
-                    return host?.sessionId ? { hostSessionId: host.sessionId } : {};
-                })()
+                // [2378]/[2380] RB-478:wa* 三级回落(root→parentSessionId→行查表)收单级——core 三条发射腿
+                // 已无条件带 root 锚,后两级成死臂;缺席=不打标(over-filter,durable 兜),不再猜。
+                ? (e.rootSessionId ? { hostSessionId: e.rootSessionId } : {})
                 : {}),
             // [1493] cross-session isolation: a NON-session-scoped, non-wa* bg child (owner = the run taskId — the
             // norm when backgroundScope!="session", i.e. every multi-tenant deployment, and any local path where the
@@ -654,18 +651,11 @@ export function fleetBackgroundChildPublisher(bus, log) {
             // top-level/nested discriminator) on the spawn event — asked as a core seam follow-up ([1493]).
             // core 1.367 δ:[1493] fable5-R1 注里请的 root fix **到货**——spawn 帧显式带 rootSessionId
             // (固定点语义,嵌套孙代恒=root shell 会话),信任源直用;alias 反查臂降为旧 core 帧回落。
-            ...(!(e.sessionScoped && e.owner) && !e.workflowRunId && (e.rootSessionId ?? e.parentSessionId)
-                ? (() => {
-                    if (e.rootSessionId)
-                        return { hostSessionId: e.rootSessionId };
-                    const childScope = e.scope ?? "default";
-                    for (const pm of meta.values()) {
-                        if (pm.aliasUuid === e.parentSessionId && (pm.tenantScope ?? "default") === childScope) {
-                            return pm.hostSessionId ? { hostSessionId: pm.hostSessionId } : {}; // nested: inherit root (or stay untagged → Part B)
-                        }
-                    }
-                    return { hostSessionId: e.parentSessionId }; // top-level: parentSessionId IS the shell root session
-                })()
+            // [2354] 兼容面全清:alias 反查臂(旧 core 帧无 rootSessionId 时经 meta 反查 parentSessionId)已删——
+            // floor ^4.0.0 下 spawn 帧恒带 rootSessionId(core 1.367 δ 固定点语义);缺席=不打 host 标,
+            // 失败方向仍是 over-filtering(durable inbox/stream-open drain 兜),永不 cross-delivery。
+            ...(!(e.sessionScoped && e.owner) && !e.workflowRunId && e.rootSessionId
+                ? { hostSessionId: e.rootSessionId }
                 : {}),
         };
         remember(e.taskId, m);
@@ -719,9 +709,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
         }
         const tokens = sumUsage(e.usage);
         const name = e.name ? redactSecrets(e.name) : undefined;
-        // [1364]③ K-7 换位:TYPE 列取 tick 帧的行级 `agentType`(core 1.350 定谳:`name` 位=display 标签
-        // ——description 充是历史语义非 bug,类型名在 agentType 位)。缺省回落 name(旧 core 兼容,原行为)。
-        const agentType = e.agentType ? redactSecrets(e.agentType) : name;
+        // [1364]③ K-7 换位:TYPE 列取 tick 帧的行级 `agentType`(core 1.350 定谳)。[2354] 兼容面全清:
+        // 「缺省回落 name」旧 core 兼容臂已删——floor ^4.0.0 下 agentType 恒在;缺席=诚实不发(行键 optional)。
+        const agentType = e.agentType ? redactSecrets(e.agentType) : undefined;
         // The sink tick carries core's currentAction (its only attachment point today) —
         // UNTRUSTED (tool argument head) → redact, same discipline as name. Additive; absent until a tool runs.
         const currentAction = e.currentAction ? redactSecrets(e.currentAction) : undefined;
@@ -838,7 +828,9 @@ export function fleetBackgroundChildPublisher(bus, log) {
             handleSpawn(e);
             return;
         }
-        const m = meta.get(e.taskId) ?? { sessionScoped: e.sessionScoped, tenantScope: e.scope ?? "default", spawnedAt: Date.now() }; // scope domain map holds on the lazily-minted path too([1338]④ 首见起表);F2(2026-07-30 复审):lazy-mint 曾硬编码 "default",scoped 部署下 claim 落错租户键 ⇒ 让位失效退回双生行
+        // [2354] 补审 F2:lazy-mint 不再铸 spawnedAt: Date.now() 假锚(与 spawn 臂同口径——缺 launch 锚=
+        // 诚实缺席,行键 optional;tick/terminal 先到=restart/丢 spawn 边缘,收帧时刻不是 launch 时刻)。
+        const m = meta.get(e.taskId) ?? { sessionScoped: e.sessionScoped, tenantScope: e.scope ?? "default" }; // scope domain map holds on the lazily-minted path too([1338]④ 首见起表);F2(2026-07-30 复审):lazy-mint 曾硬编码 "default",scoped 部署下 claim 落错租户键 ⇒ 让位失效退回双生行
         if (!meta.has(e.taskId)) {
             remember(e.taskId, m); // tick/terminal without a seen spawn (restart/eviction edge) — row minted lazily
             dlog("bg_child_event", { kind: `${e.kind}-lazy-mint`, taskId: e.taskId, sessionScoped: e.sessionScoped });

package/dist/fleet-client.js

@@ -190,7 +190,7 @@ export function startFleetClientFromEnv(cfg, opts) {
     if (!cc?.baseUrl || !cc.token || !address)
         return undefined;
     if (!cc.worker) {
-        opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but CONFIG_CENTER_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+        opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         return undefined;
     }
     return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker }, advertiseAddress: address });

package/dist/http/active-run-conflict.d.ts

@@ -38,6 +38,8 @@ export declare function resumeEntryForGate(kind: string, ids: {
  */
 export interface ActiveRunConflictDoneResult {
     status: "failed";
+    /** [2373]C-1:与 409 体同一机器码——流腿客户端凭它认拒绝,禁按 byte-frozen 文案匹配。 */
+    errorCode: "conflict.session_active_run";
     errorMessage: string;
     activeTaskId: string | null;
     activeTaskStatus?: string;

package/dist/http/active-run-conflict.js

@@ -36,6 +36,7 @@ export function resumeEntryForGate(kind, ids) {
 export function toDoneFrameResult(body) {
     return {
         status: "failed",
+        errorCode: body.errorCode,
         errorMessage: body.error,
         activeTaskId: body.activeTaskId,
         ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),

package/dist/http/routes/approvals-assistant.d.ts

@@ -4,7 +4,8 @@
  * 路由(前缀 `/v1/approvals` 与 `/v1/assistant`):
  *   · durable 腿(接了 checkpointStore 时优先):list / stream(SSE 原生推送)/ decide|answer / preempt /
  *     resume / plan_review;
- *   · legacy 腿(仅 approvalStore):list / by-id / decide —— 直连门部署下**必须**打不到(fail closed)。
+ *   · legacy 腿(approvalStore 轮询车道)已于 5.0.0 整体退役([2354]/[2356] A-5)——无 checkpointStore 时
+ *     `/v1/approvals` 落 404(诚实缺席),不再有 trusted-header 决裁面。
  *
  * 所有会**烧模型**的续跑都经 `ctx.legs.*`(resumeCheckpoint / resumePreempted / resumePlanReview)走 resume
  * 家族的同一条腿:lease admission、markResuming CAS、写 run log、发 fleet 帧都在腿里,本域只做入站鉴权/形状门。