@sema-agent/server 7.102.0 → 7.103.0

package/dist/config.d.ts

@@ -1,6 +1,7 @@
 import { type Model, type PathRuleBases, type RuleBehavior } from "@sema-agent/core";
 import { type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type Autonomy } from "./runtime-governance.js";
+import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
 /** [ref] A1: the config TYPE face lives in the leaf module config-types.ts; re-exported here so
  *  every existing `from "./config.js"` importer compiles unchanged (pure-type consumers should prefer
@@ -31,6 +32,8 @@ export declare function parseUsageWindows(raw: string | undefined): readonly {
     maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
+/** 墓碑拒启码(机读;拒句方括号里)。 */
+export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;
@@ -231,6 +234,10 @@ export declare const hostExecSpoolEnabled: () => boolean;
  * 门 = `test/deploy-lanes-contract.test.ts`,它读的是本表而不是任何副本。
  */
 export declare const REQUIRED_ENVS_BY_LANE: Record<RemoteExecProvider, readonly string[]>;
+/** 名单型 env 旋钮的**唯一**解析器(规则全文见上方 `ENV_NAME_ALLOWLIST_KNOBS` 头注)。`undefined` = 没配(未设 / 空串)。
+ *  服务侧旋钮要交本进程的姿态(③);runner 旋钮没有姿态,签名上就不收 —— 读者与行形由叶表的类型一起定,传错是编译红。 */
+export declare function parseEnvNameAllowlist(knob: ServerEnvNameAllowlistKnob, singleUserTurnkey: boolean): readonly string[] | undefined;
+export declare function parseEnvNameAllowlist(knob: RunnerEnvNameAllowlistKnob): readonly string[] | undefined;
 /** [ref]① 1M dual-window (core 1.289 `Model.autoCompactTokens`): an EXPLICIT positive value wins (env
  *  `MODEL_AUTO_COMPACT_TOKENS` / center roster `autoCompactTokens`); else the **model-id table** applies —
  *  sonnet-5-family id ∧ contextWindow>=1e6 ⇒ 967000 (the faithful shape of CC's single-entry per-model

package/dist/config.js

@@ -10,7 +10,7 @@ import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS } from "./config-types.js";
+import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
@@ -26,7 +26,7 @@ import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
-import { ENV_NAME_ALLOWLIST_KNOBS, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
+import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -104,6 +104,7 @@ function defaultSkillsDir() {
         return "skills";
     }
 }
+export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
 const RETIRED_ENVS = [
     ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
     ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
@@ -120,22 +121,33 @@ const RETIRED_ENVS = [
     ["OA_ISSUE_LABELS", "the OA scenario was removed in 5.0.0", "removed"],
     ["APPROVAL_POLL_MS", "the OA poll-approval lane was removed in 5.0.0; the durable checkpoint lane is the only gate", "removed"],
     ["LEADER_CONFLICT_ROUNDS", "the bounded merge-conflict-resolution agent was deleted in 7.83.0 按 C-R63 删除,合不上交用户:leader 交回 result.conflict(分支 + 冲突文件),run 状态 needs_human", "removed"],
+    [
+        "MODEL_CONNECT_TIMEOUT_MS",
+        "MODEL_FIRST_BYTE_TIMEOUT_MS",
+        "replaced",
+        "since core 7.33.0 the TCP + TLS connect clock is the transport's own; the wait from sending the request to its response headers — " +
+            "what this key really bounded — is MODEL_FIRST_BYTE_TIMEOUT_MS (unset = core's own default, plus an upload allowance and one " +
+            "widened retry; 0 = no engine clock on that segment and the transport's header / body clocks off too — the TCP + TLS connect " +
+            "keeps the transport's own clock)",
+    ],
 ];
+const RETIRED_ENV_SENTENCE = {
+    renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
+    replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
+        `its value semantics differ from the retired key's, so do not copy the old value across unread`,
+    removed: (hits) => `${hits.map(([old, why]) => `${old} (${why})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
+        `there is no replacement name and no rename that restores it`,
+};
+function retiredEnvSentence(kind, hit) {
+    const ofKind = hit.filter((h) => h[2] === kind);
+    return ofKind.length > 0 ? [RETIRED_ENV_SENTENCE[kind](ofKind)] : [];
+}
 function rejectRetiredEnvs() {
     const hit = RETIRED_ENVS.filter(([o]) => process.env[o] !== undefined && process.env[o] !== "");
     if (hit.length === 0)
         return;
-    const renamed = hit.filter(([, , k]) => k === "renamed");
-    const removed = hit.filter(([, , k]) => k === "removed");
-    const parts = [];
-    if (renamed.length > 0) {
-        parts.push(`${renamed.map(([o, n]) => `${o} → use ${n}`).join("; ")} — rename the env key(s); the value semantics are unchanged`);
-    }
-    if (removed.length > 0) {
-        parts.push(`${removed.map(([o, n]) => `${o} (${n})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
-            `there is no replacement name and no rename that restores it`);
-    }
-    throw new Error(`retired env name(s) set ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
+    const parts = Object.keys(RETIRED_ENV_SENTENCE).flatMap((kind) => retiredEnvSentence(kind, hit));
+    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] ([2354] 兼容面全清,5.0.0 起拒启): ${parts.join(" | ")}.`);
 }
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
@@ -491,9 +503,8 @@ function parseNameListEnv(name, raw, opts) {
     return names;
 }
 const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
 const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
-function parseEnvNameAllowlist(knob, singleUserTurnkey) {
+export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
     const raw = process.env[knob];
     if (raw === undefined || raw === "")
         return undefined;
@@ -513,7 +524,7 @@ function parseEnvNameAllowlist(knob, singleUserTurnkey) {
             " — refusing to start rather than silently allowing a partial list (#157). The value is not echoed (a pasted NAME=value pair may carry a secret)." +
             ` Write ${knob}=NAME,NAME with bare variable names, e.g. ${spec.example}.`);
     });
-    if (!singleUserTurnkey) {
+    if ("multiTenant" in spec && singleUserTurnkey !== true) {
         const posture = spec.multiTenant;
         switch (posture.kind) {
             case "ignored":
@@ -680,6 +691,21 @@ function parseAutoModeClassifierTimeoutMs(raw) {
     }
     return { autoModeClassifierTimeoutMs: n };
 }
+function parseFirstByteTimeoutMs(raw) {
+    if (raw === undefined || raw === "")
+        return {};
+    const { minMs, maxMs } = FIRST_BYTE_TIMEOUT_BOUNDS;
+    const n = /^(0|[1-9]\d*)$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < minMs || n > maxMs) {
+        const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
+        throw new Error(`env MODEL_FIRST_BYTE_TIMEOUT_MS=${JSON.stringify(shown)} must be a number of milliseconds: a whole number in [${minMs}, ${maxMs}] ` +
+            `(decimal digits only; unset = core's own default). It bounds the wait from sending the request to its response headers; "0" = no engine clock on ` +
+            `that segment and the transport's header / body clocks off too (the TCP + TLS connect keeps the transport's own clock); ` +
+            `above ${maxMs} Node collapses the timer to 1ms. Refusing to boot rather ` +
+            `than running the core default while the operator believes their value is in force (#210).`);
+    }
+    return { firstByteTimeoutMs: n };
+}
 function headerNameEnv(name, fallback) {
     const v = env(name, fallback);
     if (!/^[A-Za-z0-9_-]+$/.test(v))
@@ -1045,7 +1071,7 @@ function parseModelDomain() {
             }
             : undefined,
         resilience: {
-            connectTimeoutMs: numEnv("MODEL_CONNECT_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.connectTimeoutMs.value)),
+            ...parseFirstByteTimeoutMs(process.env.MODEL_FIRST_BYTE_TIMEOUT_MS),
             firstTokenTimeoutMs: numEnv("MODEL_FIRST_TOKEN_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value)),
             idleTimeoutMs: numEnv("MODEL_IDLE_TIMEOUT_MS", String(RESILIENCE_DEFAULTS.idleTimeoutMs.value)),
             circuitBreaker: boolEnv("MODEL_CIRCUIT_BREAKER", RESILIENCE_DEFAULTS.circuitBreaker.value),

package/dist/env-name-allowlist-knobs.d.ts

@@ -4,31 +4,45 @@
  * 解析规则(未设 / 形错拒启 / 姿态 / 生效名单)的全文在 `config.ts` `parseEnvNameAllowlist` 的头注;本表只装**各旋钮自己的**事实,
  * 不是解析规则:
  *  · `example` 进拒句;
- *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数。
+ *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数 —— **只有服务进程读的旋钮有这一列**(姿态是服务进程的概念):
  *    - `LSP_ENV_ALLOW` ⇒ ignored:host 腿语言服务器在多租户姿态下本来就不起,名单无处作数,设了要说出来(S-699)。
  *    - 两只沙箱名单 ⇒ honored:S-713 照录修前语义(任何姿态下都转发),S-715 主会话裁定维持 —— 沙箱 env 是部署方为隔离沙箱显式配的
  *      带外凭据(e2b / docker 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
- * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红。
+ *  · `BAKE_ENV_ALLOW`(S-684 残余,7.103.0)由 **bake-runner 进程**读(构建宿主守护进程:没有主体、没有租户 ⇒ 没有姿态列,
+ *    不进 {@link describeAllowlistPostures} 的姿态句)。它与三只服务侧旋钮同一只解析器、同一只「点名放行」谓词、同一条「原文按凭据类」律。
+ * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红;行形随读它的进程定(服务进程 ⇒ 必须写姿态列)。
  *
  * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
  * {@link describeAllowlistPostures} 的读数 —— 今天三处:`config_env_forwarded_multi_tenant.note`(`config.ts` 解析器)、LSP 剥除现场的
  * 出路句(`observability/secret-env-scrub.ts`)、配置目录 `LSP_ENV_ALLOW` 行(`config-catalog.ts`)。修前三处各手抄一遍,表改一格它们
  * 当场撒谎。为什么是纯叶:`config-catalog.ts` 被 `config.ts` 值引,表留在 `config.ts` 会成装载环。
  */
-export type EnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+/** 服务进程(`config.ts` `loadConfig`)读的名单型旋钮 —— 有多租户姿态。 */
+export type ServerEnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+/** bake-runner 进程(`bake-runner/main.ts` `loadEnv`)读的名单型旋钮 —— 构建宿主守护进程没有主体 / 租户,没有姿态。 */
+export type RunnerEnvNameAllowlistKnob = "BAKE_ENV_ALLOW";
+export type EnvNameAllowlistKnob = ServerEnvNameAllowlistKnob | RunnerEnvNameAllowlistKnob;
 export type EnvNameAllowlistPosture = {
     readonly kind: "honored";
 } | {
     readonly kind: "ignored";
     readonly why: string;
 };
+/** 服务侧旋钮一行:拒句示例 + 多租户姿态。 */
+export interface ServerEnvNameAllowlistKnobRow {
+    readonly example: string;
+    readonly multiTenant: EnvNameAllowlistPosture;
+}
+/** runner 旋钮一行:只有拒句示例(没有姿态可言)。 */
+export interface RunnerEnvNameAllowlistKnobRow {
+    readonly example: string;
+}
 export type EnvNameAllowlistKnobTable = {
-    readonly [K in EnvNameAllowlistKnob]: {
-        readonly example: string;
-        readonly multiTenant: EnvNameAllowlistPosture;
-    };
+    readonly [K in EnvNameAllowlistKnob]: K extends ServerEnvNameAllowlistKnob ? ServerEnvNameAllowlistKnobRow : RunnerEnvNameAllowlistKnobRow;
 };
 export declare const ENV_NAME_ALLOWLIST_KNOBS: EnvNameAllowlistKnobTable;
+/** 名单型旋钮的全部名字(四只;表键派生)—— 两处用:解析器的「点名名单型旋钮 = 形错」、剥除的「名单原文按凭据类」臂。 */
+export declare const ENV_NAME_ALLOWLIST_KNOB_NAMES: ReadonlySet<string>;
 /**
  * 多租户姿态句 —— **由表派生**,不许在别处手写。形:`under REQUIRE_PRINCIPAL=true: <旋钮> is ignored; <旋钮> / <旋钮> are forwarded as configured`
  * (按 {@link POSTURE_PHRASE} 的 kind 序分组、组内按表序;空组不出现)。只有旋钮名与姿态,不带任何名单内容。

package/dist/env-name-allowlist-knobs.js

@@ -5,15 +5,20 @@ export const ENV_NAME_ALLOWLIST_KNOBS = {
     },
     E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
     DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+    BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN" },
 };
+export const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));
 const POSTURE_PHRASE = {
     ignored: { one: "is ignored", many: "are ignored" },
     honored: { one: "is forwarded as configured", many: "are forwarded as configured" },
 };
 export function describeAllowlistPostures(table = ENV_NAME_ALLOWLIST_KNOBS) {
-    const knobs = Object.keys(table);
+    const postured = Object.keys(table).flatMap((k) => {
+        const row = table[k];
+        return "multiTenant" in row ? [{ knob: k, kind: row.multiTenant.kind }] : [];
+    });
     const groups = Object.keys(POSTURE_PHRASE).flatMap((kind) => {
-        const named = knobs.filter((k) => table[k].multiTenant.kind === kind);
+        const named = postured.filter((p) => p.kind === kind).map((p) => p.knob);
         if (named.length === 0)
             return [];
         const phrase = POSTURE_PHRASE[kind];

package/dist/fleet-client.d.ts

@@ -12,8 +12,11 @@
  *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
  *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
  *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
- *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启,比任何观测都快):draining 翻转由收尾链直调
- *    `announceNow`;roster 落地与 restart 信号变化由装配层把 config-center 的 `onSelfReportChange` 接到 `announceNow`
+ *  - **`modelRefusals?`(S-768)**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
+ *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
+ *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
+ *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 config-center 的 `onSelfReportChange` 接到 `announceNow`
  *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
@@ -21,7 +24,7 @@
  *    向前合并不会双计 —— 只延迟,不丢量)。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport, type RestartSignal } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type ModelRefusalsSignal, type RestartSignal } from "@sema-agent/settings-schema/fleet";
 import type { ReadinessVerdict } from "./http/readiness.js";
 import { type CenterEndpoint } from "./config-center/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
@@ -80,6 +83,9 @@ export interface FleetClientOpts {
     /** S-741:restart 信号(装配层接 `/health` 同一只取值口 `deployment.restartState`)。每条公告现读一次;`undefined` ⇒ 公告不带
      *  `restart` 键。必填:心跳面没有「不知道要不要重启」这一形。 */
     restart: () => RestartSignal | undefined;
+    /** S-768:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
+     *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */
+    modelRefusals: () => ModelRefusalsSignal | undefined;
     usage?: FleetUsageAccumulator;
     heartbeatMs?: number;
     usageWindowMs?: number;

package/dist/fleet-client.js

@@ -87,6 +87,7 @@ export function startFleetClient(opts) {
         try {
             const verdict = opts.readiness();
             const restart = opts.restart();
+            const modelRefusals = opts.modelRefusals();
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
@@ -96,6 +97,7 @@ export function startFleetClient(opts) {
                 draining: !verdict.ready && verdict.reasons.includes("draining"),
                 heartbeatMs,
                 ...(restart !== undefined ? { restart } : {}),
+                ...(modelRefusals !== undefined ? { modelRefusals } : {}),
             };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)

package/dist/host-lsp-manager.d.ts

@@ -9,7 +9,7 @@
  * `scrubServerSecrets` 的结果)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 语言服务器子进程的 env = `scrubServerSecrets`(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
  * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(今天是 `OTEL_EXPORTER_OTLP_HEADERS`),那正是 S-684 当初的病形。
@@ -23,8 +23,9 @@
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
  * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
- * env = {@link scrubServerSecrets}(process.env) 之上把 `config.lspEnvAllow` 点到的键经 {@link allowlistedEnv}(与 host shell
- * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥。名单由 `config.ts` 解析(形错拒启;
+ * env = `scrubServerSecrets`(process.env) 之上把 `config.lspEnvAllow` 点到的键经 `allowlistedEnv`(与 host shell
+ * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥 —— 7.103.0 起这件组合只有一只:{@link hostSubprocessEnv}
+ * (`server-secret-env.ts`,bake-runner 的 `BAKE_ENV_ALLOW` 调同一只)。名单由 `config.ts` 解析(形错拒启;
  * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。
  * 放回的键不是剥除 ⇒ 不进 `secret_env_scrubbed` 的键表与计数;剥掉的键经既有现场 `server.lsp.spawn-env` 一行 warn
  * (带当前放行名单与出路句),这一行就是「剥了什么」的用户可见面 —— 语言服务器侧从不报。

package/dist/host-lsp-manager.js

@@ -1,11 +1,7 @@
 import { NodeLspManager } from "@sema-agent/core";
-import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
-import { allowlistedEnv, scrubServerSecrets } from "./server-secret-env.js";
+import { hostSubprocessEnv } from "./server-secret-env.js";
 export function createHostLspManager(config, log) {
-    const scrubFindings = [];
-    const composed = { ...scrubServerSecrets(process.env, scrubFindings), ...allowlistedEnv(config.lspEnvAllow, process.env) };
-    const findings = scrubFindings.filter((f) => composed[f.key] === undefined);
-    recordSecretEnvScrub("server.lsp.spawn-env", findings, config.lspEnvAllow);
+    const composed = hostSubprocessEnv({ site: "server.lsp.spawn-env", allow: config.lspEnvAllow });
     const env = {};
     for (const [k, v] of Object.entries(composed))
         if (v !== undefined)

package/dist/http/dispatch.js

@@ -145,6 +145,10 @@ export function createDispatch(ctx) {
                     const credential = deps.centerCredentialState?.();
                     return credential ? { centerCredential: credential } : {};
                 })(),
+                ...(() => {
+                    const modelRefusals = deps.modelRefusalsState?.();
+                    return modelRefusals ? { modelRefusals } : {};
+                })(),
                 ...(() => {
                     const probe = deps.storeLiveState?.();
                     if (!probe)

package/dist/http/server.d.ts

@@ -680,6 +680,10 @@ export interface ServiceDeploymentDeps {
      *  `buildCenterCredentialHealthView` 铸形,只有闭集词 / 时刻 / 计数,不带路径与令牌)。缺席 / 返回 undefined = 健康或没有中心
      *  ⇒ `/health` 形状逐字不变(additive)。 */
     centerCredentialState?: () => import("../center-credential-renewer.js").CenterCredentialHealthView | undefined;
+    /** S-768:模型拒因信号(`/health.modelRefusals`,settings-schema 6.2.0 `ModelRefusalsSignal` 形:名 → 码 + 组拒码)。fleet 心跳读**这同一只**
+     *  (`boot/stage-10-http-server.ts` → `modelRefusals: () => deployment.modelRefusalsState?.()`)—— 一处铸、两出口。缺席 / 返回 undefined =
+     *  没有可报的拒或没有配置管道 ⇒ `/health` 形状逐字不变(additive)。 */
+    modelRefusalsState?: () => import("@sema-agent/settings-schema").ModelRefusalsSignal | undefined;
     /** [ref] 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
      *  缺席 / 回 `"not-wired"` = 本部署没有配置管道 ⇒ 该口诚实 4xx(绝不吞成 200)。 */
     configRefreshNow?: () => Promise<"triggered" | "not-wired" | "failed">;

package/dist/leader/wire.d.ts

@@ -264,7 +264,14 @@ export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;
 /** Coordinator(control plane,持有推送凭据)的 git push 闭包——从 `createLeaderRunner` 抽出为独立工厂,
  *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
  *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
- *  唯一新增是六条 execFileSync 各自的 `timeout`。 */
+ *  唯一新增是六条 execFileSync 各自的 `timeout`。
+ *
+ *  7.103.0(S-684 残余):六条 git 子进程的 env 一律 = `gitSubprocessEnv({ isolateConfig: false })` + `LC_ALL=C`(修前:
+ *  `{ ...process.env, LC_ALL: "C" }`,两条 `git config` 连 env 都不交 ⇒ 整份服务 env 进 git 与它拉起的 helper / hook)。
+ *  **不隔离宿主 git 配置**(读后定):写凭据是控制面宿主的(「Coordinator's creds」,`durableRemote` 由受信调用方给出,
+ *  代码里从不带凭据),而宿主侧能供凭据的形 —— 全局配置里的 credential helper(自带存储)/ `url.<…>.insteadOf` 改写 /
+ *  `core.sshCommand` —— 都住在全局 git 配置里,隔离会把它们一起切掉;URL 里带凭据的形隔离与否都能用,所以隔离只会打断前者。
+ *  仍然剥密 + `GIT_TERMINAL_PROMPT=0`:helper 看得到的只剩非密钥 env,凭据缺席 ⇒ 响亮失败而不是挂在 prompt 上。 */
 export declare function createCoordinatorPush(durableRemote: string, targetRef: string | undefined, ident: {
     name: string;
     email: string;

package/dist/leader/wire.js

@@ -8,6 +8,7 @@ import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_R
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
+import { gitSubprocessEnv } from "../server-secret-env.js";
 import { presignS3Url } from "../plugins/s3-presign.js";
 import { buildUploadScript, uploadStepSuffix, fetchUploadedDiff, withStaging } from "./diffup.js";
 import { pullDiff, safeRev } from "./diffout.js";
@@ -100,11 +101,11 @@ export const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30_000;
 export function createCoordinatorPush(durableRemote, targetRef, ident) {
     return async (integratedPatch, baseSha) => {
         const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
-        const gitEnv = { ...process.env, LC_ALL: "C" };
+        const gitEnv = { ...gitSubprocessEnv({ site: "server.leader.git-push", isolateConfig: false }), LC_ALL: "C" };
         try {
             execFileSync("git", ["clone", "-q", durableRemote, dir], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
-            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
-            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
             writeFileSync(join(dir, ".leader.patch"), integratedPatch);
             execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
             rmSync(join(dir, ".leader.patch"));

package/dist/model-entry-refusal.d.ts

@@ -1,15 +1,20 @@
-/** 不可用的成因 —— **闭集**(加一个成因 ⇒ {@link MODEL_ENTRY_REFUSAL_CODES} 与 {@link refusalEventOf} 编译红)。 */
-export type ModelEntryRefusalReason = "no_brain" | "entry_invalid";
-/** 机读码(拼法随 `config.*` 家族,按**规则**命名):出现在拒因句的方括号里、warn 字段里、`modelRefusals` 里。 */
-export declare const MODEL_ENTRY_REFUSAL_CODES: {
-    readonly no_brain: "config.model_no_brain";
-    readonly entry_invalid: "config.model_entry_invalid";
+import { type ModelEntryRefusalCode, type ModelPlaneRefusalCode, type ModelRefusalsSignal } from "@sema-agent/settings-schema";
+/**
+ * 条目拒因码 → 本仓铸它的成因 —— **以码为键**(S-768):码闭集的属主是 settings-schema(`MODEL_ENTRY_REFUSAL_CODES`,6.2.0 起;此前本仓
+ * 自持一份同名码表,撞名已消灭、零别名)。那边加一个条目码 ⇒ 本表缺键 ⇒ 本仓 tsc 红(只拿 `satisfies` 约束码值证明的是「子集」,
+ * 不是「相等」;以码为键才证相等)。成因闭集由本表派生,{@link refusalEventOf} 对它穷举 —— 加成因同样编译红。
+ * 码的拼法随 `config.*` 家族,按**规则**命名:出现在拒因句的方括号里、warn 字段里、`modelRefusals` 里。
+ */
+export declare const ENTRY_REFUSAL_REASON_OF: {
+    readonly "config.model_no_brain": "no_brain";
+    readonly "config.model_entry_invalid": "entry_invalid";
 };
-export type ModelEntryRefusalCode = (typeof MODEL_ENTRY_REFUSAL_CODES)[ModelEntryRefusalReason];
-/** 「这张表没有缺省模型」的机读码(S-705;boot 拒启与热路径模型面组拒同一个码)。 */
+/** 不可用的成因 —— **闭集**,由 {@link ENTRY_REFUSAL_REASON_OF} 派生。 */
+export type ModelEntryRefusalReason = (typeof ENTRY_REFUSAL_REASON_OF)[ModelEntryRefusalCode];
+/** 「这张表没有缺省模型」的机读码(S-705;boot 拒启与热路径模型面组拒同一个码;组拒码闭集属主 = settings-schema)。 */
 export declare const DEFAULT_MODEL_MISSING_CODE = "config.default_model_missing";
 /** 🔴 S-712「被拒的名字被档位 / 别名增广铸到了别的条目上(或被丢身份载体形不对、读不出名字,无从证明没有)」的机读码
- *  (不变量 `refused-names-not-minted`;热路径 / boot 首次 apply / dry-run 同一个码)。 */
+ *  (不变量 `refused-names-not-minted`;热路径 / boot 首次 apply / dry-run 同一个码;组拒码闭集属主 = settings-schema)。 */
 export declare const REFUSED_NAME_MINTED_CODE = "config.model_refused_name_minted";
 /**
  * 一条不可用条目的**事实**(纯数据;`config.modelRefusals[<name>]` 的值)。
@@ -50,6 +55,8 @@ export declare function judgeCatalogEntry(m: CatalogEntryLike, ctx: CatalogEntry
 /** 一批已启用条目的判决:可用的(保序)、不可用的(按 catalog name)、以及形不对的被丢身份载体行(坐标)。 */
 export interface CatalogEntriesVerdict<M extends CatalogEntryLike> {
     readonly usable: readonly M[];
+    /** 键 = catalog name(**每一个**名,含秘密形 / 空串 / `__proto__`:引擎自己的判决保持完整 —— S-712 不变量与选择面的「让出」都读它;
+     *  名筛只在出口,见 {@link buildModelRefusalsSignal})。键以自有数据属性写入(`__proto__` 不走原型 setter)。 */
     readonly refused: Readonly<Record<string, ModelEntryRefusal>>;
     /** S-712:被丢身份**载体形不对**的行坐标(`models.3`;载体不是列表时是一个固定标记)。读腿只为有名的被丢条目铸载体行
      *  (`read-warnings.ts` `DroppedModelIdentity`,`name` 必在),所以这一形只来自绕过读腿的输入被改过(盘上 LKG 被手改 / 手写
@@ -65,6 +72,21 @@ export interface CatalogEntriesVerdict<M extends CatalogEntryLike> {
  * 与一条可用 / 已判不可用条目同名时不覆盖(可用条目仍可用;同名撞车由不变量 `refused-names-not-minted` 响亮拒)。
  */
 export declare function judgeCatalogEntries<M extends CatalogEntryLike>(enabled: readonly M[], ctx: CatalogEntryVerdictCtx, dropped?: unknown): CatalogEntriesVerdict<M>;
+/** S-768:一次 apply 对「最新交到手的那份候选目录」的模型拒因判决(纯数据;`ApplyReport.modelRefusals`)。 */
+export interface ModelRefusalVerdict {
+    /** 那份候选的逐条判决(键 = catalog name,**完整**,未过名筛 —— 名筛在出口 {@link buildModelRefusalsSignal})。 */
+    readonly entries: Readonly<Record<string, ModelEntryRefusal>>;
+    /** 那份候选的模型面组拒码(组拒时在场;一个候选恰一个组拒判决)。 */
+    readonly plane?: ModelPlaneRefusalCode;
+}
+/**
+ * S-768 —— 判决 → `/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的 wire 形(settings-schema `ModelRefusalsSignal`,纯投影):
+ * 名 → 码,**值只码**(拒因事实里的上游 id / provider 词 / 坏字段键 / 出路句都不上 wire —— `entry_invalid` 行是没人验过的行,id / provider
+ * 可能就是坏行原样;句子是给本机运维的散文,不是契约)。**名筛在这里、只在这里**:键过 settings-schema `isReportableRefusalName`(唯一判据,
+ * import 不复制)—— 秘密形 / 空串 / `__proto__` 这类出不了门的名不进键、不计数;引擎内部的判决不受影响(本机日志的写名行为与基线同)。
+ * 逐条空且无组拒 ⇒ `undefined`(键缺席:「没有」只有一种拼法)。
+ */
+export declare function buildModelRefusalsSignal(v: ModelRefusalVerdict | undefined): ModelRefusalsSignal | undefined;
 /** 成因 → 它那一条 warn 的事件名(**穷举**)。两个名字是票面点名的既有/新事件,运维的告警规则按名挂。 */
 export declare function refusalEventOf(reason: ModelEntryRefusalReason): "sema_registry_model_no_brain" | "sema_registry_model_entry_invalid";
 /** warn 字段(不含值):`field` = 第一处坏字段(告警规则最常按它分组),`fields` = 全部。 */

package/dist/model-entry-refusal.js

@@ -1,12 +1,15 @@
 import { CC_MODEL_TIER_ALIASES, DEFAULT_TIER_ORDER, expandTiers } from "@sema-agent/core";
-import { ModelEntry } from "@sema-agent/settings-schema";
+import { ModelEntry, isReportableRefusalName } from "@sema-agent/settings-schema";
 import { catalogBrainLane } from "./model-provider.js";
 import { describeSchemaIssueFields, describeSchemaIssues } from "./config-center/read-warnings.js";
 import { DEFAULT_MODEL_REF } from "./model-select.js";
-export const MODEL_ENTRY_REFUSAL_CODES = {
-    no_brain: "config.model_no_brain",
-    entry_invalid: "config.model_entry_invalid",
+export const ENTRY_REFUSAL_REASON_OF = {
+    "config.model_no_brain": "no_brain",
+    "config.model_entry_invalid": "entry_invalid",
 };
+function refusalCause(code) {
+    return { reason: ENTRY_REFUSAL_REASON_OF[code], code };
+}
 export const DEFAULT_MODEL_MISSING_CODE = "config.default_model_missing";
 export const REFUSED_NAME_MINTED_CODE = "config.model_refused_name_minted";
 function laneMount(lane, ctx) {
@@ -27,8 +30,7 @@ export function judgeCatalogEntry(m, ctx) {
     const mount = laneMount(lane, ctx);
     if (!mount.mounted) {
         return {
-            reason: "no_brain",
-            code: MODEL_ENTRY_REFUSAL_CODES.no_brain,
+            ...refusalCause("config.model_no_brain"),
             id: m.id,
             provider: m.provider,
             fields: [],
@@ -41,8 +43,7 @@ export function judgeCatalogEntry(m, ctx) {
 }
 function entryInvalidRefusal(id, provider, fields, issues) {
     return {
-        reason: "entry_invalid",
-        code: MODEL_ENTRY_REFUSAL_CODES.entry_invalid,
+        ...refusalCause("config.model_entry_invalid"),
         id,
         provider,
         fields: [...fields],
@@ -54,12 +55,15 @@ const MALFORMED_CARRIER_NOT_A_LIST = "(droppedIdentities is not a list)";
 export function judgeCatalogEntries(enabled, ctx, dropped) {
     const usable = [];
     const refused = {};
+    const mint = (name, r) => {
+        Object.defineProperty(refused, name, { value: r, enumerable: true, writable: true, configurable: true });
+    };
     for (const m of enabled) {
         const r = judgeCatalogEntry(m, ctx);
         if (r === undefined)
             usable.push(m);
         else
-            refused[String(m.name)] = r;
+            mint(String(m.name), r);
     }
     const rows = dropped === undefined ? [] : Array.isArray(dropped) ? dropped : undefined;
     if (rows === undefined)
@@ -74,10 +78,18 @@ export function judgeCatalogEntries(enabled, ctx, dropped) {
         if (Object.hasOwn(refused, e.name))
             continue;
         const fields = Array.isArray(e.fields) ? e.fields.filter((f) => typeof f === "string") : [];
-        refused[e.name] = entryInvalidRefusal(typeof e.id === "string" ? e.id : "", "", fields, typeof e.issues === "string" ? e.issues : fields.join(", "));
+        mint(e.name, entryInvalidRefusal(typeof e.id === "string" ? e.id : "", "", fields, typeof e.issues === "string" ? e.issues : fields.join(", ")));
     }
     return { usable, refused, malformed };
 }
+export function buildModelRefusalsSignal(v) {
+    if (v === undefined)
+        return undefined;
+    const entries = Object.fromEntries(Object.entries(v.entries).flatMap(([name, r]) => (isReportableRefusalName(name) ? [[name, r.code]] : [])));
+    if (Object.keys(entries).length === 0 && v.plane === undefined)
+        return undefined;
+    return v.plane === undefined ? { entries } : { entries, plane: v.plane };
+}
 export function refusalEventOf(reason) {
     switch (reason) {
         case "no_brain":

package/dist/model-route-endpoint.d.ts

@@ -79,4 +79,14 @@ export interface ModelRouteEndpointView {
  * 与别的键指同一只对象时不重复点名;只有它一个键时(手搓夹具)照样点名 `default`。
  */
 export declare function modelRouteEndpointRefusal(view: ModelRouteEndpointView): string | undefined;
+/** S-768:部署级判决的结构化形 —— 码与拒因句由**同一次**判决给出(一个不变量 id 两个码,组拒码在判决那刻当数据带出,不从句子里抠)。 */
+export interface ModelRouteEndpointVerdict {
+    readonly code: typeof GATEWAY_FALLBACK_WITHOUT_PRIMARY_CODE | typeof MODEL_ROUTE_ENDPOINT_MISSING_CODE;
+    readonly reason: string;
+}
+/**
+ * **判据属主**(S-768 起的结构化形;{@link modelRouteEndpointRefusal} 是它的句子投影):`undefined` = 通过。判序即 {@link modelRouteEndpointRefusal}
+ * 头注所列 —— ① 备用无主先说,② 逐条目解析不到端点全部点名。加一枝 = 在这里同时给出码与句(返回型强制两者同在)。
+ */
+export declare function judgeModelRouteEndpoint(view: ModelRouteEndpointView): ModelRouteEndpointVerdict | undefined;
 //# sourceMappingURL=model-route-endpoint.d.ts.map

package/dist/model-route-endpoint.js

@@ -14,13 +14,17 @@ export function resolveOpenaiRouteEndpoint(routeName, routeBaseUrl, gatewayBaseU
     return baseUrl !== undefined ? { ok: true, baseUrl } : { ok: false, refusal: routeEndpointMissingRefusal([`"${routeName}"`]) };
 }
 export function modelRouteEndpointRefusal(view) {
+    return judgeModelRouteEndpoint(view)?.reason;
+}
+export function judgeModelRouteEndpoint(view) {
     const gateway = declared(view.gatewayBaseUrl);
     if (gateway === undefined && view.gatewayFallbackUrls.length > 0) {
-        return (`env MODEL_GATEWAY_FALLBACK_URLS is set but MODEL_GATEWAY_BASEURL is not [${GATEWAY_FALLBACK_WITHOUT_PRIMARY_CODE}] — ` +
+        const reason = (`env MODEL_GATEWAY_FALLBACK_URLS is set but MODEL_GATEWAY_BASEURL is not [${GATEWAY_FALLBACK_WITHOUT_PRIMARY_CODE}] — ` +
             "the fallback URLs are mirrors of the primary gateway (same provider, same account, same key scope), tried only " +
             "after the primary fails; with no primary there is nothing to fail over from, and MODEL_GATEWAY_BASEURL has no " +
             `factory default. Set MODEL_GATEWAY_BASEURL to the primary gateway (for one on this machine: ${LOCAL_GATEWAY_HINT}), ` +
             "or unset MODEL_GATEWAY_FALLBACK_URLS.");
+        return { code: GATEWAY_FALLBACK_WITHOUT_PRIMARY_CODE, reason };
     }
     const anthropicMounted = view.anthropic !== undefined;
     const entries = Object.entries(view.models ?? {});
@@ -36,7 +40,7 @@ export function modelRouteEndpointRefusal(view) {
             ? `"${name}" (provider "anthropic", but no Anthropic route is mounted — ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN are unset — so it falls to the openai-compatible lane)`
             : `"${name}"`);
     }
-    return unresolved.length > 0 ? routeEndpointMissingRefusal(unresolved) : undefined;
+    return unresolved.length > 0 ? { code: MODEL_ROUTE_ENDPOINT_MISSING_CODE, reason: routeEndpointMissingRefusal(unresolved) } : undefined;
 }
 function routeEndpointMissingRefusal(quotedNames) {
     const one = quotedNames.length === 1;

package/dist/observability/secret-env-scrub.d.ts

@@ -27,6 +27,18 @@ export declare const SECRET_ENV_SCRUB_SITES: {
         readonly note: "宿主车道本地语言服务器子进程 env(core 7.30.1 #1073 的 `NodeLspManagerOptions.env`)—— 语言服务器会执行仓里的代码(构建脚本/插件/工作区配置),一次泄漏等于把本进程的凭据交给仓";
         readonly remedy: `LSP_ENV_ALLOW=NAME,NAME \u70B9\u540D\u653E\u884C(\u539F\u6837\u4EA4\u7ED9\u8BED\u8A00\u670D\u52A1\u5668,\u90E8\u7F72\u65B9\u663E\u5F0F\u627F\u62C5;${string});\u503C\u4E0D\u8FDB\u65E5\u5FD7`;
     };
+    readonly "server.center-plugins.git-clone": {
+        readonly note: "center 下发插件的 git clone / fetch 子进程 env —— 克隆的是 center 声明里的第三方仓,git 与它拉起的 transport / askpass 以本进程身份运行";
+        readonly remedy: null;
+    };
+    readonly "server.leader.git-push": {
+        readonly note: "leader 控制面把集成结果推回 durable remote 的 git 子进程 env —— 这条腿保留宿主 git 配置(写凭据可能走宿主 credential helper),helper / hook 以本进程身份运行";
+        readonly remedy: null;
+    };
+    readonly "server.bake-runner.spawn-env": {
+        readonly note: "bake-runner(构建宿主守护进程)交给 build.sh 与主机命令(git fetch / docker push / docker image inspect / df)的 env —— 配方脚本在构建宿主上以 runner 身份运行,一次泄漏等于把 runner 的 BAKE_RUNNER_TOKEN 交给配方";
+        readonly remedy: "BAKE_ENV_ALLOW=NAME,NAME 点名放行(原样交给 build.sh 与主机命令,部署方显式承担;bake-runner 进程的旋钮,没有多租户姿态);值不进日志";
+    };
 };
 /** 词表键推导的闭集类型。 */
 export type SecretEnvScrubSite = keyof typeof SECRET_ENV_SCRUB_SITES;

package/dist/observability/secret-env-scrub.js

@@ -13,6 +13,18 @@ export const SECRET_ENV_SCRUB_SITES = {
         note: "宿主车道本地语言服务器子进程 env(core 7.30.1 #1073 的 `NodeLspManagerOptions.env`)—— 语言服务器会执行仓里的代码(构建脚本/插件/工作区配置),一次泄漏等于把本进程的凭据交给仓",
         remedy: `LSP_ENV_ALLOW=NAME,NAME 点名放行(原样交给语言服务器,部署方显式承担;${describeAllowlistPostures()});值不进日志`,
     },
+    "server.center-plugins.git-clone": {
+        note: "center 下发插件的 git clone / fetch 子进程 env —— 克隆的是 center 声明里的第三方仓,git 与它拉起的 transport / askpass 以本进程身份运行",
+        remedy: null,
+    },
+    "server.leader.git-push": {
+        note: "leader 控制面把集成结果推回 durable remote 的 git 子进程 env —— 这条腿保留宿主 git 配置(写凭据可能走宿主 credential helper),helper / hook 以本进程身份运行",
+        remedy: null,
+    },
+    "server.bake-runner.spawn-env": {
+        note: "bake-runner(构建宿主守护进程)交给 build.sh 与主机命令(git fetch / docker push / docker image inspect / df)的 env —— 配方脚本在构建宿主上以 runner 身份运行,一次泄漏等于把 runner 的 BAKE_RUNNER_TOKEN 交给配方",
+        remedy: "BAKE_ENV_ALLOW=NAME,NAME 点名放行(原样交给 build.sh 与主机命令,部署方显式承担;bake-runner 进程的旋钮,没有多租户姿态);值不进日志",
+    },
 };
 const SCRUB_COUNTER = "secret_env_scrubbed_total";
 const DISCLOSED_CAP = 512;