@sema-agent/server 7.122.0 → 7.124.0

package/dist/config.js

@@ -1,10 +1,10 @@
 import { readFileSync } from "node:fs";
-import { DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
-import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./memory-scope.js";
@@ -13,7 +13,7 @@ import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf } from "./config-types.js";
 import { FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
 import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
-import { centerLaneConfigured, pathBaseUrlRefusal } from "./config-center/center-request.js";
+import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
@@ -22,29 +22,27 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
-import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeEmptyToolSegmentEntry, describeInertRuleEntries, emptyToolSegmentEntryOf, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { buildHttpUrlRefusal, httpUrlFlaws } from "./url-shape.js";
-import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
+import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "./url-refusal.js";
+import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
-    return (process.env[name] ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter(Boolean);
+    return csvOf(process.env[name]);
 }
 export function parseAutonomy(raw) {
     const v = raw?.trim();
@@ -116,74 +114,10 @@ function defaultSkillsDir() {
         return "skills";
     }
 }
-export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-export const RETIRED_ENVS = [
-    ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
-    ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
-    ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", CENTER_CREDENTIAL_ENV.token, "renamed"],
-    ["CONFIG_CENTER_DRY_RUN", "SEMA_REGISTRY_DRY_RUN", "renamed"], ["CONFIG_CENTER_WORKER", "SEMA_REGISTRY_WORKER", "renamed"],
-    ["ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL", "renamed"],
-    ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"],
-    ["OA_API_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_SERVICE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_OWNER", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_REPO", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_LABELS", "the OA scenario was removed in 5.0.0", "removed"],
-    ["APPROVAL_POLL_MS", "the OA poll-approval lane was removed in 5.0.0; the durable checkpoint lane is the only gate", "removed"],
-    ["LEADER_CONFLICT_ROUNDS", "the bounded merge-conflict-resolution agent was deleted in 7.83.0 按 C-R63 删除,合不上交用户:leader 交回 result.conflict(分支 + 冲突文件),run 状态 needs_human", "removed"],
-    [
-        "MODEL_CONNECT_TIMEOUT_MS",
-        "MODEL_FIRST_BYTE_TIMEOUT_MS",
-        "replaced",
-        "since core 7.33.0 the TCP + TLS connect clock is the transport's own; the wait from sending the request to its response headers — " +
-            "what this key really bounded — is MODEL_FIRST_BYTE_TIMEOUT_MS (unset = core's own default, plus an upload allowance and one " +
-            "widened retry; 0 = no engine clock on that segment and the transport's header / body clocks off too — the TCP + TLS connect " +
-            "keeps the transport's own clock)",
-    ],
-    ["PROJECT_MEMORY_DISABLED", "PROJECT_MEMORY_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: PROJECT_MEMORY_DISABLED=true is PROJECT_MEMORY_ENABLED=false (the positive name defaults on)"],
-    ["CONFIG_LKG_DISABLED", "CONFIG_LKG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: CONFIG_LKG_DISABLED=true is CONFIG_LKG_ENABLED=false (the positive name defaults on)"],
-    ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
-    ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
-    ["UNATTENDED_PERMISSION_MODE", "since server 7.109.0 the unattended legs (leader workers and their repair legs, run-local, and their durable resumes) always run permissionMode \"default\" with an approver that answers by ask class: a machine answers only \"ordinary\" asks, and every other class goes to the leg's approver seat (run-local's terminal prompt) or parks / is refused — there is no mode to choose", "removed"],
-];
-for (const row of RETIRED_ENVS)
-    Object.freeze(row);
-Object.freeze(RETIRED_ENVS);
-export function buildRetiredEnvWire() {
-    return RETIRED_ENVS.map((row) => {
-        switch (row[2]) {
-            case "renamed":
-                return { name: row[0], kind: row[2], replacement: row[1] };
-            case "replaced":
-                return { name: row[0], kind: row[2], replacement: row[1], reason: row[3] };
-            case "removed":
-                return { name: row[0], kind: row[2], reason: row[1] };
-            default: {
-                const unhandled = row;
-                throw new Error(`unhandled retired-env kind: ${String(unhandled[2])}`);
-            }
-        }
-    });
-}
-const RETIRED_ENV_SENTENCE = {
-    renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
-    replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
-        `its value semantics differ from the retired key's, so do not copy the old value across unread`,
-    removed: (hits) => `${hits.map(([old, why]) => `${old} (${why})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
-        `there is no replacement name and no rename that restores it`,
-};
-function retiredEnvSentence(kind, hit) {
-    const ofKind = hit.filter((h) => h[2] === kind);
-    return ofKind.length > 0 ? [RETIRED_ENV_SENTENCE[kind](ofKind)] : [];
-}
 function rejectRetiredEnvs() {
-    const hit = RETIRED_ENVS.filter(([o]) => process.env[o] !== undefined && process.env[o] !== "");
-    if (hit.length === 0)
-        return;
-    const parts = Object.keys(RETIRED_ENV_SENTENCE).flatMap((kind) => retiredEnvSentence(kind, hit));
-    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] — refused while present, whether or not the replacement is also set: ${parts.join(" | ")}.`);
+    const refusal = retiredEnvRefusal(process.env);
+    if (refusal !== undefined)
+        throw new Error(refusal);
 }
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
@@ -250,7 +184,7 @@ function parseConfigProvider() {
         return undefined;
     const word = CONFIG_PROVIDER_WORDS.find((w) => w === raw);
     if (word === undefined) {
-        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then SEMA_REGISTRY_URL, if set, selects the center as the config source; otherwise this worker is env-only). ` +
+        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then ${WEB_ADMIN_ENV.url}, if set, selects the center as the config source; otherwise this worker is env-only). ` +
             `The word is matched exactly (no trimming, no case folding). Refusing to boot rather than guessing: the config source, the execution-lane default and the local config root all key on this one word.`);
     }
     return word;
@@ -312,14 +246,6 @@ export function logConfigDiagnostics(logger) {
         }
     }
 }
-function firstSetEnv(...names) {
-    for (const n of names) {
-        const v = process.env[n];
-        if (v !== undefined && v !== "")
-            return v;
-    }
-    return undefined;
-}
 function clampEnvWithWarn(name, fallback, min, max = Number.POSITIVE_INFINITY) {
     const n = numEnv(name, fallback);
     const used = Math.min(max, Math.max(min, n));
@@ -948,48 +874,41 @@ function parseStoreDomain(ctx) {
             : undefined,
     };
 }
-export function isRosterGateArmed(configCenter) {
-    return configCenter !== undefined && !configCenter.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
+export function isRosterGateArmed(webAdmin) {
+    return webAdmin !== undefined && !webAdmin.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
 }
 function parseModelDomain() {
-    const gatewayBaseUrl = firstSetEnv("MODEL_GATEWAY_BASEURL");
-    const modelId = env("MODEL_ID", "");
-    const explicitProvider = process.env.MODEL_PROVIDER;
-    if (explicitProvider !== undefined && explicitProvider !== "") {
-        const refusal = modelProviderRefusal(explicitProvider);
+    const route = readModelRouteEnv(process.env);
+    const gatewayBaseUrl = route.gatewayBaseUrl;
+    const modelId = route.mainId;
+    if (route.providerSource === "explicit") {
+        const refusal = modelProviderRefusal(route.provider);
         if (refusal !== undefined) {
             throw new Error(refusal);
         }
     }
     for (const [envKey, raw, knob] of [
         ["MODEL_GATEWAY_BASEURL", gatewayBaseUrl ?? "", "MODEL_API_KEY"],
-        ...csv("MODEL_GATEWAY_FALLBACK_URLS").map((u, i) => [`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"]),
-        ["ANTHROPIC_BASE_URL", firstSetEnv("ANTHROPIC_BASE_URL") ?? "", "ANTHROPIC_API_KEY"],
+        ...route.gatewayFallbackUrls.map((u, i) => [`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"]),
+        ["ANTHROPIC_BASE_URL", route.anthropicBaseUrl ?? "", "ANTHROPIC_API_KEY"],
     ]) {
         const refusal = modelRouteUrlRefusal(envKey, raw, knob);
         if (refusal !== undefined) {
             throw new Error(refusal);
         }
     }
-    const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASE_URL");
-    const inferredAnthropicCred = firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN");
-    const provider = (() => {
-        if (explicitProvider !== undefined && explicitProvider !== "")
-            return explicitProvider;
-        if (inferredAnthropicBaseUrl && inferredAnthropicCred) {
-            CONFIG_NOTICES.push({
-                level: "warn",
-                event: "model_provider_inferred",
-                fields: {
-                    provider: "anthropic",
-                    baseUrl: buildDisplaySafeUrl(inferredAnthropicBaseUrl),
-                    hint: "MODEL_PROVIDER is unset but an explicit ANTHROPIC base URL + credential are configured — inferred provider=anthropic (set MODEL_PROVIDER explicitly to override)",
-                },
-            });
-            return "anthropic";
-        }
-        return "gateway";
-    })();
+    const provider = route.provider;
+    if (route.providerSource === "inferred") {
+        CONFIG_NOTICES.push({
+            level: "warn",
+            event: "model_provider_inferred",
+            fields: {
+                provider: "anthropic",
+                baseUrl: buildDisplaySafeUrl(route.anthropicBaseUrl),
+                hint: "MODEL_PROVIDER is unset but an explicit ANTHROPIC base URL + credential are configured — inferred provider=anthropic (set MODEL_PROVIDER explicitly to override)",
+            },
+        });
+    }
     const extraBody = buildExtraBody();
     const thinkingDefault = parseDefaultThinking(process.env.MODEL_DEFAULT_THINKING);
     const envCompatDeclared = buildModelCompat({
@@ -1021,35 +940,40 @@ function parseModelDomain() {
         ...(envCompat ? { compat: envCompat } : {}),
         ...(extraBody ? { extraBody } : {}),
     };
-    const cheapId = process.env.MODEL_CHEAP_ID;
-    if (cheapId && modelId === "") {
-        CONFIG_NOTICES.push({
-            level: "warn",
-            event: "model_cheap_slot_without_main",
-            fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
-        });
-    }
-    const cheapIsMain = cheapId !== undefined && cheapId !== "" && modelId !== "" && cheapId === modelId;
-    if (cheapIsMain) {
-        CONFIG_NOTICES.push({
-            level: "warn",
-            event: "config_env_entry_cheap_same_as_main",
-            fields: {
-                env: "MODEL_CHEAP_ID",
-                model: modelId,
-                hint: `MODEL_CHEAP_ID names the same model as MODEL_ID ("${modelId}") — the env cheap slot is the main gateway under a different id, ` +
-                    `so the same id IS the main model: no cheap slot is minted and subagent / summarize stay on the main model (roles -> default); ` +
-                    `any other MODEL_CHEAP_* key set here describes that slot and is not applied. Set MODEL_CHEAP_ID to a different (cheaper) model ` +
-                    `id to run those roles cheap, or declare two differently-named entries in config.d/models.json to give one upstream id a second ` +
-                    `shape (price / reasoning / window); unset MODEL_CHEAP_ID to silence this line.`,
-            },
-        });
+    const cheapSlot = route.cheapSlot;
+    switch (cheapSlot.kind) {
+        case "without_main":
+            CONFIG_NOTICES.push({
+                level: "warn",
+                event: "model_cheap_slot_without_main",
+                fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the web-admin) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
+            });
+            break;
+        case "same_as_main":
+            CONFIG_NOTICES.push({
+                level: "warn",
+                event: "config_env_entry_cheap_same_as_main",
+                fields: {
+                    env: "MODEL_CHEAP_ID",
+                    model: modelId,
+                    hint: `MODEL_CHEAP_ID names the same model as MODEL_ID ("${modelId}") — the env cheap slot is the main gateway under a different id, ` +
+                        `so the same id IS the main model: no cheap slot is minted and subagent / summarize stay on the main model (roles -> default); ` +
+                        `any other MODEL_CHEAP_* key set here describes that slot and is not applied. Set MODEL_CHEAP_ID to a different (cheaper) model ` +
+                        `id to run those roles cheap, or declare two differently-named entries in config.d/models.json to give one upstream id a second ` +
+                        `shape (price / reasoning / window); unset MODEL_CHEAP_ID to silence this line.`,
+                },
+            });
+            break;
+        case "absent":
+        case "minted":
+            break;
     }
-    const cheapModel = cheapId && modelId !== "" && !cheapIsMain
+    const cheapMintedId = mintedCheapId(cheapSlot);
+    const cheapModel = cheapMintedId !== undefined
         ? {
             ...model,
-            id: cheapId,
-            name: cheapId,
+            id: cheapMintedId,
+            name: cheapMintedId,
             input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
             ...buildModelCostKey(buildCostOrAbsent({
                 input: costEnv("MODEL_CHEAP_COST_INPUT", "declares-zero"),
@@ -1093,9 +1017,7 @@ function parseModelDomain() {
         }
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
-    const models = modelId === "" ? {} : { default: model, [model.id]: model };
-    if (cheapModel)
-        models[cheapModel.id] = cheapModel;
+    const models = envLaneTable(modelId, model, cheapModel);
     const gatewayApiKey = process.env.MODEL_API_KEY;
     if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
         CONFIG_NOTICES.push({
@@ -1129,13 +1051,13 @@ function parseModelDomain() {
     const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
         ...(gatewayBaseUrl !== undefined ? { gatewayBaseUrl, gatewayApiKey } : {}),
-        gatewayFallbackUrls: csv("MODEL_GATEWAY_FALLBACK_URLS"),
+        gatewayFallbackUrls: route.gatewayFallbackUrls,
         ...(process.env.GATEWAY_MAX_RETRIES ? { gatewayMaxRetries: numEnvBounded("GATEWAY_MAX_RETRIES", "2", 0, 20) } : {}),
-        anthropic: firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")
+        anthropic: route.anthropicRouteMounted
             ? {
-                apiKey: firstSetEnv("ANTHROPIC_API_KEY"),
-                authToken: firstSetEnv("ANTHROPIC_AUTH_TOKEN"),
-                baseUrl: firstSetEnv("ANTHROPIC_BASE_URL"),
+                apiKey: route.anthropicApiKey,
+                authToken: route.anthropicAuthToken,
+                baseUrl: route.anthropicBaseUrl,
                 version: process.env.ANTHROPIC_VERSION,
                 cacheBreakpoints: boolEnv("ANTHROPIC_CACHE_BREAKPOINTS", true),
                 ...(process.env.ANTHROPIC_MAX_RETRIES ? { maxRetries: numEnv("ANTHROPIC_MAX_RETRIES", "2") } : {}),
@@ -1155,11 +1077,12 @@ function parseModelDomain() {
         modelApiKeyEnv: {},
         modelApiKeys: {},
         modelRefusals: {},
+        droppedCatalogEntries: [],
         modelQuotaWeights: {},
         tiers: {},
         projects: {},
         roles,
-        atModelAllowlist: [],
+        atMention: DEFAULT_AT_MENTION,
         cascadeLadder: csv("MODEL_CASCADE_LADDER"),
         degrade: process.env.MODEL_DEGRADE_TO
             ? {
@@ -1272,9 +1195,6 @@ export function approvalGrantRefusal(names) {
     const over = allowLayerEntryCountIssue(APPROVAL_GRANT_ENV, names);
     if (over !== undefined)
         return `${over.message} — refusing to start rather than running with a truncated list`;
-    const empty = emptyToolSegmentEntryOf(names);
-    if (empty !== undefined)
-        return `${describeEmptyToolSegmentEntry(APPROVAL_GRANT_ENV, empty)} — refusing to start rather than running without it`;
     const inert = inertRuleEntriesOf(names, "allow");
     if (inert.length > 0)
         return `${describeInertRuleEntries(APPROVAL_GRANT_ENV, inert)} — the engine would grant nothing for ${inert.length === 1 ? "it" : "them"}; refusing to start rather than running with an allow rule that never takes effect`;
@@ -1375,7 +1295,7 @@ function parseApprovalDomain(ctx) {
             const trimmed = raw.trim();
             if (trimmed === "" || trimmed.toLowerCase() === "off")
                 return [];
-            return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+            return csvOf(trimmed);
         })(process.env.SENSITIVE_WRITE_PATTERNS),
         ...((decision) => (decision === undefined ? {} : { writeProtectedPaths: decision }))(parseWriteProtectedTableEnv(process.env.WRITE_PROTECTED_EXTRA, process.env.WRITE_PROTECTED_TABLE_REPLACE)),
         ...((raw) => {
@@ -1826,7 +1746,7 @@ function parseAuthDomain(ctx) {
         authToken: process.env.SERVICE_AUTH_TOKEN,
         authTokens,
         allowUnauthedWrites: boolEnv("ALLOW_UNAUTHED_WRITES", false),
-        corsOrigins: (process.env.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        corsOrigins: csv("CORS_ORIGIN"),
         principalHeader: headerNameEnv("PRINCIPAL_HEADER", "x-agent-principal"),
         requirePrincipal,
         autonomy: parseAutonomy(process.env.AUTONOMY),
@@ -2011,7 +1931,7 @@ function parseOrchestrationDomain(ctx) {
             ? {
                 repoRoot: process.env.WORKTREE_REPO_ROOT,
                 ...(process.env.WORKTREE_ALLOWED_ROOTS
-                    ? { allowedRoots: process.env.WORKTREE_ALLOWED_ROOTS.split(",").map((s) => s.trim()).filter(Boolean) }
+                    ? { allowedRoots: csv("WORKTREE_ALLOWED_ROOTS") }
                     : {}),
                 ...(process.env.WORKTREE_BASE_COMMIT ? { commit: process.env.WORKTREE_BASE_COMMIT } : {}),
             }
@@ -2095,7 +2015,7 @@ function parseLimitsHttpDomain() {
         workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
         attachmentMaxBytes: clampEnvWithWarn("ATTACHMENT_MAX_BYTES", String(32 * 1024 * 1024), LIMITS_HTTP_FLOORS.attachmentMaxBytes),
         ...(process.env.ATTACHMENT_MIME_ALLOWLIST
-            ? { attachmentMimeAllowlist: process.env.ATTACHMENT_MIME_ALLOWLIST.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) }
+            ? { attachmentMimeAllowlist: csv("ATTACHMENT_MIME_ALLOWLIST").map((s) => s.toLowerCase()) }
             : {}),
         attachmentUnboundTtlMs: clampEnvWithWarn("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000), LIMITS_HTTP_FLOORS.attachmentUnboundTtlMs),
         infraCostRates: {
@@ -2125,7 +2045,7 @@ function parseLimitsHttpDomain() {
         toolResultTtlSec: (() => {
             const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
             if (ttl <= 0) {
-                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the config center refuses the same value)`);
+                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the web-admin refuses the same value)`);
             }
             return ttl;
         })(),
@@ -2182,15 +2102,15 @@ function parseGitApiKind(raw, baseUrl) {
 }
 function parseIntegrationsDomain(ctx) {
     const { requirePrincipal, configProvider } = ctx;
-    const registryUrl = parseCenterBaseUrl("SEMA_REGISTRY_URL", process.env.SEMA_REGISTRY_URL, `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
-    const registryLiveUrl = parseCenterBaseUrl("SEMA_REGISTRY_LIVE_URL", process.env.SEMA_REGISTRY_LIVE_URL, `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to SEMA_REGISTRY_URL.`);
-    const registryWebUrl = parseCenterBaseUrl("SEMA_REGISTRY_WEB_URL", process.env.SEMA_REGISTRY_WEB_URL, `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
-    const configCenter = registryUrl !== undefined ? parseConfigCenter(registryUrl, requirePrincipal, registryLiveUrl, registryWebUrl) : undefined;
+    const baseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.url, process.env[WEB_ADMIN_ENV.url], `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
+    const liveBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.liveUrl, process.env[WEB_ADMIN_ENV.liveUrl], `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to ${WEB_ADMIN_ENV.url}.`);
+    const webBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.webUrl, process.env[WEB_ADMIN_ENV.webUrl], `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
+    const webAdmin = baseUrl !== undefined ? parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) : undefined;
     const fleetGeneration = parseFleetGeneration(process.env.FLEET_GENERATION);
     const fleetAdvertiseAddress = parseFleetAdvertiseAddress(process.env.FLEET_ADVERTISE_ADDRESS);
-    fleetFenceLaneOf({ ...fleetGeneration, configCenter, ...fleetAdvertiseAddress });
+    fleetFenceLaneOf({ ...fleetGeneration, webAdmin, ...fleetAdvertiseAddress });
     return {
-        pluginsAllowHosts: (process.env.PLUGINS_ALLOW_HOSTS ?? "github.com").split(",").map((h) => h.trim()).filter(Boolean),
+        pluginsAllowHosts: csvOf(process.env.PLUGINS_ALLOW_HOSTS ?? "github.com"),
         configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
         gitApiBaseUrl: process.env.GIT_API_BASEURL,
         gitApiToken: process.env.GIT_API_TOKEN,
@@ -2198,7 +2118,7 @@ function parseIntegrationsDomain(ctx) {
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
-        configCenter,
+        webAdmin,
         fleetLeaseFailClosed: parseFleetLeaseFailClosed(process.env.FLEET_LEASE_FAIL_CLOSED, requirePrincipal),
         ...fleetGeneration,
         fleetScope: parseFleetScope(process.env.FLEET_SCOPE),
@@ -2256,9 +2176,9 @@ export function fleetFenceLaneOf(cfg) {
         return undefined;
     const laneConfigured = centerLaneConfigured(cfg);
     if (laneConfigured && cfg.fleetAdvertiseAddress !== undefined)
-        return { center: cfg.configCenter, generation };
+        return { center: cfg.webAdmin, generation };
     const missing = [
-        ...(laneConfigured ? [] : [`the center lane (SEMA_REGISTRY_URL + ${CENTER_CREDENTIAL_ENV.token} or ${CENTER_CREDENTIAL_ENV.tokenFile} + SEMA_REGISTRY_WORKER)`]),
+        ...(laneConfigured ? [] : [`the center lane (${WEB_ADMIN_ENV.url} + ${WEB_ADMIN_ENV.token} or ${WEB_ADMIN_ENV.tokenFile} + ${WEB_ADMIN_ENV.worker})`]),
         ...(cfg.fleetAdvertiseAddress === undefined ? ["the announce address (FLEET_ADVERTISE_ADDRESS)"] : []),
     ];
     throw fleetEnvRefusal("member_unfenced", `fleet member cannot be fenced — env FLEET_GENERATION=${JSON.stringify(generation)} makes this engine a fleet member, ` +
@@ -2293,15 +2213,15 @@ function parseCenterBaseUrl(name, raw, role) {
         throw new Error(`${refusal}. ${role}`);
     return raw;
 }
-function parseConfigCenter(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
-    const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+function parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
+    const worker = process.env[WEB_ADMIN_ENV.worker] || undefined;
     const declared = readCenterCredentialDeclaration();
     return {
         baseUrl,
         ...(liveBaseUrl !== undefined ? { liveBaseUrl } : {}),
         ...(webBaseUrl !== undefined ? { webBaseUrl } : {}),
         credential: createCenterCredentialSource(declared.from === "file" ? { ...declared, multiTenant: requirePrincipal } : declared, worker),
-        dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
+        dryRun: boolEnv(WEB_ADMIN_ENV.dryRun, false),
         worker,
     };
 }
@@ -2388,7 +2308,7 @@ const STORE_GROUP_KEYS = [
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
-    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
+    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atMention", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
@@ -2428,7 +2348,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2490,6 +2410,10 @@ export function loadConfig() {
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
     const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
+    const centerIdentity = centerIdentityRefusal({ authBridgeIssuer: auth.authBridgeIssuer, webAdmin: integrations.webAdmin });
+    if (centerIdentity !== undefined) {
+        throw new Error(centerIdentity);
+    }
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
@@ -2527,15 +2451,9 @@ export function loadConfig() {
         throw new Error(laneRequiredRefusal);
     }
     {
-        const envLaneDispatchable = !isRosterGateArmed(integrations.configCenter);
-        const refusal = modelRouteEndpointRefusal({
-            gatewayBaseUrl: modelPlane.gatewayBaseUrl,
-            gatewayFallbackUrls: modelPlane.gatewayFallbackUrls,
-            anthropic: modelPlane.anthropic,
-            models: envLaneDispatchable ? modelPlane.models : {},
-        });
-        if (refusal !== undefined) {
-            throw new Error(refusal);
+        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.webAdmin) });
+        if (routeGap.gap !== "none") {
+            throw new Error(routeGap.reason);
         }
     }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);

package/dist/execution-lane-caps.d.ts

@@ -144,7 +144,7 @@ export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly stri
  *
  * 🔴 病(S-1008,test d327-g6-engine-7112 OBS-4 / OBS-5;2026-10-03 亲核):修前**两份句子**。运行期真拒启的是 `config.ts` 手写 throw
  * (点名 `REQUIRE_EXECUTION_LANE` / `REMOTE_EXEC` + 修法,用户在 stderr 读到的就是它);注册表条目另写了一句短的
- * 「the deployment asked to refuse this state」,而它只在 `config-center/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
+ * 「the deployment asked to refuse this state」,而它只在 `web-admin-client/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
  * `BATCH1_LIMIT_KEYS` 的限额键,带不上这两键 ⇒ 对本条恒 `next === live`,**那一句没有任何读者**(test 六个拒启格 stderr 里零命中)。
  * 改一份另一份不跟。现形:boot 的 throw 与注册表条目的 `check` **都**调本函数 —— 一只判据、一句话,没有第二份文本可漂。
  *

package/dist/fleet/drain-entry.d.ts

@@ -21,7 +21,7 @@
  *     · `worker` / `expectedGeneration`:缺席对缺席(非 fleet 成员没有代际,不带 `expectedGeneration` 的请求是单机形,不是通配)。
  *     · `instanceId`:请求带了才比(它是引擎每进程自铸的身份,`/health` 上可读);「点名的是不是别的进程」与 run 行同一只判据
  *       `runProvenElsewhere`。
- *     引擎自己的 worker / instanceId 读不出 ⇒ 带了这一项的请求不符(认不出自己就不认任何点名;没配 `SEMA_REGISTRY_WORKER` 的引擎因此
+ *     引擎自己的 worker / instanceId 读不出 ⇒ 带了这一项的请求不符(认不出自己就不认任何点名;没配 `SEMA_WEB_ADMIN_WORKER` 的引擎因此
  *     只能用停止信号排空)。
  *  5. **进入那一拍让出在飞**:本副本可抢占的在飞腿经 core `TaskSpec.preemptSignal` 让出(在下一个干净的回合边界耐久停驻,
  *     `resource_limit` / `preempt`;不合格的腿上 core 静默不动,等到期限硬停 —— 既有 `crashed` 臂);活的审批卡按断连同路改路耐久停驻