@sema-agent/server 7.122.0 → 7.124.0

package/dist/{config-center → web-admin-client}/skills-mcp.js

@@ -18,7 +18,7 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
             const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");
             if (skillContentHash(text) === hash)
                 return text;
-            logger?.warn("sema_registry_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
+            logger?.warn("web_admin_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
         }
         catch {
         }
@@ -34,7 +34,7 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
             const tmp = joinPath(diskCacheDir, `${hex}.${Math.random().toString(36).slice(2, 8)}.tmp`);
             await fsp.writeFile(tmp, content, { mode: 0o600 });
             await fsp.rename(tmp, joinPath(diskCacheDir, hex));
-        })().catch((err) => logger?.warn("sema_registry_skill_cache_write_failed", { hash, err: String(err) })));
+        })().catch((err) => logger?.warn("web_admin_skill_cache_write_failed", { hash, err: String(err) })));
     };
     const byName = new Map(baseline.map((s) => [s.spec.name, s]));
     const contentCache = new Map();
@@ -43,7 +43,7 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
         if (m.enabled === false)
             continue;
         if (seenNames.has(m.name))
-            logger?.warn("sema_registry_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
+            logger?.warn("web_admin_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
         seenNames.add(m.name);
         try {
             let content = contentCache.get(m.contentHash);
@@ -56,16 +56,16 @@ export async function applyCenterSkills(baseline, manifest, center, logger, fetc
             contentCache.set(m.contentHash, content);
             const overrodeBuiltin = byName.has(m.name);
             byName.set(m.name, { spec: { name: m.name, description: m.description, content }, scenarios: m.scenarios ?? [] });
-            logger?.info("sema_registry_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
+            logger?.info("web_admin_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
         }
         catch (err) {
-            logger?.warn("sema_registry_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
+            logger?.warn("web_admin_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
         }
     }
     await Promise.all(pendingWrites);
     return [...byName.values()];
 }
-function resolveRefs(refs, server, kind, logger, event = "sema_registry_mcp_env_missing", skipNote = "skipping this MCP server — referenced env var is unset in this service") {
+function resolveRefs(refs, server, kind, logger, event = "web_admin_mcp_env_missing", skipNote = "skipping this MCP server — referenced env var is unset in this service") {
     if (!refs)
         return {};
     const out = {};
@@ -86,7 +86,7 @@ export function resolveMcpServers(mcp, logger) {
         if (s.enabled === false)
             continue;
         if (!isUsableWireName(s.name)) {
-            logger?.warn("sema_registry_mcp_name_unusable", {
+            logger?.warn("web_admin_mcp_name_unusable", {
                 server: describeBadWireName(s.name),
                 note: "server SKIPPED — an MCP server name is its identity (it becomes the tool namespace prefix) and core REFUSES an out-of-bound name at prepare, which would fail every task in this scenario. Shorten the name and republish; sibling servers are unaffected.",
             });
@@ -99,7 +99,7 @@ export function resolveMcpServers(mcp, logger) {
             if (isContentOriginWord(s.contentOrigin))
                 contentOrigin = { contentOrigin: s.contentOrigin };
             else
-                logger?.warn("sema_registry_mcp_content_class_invalid", {
+                logger?.warn("web_admin_mcp_content_class_invalid", {
                     server: s.name,
                     value: describeBadContentOrigin(s.contentOrigin),
                     allowed: CONTENT_ORIGIN_WORDS,
@@ -109,7 +109,7 @@ export function resolveMcpServers(mcp, logger) {
         const source = readMcpSourceLabel(s.name, s.source);
         const facesRead = readMcpToolFaces(s.toolFaces);
         if (!facesRead.ok) {
-            logger?.warn("sema_registry_mcp_tool_faces_invalid", {
+            logger?.warn("web_admin_mcp_tool_faces_invalid", {
                 server: s.name,
                 problem: facesRead.problem,
                 note: "server SKIPPED — a toolFaces overlay is a NARROWING declaration (its pathTarget is what the sensitive-path / write fences read); mounting the server without it would silently drop the protection you declared. Fix the entry and republish.",
@@ -137,7 +137,7 @@ export function resolveMcpServers(mcp, logger) {
         }
     }
     if (out.length > 0)
-        logger?.info("sema_registry_mcp", { servers: out.map((s) => s.spec.name) });
+        logger?.info("web_admin_mcp", { servers: out.map((s) => s.spec.name) });
     return { servers: out, reservedNames };
 }
 export function mcpForScenario(center, scenario) {
@@ -153,13 +153,13 @@ export function resolveA2aPeers(a2a, logger) {
         if (p.enabled === false)
             continue;
         if (!isUsableWireName(p.name)) {
-            logger?.warn("sema_registry_a2a_name_unusable", {
+            logger?.warn("web_admin_a2a_name_unusable", {
                 peer: describeBadWireName(p.name),
                 note: "peer SKIPPED — an A2A peer name is its identity (it lands as the roster's `origin.peer`) and core REFUSES an out-of-bound name at prepare, which would fail every task in this scenario. Shorten the name and republish; sibling peers are unaffected.",
             });
             continue;
         }
-        const headers = resolveRefs(p.headerRefs, p.name, "header", logger, "sema_registry_a2a_env_missing", "skipping this A2A peer — referenced env var is unset in this service");
+        const headers = resolveRefs(p.headerRefs, p.name, "header", logger, "web_admin_a2a_env_missing", "skipping this A2A peer — referenced env var is unset in this service");
         if (headers === null)
             continue;
         out.push({
@@ -175,7 +175,7 @@ export function resolveA2aPeers(a2a, logger) {
         });
     }
     if (out.length > 0)
-        logger?.info("sema_registry_a2a", { peers: out.map((p) => p.spec.name) });
+        logger?.info("web_admin_a2a", { peers: out.map((p) => p.spec.name) });
     return out;
 }
 export function a2aForScenario(peers, scenario) {

package/dist/{config-center → web-admin-client}/stage-limits.d.ts

@@ -17,17 +17,11 @@ import type { Logger } from "../observability/logger.js";
 import { type Batch1LimitKey } from "./hot-keys-registry.js";
 import type { EffectiveLimits } from "./types.js";
 /**
- * stage 的入参视图。
- *
- * 🔴 `legacyGates` 是**已过旧位 presence 判据**的闸值(判据属主 = `runtimeGatePresent`,调用方过一遍再传)。
- * 两位刻意判据不同,不是疏忽:旧位(`runtime`)的容忍语义(例如 `costQuotaWindowSec: 0` 判「缺席」保 env)
- * 是既有 center 的在营契约,收紧它会把一个存量发布变成整批拒;新位(`limits`)从第一天起就是严判
- * (坏值 = 整批响亮拒)。判据属主各只有一个,谁都没有被复刻第二份。
+ * stage 的入参视图:`limits` 域是这些键的**唯一**发布位(settings-schema 11 退役了 `runtime` 域,它的旧位读法随之删)。
  */
 export interface LimitsSource {
     readonly version: number;
     readonly limits?: EffectiveLimits;
-    readonly legacyGates?: Readonly<Record<string, unknown>>;
 }
 /** 逐键 defer 的铸因(codex R2-F2):值合法但这一键**不热**,变更只能重启生效。 */
 export interface DeferredLimit {

package/dist/{config-center → web-admin-client}/stage-limits.js

@@ -69,7 +69,6 @@ function candidateView(config, assignments) {
 }
 export function stageLimits(config, eff, logger) {
     const baseline = baselineOf(config);
-    const legacy = eff.legacyGates ?? {};
     const assignments = [];
     const deletions = [];
     const changed = [];
@@ -79,7 +78,7 @@ export function stageLimits(config, eff, logger) {
     const rawLimits = eff.limits;
     if (rawLimits !== undefined && (rawLimits === null || typeof rawLimits !== "object" || Array.isArray(rawLimits))) {
         const rejected = { keys: [...BATCH1_LIMIT_KEYS], reason: `the published limits domain must be a JSON object — got ${rawLimits === null ? "null" : Array.isArray(rawLimits) ? "array" : typeof rawLimits}` };
-        logger?.warn("sema_registry_limits_invalid", {
+        logger?.warn("web_admin_limits_invalid", {
             ...rejected,
             version: eff.version,
             kept: "the whole limits batch is refused — a malformed container must never read as 'the center manages none of these keys' (that would silently revert every published ceiling to the env baseline)",
@@ -91,7 +90,7 @@ export function stageLimits(config, eff, logger) {
         const known = new Set([...BATCH1_LIMIT_KEYS, ...DEFERRED_LIMIT_KEYS.map((d) => d.key)]);
         const unconsumed = Object.keys(limits).filter((k) => !known.has(k));
         if (unconsumed.length > 0) {
-            logger?.warn("sema_registry_limits_unconsumed_keys", {
+            logger?.warn("web_admin_limits_unconsumed_keys", {
                 keys: unconsumed,
                 version: eff.version,
                 note: "published in the limits domain but not consumed by this server build (misspelled, or a later-batch key) — the value is inert until a batch that owns it ships",
@@ -99,7 +98,7 @@ export function stageLimits(config, eff, logger) {
         }
     }
     for (const key of BATCH1_LIMIT_KEYS) {
-        const published = limits !== undefined && Object.prototype.hasOwnProperty.call(limits, key) ? limits[key] : legacy[key];
+        const published = limits !== undefined && Object.prototype.hasOwnProperty.call(limits, key) ? limits[key] : undefined;
         let next;
         if (published === undefined) {
             next = baseline[key];
@@ -129,7 +128,7 @@ export function stageLimits(config, eff, logger) {
     }
     if (badKeys.length > 0) {
         const rejected = { keys: badKeys, reason: reason };
-        logger?.warn("sema_registry_limits_invalid", {
+        logger?.warn("web_admin_limits_invalid", {
             ...rejected,
             version: eff.version,
             kept: "the whole limits batch is refused — the prior values keep serving (a half-applied limit face means the published numbers and the live gate are different generations)",
@@ -140,7 +139,7 @@ export function stageLimits(config, eff, logger) {
     if (!verdict.ok) {
         const involved = changed.length > 0 ? changed : BATCH1_LIMIT_KEYS.slice();
         const rejected = { keys: [...involved], reason: verdict.reason, restartReason: verdict.restartReason };
-        logger?.warn("sema_registry_limits_invalid", {
+        logger?.warn("web_admin_limits_invalid", {
             ...rejected,
             invariant: verdict.id,
             version: eff.version,
@@ -149,7 +148,7 @@ export function stageLimits(config, eff, logger) {
         return { assignments: [], deletions: [], changed: [], deferred: [], rejected };
     }
     if (deferred.length > 0) {
-        logger?.warn("sema_registry_limits_deferred", {
+        logger?.warn("web_admin_limits_deferred", {
             keys: deferred.map((d) => d.key),
             version: eff.version,
             reasons: [...new Set(DEFERRED_LIMIT_KEYS.filter((d) => deferred.some((x) => x.key === d.key)).map((d) => d.why))],

package/dist/{config-center → web-admin-client}/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * config-center wire types — the config-center `/api/config/effective` payload shapes (`CenterModel`,
+ * web-admin wire types — the web-admin `/api/config/effective` payload shapes (`CenterModel`,
  * `CenterSkillManifest`, `CenterMcpServer`, `CenterA2aPeer`, `EffectiveConfig`) plus the per-principal
  * execution/session-mirror ruling shapes riding the caps view (`ExecutionRuling`/`SessionMirrorRuling`).
  * Pure type/interface declarations — no runtime logic. Split out of `facade.ts` ([ref] A13,
@@ -8,7 +8,7 @@
 import type { ToolContentOrigin } from "@sema-agent/core";
 import type { CollabTemplateWire } from "../capabilities/collab-wire.js";
 import type { Autonomy, CommandRule } from "../runtime-governance.js";
-import type { DroppedModelIdentity } from "./read-warnings.js";
+import type { DroppedCatalogEntry } from "./read-warnings.js";
 export interface CenterModel {
     name: string;
     id: string;
@@ -134,7 +134,7 @@ export interface CenterMcpServer {
      * 的 `McpServerSpec` 是默认 strip 的 zod object 且没有 `contentOrigin` 可选键,本地腿在 FileConfigStore 的
      * `parseDomainLoud(DOMAIN_SCHEMAS.mcp)`、远端腿在消费端边界 `readEffectiveWire`([ref] 裁B)**各被剥一次**。
      * 修在 sema-settings-schema(补同名可选枚举键 + 发包),本仓提货后 `config-provider.ts` 的映射加一行即通;
-     * 两条 `it.fails` 绊线(test/config-center-wire-read.test.ts + test/config-provider.test.ts)在上游到货时
+     * 两条 `it.fails` 绊线(test/web-admin-wire-read.test.ts + test/config-provider.test.ts)在上游到货时
      * 自动翻红逼销账。
      */
     contentOrigin?: ToolContentOrigin;
@@ -195,7 +195,7 @@ export interface CenterA2aPeer {
  * #A4([ref] 窗三件批 件1;[ref]/[ref] 承诺件)—— READ 容纳面的 center 下发形(`CenterA2aPeer` 的
  * 同族:一个 additive 顶层域,server 声明它才不会被静默丢弃)。四个成员逐一对应部署 env 的四键
  * (`READ_FACE` / `READ_DENY_PATTERNS` / `READ_DENY_BUILTIN_TIERS` / `READ_DENY_BUILTIN_EXCLUDE`),
- * 消费半场 = `config-center/read-face.ts` `applyCenterReadFace`。
+ * 消费半场 = `web-admin-client/read-face.ts` `applyCenterReadFace`。
  *
  * 🔴 **env 显式恒赢**(operator-knob 律,消费侧执法):env 是这台机器的部署主权,center 是组织下发;
  * 冲突时本机 env 原样保留 + 一条点名 warn。所以本类型描述的是「组织想要什么」,不是「这台机器最终是什么」。
@@ -267,17 +267,18 @@ export interface EffectiveConfig {
     models: {
         models: CenterModel[];
         roles: Record<string, CenterRoleTarget>;
-        atModelAllowlist?: string[];
-        default?: string;
+        /** `models.atMention`(settings-schema 11)的**承载位**:类型是 `unknown` 而不是那个三态,理由与 {@link CenterModel.compat} 同 ——
+         *  本类型描述到货 JSON,形与缺省读法的单一属主是契约座位 schema(`model-select.ts` `readAtMention`,stage 在那一刻调它)。
+         *  两条读腿恒物化它;只有一份 11.0.0 之前写下、迁移后仍没有这一键的 LKG 载荷缺席它(缺席 = 契约缺省)。 */
+        atMention?: unknown;
         tierGroups?: unknown;
         activeTierGroup?: string;
-        /** 🔴 S-712 —— **本仓读腿铸的**载体(不是 wire 键:中心在模型域里写同名键会被 schema 当未知键剥掉并进候选门):这次读
-         *  被 schema 逐条丢掉的**启用**、**有名**目录条目的身份(取 settings-schema 6.1.0 告警自带的 `identity`,见
-         *  `read-warnings.ts` `splitFoldedReadWarnings`)。模型面 stage 把它们铸成 `config.model_entry_invalid` 墓碑进 `modelRefusals`,
-         *  不变量 `refused-names-not-minted` 据此判增广有没有把它们的名字铸到别的条目上。挂在 effective 上(而不是读结果旁边)是为了
-         *  **随 effective 落 LKG**:重启从 LKG 起服时墓碑还在。形见 {@link DroppedModelIdentity}(纯身份,不含值);盘上形不对
-         *  (不是列表 / 行缺字符串 `name`)⇒ 模型面整组拒。 */
-        droppedIdentities?: DroppedModelIdentity[];
+        /** 🔴 S-712 / S-1295 —— **本仓读腿铸的**载体(不是 wire 键:中心在模型域里写同名键会被 schema 当未知键剥掉并进候选门):这次读
+         *  被 schema 逐条丢掉的**每一条**目录条目一行(下标 + settings-schema 闭集词 `reasonCode` + 告警自带的 `identity` + 字段诊断;形与律见
+         *  `read-warnings.ts` {@link DroppedCatalogEntry})。读者各取所需:模型面 stage 把有名且启用的行铸成 `config.model_entry_invalid` 墓碑
+         *  (不变量 `refused-names-not-minted` 据此判增广),每一行与 `models` 同 commit 进 `config.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源)。
+         *  挂在 effective 上(而不是读结果旁边)是为了**随 effective 落 LKG**:重启从 LKG 起服时它还在。盘上形不对 ⇒ 模型面整组拒。 */
+        droppedCatalogEntries?: DroppedCatalogEntry[];
     };
     /** registry-core 0.7 collab domain (teams' successor) — consumed by the slice-1.5 projection
      *  (projectCollabToWorkflows → registerCollabWorkflows). Both lanes carry it: the remote worker /effective view
@@ -308,42 +309,13 @@ export interface EffectiveConfig {
             enabled?: boolean;
         }>;
     };
-    /** `runtime` 域 = **限额残余五键**,与 settings-schema `RuntimeConfig` 的键集逐字相等([ref] 件3 对账门
-     *  test/settings-schema-consumption-gates.test.ts 读 dist `RuntimeConfig.shape` 钉集合等式)。全部 center
-     *  `.optional()`(center `f95438a`):缺席 = 不管 → 保 env;在场(含显式 0 = "publish OFF")= 覆盖。
-     *  [ref] 批1 起五键全是**热**键(属主 stage-limits,boot+refresh 双腿);`limits` 域是它们的继任发布位
-     *  (两处同现 ⇒ limits 赢,见 {@link EffectiveConfig.limits})。
-     *
-     *  🔴 治理三件(autonomy / commandPolicy / approvalRequire)**不在这里**([ref] 件3 退役键清除):它们自
-     *  settings-schema 0.6 起住 `governance` 域,0.7.1 撤了 runtime 位的双写镜像;此后 `RuntimeConfig` 是 strip
-     *  的 zod object,两条腿(远端 `readEffectiveWire` / 本地 FileConfigStore→`buildEffective`)都把旧位 strip
-     *  掉、由 `legacyGovernanceFromRuntime` 抬进 governance ⇒ 本仓在 runtime 位上读它们的每一行都是死码。
-     *  旧类型面上留着这三键,让(已于 S-668 波 2 退役的)`runtime-gates` 重启片一直读着一个生产上恒缺席的位(审批闸收紧静默不生效)。 */
-    runtime?: {
-        rateLimitPerMin?: number;
-        maxTaskCostUsd?: number;
-        maxTaskTokens?: number;
-        maxPrincipalCostUsd?: number;
-        costQuotaWindowSec?: number;
-    };
     /**
      * [ref] 批1 —— **limitsHttp 组的热更新发布域**([ref] §6 批1)。
      *
-     * 🔴 为什么是**新顶层域**而不是往 `runtime` 里加键(亲验,不是推测):registry-core 的 `RuntimeConfig`
-     * 是 zod `"strip"` 对象,`runtime` 里的未知键在**两条腿上都会被静默剥掉**(local 腿实测
-     * `{rateLimitPerMin:7, toolResultTtlSec:999}` → `{rateLimitPerMin:7}`,零 domainError;remote 腿的
-     * `readEffectiveWire` 同一 schema)。而**未知顶层域**是 open-world verbatim 透传的(同一实测:顶层
-     * `limits` 原样到手)——所以这是今天唯一能真的把这些键送到消费端的形,也与 governance 域当初从
-     * runtime 里拆出去的先例同族。
-     *
-     * 车道现状(如实):remote 腿即刻可用(center 发什么就到什么);**local 腿(config.d/)暂不可用** ——
-     * `FileConfigStore` 的域表是闭集,`config.d/limits.json` 根本不会被读进 effective。补法在 registry-core
-     * (加 `limits` 域 + PORTABLE_DOMAINS),与 `a2a`/`readFace` 当初的缺口同族;server 侧的消费半场(本键 +
-     * stage + commit)先落地,不在下游自建第二个读盘腿(源头修复纪律)。
-     *
-     * 与 `runtime` 的**优先级**:五个既有闸键(rateLimitPerMin/maxTaskCostUsd/maxTaskTokens/
-     * maxPrincipalCostUsd/costQuotaWindowSec)两处都可能出现 ⇒ `limits` 赢(新位是真值,旧位是过渡),
-     * 与 governance/runtime 的读取优先级契约同形。
+     * 限额五闸(rateLimitPerMin / maxTaskCostUsd / maxTaskTokens / maxPrincipalCostUsd / costQuotaWindowSec)与其余限额键的**唯一**发布位:
+     * settings-schema 11 退役了 `runtime` 域(它曾承载前五键;存量由一次性迁移 SS-M1 搬进本域,读腿对带事实的 `runtime` 整份拒),
+     * 本仓的旧位读法随之删 —— 一个键一个发布位,没有「两处同现谁赢」的优先级规则。两条腿都读它(本地腿:`config.d/limits.json`,
+     * `limits` 在 PORTABLE_DOMAINS 里)。
      */
     limits?: EffectiveLimits;
     /** 142-S4(registry-core 0.10.0 第 15 域):center 项目登记簿。wire 面 verbatim JSON —
@@ -388,7 +360,7 @@ export interface EffectiveConfig {
  *  `host` lane on purpose). ⚠️ Admins writing `required=true` policies must include `in-process` when such
  *  workers should stay admittable — center UI/doc 词表待补齐。
  *
- *  🔴 **`device` 是 per-principal 执行面上最需要写清的一条**(device-executor-lane-v2 §4.1 的 config-center
+ *  🔴 **`device` 是 per-principal 执行面上最需要写清的一条**(device-executor-lane-v2 §4.1 的 web-admin
  *  行,车A-4 补):它是「在**员工自己的机器**上执行」的那条车道 —— 允许它 ≠ 允许一台云沙箱,而是允许
  *  这个 principal 把裁决过的指令投到一台**受管设备**上。⚠️ 但**别把它当设备准入门用**:本 ruling 的
  *  粒度是 lane 名,它表达不了 principal×device 绑定,而且 no-ruling 是 **fail-open** 的

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.122.0",
+  "version": "7.124.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -64,8 +64,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.47.0",
-    "@sema-agent/settings-schema": "9.0.0",
+    "@sema-agent/core": "7.48.0",
+    "@sema-agent/settings-schema": "11.2.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",

package/skills/find-skills.md

@@ -142,7 +142,7 @@ npx skills init my-xyz-skill
 
 <!--
 TODO (clay): add our own first-party skill sources here -
-sema-registry / config-center - as a discovery+install lane alongside the open
-skills.sh ecosystem. Not every deployment ships a config-center, so the section
+web-admin / web-admin - as a discovery+install lane alongside the open
+skills.sh ecosystem. Not every deployment ships a web-admin, so the section
 must probe availability first and fall back to the public ecosystem cleanly.
 -->

package/dist/config-center/read-warnings.d.ts

@@ -1,109 +0,0 @@
-/**
- * `EffectiveReadWarning` → 候选门口径的**单点**折叠(本地腿 `config-provider.ts` 与远程腿 `http-client.ts` 共用;
- * 两腿各抄一份映射正是漂移的成因——远程腿曾漏掉一次改动,版本超前的 center 多一个字段就整份远程 refresh 整拒)。
- *
- * **律只有一条:未知键 = 候选门错误,零特例。** 「别的写者按契约放的扩展键」(壳写在 models 条目上的 `sema*`)
- * 不是本函数要分辨的事——那由 settings-schema 的 `EXTENSION_NAMESPACES` 在**声明处**说清(登记的键既不点名也不计数,
- * 1.5.0 起);到了这里的每一个键都是「写了没生效」的拼错或越界,与 domain-defaulted 同级。此前本仓在下游按 kind/
- * 按域/按键路径闭集/按 64 满额四层猜意图,每层都被下一轮复审打穿——意图只能在声明处说,消费方不猜。
- *
- * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
- * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
- *
- * **归族判据两问**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):
- *  ① 值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面(`null`);
- *  ② 写了没生效的,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独
- *     不在,同域其余条目照用,候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。
- *
- * 🔴 S-704 ②(2026-09-24,凭据轴):此前 `entry-dropped` 归「候选门错误」(settings-schema 2.0.0 提货时的归族),于是
- * schema 的**逐条容错**在本仓的 refresh / 迟到 boot 两条腿上被**还原成整份拒** —— 目录里一条 `contextWindow:"abc"`
- * 就让整份目录停在上一代;而上一代若还是 env(boot 拉取失败 / 超窗且无 LKG),env 模型就一直服务、env 钥匙一直被送到
- * 网关缺省端点(红先实测:`config_candidate_rejected` + env 模型继续服务)。粒度对了规则反而更少:颗粒是条目的失效
- * 留在条目上,只有颗粒更粗的失效才动候选。
- * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归①——那几个键**生效了**
- * (`buildEffective` 用抬升结果解析 governance),把它折成错误会让一份合法的 0.5 期存量配置每一次 refresh 都被
- * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
- * `onWarning` 流),不借候选门这条带副作用的通道传信息。
- */
-import { type EffectiveReadWarning } from "@sema-agent/settings-schema";
-/** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`)。 */
-export type FoldedReadWarning = {
-    readonly scope: "domain";
-    readonly domain: string;
-    readonly error: string;
-} | {
-    readonly scope: "entry";
-    readonly domain: string;
-    readonly entry: string;
-    readonly error: string;
-};
-/** 逐条丢弃面的一行(两条读腿的 `droppedEntries` 同形):`entry` = 被丢那条的出门形坐标(`models.1`),`error` = 哪些字段、为什么。 */
-export type DroppedConfigEntry = {
-    readonly domain: string;
-    readonly entry: string;
-    readonly error: string;
-};
-/**
- * zod 形的错误 → 一行可读的字段诊断(`contextWindow: expected number, received string; api: custom`)。
- * **只读**每条 issue 的 `path`(键名)与 `code`,`invalid_type` 臂另读 `expected` / `received`(两者都是**类型词**)——
- * 刻意不读 `message`(自定义 refine 的 message 可以回声值)与 `invalid_enum_value` 等臂的 `received`(那是原值)。
- * 读不出 issues 形 ⇒ `undefined`(调用方退回既有文案)。模型面 stage 的逐条判据与本折叠点共用这一只(一个刻度)。
- */
-export declare function describeSchemaIssues(error: unknown): string | undefined;
-/**
- * zod 形错误 → 坏字段的**键路径**(去重保序;`(entry)` = 整条)。与 {@link describeSchemaIssues} 同一只读法(只读 `path`),
- * 不含值。模型面 stage 的逐条判据(`judgeCatalogEntry`)与本折叠点的被丢条目身份共用这一只 —— 一个刻度。
- */
-export declare function describeSchemaIssueFields(error: unknown): string[];
-/** null = 不入诊断面(`hosts-grandfathered` / `legacy-governance-lifted`:值已被收编接受,与本地店同口径)。 */
-export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
-/**
- * 🔴 S-712 —— 一条被 schema 逐条丢掉的**启用**、**有名**目录条目的身份(模型面墓碑的来源;载体 = `EffectiveConfig.models.droppedIdentities`,
- * 随 effective 走 —— 盘上 LKG 从同一个对象落盘,重启从 LKG 起服墓碑不丢)。
- *
- * 为什么要交出身份:条目被丢之后它的名字从目录里消失,而档位增广(core `expandTiers`)会把一个**空出来的**档位词 / CC 别名
- * (条目恰好叫 `sonnet` / `pro` …)重新铸到另一条条目上 —— 显式点它的请求与点名它的角色绑定就这样被静默换了目的地
- * (gpt-6 腿 F2 / F3,真复现)。身份进 `modelRefusals` 之后,不变量 `refused-names-not-minted` 才判得到它。
- *
- * 🔐 纯身份,不含值:`name` / `id` 取自告警的 `identity`(settings-schema 6.1.0:只取被丢条目原文里的字符串形,脱敏器会改动的串
- * 整键扣下),`fields` 是坏字段的**键路径**,`issues` 是 {@link describeSchemaIssues} 的一行(键名 + 类型词)—— 被丢条目的原值
- * (可能是一段贴错位置的凭据)绝不进载体、日志、LKG 与 400 拒因句。
- */
-export interface DroppedModelIdentity {
-    /** 出门形坐标(`models.1`),与同一次读的 `droppedEntries[].entry` 同一串。 */
-    readonly entry: string;
-    /** 条目写的 `name`(读腿只为有名的行铸载体)。载体上缺了它 = 载体形不对(LKG 载体被改 / 手写 effective)⇒ 模型面整组拒,
-     *  判在 `model-entry-refusal.ts` `judgeCatalogEntries`。 */
-    readonly name: string;
-    readonly id?: string;
-    readonly fields: readonly string[];
-    readonly issues: string;
-}
-/**
- * 两条读腿(远端 `http-client.ts` / 本地 `config-provider.ts`)共用的**分面单点**:折叠产物按 `scope` 分进候选门
- * (`domainErrors`)与逐条丢弃面(`droppedEntries`)。`switch` 穷举 —— 加一种 scope 不补臂 = 编译红,两腿不会各分各的。
- * 文案**未脱敏**:进日志流之前各腿在自己的产出边界上过 `redactConfigError`(与 `domainErrors` 同一道)。
- *
- * 🔴 S-712 身份规则(一条,数据源 = 告警自带的 `identity`,settings-schema 6.1.0 在**同一次解析**里从被丢条目原文取 —— 本仓不再回读原文档):
- * **`identity.name` 是字符串 ⇒ 有名;有名且 `identity.enabled !== false` ⇒ 墓碑(进载体);其余一律不进载体。**
- *  · 有名而停用 ⇒ 停用 = 不在目录(与 7.100.0 同义);
- *  · 没有字符串名 —— `identity` 在场而无 `name`,或 `identity` 整个缺席 ⇒ **无名可留**,与停用同处置。按 settings-schema 6.1.0 的铸点
- *    (`config-fns.ts` `readEntryIdentity`),「没有名」有两个成因、刻意不分:原文 `name` 不是字符串(`null` / 数 / 整行不是对象),
- *    或是字符串但脱敏器会改动它(秘密形 —— 扣下不出门)。后者对本判据同样安全:档位增广只铸闭集词(`ultra` / `max` / `pro` /
- *    `flash` / `lite`、CC 别名、`best`),没有一个是秘密形,一个被扣下的名字无从被铸出;它的代价只是显式点它的请求拿到「未知模型」
- *    而不是 `request.model_unavailable`(那个名字本来也不许进日志与拒因句)。
- * 坏行本身照样走 `droppedEntries`(坐标 + 字段,不带值)。
- */
-export declare function splitFoldedReadWarnings(warnings: readonly EffectiveReadWarning[]): {
-    domainErrors: Array<{
-        domain: string;
-        error: string;
-    }>;
-    droppedEntries: DroppedConfigEntry[];
-    droppedIdentities: DroppedModelIdentity[];
-};
-/** S-712:把本次读交出的被丢身份挂上 effective 的模型域(两腿同一只;空 ⇒ 不挂键)。 */
-export declare function withDroppedIdentities<E extends {
-    models?: object;
-}>(effective: E, droppedIdentities: readonly DroppedModelIdentity[]): E;
-//# sourceMappingURL=read-warnings.d.ts.map

package/dist/config-center/read-warnings.js

@@ -1,110 +0,0 @@
-import { formatConfigPath } from "@sema-agent/settings-schema";
-export function describeSchemaIssues(error) {
-    const issues = schemaIssuesOf(error);
-    if (issues === undefined)
-        return undefined;
-    return issues
-        .map((raw) => {
-        const i = (typeof raw === "object" && raw !== null ? raw : {});
-        const field = Array.isArray(i.path) && i.path.length > 0 ? i.path.map(String).join(".") : "(entry)";
-        const what = i.code === "invalid_type" && typeof i.expected === "string" && typeof i.received === "string"
-            ? `expected ${i.expected}, received ${i.received}`
-            : typeof i.code === "string"
-                ? i.code
-                : "invalid";
-        return `${field}: ${what}`;
-    })
-        .join("; ");
-}
-function schemaIssuesOf(error) {
-    const issues = typeof error === "object" && error !== null ? error.issues : undefined;
-    return Array.isArray(issues) && issues.length > 0 ? issues : undefined;
-}
-export function describeSchemaIssueFields(error) {
-    const issues = schemaIssuesOf(error) ?? [];
-    const fields = issues.map((raw) => {
-        const p = typeof raw === "object" && raw !== null ? raw.path : undefined;
-        return Array.isArray(p) && p.length > 0 ? p.map(String).join(".") : "(entry)";
-    });
-    return [...new Set(fields)];
-}
-const MAX_ERROR_CHARS = 600;
-const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
-const errorText = (e) => (e instanceof Error ? e.message : String(e));
-const keyList = (prefix, keys, truncatedFrom) => {
-    const total = truncatedFrom ?? keys.length;
-    const budget = MAX_ERROR_CHARS - prefix.length;
-    const shown = [];
-    let used = 0;
-    const suffixFor = (n) => (n < total ? ` (+${total - n} more, list truncated)` : "");
-    for (const k of keys) {
-        const rendered = formatConfigPath(k);
-        const piece = (shown.length > 0 ? ", " : "") + rendered;
-        if (used + piece.length + suffixFor(shown.length + 1).length > budget)
-            break;
-        shown.push(rendered);
-        used += piece.length;
-    }
-    return `${prefix}${shown.join(", ")}${suffixFor(shown.length)}`;
-};
-export function foldEffectiveReadWarning(w) {
-    switch (w.kind) {
-        case "hosts-grandfathered":
-        case "legacy-governance-lifted":
-            return null;
-        case "domain-defaulted":
-            return { scope: "domain", domain: w.domain, error: cap(errorText(w.error)) };
-        case "entry-dropped":
-            return { scope: "entry", domain: w.domain, entry: formatConfigPath(w.path), error: cap(`entry dropped by domain schema: ${describeSchemaIssues(w.error) ?? errorText(w.error)}`) };
-        case "unknown-keys-dropped":
-            return { scope: "domain", domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
-        case "unknown-keys-carried":
-            return { scope: "domain", domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
-        case "unread-config-file":
-            return { scope: "domain", domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
-        default: {
-            const never = w;
-            throw new Error(`unhandled EffectiveReadWarning kind: ${JSON.stringify(never)}`);
-        }
-    }
-}
-function isModelEntryDrop(w) {
-    return w.kind === "entry-dropped" && w.domain === "models" && w.path.length === 2 && w.path[0] === "models" && typeof w.path[1] === "number";
-}
-export function splitFoldedReadWarnings(warnings) {
-    const domainErrors = [];
-    const droppedEntries = [];
-    for (const w of warnings) {
-        const f = foldEffectiveReadWarning(w);
-        if (f === null)
-            continue;
-        switch (f.scope) {
-            case "domain":
-                domainErrors.push({ domain: f.domain, error: f.error });
-                break;
-            case "entry":
-                droppedEntries.push({ domain: f.domain, entry: f.entry, error: f.error });
-                break;
-            default: {
-                const never = f;
-                throw new Error(`unhandled folded read-warning scope: ${JSON.stringify(never)}`);
-            }
-        }
-    }
-    const droppedIdentities = [];
-    for (const w of warnings) {
-        if (!isModelEntryDrop(w))
-            continue;
-        const identity = w.identity;
-        if (identity?.name === undefined || identity.enabled === false)
-            continue;
-        droppedIdentities.push({ entry: formatConfigPath(w.path), name: identity.name, ...(identity.id !== undefined ? { id: identity.id } : {}), fields: describeSchemaIssueFields(w.error), issues: describeSchemaIssues(w.error) ?? "(schema issues unreadable)" });
-    }
-    return { domainErrors, droppedEntries, droppedIdentities };
-}
-export function withDroppedIdentities(effective, droppedIdentities) {
-    if (droppedIdentities.length === 0 || effective.models === undefined)
-        return effective;
-    return { ...effective, models: { ...effective.models, droppedIdentities: [...droppedIdentities] } };
-}
-//# sourceMappingURL=read-warnings.js.map

package/dist/url-shape.d.ts

@@ -1,31 +0,0 @@
-/** 座位可以禁掉的部件(闭集;判序 = 本数组序)。 */
-export declare const HTTP_URL_PARTS: readonly ["userinfo", "query", "fragment"];
-export type HttpUrlPart = (typeof HTTP_URL_PARTS)[number];
-/** 判官的拒因词(闭集):形不对,或一件被禁的部件在场。 */
-export type HttpUrlFlaw = "not-http-url" | HttpUrlPart;
-/** 「不是一个 http(s) URL」的规则词 —— 不透明形、不可解析、层级式非 http(s) 同一句;只点名规则,不回显 scheme。钉读这一只,不手抄。 */
-export declare const HTTP_URL_SHAPE_RULE = "is not a parseable http(s) URL (scheme must be http or https; it must look like http(s)://host[:port][/path])";
-/**
- * 判:合格 ⇒ `[]`;否则按判序交回规则词。形不对且不透明 ⇒ 只有 `not-http-url`(部件在不透明形上无从判,
- * 也不需要判 —— 那一形整只不收);层级式非 http(s) ⇒ `not-http-url` 之后照判部件。
- * 返回类型按 `forbid` 收窄:座位没禁的部件不会出现在答案里(调用方的穷举 switch 因此不需要一条「不可达」臂)。
- */
-export declare function httpUrlFlaws<P extends HttpUrlPart>(raw: string, forbid: readonly P[]): ReadonlyArray<"not-http-url" | P>;
-/** 一个拒因词的规则句(穷举;新词不补 = 编译红)。句子只说规则,不含值。 */
-export declare function httpUrlRule(flaw: HttpUrlFlaw): string;
-/**
- * 拒句里值的样子(纯函数):合格的 http(s) 形 ⇒ 只到 origin(`scheme://host[:port]`,过展示铸点),origin 之后还有东西(userinfo /
- * 路径 / query / fragment)⇒ 接一枚 `/…`;其余(不透明 / 不可解析 / 层级式非 http(s))⇒ 展示铸点的占位 `«redacted:url»` ——
- * 拒句里不出现非 http(s) 的 scheme 词(主会话增补裁:写成 scheme 的令牌 `<48hex>://host` 曾原样进 fatal 行)。
- *
- * 🔴 为什么只到 origin(车内 codex 对抗复审 r1 [high],亲跑复现):展示铸点的路径段**逐字**保留、只靠形状律认令牌形 ——
- * 形状律认不出的令牌(48 位十六进制拉取令牌就是一例)放在路径上会原样进拒句。拒句落在 fatal 行、stderr、每一轮的请求失败日志,
- * 这几处不赌形状律的覆盖面:座位名 + 规则词已经说清了哪一席错在哪,值只需要认得出是哪一台主机。
- */
-export declare function buildRefusalShownUrl(raw: string): string;
-/**
- * 拒句的**唯一**铸点:`<subject> <规则句>[; <规则句>…]; got "<值的样子>"`(`build*` = 纯数据)。
- * 值只经 {@link buildRefusalShownUrl} 出现;`flaws` 来自 {@link httpUrlFlaws}(调用方按首个拒因选自己的码与出路句)。
- */
-export declare function buildHttpUrlRefusal(subject: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
-//# sourceMappingURL=url-shape.d.ts.map

package/dist/url-shape.js

@@ -1,41 +0,0 @@
-import { DISPLAY_SAFE_URL_TOKEN, buildDisplaySafeUrl, isHierarchicalUrl } from "./trace/redact.js";
-export const HTTP_URL_PARTS = ["userinfo", "query", "fragment"];
-export const HTTP_URL_SHAPE_RULE = "is not a parseable http(s) URL (scheme must be http or https; it must look like http(s)://host[:port][/path])";
-export function httpUrlFlaws(raw, forbid) {
-    if (!isHierarchicalUrl(raw))
-        return ["not-http-url"];
-    const u = new URL(raw);
-    const hashAt = u.href.indexOf("#");
-    const present = {
-        userinfo: u.username !== "" || u.password !== "",
-        query: (hashAt < 0 ? u.href : u.href.slice(0, hashAt)).includes("?"),
-        fragment: hashAt >= 0,
-    };
-    const shape = u.protocol === "http:" || u.protocol === "https:" ? [] : ["not-http-url"];
-    return [...shape, ...HTTP_URL_PARTS.filter((p) => forbid.includes(p) && present[p])];
-}
-export function httpUrlRule(flaw) {
-    switch (flaw) {
-        case "not-http-url":
-            return HTTP_URL_SHAPE_RULE;
-        case "userinfo":
-            return "must not carry userinfo (credentials in the URL are logged, reported and handed to fetch; they belong in a credential setting)";
-        case "query":
-            return "must not carry a query (request paths are appended to this base)";
-        case "fragment":
-            return "must not carry a fragment (it is never sent, and anything appended after it is dropped with it)";
-    }
-}
-export function buildRefusalShownUrl(raw) {
-    if (!isHierarchicalUrl(raw))
-        return DISPLAY_SAFE_URL_TOKEN;
-    const u = new URL(raw);
-    if (u.protocol !== "http:" && u.protocol !== "https:")
-        return DISPLAY_SAFE_URL_TOKEN;
-    const origin = `${u.protocol}//${u.host}`;
-    return `${buildDisplaySafeUrl(origin)}${u.href === `${origin}/` ? "" : "/…"}`;
-}
-export function buildHttpUrlRefusal(subject, raw, flaws) {
-    return `${subject} ${flaws.map(httpUrlRule).join("; ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}`;
-}
-//# sourceMappingURL=url-shape.js.map