@sema-agent/server 7.123.0 → 7.124.0

package/dist/boot/{config-center.js → web-admin.js}

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { CENTER_CREDENTIAL_ENV, skillContentHash } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, formatConfigPath, skillContentHash } from "@sema-agent/settings-schema";
 import { stableStringify } from "@sema-agent/settings-schema/hash";
 import { buildModelRefusalsSignal } from "../model-entry-refusal.js";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
@@ -15,15 +15,16 @@ import { isRosterGateArmed } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
-import { centerManagedConfigKeys } from "../config-center/apply-effective.js";
+import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
+import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../config-center/facade.js";
+import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
-import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
+import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../config-center/apply-ledger.js";
+import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -32,7 +33,7 @@ function lkgReadNote(scope) {
             return "the live candidate's model plane was refused at boot — the persisted last-known-good supplies the model plane only (catalog and the collab templates that reference it); every other group and every restart-to-apply face stays the live candidate's";
     }
 }
-export async function createConfigCenterRuntime(ctx) {
+export async function createWebAdminRuntime(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     let ccEtag;
     let effective;
@@ -65,13 +66,13 @@ export async function createConfigCenterRuntime(ctx) {
     let bootSkillStale = false;
     let pendingRestart;
     let modelRefusals;
-    const cc = config.configCenter;
+    const cc = config.webAdmin;
     const bootCredential = cc?.credential.read();
     const bootVerdict = bootCredential === undefined ? undefined : judgeCenterCredentialAtBoot(bootCredential);
     if (bootVerdict?.verdict === "refuse")
         throw new Error(bootVerdict.sentence);
     if (bootVerdict?.verdict === "loud") {
-        logger.error("center_credential_unreadable", { key: CENTER_CREDENTIAL_ENV.tokenFile, failure: bootVerdict.failure, reason: bootVerdict.reason, effect: bootVerdict.effect });
+        logger.error("center_credential_unreadable", { key: WEB_ADMIN_ENV.tokenFile, failure: bootVerdict.failure, reason: bootVerdict.reason, effect: bootVerdict.effect });
     }
     const credentialRenewer = cc !== undefined && cc.credential.origin.from === "file"
         ? createCenterCredentialRenewer({ source: cc.credential, centerUrl: cc.baseUrl, leadMs: config.centerCredentialRenewLeadMs, logger })
@@ -110,7 +111,7 @@ export async function createConfigCenterRuntime(ctx) {
         sealedKeys = await ensureSealedKeyStore(join(config.localDataRoot ?? localRoot, "sealed-key"), logger);
         void reportExecutionPublicKey({
             baseUrl: cc?.baseUrl,
-            adminToken: process.env.SEMA_REGISTRY_ADMIN_TOKEN,
+            adminToken: process.env[WEB_ADMIN_ENV.adminToken],
             key: sealedKeys.latest,
             ...(cc?.worker ? { notes: `worker ${cc.worker}` } : {}),
             logger,
@@ -122,10 +123,12 @@ export async function createConfigCenterRuntime(ctx) {
     const configProvider = serviceConfigSourceKind(config) !== undefined
         ? createConfigProvider({
             ...(config.configProvider ? { provider: config.configProvider } : {}),
-            ...(cc ? { configCenter: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
+            ...(cc ? { webAdmin: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
             localDir: localRoot,
         })
         : undefined;
+    if (configProvider?.kind === "local")
+        logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
     const rosterGateArmed = isRosterGateArmed(cc);
     const modelReadyState = { ready: !rosterGateArmed };
     const warnDroppedEntries = (r, phase) => {
@@ -354,8 +357,8 @@ export async function createConfigCenterRuntime(ctx) {
         }
         const lkgPath = lkgPathFor(identity);
         try {
-            if (effectiveObj.skills && config.configCenter) {
-                await applyCenterSkills([], effectiveObj.skills, config.configCenter, logger, undefined, defaultSkillCacheDir(config));
+            if (effectiveObj.skills && config.webAdmin) {
+                await applyCenterSkills([], effectiveObj.skills, config.webAdmin, logger, undefined, defaultSkillCacheDir(config));
             }
             const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
             const cacheDir = defaultSkillCacheDir(config);
@@ -420,8 +423,21 @@ export async function createConfigCenterRuntime(ctx) {
                 logger.warn("config_lkg_unusable", { path: lkgPath, reason: "center credential identity changed while the LKG was being read — not used", note: "env fallback serves; the current identity's next pull re-establishes its own LKG" });
                 return null;
             }
-            if (read.migrated !== undefined)
-                logger.info("config_lkg_migrated", { to: lkgPath, note: read.migrated });
+            if (read.migrated !== undefined) {
+                const m = read.migrated;
+                logger.info("config_lkg_migrated", {
+                    to: lkgPath,
+                    fromFormat: m.fromFormat,
+                    ...(m.note !== undefined ? { note: m.note } : {}),
+                    receipts: m.receipts.map((r) => ({ migration: r.migration, document: r.document, path: formatConfigPath(r.path), appliedAs: r.appliedAs })),
+                });
+                try {
+                    await saveLkg(lkgPath, cc?.worker, identity, read.lkg.effective, read.lkg.etag);
+                }
+                catch (err) {
+                    logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "the migrated LKG is used from memory this boot; the on-disk copy is migrated again on the next read-back and replaced by the next clean candidate" });
+                }
+            }
             logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, scope, note: lkgReadNote(scope) });
             const lkgEffective = read.lkg.effective;
             candidateIdentity.set(lkgEffective, identity);
@@ -648,8 +664,8 @@ export async function createConfigCenterRuntime(ctx) {
             return (await manualRefresh()) === "failed" ? "failed" : "triggered";
         },
         async applyCenterCapabilities(skills) {
-            if (effective?.skills && config.configCenter) {
-                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, config.configLkgEnabled ? defaultSkillCacheDir(config) : undefined);
+            if (effective?.skills && config.webAdmin) {
+                skills = await applyCenterSkills(skills, effective.skills, config.webAdmin, logger, undefined, config.configLkgEnabled ? defaultSkillCacheDir(config) : undefined);
             }
             if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
@@ -705,7 +721,7 @@ export async function createConfigCenterRuntime(ctx) {
                 Object.assign(scenarios, overlay);
                 Object.assign(scenarioDetails, centerScenarioDetails(effective.scenarios.scenarios, builtinScenarioNames, scenarioDeps));
                 if (Object.keys(overlay).length > 0)
-                    logger.info("sema_registry_scenarios", { scenarios: Object.keys(overlay), ...(shadows.length > 0 ? { shadowsBuiltin: shadows } : {}) });
+                    logger.info("web_admin_scenarios", { scenarios: Object.keys(overlay), ...(shadows.length > 0 ? { shadowsBuiltin: shadows } : {}) });
             }
         },
         initKeyResolver() {
@@ -785,7 +801,7 @@ export async function createConfigCenterRuntime(ctx) {
             };
             const restartLogFields = (signal) => signal ? { restartRequired: true, restartReasons: signal.reasons } : {};
             if (configProvider) {
-                const ccRef = config.configCenter;
+                const ccRef = config.webAdmin;
                 let refreshInFlight = false;
                 const refreshTick = async (arrival) => {
                     if (refreshInFlight)
@@ -895,7 +911,7 @@ export async function createConfigCenterRuntime(ctx) {
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
                                     const partialSignal = signalRestart({ applied: "partial", effective: r.effective, baseline: effective, refused: refused.map((g) => g.group) });
-                                    logger.info("sema_registry_refreshed", {
+                                    logger.info("web_admin_refreshed", {
                                         version: r.effective.version,
                                         note: "partially applied — the refused group(s) keep their prior values (see config_candidate_partially_applied); the other groups hot-applied; restart fields as on a complete tick",
                                         ...restartLogFields(partialSignal),
@@ -904,7 +920,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
                                 const signal = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
-                                logger.info("sema_registry_refreshed", {
+                                logger.info("web_admin_refreshed", {
                                     version: r.effective.version,
                                     note: "collab + runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
                                     ...restartLogFields(signal),
@@ -915,7 +931,7 @@ export async function createConfigCenterRuntime(ctx) {
                         }
                     }
                     catch (err) {
-                        logger.warn("sema_registry_refresh_failed", { err: String(err), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
+                        logger.warn("web_admin_refresh_failed", { err: String(err), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
                         return "failed";
                     }
                     finally {
@@ -1044,4 +1060,4 @@ export async function createConfigCenterRuntime(ctx) {
         },
     };
 }
-//# sourceMappingURL=config-center.js.map
+//# sourceMappingURL=web-admin.js.map

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -51,9 +51,9 @@ export type WebFetchSummarizeLane = NonNullable<NonNullable<WebFetchConfig["summ
 export interface WebFetchSummarizeLaneCtx {
     /** 与 `RunnerDeps.brain` **同一只**实例(wrapper 在外面包,不改这只)。 */
     brain: Brain;
-    /** 活配置引用:目录/角色表被 config-center 就地热应用(`mutateInPlace`),按调用取值才跟得上。 */
+    /** 活配置引用:目录/角色表被 web-admin 就地热应用(`mutateInPlace`),按调用取值才跟得上。 */
     config: ServiceConfig;
-    /** 活引用取值 —— registry 热应用整个换 resolver 引用(`boot/config-center.ts` 每次 apply 重铸)。 */
+    /** 活引用取值 —— registry 热应用整个换 resolver 引用(`boot/web-admin.ts` 每次 apply 重铸)。 */
     getKeyResolver: () => KeyResolver;
     logger: Logger;
 }

package/dist/brain.d.ts

@@ -1,7 +1,7 @@
 import { type Brain, type BreakerState, type Model } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import { type SealedCustodyPoison } from "./key-resolver.js";
-import { type RestartSliceCtx } from "./config-center/restart-signal.js";
+import { type RestartSliceCtx } from "./web-admin-client/restart-signal.js";
 /**
  * 配了快切层(failover ≥2 路 / 断路器)时,**每路**的重试上限。
  *

package/dist/brain.js

@@ -6,7 +6,7 @@ import { createHash } from "node:crypto";
 import { isModelKeyPoison, modelKeyPoisonIdentity } from "./key-resolver.js";
 import { dispatchBrainLane } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
-import { catalogEntryFingerprint } from "./config-center/restart-signal.js";
+import { catalogEntryFingerprint } from "./web-admin-client/restart-signal.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
 import { createModelReachBrain } from "./model-unreachable-notice.js";
 function isOffDeploymentRoot(baseUrl, config) {

package/dist/budget.d.ts

@@ -23,13 +23,13 @@ import { type PromptManifestTracker } from "./observability/prompt-manifest.js";
 export declare function buildPricing(models: Record<string, Model>): Record<string, ModelPricing>;
 /**
  * 缝合审 M3:`capabilities.pricingConfigured` 的判据 —— 提成函数放在 pricing 自己的文件里,因为
- * **这个表是热变的**(`boot/config-center.ts` 的 `mutateInPlace(pricing, buildPricing(config.models))`,
+ * **这个表是热变的**(`boot/web-admin.ts` 的 `mutateInPlace(pricing, buildPricing(config.models))`,
  * 那行注释自己写着 `hot: cost/model changes`)。旧码在 `main.ts` 的 capabilities 字面量里把它算成一个
- * **boot 时的布尔快照**,于是运维在 config center 里加上/撤掉价目表之后,`/v1/capabilities` 还报旧值 ——
+ * **boot 时的布尔快照**,于是运维在 web-admin 里加上/撤掉价目表之后,`/v1/capabilities` 还报旧值 ——
  * 而这个键的**全部用途**就是给消费端消歧「costMicroUsd=0 是免费跑,还是根本没配价目表」,报错了就是
  * 把消歧信号变成误导信号。main.ts 侧改用 getter(读时求值)。
  *
- * 同一条论证在同一个字面量里**已经执行过一次**:紧邻的 `restartState: () => configCenter.restartState()`
+ * 同一条论证在同一个字面量里**已经执行过一次**:紧邻的 `restartState: () => webAdmin.restartState()`
  * 带着注释「A live getter (not a snapshot) so /health always reads current」—— 兄弟键漏了。本仓第 7 例同形。
  *
  * 🔴 B-089(判据本身,同一条「0 不是缺席」的病):此前判的是「**有没有一项正价**」

package/dist/canonical-json.d.ts

@@ -4,7 +4,7 @@
  *
  * ## 为什么只能有一个
  * 合并前本仓有 **5 处**手写复刻(memory-origin-fence / permission-rule-store-sql / bench-l8 artifact /
- * config-center restart-signal / mcp-revocation),每处一份「排 key、递归、拼串」——同一个算法五份实现,
+ * web-admin restart-signal / mcp-revocation),每处一份「排 key、递归、拼串」——同一个算法五份实现,
  * 语义在边缘(undefined 值键、函数成员、非有限数)各自漂了一点。指纹型代码的病灶恰恰在边缘:同一份内容算出
  * 两个指纹 = 落库 checksum 失配 / 误签 restart / 包完整性自校验对不上。
  *
@@ -29,7 +29,7 @@
  *  · `bigint`:`JSON.stringify` 抛 TypeError,原样上抛。
  *
  * ## 不在本文件里的第二形(如实登记)
- * `src/config-center/restart-signal.ts#stableStringify`(mcp-revocation 同源改调)是**另一个语义**:undefined 值键
+ * `src/web-admin-client/restart-signal.ts#stableStringify`(mcp-revocation 同源改调)是**另一个语义**:undefined 值键
  * **保留为 `"k":null`**。两族在 JSON 形输入上逐字节相同(golden 交叉读数已证),分歧只在进程内构造的
  * `{k: undefined}` 形——restart 指纹的输入正是进程内切片对象,该形原则上可达,而 `{k:undefined}` 与 `{}` 是否
  * 同指纹是 restart-signal 轴上的**行为**(多签/少签一次 fleet 滚动重启),不是序列化器的私事 ⇒ 本批不并

package/dist/capabilities/center-plugins.d.ts

@@ -85,7 +85,7 @@ export interface ApplyPluginsResult {
 }
 /**
  * 装载器**会物化**的插件(按声明序)—— 每条声明过**同一只**判定 {@link validatePluginDecl},只留 `ok` 的
- * `{name, url, sha?}`。restart 指纹(`config-center/restart-signal.ts` 的 skills 片,S-668 波 0)读的就是它:
+ * `{name, url, sha?}`。restart 指纹(`web-admin-client/restart-signal.ts` 的 skills 片,S-668 波 0)读的就是它:
  * 装载器不读的字段(notes / version)、整条跳过的声明(`enabled:false` / marketplace 源 / 白名单外 host / 坏形)
  * 在这里一并消失,于是「重启之后什么都不会变」的发布不签重启(codex 对抗复审 r1 [medium]);顺序保留 ——
  * 撞名让位按声明序,对调两条是真变化。`allowHosts` 与装载时同一份(部署事实 `PLUGINS_ALLOW_HOSTS`)。

package/dist/capabilities/center-wiring.d.ts

@@ -5,16 +5,20 @@
  * 与运维面板都读不出「额度现在没人在判」。本键把它们收成一个读面(调用方面;运维面仍是 `/health` 与 `GET /v1/diagnostics/wiring`)。
  *
  * ## 形与 present-iff
- * 整个键只在接了中心(`config.configCenter` 在场)时出现;`lease:"absent"`(中心三件不齐 ⇒ 没装租约管理器)时 `leaseHealth` /
+ * 整个键只在接了中心(`config.webAdmin` 在场)时出现;`lease:"absent"`(中心三件不齐 ⇒ 没装租约管理器)时 `leaseHealth` /
  * `failMode` / `caller` 三键缺席。「键缺席」于是两义:老 worker / 没接中心 —— 同一体的 `version` 能分。
  *  · `effectivePull` = 最近一次实拉成功(`lastPull === "ok"`;LKG 起服 / 从未成功 / 最近一拍失败 = false);
- *  · `effectiveRevision` = 与 `/health.configAppliedVersion` 同一只 ledger 视图(`config-center/pull-state.ts`);
+ *  · `effectiveRevision` = 与 `/health.configAppliedVersion` 同一只 ledger 视图(`web-admin-client/pull-state.ts`);
  *  · `lease` / `leaseHealth` / `failMode` / `caller` = 租约管理器的 `snapshot()` 与生效姿态(与执行的那一只同源);
  *  · `usageReport` = 用量环装没装(装配事实:累加器与环同一只谓词 `centerLaneConfigured`);
- *  · `issuer` = 鉴权桥 issuer 显式 / 回退(`authBridgeIssuerOf`;接了中心 ⇒ 桥恒装 ⇒ 没有 `none` 这一词)。
+ *  · `issuer` = 鉴权桥 issuer 显式 / 回退(`authBridgeIssuerOf`;接了中心 ⇒ 桥恒装 ⇒ 没有 `none` 这一词);
+ *  · `worker` = 引擎向中心登记用的 worker 名(取值口 = `config.webAdmin.worker`,排空口身份四元读的同一只)。**present-iff 配了名且名可披露**:
+ *    没配 ⇒ 缺席(不拼不猜);配了但不是标识符形 / 是秘密形(契约 `isDisclosableIdentity`,「引擎要不要把一个名字写出去」问的那一只)⇒ 按无名处置,
+ *    键缺席,不打码。它住在这张**有鉴权**的能力面、不住无鉴权 `/health`(`http/health-self-report.ts` 头注:worker 名刻意不上无鉴权面)——
+ *    壳附着后用它拼网页会话链接(`<webBaseUrl>/chat?agent=<worker>&session=<id>`)。
  * caps 路由自己**不 admit**(不打中心):读的是最近一次谈判留下的状态。
  */
-import type { CenterPullView } from "../config-center/pull-state.js";
+import type { CenterPullView } from "../web-admin-client/pull-state.js";
 import type { CallerLease, FleetLeaseManager, LeaseFailMode, LeaseHealth, LeaseSnapshot } from "../fleet-lease.js";
 import type { ServiceConfig } from "../config.js";
 /** `issuer` 的词表(两词:接了中心 ⇒ 桥恒装,`none` 结构上到不了,闭集里不留死词)。 */
@@ -32,6 +36,7 @@ export interface CenterWiring {
     readonly failMode?: LeaseFailMode;
     readonly usageReport: boolean;
     readonly issuer: CenterIssuer;
+    readonly worker?: string;
     readonly caller?: {
         readonly lease: CallerLease;
         readonly retryAfterSec?: number;
@@ -47,6 +52,8 @@ export interface CenterWiringFacts {
     } | undefined;
     readonly usageReport: boolean;
     readonly issuer: CenterIssuer;
+    /** 配置里的 worker 名(`config.webAdmin.worker`;缺席 = 没配)。可披露性在投影里判,不在取值处判。 */
+    readonly worker: string | undefined;
 }
 /** 输入 → caps 投影(纯函数,`build*` = 纯数据)。 */
 export declare function buildCenterWiring(f: CenterWiringFacts): CenterWiring;
@@ -55,7 +62,7 @@ export declare function buildCenterWiring(f: CenterWiringFacts): CenterWiring;
  * 没接中心 ⇒ `undefined`(键整个缺席)。`now` 注入只给测试(与租约管理器同钟才判得出过期);生产缺省 `Date.now`。
  */
 export declare function createCenterWiringReader(a: {
-    readonly config: Pick<ServiceConfig, "configCenter" | "authBridgeIssuer">;
+    readonly config: Pick<ServiceConfig, "webAdmin" | "authBridgeIssuer">;
     readonly pullState: () => CenterPullView;
     readonly fleetLease: Pick<FleetLeaseManager, "snapshot" | "failMode"> | undefined;
     readonly usageReport: boolean;

package/dist/capabilities/center-wiring.js

@@ -1,13 +1,21 @@
 import { authBridgeIssuerOf } from "../auth-bridge.js";
+import { isDisclosableIdentity } from "@sema-agent/settings-schema";
 export const CENTER_ISSUER_WORDS = ["explicit", "fallback"];
 export function buildCenterWiring(f) {
-    const base = { effectivePull: f.pull.lastPull === "ok", effectiveRevision: f.pull.effectiveRevision, usageReport: f.usageReport, issuer: f.issuer };
+    const base = {
+        effectivePull: f.pull.lastPull === "ok",
+        effectiveRevision: f.pull.effectiveRevision,
+        usageReport: f.usageReport,
+        issuer: f.issuer,
+        ...(f.worker !== undefined && isDisclosableIdentity(f.worker) ? { worker: f.worker } : {}),
+    };
     if (f.lease === undefined)
         return { ...base, lease: "absent" };
     return { ...base, lease: "configured", leaseHealth: f.lease.snapshot.leaseHealth, failMode: f.lease.failMode, caller: f.lease.snapshot.caller };
 }
 export function createCenterWiringReader(a) {
-    if (a.config.configCenter === undefined)
+    const webAdmin = a.config.webAdmin;
+    if (webAdmin === undefined)
         return undefined;
     const issuer = authBridgeIssuerOf(a.config);
     if (issuer === undefined)
@@ -19,6 +27,7 @@ export function createCenterWiringReader(a) {
         lease: lease === undefined ? undefined : { failMode: lease.failMode, snapshot: lease.snapshot(principal, now()) },
         usageReport: a.usageReport,
         issuer: issuer.source,
+        worker: webAdmin.worker,
     });
 }
 //# sourceMappingURL=center-wiring.js.map

package/dist/capabilities/composite-members.d.ts

@@ -42,7 +42,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"];
     readonly memoryEngine: readonly ["backend", "vectorMode"];
     readonly store: readonly ["declared", "backend", "durable", "degradedReason", "sql"];
-    readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"];
+    readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"];
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
     readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"];

package/dist/capabilities/composite-members.js

@@ -3,7 +3,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"],
     memoryEngine: ["backend", "vectorMode"],
     store: ["declared", "backend", "durable", "degradedReason", "sql"],
-    centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "caller"],
+    centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"],
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],

package/dist/capabilities/scenarios.js

@@ -222,12 +222,12 @@ export function centerScenarios(deps, specs, builtinNames, logger) {
         if (spec.enabled === false)
             continue;
         if (typeof spec.name !== "string" || !SCENARIO_NAME_RE.test(spec.name)) {
-            logger?.warn("sema_registry_scenario_invalid", { name: String(spec?.name), reason: "name must match " + String(SCENARIO_NAME_RE) });
+            logger?.warn("web_admin_scenario_invalid", { name: String(spec?.name), reason: "name must match " + String(SCENARIO_NAME_RE) });
             continue;
         }
         const toolset = Object.hasOwn(TOOLSETS, spec.toolset) ? TOOLSETS[spec.toolset] : undefined;
         if (!toolset) {
-            logger?.warn("sema_registry_scenario_invalid", { name: spec.name, reason: `unknown toolset "${String(spec.toolset)}" (have: ${Object.keys(TOOLSETS).join(", ")})` });
+            logger?.warn("web_admin_scenario_invalid", { name: spec.name, reason: `unknown toolset "${String(spec.toolset)}" (have: ${Object.keys(TOOLSETS).join(", ")})` });
             continue;
         }
         const name = spec.name;

package/dist/capabilities/team.d.ts

@@ -83,7 +83,7 @@ export interface TeamTemplate {
         systemPrompt?: string;
     };
 }
-/** Built-in team templates (placeholder until the sema registry supplies them). */
+/** Built-in team templates (placeholder until the web-admin supplies them). */
 export declare const BUILTIN_TEAMS: Record<string, TeamTemplate>;
 export declare function registerTeams(extra: Record<string, TeamTemplate>): void;
 export declare function getTeam(name: string): TeamTemplate | undefined;

package/dist/capabilities/tool-defer.d.ts

@@ -18,7 +18,7 @@
  *    在本仓缺省场景下那会连 Agent 与 Task 四件一起卷进候选(与 CC 姿态相反),所以我们**刻意不开**;
  *    🔴 该判断在 core 5.40.0 / 7.15.0 上**逐字仍成立**(亲验):两次收窄动的都是「候选集是谁」,而
  *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 不开 auto 的理由没有被消解。
- *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(config-center 曾有同形近名 `deferModelPlane`,
+ *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(web-admin 曾有同形近名 `deferModelPlane`,
  *    与本轴无关,已于 S-668 波 0 退役)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
  *    在两个 core 世代之间行为逐字不变的**全部**依据,所以它值一根钉而不只是一句注。
  *  - per-tool `ToolSpec.defer:true` 是本 helper 施加的那一位。**7.15.0 起它是一次「进候选集」的声明,

package/dist/center-credential-renewer.d.ts

@@ -59,7 +59,7 @@ export declare function buildCenterCredentialHealthView(health: CenterCredential
 export interface CenterCredentialRenewerDeps {
     /** 文件形凭证来源(续签器只从它的取值被触发;文件路径取自它的 `origin`)。 */
     readonly source: CenterCredentialSource;
-    /** `configCenter.url` —— 续签只向与它同源的 `issuer` 发。 */
+    /** `webAdmin.url` —— 续签只向与它同源的 `issuer` 发。 */
     readonly centerUrl: string;
     /** `CENTER_CREDENTIAL_RENEW_LEAD_MS`(已过 {@link parseCenterCredentialRenewLeadMs});0 = 关续签。 */
     readonly leadMs: number;

package/dist/center-credential-renewer.js

@@ -1,9 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
 import { closeSync, fchmodSync, fsyncSync, openSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { CENTER_CREDENTIAL_ENV, CenterCredentialEnvelope, parseCenterCredentialFile } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, WebAdminCredentialEnvelope, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 import { ACCESS_TOKEN_TTL_SECONDS, OAuthErrorResponse, TokenGrantResponse } from "@sema-agent/settings-schema/api/auth";
-import { CENTER_PULL_TIMEOUT_MS, centerTokenRefresh } from "./config-center/center-request.js";
+import { CENTER_PULL_TIMEOUT_MS, centerTokenRefresh } from "./web-admin-client/center-request.js";
 export const CENTER_CREDENTIAL_RENEW_LEAD_KEY = "CENTER_CREDENTIAL_RENEW_LEAD_MS";
 export const CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS = 5 * 60_000;
 export const CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS = CENTER_PULL_TIMEOUT_MS;
@@ -42,7 +42,7 @@ function readFileNow(path) {
         const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
         return code === "ENOENT" ? { kind: "no-session" } : { kind: "unreadable", code };
     }
-    const file = parseCenterCredentialFile(text);
+    const file = parseWebAdminCredentialFile(text);
     return file.kind === "envelope" ? { kind: "session", envelope: file.envelope, refreshDigest: digest16(file.envelope.refreshToken) } : { kind: "no-session" };
 }
 const TMP_RANDOM_BYTES = 6;
@@ -83,7 +83,7 @@ function sessionExpiryOf(read) {
 export function createCenterCredentialRenewer(deps) {
     const { source, centerUrl, leadMs, logger } = deps;
     if (source.origin.from !== "file")
-        throw new Error(`center credential renewer needs the ${CENTER_CREDENTIAL_ENV.tokenFile} form (got ${source.origin.from})`);
+        throw new Error(`center credential renewer needs the ${WEB_ADMIN_ENV.tokenFile} form (got ${source.origin.from})`);
     const path = source.origin.path;
     const now = deps.now ?? Date.now;
     const tickMs = Math.min(Math.max(leadMs / 2, 1000), 60_000);
@@ -147,7 +147,7 @@ export function createCenterCredentialRenewer(deps) {
             return;
         unavailableStreak = read.failure;
         logger.warn("center_credential_unreadable", {
-            key: CENTER_CREDENTIAL_ENV.tokenFile,
+            key: WEB_ADMIN_ENV.tokenFile,
             failure: read.failure,
             reason: read.reason,
             note: "no center request carries this credential until the file holds a usable one again (each consumer takes its own failure arm); warned once per unavailability streak",
@@ -172,7 +172,7 @@ export function createCenterCredentialRenewer(deps) {
         subject = refreshDigest;
         held = undefined;
         if (reason === "issuer_mismatch") {
-            logger.warn("center_credential_issuer_mismatch", { ...fields, note: "the sign-in envelope was issued by a different center than SEMA_REGISTRY_URL — its refresh token is never sent there; the access token is used until it expires, then sign in again against this center" });
+            logger.warn("center_credential_issuer_mismatch", { ...fields, note: `the sign-in envelope was issued by a different center than ${WEB_ADMIN_ENV.url} — its refresh token is never sent there; the access token is used until it expires, then sign in again against this center` });
             return;
         }
         logger.warn("center_credential_renew_failed", {
@@ -297,7 +297,7 @@ export function createCenterCredentialRenewer(deps) {
             judgeRefusal(usedDigest, "malformed_grant", { status: res.status });
             return;
         }
-        const next = CenterCredentialEnvelope.safeParse({
+        const next = WebAdminCredentialEnvelope.safeParse({
             kind: envelope.kind,
             accessToken: grant.data.access_token,
             refreshToken: grant.data.refresh_token,

package/dist/center-credential.d.ts

@@ -1,5 +1,5 @@
-import { type CenterCredentialDeclaration } from "@sema-agent/settings-schema";
-/** 凭证种类闭集。新增一个种类 = 本文件与 `config-center/center-request.ts` 的穷举 switch 当场编译红。 */
+import { type WebAdminCredentialDeclaration } from "@sema-agent/settings-schema";
+/** 凭证种类闭集。新增一个种类 = 本文件与 `web-admin-client/center-request.ts` 的穷举 switch 当场编译红。 */
 export type CenterCredentialKind = "pull-token" | "user-jwt" | "user-session" | "none";
 /** 一次取值失败的成因闭集(见模块头注「四个成因」;boot 判决 {@link judgeCenterCredentialAtBoot} 对它穷举)。 */
 export type CenterCredentialFailure = "missing" | "malformed" | "multi_tenant_session" | "expired";
@@ -84,7 +84,7 @@ export declare class CenterCredentialUnavailableError extends Error {
  * 凭证来源的构造入参:settings-schema 的声明形,文件形**必须**带上本部署的租户姿态(多租户拒人的会话信封,见模块头注)——
  * 姿态只在文件形有意义(env 值形是部署注入的拉取令牌,永远不是信封),所以只在那一臂上必填:漏传 = 编译红,不是静默单租户。
  */
-export type CenterCredentialSourceSpec = Exclude<CenterCredentialDeclaration, {
+export type CenterCredentialSourceSpec = Exclude<WebAdminCredentialDeclaration, {
     from: "file";
 }> | {
     readonly from: "file";
@@ -92,16 +92,16 @@ export type CenterCredentialSourceSpec = Exclude<CenterCredentialDeclaration, {
     readonly multiTenant: boolean;
 };
 /**
- * 读两个声明键 —— 判定全交 settings-schema 的判官 `judgeCenterCredentialDeclaration`(S-742:二选一规则的**唯一**实现;空串 = 未设、
+ * 读两个声明键 —— 判定全交 settings-schema 的判官 `judgeWebAdminCredentialDeclaration`(S-742:二选一规则的**唯一**实现;空串 = 未设、
  * 不 trim;两个都设 ⇒ throw,boot 拒启,拒句点名两个键、不回显值)。本仓只多读方自己的那一步:文件路径按本进程 cwd 解析成绝对
  * 路径(之后 cwd 变了也读同一个文件 —— 纯契约不碰 `node:path`,这一步归读方)。
  */
-export declare function readCenterCredentialDeclaration(env?: Readonly<Record<string, string | undefined>>): CenterCredentialDeclaration;
+export declare function readCenterCredentialDeclaration(env?: Readonly<Record<string, string | undefined>>): WebAdminCredentialDeclaration;
 /** 拉取令牌形的身份 = worker(拉取令牌代表 worker,不是人)。种类判别与 formatVersion 1 LKG 的一次性迁移
  *  (`config-lkg.ts` `migrateV1Lkg`:v1 信封只记 worker,只有这一形的身份推得出来)共用这一只。 */
 export declare function pullTokenIdentity(worker: string | undefined): string;
 /**
- * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_REGISTRY_WORKER`(拉取令牌形的身份)。
+ * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_WEB_ADMIN_WORKER`(拉取令牌形的身份)。
  * `readFile` / `now` 只为测试注入。
  */
 export declare function createCenterCredentialSource(spec: CenterCredentialSourceSpec, worker: string | undefined, deps?: {
@@ -128,13 +128,13 @@ export declare const CENTER_CREDENTIAL_REFUSAL_CODES: {
 };
 export type CenterCredentialRefusalCode = (typeof CENTER_CREDENTIAL_REFUSAL_CODES)[keyof typeof CENTER_CREDENTIAL_REFUSAL_CODES];
 /**
- * S-698 —— boot 读到的凭证怎么处置(`boot/config-center.ts` 执行,规则只在这里):
+ * S-698 —— boot 读到的凭证怎么处置(`boot/web-admin.ts` 执行,规则只在这里):
  *  · `missing` / `expired` ⇒ 响亮(error 级一行),照常起服 —— 前者是「此刻没有凭证」(登出形,文件出现即恢复),
  *    后者续签器立刻续签;
  *  · `malformed` / `multi_tenant_session` ⇒ **拒启**,拒句带码、点名文件键,不回显内容(`reason` 由本模块铸,本来就不含内容)。
  */
 export declare function judgeCenterCredentialAtBoot(read: CenterCredentialRead): CenterCredentialBootVerdict;
-/** 需要作用域 worker 的拉取令牌(`wpt_<self>`)却没配 `SEMA_REGISTRY_WORKER` ⇒ 中心对 per-principal caps
+/** 需要作用域 worker 的拉取令牌(`wpt_<self>`)却没配 `SEMA_WEB_ADMIN_WORKER` ⇒ 中心对 per-principal caps
  *  逐次 403(caps fail-closed 拒全部 workflow)。boot 期一次性诊断用;判据只读本模块的种类判别。 */
 export declare function scopedTokenNeedsWorker(read: CenterCredentialRead, worker: string | undefined): boolean;
 /**
@@ -148,7 +148,7 @@ export declare function centerStateBin(worker: string | undefined, identity: str
 export declare function credentialIdentityNow(source: CenterCredentialSource): string | undefined;
 /**
  * [ref] E-15 ② —— 一次中心往返的答复**仍属于此刻的凭证**:发出它所用的身份 = 此刻的身份。
- * 拉配置(`boot/config-center.ts` `pullEffective`)与两条 `?principal=` 视图(`config-center/http-client.ts`)
+ * 拉配置(`boot/web-admin.ts` `pullEffective`)与两条 `?principal=` 视图(`web-admin-client/http-client.ts`)
  * 都只问这一只;不成立 ⇒ 答复丢弃,当这次拉取失败(各走各的失败臂)。
  */
 export declare function answerStillCurrent(source: CenterCredentialSource, usedIdentity: string | undefined): usedIdentity is string;

package/dist/center-credential.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { resolve as resolvePath } from "node:path";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
-import { CENTER_CREDENTIAL_ENV, judgeCenterCredentialDeclaration, parseCenterCredentialFile } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, judgeWebAdminCredentialDeclaration, parseWebAdminCredentialFile } from "@sema-agent/settings-schema";
 export class CenterCredentialUnavailableError extends Error {
     reason;
     constructor(reason) {
@@ -12,7 +12,7 @@ export class CenterCredentialUnavailableError extends Error {
     }
 }
 export function readCenterCredentialDeclaration(env = process.env) {
-    const declared = judgeCenterCredentialDeclaration(env);
+    const declared = judgeWebAdminCredentialDeclaration(env, "access");
     return declared.from === "file" ? { from: "file", path: resolvePath(declared.path) } : declared;
 }
 const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
@@ -43,8 +43,8 @@ export function pullTokenIdentity(worker) {
 const NONE = { ok: true, kind: "none", identity: "none" };
 const PARSER_EMPTY_REASON = "empty";
 function readCredentialText(text, spec, worker, now) {
-    const where = `${CENTER_CREDENTIAL_ENV.tokenFile} ${spec.path}`;
-    const file = parseCenterCredentialFile(text);
+    const where = `${WEB_ADMIN_ENV.tokenFile} ${spec.path}`;
+    const file = parseWebAdminCredentialFile(text);
     switch (file.kind) {
         case "bare":
             return classify(file.bearer, worker);
@@ -105,7 +105,7 @@ export function createCenterCredentialSource(spec, worker, deps = {}) {
                 }
                 catch (err) {
                     const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
-                    return { ok: false, failure: "missing", reason: `${CENTER_CREDENTIAL_ENV.tokenFile} ${spec.path} is unreadable (${code})` };
+                    return { ok: false, failure: "missing", reason: `${WEB_ADMIN_ENV.tokenFile} ${spec.path} is unreadable (${code})` };
                 }
                 return readCredentialText(text, spec, worker, now());
             };
@@ -155,7 +155,7 @@ export function judgeCenterCredentialAtBoot(read) {
             return {
                 verdict: "refuse",
                 code,
-                sentence: `center credential refused at boot [${code}]: ${read.reason}. The file must hold one bare token line, or the sign-in envelope the shell writes (a CenterCredentialEnvelope JSON object); sign in again so the shell rewrites it, or fix the file — its content is never echoed.`,
+                sentence: `center credential refused at boot [${code}]: ${read.reason}. The file must hold one bare token line, or the sign-in envelope the shell writes (a WebAdminCredentialEnvelope JSON object); sign in again so the shell rewrites it, or fix the file — its content is never echoed.`,
             };
         }
         case "multi_tenant_session": {