@sema-agent/server 7.123.0 → 7.124.0

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import { type Model, type PathRuleBases, type PermissionRule } from "@sema-agent/core";
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 import { type Autonomy } from "./runtime-governance.js";
 import { type RunnerEnvNameAllowlistKnob, type ServerEnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 import type { ServiceConfig, ServiceConfigFlat, ServiceConfigGroups } from "./config-types.js";
@@ -12,7 +12,7 @@ export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config
 /** Parse the AUTONOMY env into a validated autonomy mode. Unset/empty → undefined (unmanaged → no extra
  *  tightening). An UNKNOWN value FAILS at startup rather than silently becoming a no-op (a typo'd `AUTONOMY=readonly`
  *  must not silently leave a deployment ungoverned — fail-loud, same discipline as numEnv). Exported so the HOT
- *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
+ *  config overlay (web-admin-client/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
 /** [ref]-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
@@ -32,43 +32,6 @@ export declare function parseUsageWindows(raw: string | undefined): readonly {
     maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
-/** [ref] 兼容面全清:退役 env 名墓碑——老名**在场即拒启**带新名指引。静默忽略=部署带着失效配置无感跑;双读=兼容层吸收
- *  下游冒烟。都不要。
- *
- *  🪦 **墓碑是永久的响亮拒,不设到期**(S-588)。一行墓碑就是那句拒启句本身,成本一行;删掉它 = 旧名重新被悄悄忽略。
- *  ⇒ 本表只增不减,**唯一的删除条件是这个名字要被赋予新含义**:那一次提交同时删掉墓碑行,并在 MIGRATION 写明旧名改作何用。
- *  (与一次性迁移不是一回事:迁移码每次起服都跑、碰真数据,所以有窗、窗关即删码 —— 见 `plugins/one-time-migrations.ts`
- *  的登记表;墓碑不碰数据,只拒启。)
- *  A tombstone is a permanent loud refusal with no expiry: deleting a row lets the retired name be silently ignored again,
- *  so a row goes only when the name is given a new meaning — in that same commit, with a MIGRATION note.
- *
- *  **旧名在场即拒,替代名在不在都一样**:判据只问旧名在不在场,不看替代键设没设、设成什么 ——「新旧两个名字都留着」正是
- *  迁移到一半的部署最常见的形,旧名在那一形里若被静默忽略,运维会以为它还在生效。server 3.0.0 的旧负名(`X_DISABLED` →
- *  `X_ENABLED`)同在本表(`replaced` 族:极性相反,照抄旧值过去恰好是反义),与其余墓碑走同一只 {@link rejectRetiredEnvs};
- *  那几个旋钮的读点只读正名(`boolEnv`),不再有第二套「正名缺席才看旧名」的判据(S-588 之前的 `boolEnvWithLegacyNegated`)。
- *
- *  墓碑分三族(A4 两族 + S-753 第三族),每族各说各的尾句 —— 族是**闭集**,渲染是穷举表(加一族不写尾句 = 编译红):
- *   · `renamed`  = 同一能力换了个键名,值语义逐字不变 ⇒ 「照新名改写即可」;
- *   · `replaced` = 有替代键,但**值语义变了**(缺省 / `0` 义 / 计量段 / 极性不同)⇒ 点名新键 + 说清变了什么,**不许**说「语义不变」
- *                  —— 照抄旧值过去就是另一个意思(S-753:`MODEL_CONNECT_TIMEOUT_MS` → `MODEL_FIRST_BYTE_TIMEOUT_MS`);
- *   · `removed`  = 能力本身没了,`why` 是「为什么没了」,**没有可 rename 的目标**。
- *  拒句带码 `[config.env_key_retired]`(拒启码,拼法随 `config.*` 家族;与中心凭证两码同形,出现在拒句方括号里)。
- *  空串 = 未设(与 `env()` 同一条约定:compose `${X:-}` 透传的空值不是一次表态),不拒。 */
-export type RetiredEnv = readonly [old: string, to: string, kind: "renamed"] | readonly [old: string, to: string, kind: "replaced", why: string] | readonly [old: string, why: string, kind: "removed"];
-export type RetiredEnvKind = RetiredEnv[2];
-/** 墓碑拒启码(机读;拒句方括号里)。 */
-export declare const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-export declare const RETIRED_ENVS: readonly RetiredEnv[];
-/** S-885 —— 墓碑表的 wire 投影一行(`GET /v1/config/catalog` 的 `retired[]`):按族定形 —— renamed 只带 `replacement`;replaced 带
- *  `replacement` + `reason`(值语义怎么变了);removed 只带 `reason`(能力为什么没了)。 */
-export interface RetiredEnvWire {
-    readonly name: string;
-    readonly kind: RetiredEnvKind;
-    readonly replacement?: string;
-    readonly reason?: string;
-}
-/** 墓碑表 → wire 投影(纯数据 ⇒ `build*`)。**同一张表、同序**;族是闭集,穷举 switch(加一族不写这里 ⇒ 编译红)。 */
-export declare function buildRetiredEnvWire(): RetiredEnvWire[];
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;
@@ -156,7 +119,7 @@ export declare function logConfigDiagnostics(logger: {
 type ModelCost = NonNullable<Model["cost"]>;
 /**
  * 🔴 B-089 —— `Model.cost` 这**一个键**的唯一铸点(可展开片段):有价目表 ⇒ 键在;没配 ⇒ **键不出**。
- * 三个铸点(env 主槽 / env cheap 槽 / config-center 车道)共用它,所以「缺席怎么表达」在本仓只有一处答案。
+ * 三个铸点(env 主槽 / env cheap 槽 / web-admin 车道)共用它,所以「缺席怎么表达」在本仓只有一处答案。
  *
  * `Model.cost` 自 core 7.16.0([ref])起在**类型面**上也是可选的(`dist/engine/llm/types.d.ts` 的
  * `cost?:`),与它一直以来的运行期读法([ref] 的 `isModelPriced`:这个键在不在)对齐 ——
@@ -178,7 +141,7 @@ export declare function buildModelCostKey(cost: ModelCost | undefined): Pick<Mod
  * `loadConfig` 只见 env 车道,而 `main.ts` 在第一次 effective 拉取**之前**就把 boot 诊断排空了 ——
  * 在那里判会同时犯两个方向的错:center 名册已配价、env 未配 ⇒ **假警**;env 已配价、center 名册撤了价
  * (或天花板只由 center 的 limits 下发)⇒ **漏警**。故本函数只给判据,席位在两只入口各自的
- * **采纳之后**(`main.ts` 的 `createConfigCenterRuntime` 之后 / `run-local.ts` 的 `applyEffective` 之后)。
+ * **采纳之后**(`main.ts` 的 `createWebAdminRuntime` 之后 / `run-local.ts` 的 `applyEffective` 之后)。
  *
  * 判据 = **目录里没有任何一只带价模型**,问法与 `budget.buildPricing` 的填表判据是**同一只函数**
  * (S-231:core 7.16.0 导出的 `isModelPriced`;第二参传 `undefined` = 这一问发生在注入表建起来之前,
@@ -263,17 +226,17 @@ export declare function parseEnvNameAllowlist(knob: RunnerEnvNameAllowlistKnob):
  *  here claiming this was "the exact CC alignment core recommends embedders set" mis-read core's per-model
  *  advice as a width rule). Returns a discriminant so the env lane can turn the removed implicit value into
  *  a loud CONFIG_NOTICES line ("removed-1m"); the center lane's roster culture is explicit declaration.
- *  Shared by the env lane (main + cheap models) and the center lane (sema-registry toModel). */
+ *  Shared by the env lane (main + cheap models) and the center lane (web-admin toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
 /**
- * **严格名册布防**的唯一判据(boot 就绪门 `boot/config-center.ts` 与 S-623 端点判据同调这一只)。
+ * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与 S-623 端点判据同调这一只)。
  *
  * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
  * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
  * `/health` ready:false,落地后整张模型表被中心目录换装。dryRun 是 compare-only(名册从不被应用),local / 纯 env
  * 部署没有「中心」可等 ⇒ 都不布防。
  */
-export declare function isRosterGateArmed(configCenter: ServiceConfig["configCenter"]): boolean;
+export declare function isRosterGateArmed(webAdmin: ServiceConfig["webAdmin"]): boolean;
 /**
  * 一条工具名**永不匹配任何现役工具**的三种拼法,及其修正指引。审批/权限名单是 server 侧 ToolPolicy 的
  * RAW 逐字比对(canonicalToolName 折叠面已随 core 5.0.0 [ref] 退役),所以写错的名字不会报错、只会静默
@@ -281,7 +244,7 @@ export declare function isRosterGateArmed(configCenter: ServiceConfig["configCen
  *
  * 判据在此**单点成文**,三条腿共用(它们此前各自为政,拼法覆盖面不一致才是真缺口):
  *   ① env 腿(`APPROVAL_REQUIRE`/`DENY`/`NEVER_AUTO`,下方)—— boot 拒启;
- *   ② 中心下发腿(`runtime.approvalRequire`,config-center/apply-effective.ts)—— 域级拒绝+保前值+warn
+ *   ② 中心下发腿(`runtime.approvalRequire`,web-admin-client/apply-effective.ts)—— 域级拒绝+保前值+warn
  *      (常驻进程不 crash);
  *   ③ per-request 腿(`settings.permissions.{ask,deny}`,task-settings.ts)—— 该请求 422。
  * (两张 allow 表 —— 请求的 `settings.permissions.allow` 与运维的 `APPROVAL_GRANT` —— 自 7.117.0 / core 7.42.0 起不经这里:它们整份交给引擎的
@@ -426,7 +389,7 @@ export interface FleetFenceLane {
  */
 export declare function fleetFenceLaneOf(cfg: {
     readonly fleetGeneration?: string | undefined;
-    readonly configCenter?: (CenterEndpoint & {
+    readonly webAdmin?: (CenterEndpoint & {
         readonly worker?: string | undefined;
     }) | undefined;
     readonly fleetAdvertiseAddress?: string | undefined;

package/dist/config.js

@@ -1,10 +1,10 @@
 import { readFileSync } from "node:fs";
-import { DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
-import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./memory-scope.js";
@@ -13,7 +13,7 @@ import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf } from "./config-types.js";
 import { FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
 import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
-import { centerLaneConfigured, pathBaseUrlRefusal } from "./config-center/center-request.js";
+import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
@@ -22,7 +22,7 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
-import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
@@ -33,7 +33,8 @@ import { createCenterCredentialSource, readCenterCredentialDeclaration } from ".
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { buildHttpUrlRefusal, httpUrlFlaws } from "./url-shape.js";
+import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "./url-refusal.js";
 import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
@@ -113,74 +114,10 @@ function defaultSkillsDir() {
         return "skills";
     }
 }
-export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-export const RETIRED_ENVS = [
-    ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
-    ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
-    ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", CENTER_CREDENTIAL_ENV.token, "renamed"],
-    ["CONFIG_CENTER_DRY_RUN", "SEMA_REGISTRY_DRY_RUN", "renamed"], ["CONFIG_CENTER_WORKER", "SEMA_REGISTRY_WORKER", "renamed"],
-    ["ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL", "renamed"],
-    ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"],
-    ["OA_API_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_SERVICE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_OWNER", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_REPO", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_LABELS", "the OA scenario was removed in 5.0.0", "removed"],
-    ["APPROVAL_POLL_MS", "the OA poll-approval lane was removed in 5.0.0; the durable checkpoint lane is the only gate", "removed"],
-    ["LEADER_CONFLICT_ROUNDS", "the bounded merge-conflict-resolution agent was deleted in 7.83.0 按 C-R63 删除,合不上交用户:leader 交回 result.conflict(分支 + 冲突文件),run 状态 needs_human", "removed"],
-    [
-        "MODEL_CONNECT_TIMEOUT_MS",
-        "MODEL_FIRST_BYTE_TIMEOUT_MS",
-        "replaced",
-        "since core 7.33.0 the TCP + TLS connect clock is the transport's own; the wait from sending the request to its response headers — " +
-            "what this key really bounded — is MODEL_FIRST_BYTE_TIMEOUT_MS (unset = core's own default, plus an upload allowance and one " +
-            "widened retry; 0 = no engine clock on that segment and the transport's header / body clocks off too — the TCP + TLS connect " +
-            "keeps the transport's own clock)",
-    ],
-    ["PROJECT_MEMORY_DISABLED", "PROJECT_MEMORY_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: PROJECT_MEMORY_DISABLED=true is PROJECT_MEMORY_ENABLED=false (the positive name defaults on)"],
-    ["CONFIG_LKG_DISABLED", "CONFIG_LKG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: CONFIG_LKG_DISABLED=true is CONFIG_LKG_ENABLED=false (the positive name defaults on)"],
-    ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
-    ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
-    ["UNATTENDED_PERMISSION_MODE", "since server 7.109.0 the unattended legs (leader workers and their repair legs, run-local, and their durable resumes) always run permissionMode \"default\" with an approver that answers by ask class: a machine answers only \"ordinary\" asks, and every other class goes to the leg's approver seat (run-local's terminal prompt) or parks / is refused — there is no mode to choose", "removed"],
-];
-for (const row of RETIRED_ENVS)
-    Object.freeze(row);
-Object.freeze(RETIRED_ENVS);
-export function buildRetiredEnvWire() {
-    return RETIRED_ENVS.map((row) => {
-        switch (row[2]) {
-            case "renamed":
-                return { name: row[0], kind: row[2], replacement: row[1] };
-            case "replaced":
-                return { name: row[0], kind: row[2], replacement: row[1], reason: row[3] };
-            case "removed":
-                return { name: row[0], kind: row[2], reason: row[1] };
-            default: {
-                const unhandled = row;
-                throw new Error(`unhandled retired-env kind: ${String(unhandled[2])}`);
-            }
-        }
-    });
-}
-const RETIRED_ENV_SENTENCE = {
-    renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
-    replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
-        `its value semantics differ from the retired key's, so do not copy the old value across unread`,
-    removed: (hits) => `${hits.map(([old, why]) => `${old} (${why})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
-        `there is no replacement name and no rename that restores it`,
-};
-function retiredEnvSentence(kind, hit) {
-    const ofKind = hit.filter((h) => h[2] === kind);
-    return ofKind.length > 0 ? [RETIRED_ENV_SENTENCE[kind](ofKind)] : [];
-}
 function rejectRetiredEnvs() {
-    const hit = RETIRED_ENVS.filter(([o]) => process.env[o] !== undefined && process.env[o] !== "");
-    if (hit.length === 0)
-        return;
-    const parts = Object.keys(RETIRED_ENV_SENTENCE).flatMap((kind) => retiredEnvSentence(kind, hit));
-    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] — refused while present, whether or not the replacement is also set: ${parts.join(" | ")}.`);
+    const refusal = retiredEnvRefusal(process.env);
+    if (refusal !== undefined)
+        throw new Error(refusal);
 }
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
@@ -247,7 +184,7 @@ function parseConfigProvider() {
         return undefined;
     const word = CONFIG_PROVIDER_WORDS.find((w) => w === raw);
     if (word === undefined) {
-        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then SEMA_REGISTRY_URL, if set, selects the center as the config source; otherwise this worker is env-only). ` +
+        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then ${WEB_ADMIN_ENV.url}, if set, selects the center as the config source; otherwise this worker is env-only). ` +
             `The word is matched exactly (no trimming, no case folding). Refusing to boot rather than guessing: the config source, the execution-lane default and the local config root all key on this one word.`);
     }
     return word;
@@ -937,8 +874,8 @@ function parseStoreDomain(ctx) {
             : undefined,
     };
 }
-export function isRosterGateArmed(configCenter) {
-    return configCenter !== undefined && !configCenter.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
+export function isRosterGateArmed(webAdmin) {
+    return webAdmin !== undefined && !webAdmin.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
 }
 function parseModelDomain() {
     const route = readModelRouteEnv(process.env);
@@ -1009,7 +946,7 @@ function parseModelDomain() {
             CONFIG_NOTICES.push({
                 level: "warn",
                 event: "model_cheap_slot_without_main",
-                fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
+                fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the web-admin) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
             });
             break;
         case "same_as_main":
@@ -1145,7 +1082,7 @@ function parseModelDomain() {
         tiers: {},
         projects: {},
         roles,
-        atModelAllowlist: [],
+        atMention: DEFAULT_AT_MENTION,
         cascadeLadder: csv("MODEL_CASCADE_LADDER"),
         degrade: process.env.MODEL_DEGRADE_TO
             ? {
@@ -2108,7 +2045,7 @@ function parseLimitsHttpDomain() {
         toolResultTtlSec: (() => {
             const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
             if (ttl <= 0) {
-                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the config center refuses the same value)`);
+                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the web-admin refuses the same value)`);
             }
             return ttl;
         })(),
@@ -2165,13 +2102,13 @@ function parseGitApiKind(raw, baseUrl) {
 }
 function parseIntegrationsDomain(ctx) {
     const { requirePrincipal, configProvider } = ctx;
-    const registryUrl = parseCenterBaseUrl("SEMA_REGISTRY_URL", process.env.SEMA_REGISTRY_URL, `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
-    const registryLiveUrl = parseCenterBaseUrl("SEMA_REGISTRY_LIVE_URL", process.env.SEMA_REGISTRY_LIVE_URL, `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to SEMA_REGISTRY_URL.`);
-    const registryWebUrl = parseCenterBaseUrl("SEMA_REGISTRY_WEB_URL", process.env.SEMA_REGISTRY_WEB_URL, `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
-    const configCenter = registryUrl !== undefined ? parseConfigCenter(registryUrl, requirePrincipal, registryLiveUrl, registryWebUrl) : undefined;
+    const baseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.url, process.env[WEB_ADMIN_ENV.url], `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
+    const liveBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.liveUrl, process.env[WEB_ADMIN_ENV.liveUrl], `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to ${WEB_ADMIN_ENV.url}.`);
+    const webBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.webUrl, process.env[WEB_ADMIN_ENV.webUrl], `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
+    const webAdmin = baseUrl !== undefined ? parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) : undefined;
     const fleetGeneration = parseFleetGeneration(process.env.FLEET_GENERATION);
     const fleetAdvertiseAddress = parseFleetAdvertiseAddress(process.env.FLEET_ADVERTISE_ADDRESS);
-    fleetFenceLaneOf({ ...fleetGeneration, configCenter, ...fleetAdvertiseAddress });
+    fleetFenceLaneOf({ ...fleetGeneration, webAdmin, ...fleetAdvertiseAddress });
     return {
         pluginsAllowHosts: csvOf(process.env.PLUGINS_ALLOW_HOSTS ?? "github.com"),
         configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
@@ -2181,7 +2118,7 @@ function parseIntegrationsDomain(ctx) {
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
-        configCenter,
+        webAdmin,
         fleetLeaseFailClosed: parseFleetLeaseFailClosed(process.env.FLEET_LEASE_FAIL_CLOSED, requirePrincipal),
         ...fleetGeneration,
         fleetScope: parseFleetScope(process.env.FLEET_SCOPE),
@@ -2239,9 +2176,9 @@ export function fleetFenceLaneOf(cfg) {
         return undefined;
     const laneConfigured = centerLaneConfigured(cfg);
     if (laneConfigured && cfg.fleetAdvertiseAddress !== undefined)
-        return { center: cfg.configCenter, generation };
+        return { center: cfg.webAdmin, generation };
     const missing = [
-        ...(laneConfigured ? [] : [`the center lane (SEMA_REGISTRY_URL + ${CENTER_CREDENTIAL_ENV.token} or ${CENTER_CREDENTIAL_ENV.tokenFile} + SEMA_REGISTRY_WORKER)`]),
+        ...(laneConfigured ? [] : [`the center lane (${WEB_ADMIN_ENV.url} + ${WEB_ADMIN_ENV.token} or ${WEB_ADMIN_ENV.tokenFile} + ${WEB_ADMIN_ENV.worker})`]),
         ...(cfg.fleetAdvertiseAddress === undefined ? ["the announce address (FLEET_ADVERTISE_ADDRESS)"] : []),
     ];
     throw fleetEnvRefusal("member_unfenced", `fleet member cannot be fenced — env FLEET_GENERATION=${JSON.stringify(generation)} makes this engine a fleet member, ` +
@@ -2276,15 +2213,15 @@ function parseCenterBaseUrl(name, raw, role) {
         throw new Error(`${refusal}. ${role}`);
     return raw;
 }
-function parseConfigCenter(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
-    const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+function parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
+    const worker = process.env[WEB_ADMIN_ENV.worker] || undefined;
     const declared = readCenterCredentialDeclaration();
     return {
         baseUrl,
         ...(liveBaseUrl !== undefined ? { liveBaseUrl } : {}),
         ...(webBaseUrl !== undefined ? { webBaseUrl } : {}),
         credential: createCenterCredentialSource(declared.from === "file" ? { ...declared, multiTenant: requirePrincipal } : declared, worker),
-        dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
+        dryRun: boolEnv(WEB_ADMIN_ENV.dryRun, false),
         worker,
     };
 }
@@ -2371,7 +2308,7 @@ const STORE_GROUP_KEYS = [
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
-    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
+    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atMention", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
@@ -2411,7 +2348,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2473,6 +2410,10 @@ export function loadConfig() {
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
     const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
+    const centerIdentity = centerIdentityRefusal({ authBridgeIssuer: auth.authBridgeIssuer, webAdmin: integrations.webAdmin });
+    if (centerIdentity !== undefined) {
+        throw new Error(centerIdentity);
+    }
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
@@ -2510,7 +2451,7 @@ export function loadConfig() {
         throw new Error(laneRequiredRefusal);
     }
     {
-        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.configCenter) });
+        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.webAdmin) });
         if (routeGap.gap !== "none") {
             throw new Error(routeGap.reason);
         }

package/dist/execution-lane-caps.d.ts

@@ -144,7 +144,7 @@ export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly stri
  *
  * 🔴 病(S-1008,test d327-g6-engine-7112 OBS-4 / OBS-5;2026-10-03 亲核):修前**两份句子**。运行期真拒启的是 `config.ts` 手写 throw
  * (点名 `REQUIRE_EXECUTION_LANE` / `REMOTE_EXEC` + 修法,用户在 stderr 读到的就是它);注册表条目另写了一句短的
- * 「the deployment asked to refuse this state」,而它只在 `config-center/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
+ * 「the deployment asked to refuse this state」,而它只在 `web-admin-client/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
  * `BATCH1_LIMIT_KEYS` 的限额键,带不上这两键 ⇒ 对本条恒 `next === live`,**那一句没有任何读者**(test 六个拒启格 stderr 里零命中)。
  * 改一份另一份不跟。现形:boot 的 throw 与注册表条目的 `check` **都**调本函数 —— 一只判据、一句话,没有第二份文本可漂。
  *

package/dist/fleet/drain-entry.d.ts

@@ -21,7 +21,7 @@
  *     · `worker` / `expectedGeneration`:缺席对缺席(非 fleet 成员没有代际,不带 `expectedGeneration` 的请求是单机形,不是通配)。
  *     · `instanceId`:请求带了才比(它是引擎每进程自铸的身份,`/health` 上可读);「点名的是不是别的进程」与 run 行同一只判据
  *       `runProvenElsewhere`。
- *     引擎自己的 worker / instanceId 读不出 ⇒ 带了这一项的请求不符(认不出自己就不认任何点名;没配 `SEMA_REGISTRY_WORKER` 的引擎因此
+ *     引擎自己的 worker / instanceId 读不出 ⇒ 带了这一项的请求不符(认不出自己就不认任何点名;没配 `SEMA_WEB_ADMIN_WORKER` 的引擎因此
  *     只能用停止信号排空)。
  *  5. **进入那一拍让出在飞**:本副本可抢占的在飞腿经 core `TaskSpec.preemptSignal` 让出(在下一个干净的回合边界耐久停驻,
  *     `resource_limit` / `preempt`;不合格的腿上 core 静默不动,等到期限硬停 —— 既有 `crashed` 臂);活的审批卡按断连同路改路耐久停驻

package/dist/fleet/engine-signal.d.ts

@@ -10,7 +10,7 @@
  *     `ready ∧ ¬draining ∧ leaseState ≠ denied` —— 后两项不是新判据:`draining` 本来就是就绪原因,而租约被拒**同一拍**经
  *     唯一的排空入口进入排空(`fleet/serving-lease.ts`),所以「被拒 ⇒ 排空 ⇒ 不就绪」是构造出来的,不靠第二只谓词。
  *     `leaseState = expired` **不**进就绪(中心不可达不是本实例的病,见租约模块头注)。
- *  3. **重启**:`restart` = 已发布的重启信号;没有已发布信号而有一只**扣着**的候选(config-center 的保留候选状态机)且它确有被扣的片时,
+ *  3. **重启**:`restart` = 已发布的重启信号;没有已发布信号而有一只**扣着**的候选(web-admin 的保留候选状态机)且它确有被扣的片时,
  *     铸 `{reasons: 被扣的片, version, since, withheld: true}`(「要重启,但此刻换掉本实例会丢它手里的候选」)。已发布的信号恒胜(那几片
  *     是安全可重启的,扣着的片不阻止它们);被扣的片为空(只差发布重试)⇒ 不是重启事实,不铸(契约 `RestartSignal.reasons` 至少一词;
  *     那一形的面只有每拍一行运维 warn + 计数)。「扣着」在两出口上只有这一种读法(7.120.x 的 `/health.modelPlaneDeferred` 本版删除)。
@@ -54,7 +54,7 @@ export type ServingLeaseView = {
 export type FleetMembershipKeys = Pick<InstanceAnnouncement, "generation" | "leaseState" | "leaseUntil">;
 /** 非 fleet 成员 / 没装租约客户端时的读数(唯一拼法)。 */
 export declare const LEASE_NONE: ServingLeaseView;
-/** 扣着的候选(config-center 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
+/** 扣着的候选(web-admin 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
 export interface RetainedCandidate {
     readonly version: number;
     readonly since: number;
@@ -62,7 +62,7 @@ export interface RetainedCandidate {
 }
 /**
  * 重启事实的**唯一**合成点(规则 3):已发布信号恒胜;否则扣着的候选有被扣的片 ⇒ `withheld:true` 的信号;否则缺席。
- * `build*` = 纯数据。泛型让 config-center 交进来的窄型(`EngineRestartSignal`,`reasons` 是片闭集)原样回来。
+ * `build*` = 纯数据。泛型让 web-admin 交进来的窄型(`EngineRestartSignal`,`reasons` 是片闭集)原样回来。
  */
 export declare function buildRestartSignal<R extends RestartSignal>(published: R | undefined, retained: (RetainedCandidate & {
     readonly blocked?: readonly R["reasons"][number][];
@@ -72,8 +72,8 @@ export declare const CONFIG_HANDOFF_STATES: readonly ["missing"];
 export type ConfigHandoffState = (typeof CONFIG_HANDOFF_STATES)[number];
 /**
  * `/health.configHandoff`(只在 `/health`,不上心跳)—— 一件**事故**:**在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没在下一次起服将用的身份的桶里确认耐久落盘**
- * (config-center 的接力账 {@link ConfigHandoffLedger}:最后确认耐久的那一代 + 写进的那只身份桶,对比应用着的那一代 + 此刻的凭证身份 —— 离线起服按此刻
- * 的身份选桶;部署形门在 config-center 的取值口,读判「handoff confirmed」的同一只谓词)。凭证换了人(换了身份)而新身份的桶里没有这一代 ⇒ 在场。覆盖 LKG 发布失败(含保留候选、启动期技能债)与部分应用(某组被整拒、其余组已热应用,LKG 停在上一个完整世代)两形。**部署形**不在这里报:
+ * (web-admin 的接力账 {@link ConfigHandoffLedger}:最后确认耐久的那一代 + 写进的那只身份桶,对比应用着的那一代 + 此刻的凭证身份 —— 离线起服按此刻
+ * 的身份选桶;部署形门在 web-admin 的取值口,读判「handoff confirmed」的同一只谓词)。凭证换了人(换了身份)而新身份的桶里没有这一代 ⇒ 在场。覆盖 LKG 发布失败(含保留候选、启动期技能债)与部分应用(某组被整拒、其余组已热应用,LKG 停在上一个完整世代)两形。**部署形**不在这里报:
  * 没有耐久声明(`CONFIG_LKG_DURABLE` 不真 / LKG 关)的部署「重启靠中心重拉」是配置时声明的事实 ⇒ 恒缺席;本地腿 / 没有配置管道 ⇒ 缺席。
  * 与 `restart.withheld` 两个事实两张脸(可同在):要不要重启归 `restart`,声明了的接力缺不缺归本键。
  * `version` = 应用着的那一代;`since` = 这一代开始没有确认接力的时刻(持续缺着时不刷新,确认即清)。
@@ -83,7 +83,7 @@ export interface ConfigHandoff {
     readonly version: number;
     readonly since: number;
 }
-/** 配置接力账(config-center 持有,`/health.configHandoff` 的唯一来源):应用着的那一代、最后一次确认耐久接力的那一代与它写进的身份桶、
+/** 配置接力账(web-admin 持有,`/health.configHandoff` 的唯一来源):应用着的那一代、最后一次确认耐久接力的那一代与它写进的身份桶、
  *  下一次起服将用的身份(此刻的凭证身份 —— 离线起服选桶读的同一只)。 */
 export interface ConfigHandoffLedger {
     readonly applied?: number;
@@ -96,9 +96,9 @@ export interface ConfigHandoffLedger {
 /** 「接力缺着」的**唯一**判据(纯):应用过一代 ∧ 最后确认耐久的不是「这一代 ∧ 下一次起服将用的身份桶」。 */
 export declare function configHandoffMissing(ledger: ConfigHandoffLedger): boolean;
 /** `configHandoff` 的**唯一**合成点(纯):缺着 ⇒ `{ state: "missing", version: 应用着的那一代, since }`;否则缺席。`since` 由持账方锁存(发现缺着的那一拍)。
- *  `build*` = 纯数据;config-center 的 `configHandoffState()` 是唯一调用方。 */
+ *  `build*` = 纯数据;web-admin 的 `configHandoffState()` 是唯一调用方。 */
 export declare function buildConfigHandoff(ledger: ConfigHandoffLedger, since: number | undefined): ConfigHandoff | undefined;
-/** 世代账的一次读数(config-center 的 `configApplyState()` 交出的那一份里本模块读的五键;`/health` 扁平五键与嵌套形的两键读同一份)。 */
+/** 世代账的一次读数(web-admin 的 `configApplyState()` 交出的那一份里本模块读的五键;`/health` 扁平五键与嵌套形的两键读同一份)。 */
 export interface ConfigLedgerReading {
     readonly configTargetVersion: number;
     readonly configAppliedVersion: number;

package/dist/fleet/fleet-bus.d.ts

@@ -566,6 +566,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
         name?: string;
         toolName?: string;
         parentToolCallId?: string;
+        workflowRunId?: string;
         status?: string;
         seq?: number;
     }) => void;
@@ -576,6 +577,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
         name?: string;
         usage?: unknown;
         parentToolCallId?: string;
+        workflowRunId?: string;
         status?: string;
         seq?: number;
     }) => void;
@@ -639,13 +641,20 @@ export declare function fleetRunResiduals(result: {
  * session attribution → unscoped, back-compat visible). Names ride the same redactSecrets discipline.
  */
 export declare function fleetBackgroundChildPublisher(bus?: FleetEventBus, log?: (msg: string, fields: Record<string, unknown>) => void): (e: import("@sema-agent/core").BackgroundChildEvent) => void;
+/**
+ * 🔴 **run 的短名 —— 一只折法、一个输入**:输入 = run 行的预览(`user-authored-text.ts` 的 `buildRunObjectivePreview` 的产物,run 行上存的就是它);
+ * fleet 行的 `name`(发布时由 objective 现算同一只预览)与 `GET /v1/assistant/tasks` 的 `name`(读 run 行上存的预览)读同一只,
+ * 同一个 run 两面同名。预览是 `""`(有记录、剥完没有用户正文)⇒ `(notification turn)`;否则单行折叠、超过 48 字截断带 `…`。预览已脱敏。
+ * 入参只收「有记录」的预览:列上的 NULL(没记录)不是通告轮,由读面自己按契约缺席,不进这只折法。
+ */
+export declare function buildRunName(preview: string): string;
 /** BC-1 (clay-decided 2026-06-27): a top-level run's fleet-row `name` = a SHORT, single-line **objective preview**
  *  (the readable "what is this task" label) — NOT the full objective dumped in, and NOT duplicated into `description`.
  *  `description` is left to the publisher's LIVE-ACTIVITY update (`onEvent` tool_start → the current tool), so the row
  *  shows `name`=objective + `description`=current activity (two DISTINCT things, killing the earlier "objective shown
- *  twice" dup). Whitespace-collapsed + capped ≤48. (A subagent CHILD row's name = its agent-type — BC-2.)
- *  SECRET-SAFE: redact secret shapes (redactSecrets) BEFORE truncating — a secret in the objective must not leak in
- *  the row name. The durable objective is already redacted; the name preview was asymmetric (raw) until this. */
+ *  twice" dup). (A subagent CHILD row's name = its agent-type — BC-2.)
+ *  一只折法({@link buildRunName}),输入 = 与 run 行同一只预览(用户写的那段 → 脱敏 → 截):`GET /v1/assistant/tasks`
+ *  读 run 行上存的预览、过同一只折法 ⇒ 同一个 run 两面同名。剥完没有用户正文 ⇒ `(notification turn)`;闭集外的 XML 头当普通正文标。 */
 export declare function fleetRunLabels(objective: string | undefined): {
     name: string;
 };

package/dist/fleet/fleet-bus.js

@@ -3,6 +3,7 @@ import { DURABLE_AGENT_HANDLE_RE, deriveAgentDisplayStatus, isDelegatedAgentTerm
 import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function isFleetAgentTerminalNotification(n) {
     return isDelegatedAgentTerminal(n);
 }
@@ -206,6 +207,7 @@ export function fleetRunPublisher(bus, run) {
     let settledLeg = false;
     const childId = (taskId) => `${run.runId} ${taskId}`;
     const tickStatus = (st) => (st === "completed" ? "completed" : st === "failed" ? "failed" : "running");
+    const workflowRunIdField = (ev) => (ev.workflowRunId ? { workflowRunId: ev.workflowRunId } : {});
     const toolUsesOf = (usage) => {
         const t = usage?.toolUses;
         return typeof t === "number" ? t : undefined;
@@ -269,7 +271,7 @@ export function fleetRunPublisher(bus, run) {
                     childStartedAt.set(cid, Date.now());
                 if (ev.parentToolCallId)
                     childByToolCall.set(ev.parentToolCallId, cid);
-                bus.publishTask({ id: cid, sourceLane: "run-leg", ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+                bus.publishTask({ id: cid, sourceLane: "run-leg", ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, ...workflowRunIdField(ev), status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
             }
             else if (ev.type === "tool_start" && ev.toolName) {
                 bus.publishTask({ id: run.runId, description: ev.toolName });
@@ -290,7 +292,7 @@ export function fleetRunPublisher(bus, run) {
                 childStartedAt.set(cid, Date.now());
             if (ev.parentToolCallId)
                 childByToolCall.set(ev.parentToolCallId, cid);
-            bus.publishTask({ id: cid, sourceLane: "run-leg", ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+            bus.publishTask({ id: cid, sourceLane: "run-leg", ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, ...workflowRunIdField(ev), status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
         },
         onChildTerminal(taskId, status, altId, toolUseId) {
             if (settledLeg)
@@ -612,14 +614,16 @@ export function fleetBackgroundChildPublisher(bus, log) {
         handleTerminal(e, m);
     };
 }
+const NOTIFICATION_TURN_NAME = "(notification turn)";
+const RUN_NAME_CHARS = 48;
+export function buildRunName(preview) {
+    const oneLine = preview.replace(/\s+/g, " ").trim();
+    if (oneLine === "")
+        return NOTIFICATION_TURN_NAME;
+    return oneLine.length > RUN_NAME_CHARS ? `${oneLine.slice(0, RUN_NAME_CHARS - 1)}…` : oneLine;
+}
 export function fleetRunLabels(objective) {
-    const oneLine = redactSecrets((objective ?? "").replace(/\s+/g, " ")).trim();
-    if (!oneLine)
-        return { name: "task" };
-    if (/^<[a-z][a-z0-9_-]*[\s>/]/i.test(oneLine))
-        return { name: "(notification turn)" };
-    const name = oneLine.length > 48 ? `${oneLine.slice(0, 47)}…` : oneLine;
-    return { name };
+    return { name: buildRunName(buildRunObjectivePreview(objective ?? "")) };
 }
 export function isTerminalFleetStatus(status) {
     switch (status) {

package/dist/fleet/serving-lease.d.ts

@@ -1,5 +1,5 @@
-import { type CenterCapabilities } from "@sema-agent/settings-schema/fleet";
-import { type CenterEndpoint } from "../config-center/center-request.js";
+import { type WebAdminCapabilities } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "../web-admin-client/center-request.js";
 import { type DrainEntry } from "./drain-entry.js";
 import type { ServingLeaseView } from "./engine-signal.js";
 /** 续租请求的上界(ms)—— 与 fleet 心跳同量级(不在提交热路径上)。 */
@@ -34,7 +34,7 @@ export interface ServingLeaseClientOpts {
 }
 export interface ServingLeaseClient {
     /** 一次中心能力读数(`undefined` = `undeclared`,中心没宣告 = 不支持)。每一次读数调一次;`unreadable` 不是读数,不调(`fleet-client.ts` `capabilityReadingOf`)。 */
-    noteCenterCapabilities(caps: CenterCapabilities | undefined): void;
+    noteCenterCapabilities(caps: WebAdminCapabilities | undefined): void;
     /** 此刻的租约读数(铸点与准入判读它)。 */
     view(): ServingLeaseView;
     /** 起步读黏性拒(装配层在唯一排空入口装好之后调一次)。 */

package/dist/fleet/serving-lease.js

@@ -1,7 +1,7 @@
 import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { SERVING_LEASE_TTL_DEFAULT_MS, readServingLeaseResponse } from "@sema-agent/settings-schema/fleet";
-import { centerFetch } from "../config-center/center-request.js";
+import { centerFetch } from "../web-admin-client/center-request.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { leaseDrainActionId } from "./drain-entry.js";
 export const SERVING_LEASE_FETCH_TIMEOUT_MS = 5_000;