@sema-agent/server 7.123.0 → 7.124.1

package/dist/trace/redact.d.ts

@@ -16,8 +16,8 @@
  * 这两条路径是「先脱敏、脱敏后的结果才给模型看」,与工具结果路径的方向相反,不要混淆。要让内容不出机器,
  * 核对的是**该 run 实际选中的模型路由**——默认网关(`MODEL_GATEWAY_BASEURL`)只是其中一条:还有备用网关
  * (`MODEL_GATEWAY_FALLBACK_URLS`)、`provider:"anthropic"` 的独立直连路由(缺省根
- * `https://api.anthropic.com`,除非显式配 `ANTHROPIC_BASEURL`)、以及配置中心可对单个目录模型下发的
- * per-model `baseUrl` 覆盖(见 `src/brain.ts` 的路由装配与 `src/config-center/apply-effective.ts:416`)。
+ * `https://api.anthropic.com`,除非显式配 `ANTHROPIC_BASEURL`)、以及 web-admin 可对单个目录模型下发的
+ * per-model `baseUrl` 覆盖(见 `src/brain.ts` 的路由装配与 `src/web-admin-client/apply-effective.ts:416`)。
  * 靠**读侧**敏感路径门与确保**全部**生效路由都指向自己控制的基础设施,不靠本模块、也不是设一根 env 就够。
  *
  * 🔴 **射程自 7.75.1 起含「模型自由文本」全族**(B-106 / S-268):本模块此前在结果面只管诊断/披露文本,
@@ -178,27 +178,6 @@ export declare function redactDeepWith(value: unknown, leaf: (s: string) => stri
  * owner-scoped, so this preview is only ever shown to the ask's own principal (or an operator inspecting it).
  */
 export declare function redactedPreview(value: unknown, cap?: number): string | null;
-/**
- * **这一位是不是一个层级式绝对 URL**(有 authority 的那一族)—— 本铸点与 `url-shape.ts` 的 http(s) 形判官
- * (模型路由三键 / 中心基址三席 / 公告地址 / embedder / A2A 的拒启都经它问到这里)共用的**同一只**判据:两处曾各判各的,
- * 而 `URL.canParse` 单独为真的**不透明** URL 恰好是「凭据位看不见」的那一形。
- *
- * ⚠️ **射程如实**(车JC 复审去幻觉轮:此处原文写的是「本仓唯一判据」,亲读证伪)—— 仓里**另有一处**仍用
- * 裸 `URL.canParse` 回答同一个问题,且**刻意不在射程内**(改它是一次新的行为面拒启,按三问另开车):
- *  `config.ts` 的 `GIT_API_BASEURL`(`parseGitApiKind`):无协议闸 ⇒ 不透明形今天过门(拒因经本铸点,
- *  所以不回显凭据;可用性由 `fetch` 那侧决定)。
- * ✅ 原先列在这里的第二处(`config-catalog.ts` 的 `stripUrlUserinfo`:不透明形 `href === 原串` ⇒ 原样回显)
- * 已在 7.90.0 随 core `displayUrlOf` 到货**闭环** —— 那只函数整只退役,url 型行的回显改走本铸点,
- * 于是这道闸对它自动成立(catalog wire 行为面变更,CHANGELOG 已对外写明并点名 @web-admin)。
- *
- * 🔴 谓词写成 `URL.canParse` 而不是 try/catch:这一臂**不是兜底**(兜底才归静默降级那张表管),它是判据本身 ——
- * 「不是一个层级式 URL」是一个可判的状态,用异常当控制流只会让它看起来像一次意外。
- * 🔴 「解析得动」**不够**:`new URL("alice:hunter2@gw.internal:8000")` 是合法的**不透明** URL(`alice:` 当 scheme,
- * 与 `mailto:` 同族)—— 它没有 authority,URL 律的锚(`scheme://`)对它不成立,`username`/`password` 恒空,
- * 直接回原串就是密码明文(红先实测)。闸取「**层级式** URL」:`href` 以 `<protocol>//` 起头 ⇒ 有 authority
- * ⇒ 三个凭据位都在律的射程内。
- */
-export declare function isHierarchicalUrl(raw: string): boolean;
 /**
  * 🔴 **配置型 URL 上日志 / 诊断面的唯一 display-safe 铸点**(S-475 件B;`build*` = 返回纯数据的一只纯函数)。
  *

package/dist/trace/redact.js

@@ -1,4 +1,5 @@
 import { displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
+import { isHierarchicalUrl } from "@sema-agent/settings-schema";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const normalizeForRedaction = stripFormatCharacters;
 export const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
@@ -209,19 +210,24 @@ function forgetEscapedSeparatorTails() {
     escapedTailsText = undefined;
     escapedTailsValue = undefined;
 }
+const UUID_SHAPE = "[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}";
+const UUID_ALPHABET = "0123456789abcdefABCDEF-";
+const notWholeUuid = (valueClass) => new RegExp(`^${valueClass}+$`).test(UUID_ALPHABET) ? `(?!${UUID_SHAPE}(?!${valueClass}))` : "";
 const VALUE_ARM_STICKY = new Map();
 const VALUE_ARM_BODIES = [];
 const valueArm = (prefixSrc, valueClass, min, evidence) => {
-    const body = `${prefixSrc}${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
-    VALUE_ARM_BODIES.push(body);
-    const g = (() => {
+    const tail = `${twoStrongAhead(valueClass)}${atLeast(valueClass, min)}`;
+    const [body, g] = (() => {
         switch (evidence) {
-            case "self-evident":
-                return new RegExp(body, "g");
+            case "self-evident": {
+                const b = `${prefixSrc}${notWholeUuid(valueClass)}${tail}`;
+                return [b, new RegExp(b, "g")];
+            }
             case "needs-left-boundary": {
-                const re = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${body}`, "g");
-                VALUE_ARM_STICKY.set(re, new RegExp(body, "y"));
-                return re;
+                const b = `${prefixSrc}${tail}`;
+                const re = new RegExp(`(?<!${WORD_INTERIOR_CLASS})${b}`, "g");
+                VALUE_ARM_STICKY.set(re, new RegExp(b, "y"));
+                return [b, re];
             }
             default: {
                 const unhandled = evidence;
@@ -229,6 +235,7 @@ const valueArm = (prefixSrc, valueClass, min, evidence) => {
             }
         }
     })();
+    VALUE_ARM_BODIES.push(body);
     return g;
 };
 let anyValueArm;
@@ -627,6 +634,7 @@ const KEYWORD_SECRET_PATTERNS = [
     [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}"), "Basic «redacted»"],
     [keywordArm("[Tt]oken", "[A-Za-z0-9._~+/-]", 20), "token «redacted»"],
 ];
+const SK_FULL_ARM_MIN = 20;
 const SHAPE_SECRET_PATTERNS = [
     [new RegExp(String.raw `(?:ghp|gho|ghu|ghs|ghr)_${atLeast("[A-Za-z0-9]", 20)}`, "g"), "«redacted:gh-token»"],
     [new RegExp(String.raw `github_pat_[A-Za-z0-9]{22}_${atLeast("[A-Za-z0-9]", 59)}`, "g"), "«redacted:gh-token»"],
@@ -635,7 +643,7 @@ const SHAPE_SECRET_PATTERNS = [
     [new RegExp(String.raw `ASIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
     [new RegExp(String.raw `(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-${atLeast("[A-Za-z0-9_-]", 20)}|(?:sk|rk)_(?:live|test|org)_${atLeast("[A-Za-z0-9]", 24)}|pypi-${atLeast("[A-Za-z0-9_-]", 85)})`, "g"), "«redacted:key»"],
     [new RegExp(String.raw `xapp-\d-${atLeast("[A-Za-z0-9-]", 20)}`, "g"), "«redacted:slack-token»"],
-    [valueArm("sk-", "[A-Za-z0-9_-]", 16, "self-evident"), "«redacted:key»"],
+    [valueArm("sk-", "[A-Za-z0-9_-]", SK_FULL_ARM_MIN, "self-evident"), "«redacted:key»"],
 ];
 const FULL_ARM_PATTERNS = [...STRUCTURAL_SECRET_PATTERNS, ...KEYWORD_SECRET_PATTERNS, ...SHAPE_SECRET_PATTERNS];
 const PEM_HEADER_IDENT_MAX = 31;
@@ -1853,12 +1861,6 @@ export function redactedPreview(value, cap = 2000) {
     s = redactSecrets(s, { json: true });
     return s.length > cap ? `${s.slice(0, cap)}…[truncated]` : s;
 }
-export function isHierarchicalUrl(raw) {
-    if (!URL.canParse(raw))
-        return false;
-    const u = new URL(raw);
-    return u.href.startsWith(`${u.protocol}//`);
-}
 function decodeToFixedPoint(s, maxRounds = 3) {
     let cur = s;
     for (let round = 0; round < maxRounds; round += 1) {

package/dist/trace/self-minted-wire.d.ts

@@ -3,6 +3,10 @@ export interface SelfMintedWireMember {
     readonly attr: string | number;
     readonly since: string;
 }
+/** 一个**退役**成员的登记:同 {@link SelfMintedWireMember},多一格 `until`(它退出 wire 的那一版;见文件头注 `retired`)。 */
+export interface SelfMintedRetiredMember extends SelfMintedWireMember {
+    readonly until: string;
+}
 export declare const SELF_MINTED_WIRE: {
     /** [ref](7.55.0)起的终态成因注;S-929(7.108.0)+`shutdown_before_park`。 */
     readonly crashConvergedCause: {
@@ -128,12 +132,62 @@ export declare const SELF_MINTED_WIRE: {
         };
     };
     /**
-     * 审批问的**无人决终态归因**:`POST /v1/tasks/:taskId/asks/:askId/decision` 410 `gone.ask` 体的 `deniedReason`(问账行 `denied_reason` 列原值)。
-     * 词表属主 = `approval-deny-reasons.ts` 的 `DENY_REASONS` ∪ `VOID_REASONS`(`satisfies Record<DenyReason | VoidReason, …>`:表加词而本行没跟 ⇒ tsc 红)。
+     * 审批问的**无人决终态归因**:`POST /v1/tasks/:taskId/asks/:askId/decision` 410 `gone.ask` 体的 `cause`(问账行 `denied_reason` 列原值)。
+     * 词表属主 = `approval-deny-reasons.ts` 的 `APPROVAL_ENDING_CAUSES`(落这一列的那一子集 `AskRowEndingCause`;`satisfies Record<AskRowEndingCause, …>`:表加词而本行没跟 ⇒ tsc 红)。
+     * 7.124.0:键名 `deniedReason` → `cause`(硬破坏,零别名;值域不变 + `run_exited` / `batch_sibling_withdrawn` 两个新词)—— 老成员的属性格因此从 `-` 变成 `key:cause`(清单记 `changed`)。
      * 7.116.0 +2:启动收敛(承载它的进程没了)的两个词 —— 与 `crashConvergedCause` 同词(同一问在两个读面上一个成因)。
      */
     readonly askTerminalReason: {
-        readonly at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask deniedReason";
+        readonly at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask cause";
+        readonly members: {
+            routing_failure_fail_closed: {
+                attr: string;
+                since: string;
+            };
+            run_cancelled: {
+                attr: string;
+                since: string;
+            };
+            run_exited: {
+                attr: string;
+                since: string;
+            };
+            batch_aborted: {
+                attr: string;
+                since: string;
+            };
+            batch_sibling_withdrawn: {
+                attr: string;
+                since: string;
+            };
+            batch_bound_elsewhere: {
+                attr: string;
+                since: string;
+            };
+            adhoc_leg_no_durable_domain: {
+                attr: string;
+                since: string;
+            };
+            orphan_ttl_exceeded: {
+                attr: string;
+                since: string;
+            };
+            crashed_before_park: {
+                attr: string;
+                since: string;
+            };
+            shutdown_before_park: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /**
+     * 晚答 `POST /v1/tool-approvals/:id/respond` 的 `404 tool_approval.not_pending` 体的 `cause`:行 `VOID` / `DENIED` ⇒ 行上那个成因词(同决断口 410,同一列);
+     * 另有一个 404 专属词 `unknown_or_other_replica`(7.40.0 起,换副本 / 换端点重试才有意义)。7.124.0 起旧词 `voided` / `denied` 退役(被具体成因词取代,零别名)。
+     */
+    readonly notPendingCause: {
+        readonly at: "POST /v1/tool-approvals/:id/respond 404 tool_approval.not_pending cause";
         readonly members: {
             routing_failure_fail_closed: {
                 attr: string;
@@ -143,10 +197,18 @@ export declare const SELF_MINTED_WIRE: {
                 attr: string;
                 since: string;
             };
+            run_exited: {
+                attr: string;
+                since: string;
+            };
             batch_aborted: {
                 attr: string;
                 since: string;
             };
+            batch_sibling_withdrawn: {
+                attr: string;
+                since: string;
+            };
             batch_bound_elsewhere: {
                 attr: string;
                 since: string;
@@ -167,6 +229,75 @@ export declare const SELF_MINTED_WIRE: {
                 attr: string;
                 since: string;
             };
+            unknown_or_other_replica: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /**
+     * 活卡结局帧 `tool_approval_complete` 的 additive `cause`(7.124.0):**非人结局在场、人答缺席**。值 = 审计 settle 行 `cause` 的同一个词(一个事实一个读法);
+     * 值域 = 非人结局的全部成因词(`SettleCause` = 闭集去掉决断口 409 的四个词)。键是本版新铸的 ⇒ 每个成员的属性格记 `key:cause`。
+     */
+    readonly toolApprovalCompleteCause: {
+        readonly at: "tool_approval_complete frame cause";
+        readonly members: {
+            ttl_expired: {
+                attr: string;
+                since: string;
+            };
+            broadcast_lost: {
+                attr: string;
+                since: string;
+            };
+            stream_disconnected: {
+                attr: string;
+                since: string;
+            };
+            undeliverable: {
+                attr: string;
+                since: string;
+            };
+            run_cancelled: {
+                attr: string;
+                since: string;
+            };
+            run_exited: {
+                attr: string;
+                since: string;
+            };
+            batch_aborted: {
+                attr: string;
+                since: string;
+            };
+            batch_sibling_withdrawn: {
+                attr: string;
+                since: string;
+            };
+            batch_bound_elsewhere: {
+                attr: string;
+                since: string;
+            };
+            routing_failure_fail_closed: {
+                attr: string;
+                since: string;
+            };
+            crashed_before_park: {
+                attr: string;
+                since: string;
+            };
+            shutdown_before_park: {
+                attr: string;
+                since: string;
+            };
+            orphan_ttl_exceeded: {
+                attr: string;
+                since: string;
+            };
+            adhoc_leg_no_durable_domain: {
+                attr: string;
+                since: string;
+            };
         };
     };
     /** 7.121.0:`GET /health` 自报位 `auth.kinds[]` 的成员(验过的身份来源闭集;这台部署的装配能回的那几个)。 */

package/dist/trace/self-minted-wire.js

@@ -48,16 +48,53 @@ export const SELF_MINTED_WIRE = {
         },
     },
     askTerminalReason: {
-        at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask deniedReason",
+        at: "POST /v1/tasks/:taskId/asks/:askId/decision 410 gone.ask cause",
         members: {
-            routing_failure_fail_closed: { attr: "-", since: "7.3.0" },
-            run_cancelled: { attr: "-", since: "7.3.0" },
-            batch_aborted: { attr: "-", since: "7.3.0" },
-            batch_bound_elsewhere: { attr: "-", since: "7.3.0" },
-            adhoc_leg_no_durable_domain: { attr: "-", since: "7.3.0" },
-            orphan_ttl_exceeded: { attr: "-", since: "7.3.0" },
-            crashed_before_park: { attr: "-", since: "7.116.0" },
-            shutdown_before_park: { attr: "-", since: "7.116.0" },
+            routing_failure_fail_closed: { attr: "key:cause", since: "7.124.0" },
+            run_cancelled: { attr: "key:cause", since: "7.124.0" },
+            run_exited: { attr: "key:cause", since: "7.124.0" },
+            batch_aborted: { attr: "key:cause", since: "7.124.0" },
+            batch_sibling_withdrawn: { attr: "key:cause", since: "7.124.0" },
+            batch_bound_elsewhere: { attr: "key:cause", since: "7.124.0" },
+            adhoc_leg_no_durable_domain: { attr: "key:cause", since: "7.124.0" },
+            orphan_ttl_exceeded: { attr: "key:cause", since: "7.124.0" },
+            crashed_before_park: { attr: "key:cause", since: "7.124.0" },
+            shutdown_before_park: { attr: "key:cause", since: "7.124.0" },
+        },
+    },
+    notPendingCause: {
+        at: "POST /v1/tool-approvals/:id/respond 404 tool_approval.not_pending cause",
+        members: {
+            routing_failure_fail_closed: { attr: "-", since: "7.124.0" },
+            run_cancelled: { attr: "-", since: "7.124.0" },
+            run_exited: { attr: "-", since: "7.124.0" },
+            batch_aborted: { attr: "-", since: "7.124.0" },
+            batch_sibling_withdrawn: { attr: "-", since: "7.124.0" },
+            batch_bound_elsewhere: { attr: "-", since: "7.124.0" },
+            adhoc_leg_no_durable_domain: { attr: "-", since: "7.124.0" },
+            orphan_ttl_exceeded: { attr: "-", since: "7.124.0" },
+            crashed_before_park: { attr: "-", since: "7.124.0" },
+            shutdown_before_park: { attr: "-", since: "7.124.0" },
+            unknown_or_other_replica: { attr: "-", since: "7.40.0" },
+        },
+    },
+    toolApprovalCompleteCause: {
+        at: "tool_approval_complete frame cause",
+        members: {
+            ttl_expired: { attr: "key:cause", since: "7.124.0" },
+            broadcast_lost: { attr: "key:cause", since: "7.124.0" },
+            stream_disconnected: { attr: "key:cause", since: "7.124.0" },
+            undeliverable: { attr: "key:cause", since: "7.124.0" },
+            run_cancelled: { attr: "key:cause", since: "7.124.0" },
+            run_exited: { attr: "key:cause", since: "7.124.0" },
+            batch_aborted: { attr: "key:cause", since: "7.124.0" },
+            batch_sibling_withdrawn: { attr: "key:cause", since: "7.124.0" },
+            batch_bound_elsewhere: { attr: "key:cause", since: "7.124.0" },
+            routing_failure_fail_closed: { attr: "key:cause", since: "7.124.0" },
+            crashed_before_park: { attr: "key:cause", since: "7.124.0" },
+            shutdown_before_park: { attr: "key:cause", since: "7.124.0" },
+            orphan_ttl_exceeded: { attr: "key:cause", since: "7.124.0" },
+            adhoc_leg_no_durable_domain: { attr: "key:cause", since: "7.124.0" },
         },
     },
     healthAuthKind: {

package/dist/url-refusal.d.ts

@@ -0,0 +1,35 @@
+/**
+ * **「交给 `fetch` 的 http(s) URL」的拒句铸点**(S-1269 的展示半场)。判官本身 —— 这个值是不是层级式 http(s) URL、座位禁的部件
+ * (userinfo / query / fragment)在不在、每个拒因词的规则句 —— 是 settings-schema 的 URL 形判官(`httpUrlFlaws` / `httpUrlRule` /
+ * `HTTP_URL_SHAPE_RULE` / `isHierarchicalUrl`,11.0.0 由本仓的那一只 lift 过去、规则与拒因词闭集逐字搬);本仓**零第二份**形规则,
+ * 只留本仓自己的展示律:拒句里值的样子({@link buildRefusalShownUrl})与拒句的唯一铸点({@link buildHttpUrlRefusal})。
+ *
+ * ## 病(为什么拒句不回显 scheme)
+ * 值不带 `scheme://` 时 WHATWG 把冒号前那一段读成 scheme(不透明 URL,与 `mailto:` 同族):
+ * `registry-live.internal:8080` 的 scheme 是主机名,`<令牌>:<口令>@host:8080` 的 scheme 是**令牌**(字母开头、
+ * 只含 `[A-Za-z0-9+.-]` 的 48 位十六进制拉取令牌、`sk-…`、JWT 都满足),而且被小写化 —— 形状律
+ * (`redactSecrets`)因此认不出它。旧判官拒句里的 `(got "<scheme>")` 就把它整只写进了 fatal 行与 stderr。关掉它的唯一形是:
+ * 拒句从源头不含解析记号 —— 判官只给规则词,值只经本模块的展示律出现。
+ *
+ * ## 读者
+ * 中心基址三席 + 公告地址 + 请求期 `centerFetch`(`web-admin-client/center-request.ts` `pathBaseUrlRefusal`:禁 userinfo / query / fragment)·
+ * 续签 issuer(只问形)· 模型路由三键(`model-route-url.ts`:禁 userinfo / fragment,query 照收)· `MEMORY_EMBEDDER_ENDPOINT` 与
+ * `A2A_SERVE_URL`(禁 userinfo)。「scheme 只有判官与展示铸点读」由 `test/config-url-display-safe.test.ts` 的读者普查门钉住。
+ */
+import { type HttpUrlFlaw } from "@sema-agent/settings-schema";
+/**
+ * 拒句里值的样子(纯函数):合格的 http(s) 形 ⇒ 只到 origin(`scheme://host[:port]`,过展示铸点),origin 之后还有东西(userinfo /
+ * 路径 / query / fragment)⇒ 接一枚 `/…`;其余(不透明 / 不可解析 / 层级式非 http(s))⇒ 展示铸点的占位 `«redacted:url»` ——
+ * 拒句里不出现非 http(s) 的 scheme 词(主会话增补裁:写成 scheme 的令牌 `<48hex>://host` 曾原样进 fatal 行)。
+ *
+ * 🔴 为什么只到 origin(车内 codex 对抗复审 r1 [high],亲跑复现):展示铸点的路径段**逐字**保留、只靠形状律认令牌形 ——
+ * 形状律认不出的令牌(48 位十六进制拉取令牌就是一例)放在路径上会原样进拒句。拒句落在 fatal 行、stderr、每一轮的请求失败日志,
+ * 这几处不赌形状律的覆盖面:座位名 + 规则词已经说清了哪一席错在哪,值只需要认得出是哪一台主机。
+ */
+export declare function buildRefusalShownUrl(raw: string): string;
+/**
+ * 拒句的**唯一**铸点:`<subject> <规则句>[; <规则句>…]; got "<值的样子>"`(`build*` = 纯数据)。
+ * 值只经 {@link buildRefusalShownUrl} 出现;`flaws` 来自 settings-schema 的 `httpUrlFlaws`(调用方按首个拒因选自己的码与出路句)。
+ */
+export declare function buildHttpUrlRefusal(subject: string, raw: string, flaws: readonly HttpUrlFlaw[]): string;
+//# sourceMappingURL=url-refusal.d.ts.map

package/dist/url-refusal.js

@@ -0,0 +1,15 @@
+import { httpUrlRule, isHierarchicalUrl } from "@sema-agent/settings-schema";
+import { DISPLAY_SAFE_URL_TOKEN, buildDisplaySafeUrl } from "./trace/redact.js";
+export function buildRefusalShownUrl(raw) {
+    if (!isHierarchicalUrl(raw))
+        return DISPLAY_SAFE_URL_TOKEN;
+    const u = new URL(raw);
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+        return DISPLAY_SAFE_URL_TOKEN;
+    const origin = `${u.protocol}//${u.host}`;
+    return `${buildDisplaySafeUrl(origin)}${u.href === `${origin}/` ? "" : "/…"}`;
+}
+export function buildHttpUrlRefusal(subject, raw, flaws) {
+    return `${subject} ${flaws.map(httpUrlRule).join("; ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}`;
+}
+//# sourceMappingURL=url-refusal.js.map

package/dist/user-authored-text.d.ts

@@ -0,0 +1,31 @@
+/** 非用户正文块的闭集标签(引擎 / 壳注入)。加一个标签 = 改这里一处:下面的正则由本表生成。 */
+export declare const INJECTED_BLOCK_TAGS: readonly ["system-reminder", "task-notification", "attachment"];
+/**
+ * 注入块的唯一一只正则(由 {@link INJECTED_BLOCK_TAGS} 生成)。**只配 `String.prototype.replace` 使用**(带 `g`,
+ * `lastIndex` 有状态,拿去 `.test` / `.exec` 会读到上一次的位置)。
+ *
+ * 属性位:引号感知 —— 引号内可以有 `>`(文件名的合法字符,XML 属性值也允许不转义),所以
+ * `<attachment path="a>b.ts" />` 的开标签在引号之后的 `/>` 才结束;引号外禁 `<` 与 `>`,引号内禁 `<`(XML 属性值本就须转义
+ * `<`;这条同时是线性的界:每个开标签的扫描最迟在下一个 `<` 处停)。引号不成对的开标签不算块,原样保留。
+ * 体位 `[\s\S]*?(?:<\/tag>|$)` 恒在末尾成功(未闭合形)。整串线性,没有二次方臂。
+ * 自闭合 `\/>` 排在体位 `>` 之前:`<attachment path="x" />` 不会被当成开标签吞到末尾。
+ */
+export declare const INJECTED_BLOCK_RE: RegExp;
+/** 剥掉全部注入块(不 trim)。 */
+export declare function stripInjectedBlocks(text: string): string;
+/** 用户自己写的那部分:剥块 + trim。剥空 ⇒ `""`(调用方走各自「空 ⇒ 缺席 / 走下一条」的臂)。 */
+export declare function userAuthoredText(text: string): string;
+/**
+ * 预览 = 用户正文 → 脱敏 → 截断(序固定)。`chars` 由调用面给(run 120 / leader 160 …,各面的长度常量仍在各自面)。
+ * 没有用户正文(剥空 / 全空白 / 空串)⇒ `""`:**建过预览、没有用户正文**是一件事实,落列就是空串;列上的 NULL 只说「没建过」
+ * (更早版本建的行 / 无列值)。两件事一个事实位,读面各按自己的契约分(展示名折成 `(notification turn)` / 展示位缺席 / 走上一条)。
+ *
+ * 序的理由:先剥 —— 注入块里的秘密形随块整块走掉,不靠脱敏;再脱敏 —— `redactSecrets` 只认已知凭据形,是尽力而为,
+ * 先截后脱会把一个被截断的凭据形漏出去;最后截。
+ */
+export declare function buildObjectivePreview(text: string, chars: number): string;
+/** run 行 `objective_preview` 的字符数(列宽 VARCHAR(160) 内留余量)。run 行的建行点(提交腿 `runMeta`、wake 续跑腿)与 run 名的取材共用这一个数。 */
+export declare const RUN_OBJECTIVE_PREVIEW_CHARS = 120;
+/** run 行的预览:用户写的那段 → 脱敏 → 截 {@link RUN_OBJECTIVE_PREVIEW_CHARS};没有用户正文 ⇒ `""`(列写空串 = 有记录、剥空)。 */
+export declare function buildRunObjectivePreview(objective: string): string;
+//# sourceMappingURL=user-authored-text.d.ts.map

package/dist/user-authored-text.js

@@ -0,0 +1,18 @@
+import { redactSecrets } from "./trace/redact.js";
+export const INJECTED_BLOCK_TAGS = ["system-reminder", "task-notification", "attachment"];
+export const INJECTED_BLOCK_RE = new RegExp(`<(${INJECTED_BLOCK_TAGS.join("|")})(?:\\s(?:[^<>"']|"[^"<]*"|'[^'<]*')*?)?(?:\\/>|>[\\s\\S]*?(?:<\\/\\1>|$))\\s*`, "g");
+export function stripInjectedBlocks(text) {
+    return text.replace(INJECTED_BLOCK_RE, "");
+}
+export function userAuthoredText(text) {
+    return stripInjectedBlocks(text).trim();
+}
+export function buildObjectivePreview(text, chars) {
+    const own = userAuthoredText(text);
+    return own === "" ? "" : redactSecrets(own).slice(0, chars);
+}
+export const RUN_OBJECTIVE_PREVIEW_CHARS = 120;
+export function buildRunObjectivePreview(objective) {
+    return buildObjectivePreview(objective, RUN_OBJECTIVE_PREVIEW_CHARS);
+}
+//# sourceMappingURL=user-authored-text.js.map

package/dist/{config-center → web-admin-client}/apply-effective.d.ts

@@ -1,11 +1,11 @@
 /**
  * EffectiveConfig application — mutate the boot `ServiceConfig` OVER with a pulled `EffectiveConfig`
- * (models/roles/tiers/projects `applyEffective`, the approval group + runtime limit residue
- * `applyRuntimeGates`, the per-request-hot governance baton `applyRuntimeHot`) plus their shared helpers
- * (`toModel`, `mutateInPlace`, `resolveDefaultModelName`, `logEffectiveDiff`). Split out of `facade.ts`
+ * (models/roles/tiers/projects `applyEffective`, the approval group + the limits group
+ * `applyRuntimeGates` (governance approval + limits), the per-request-hot governance baton `applyRuntimeHot`) plus their shared helpers
+ * (`toModel`, `mutateInPlace`, `logEffectiveDiff`). Split out of `facade.ts`
  * ([ref] A13, internal-lossless — the facade re-exports every symbol below unchanged).
  */
-import type { Model } from "@sema-agent/core";
+import { type Model } from "@sema-agent/core";
 import type { ServiceConfig } from "../config-types.js";
 import type { SealedKeyOpener } from "../sealed-key.js";
 import type { Logger } from "../observability/logger.js";
@@ -18,20 +18,6 @@ import { type ConfigApplyReport } from "./apply-ledger.js";
  *  `this.deps.models/roles/pricing` LIVE per-task and `/v1/models` reads `config.models` — both share the
  *  reference captured at boot, so mutating it (vs reassigning) updates both with no split, no Runner rebuild. */
 export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
-/**
- * [ref] / [ref] —— 无法解读的名单条目的**代表元**。
- *
- * 为什么需要它(codex 复审 R1 真 finding):把坏条目**丢掉**会让 `[7, null]` 这种「在场但一条都读不
- * 懂」的名单塌成**空数组**,而空数组在消费端的语义恰恰是「治理关闭 = 全放行」—— 一个表达"我要限制"
- * 的配置,因为写错了类型,反而把门整个打开。方向必须反过来:名单在场 = operator 意图限制;读不懂的
- * 条目 ⇒ 换成一个**永不可能是 catalog name** 的代表元(前导 NUL,registry-core 的 name 词法不可能产
- * 出),于是它在归一时解不到任何目录条目 ⇒ 谁都准不了。
- *
- * 后果是**有界的**:被拒的只有「用户逐 turn 显式点模型」这一件事;`default` / roles / 档位表照常,
- * 任务照跑。写错配置的代价是"点不了模型"而不是"服务不可用",且 warn 当场点名成因。
- * 🔴 只活在内存判定面:不进 wire(`/v1/models` 只发布尔)、不进日志(warn 打的是原始坏值的类型标记)。
- */
-export declare const UNPARSABLE_AT_MODEL_ALLOWLIST_ENTRY = "\0<unparsable-at-model-allowlist-entry>";
 /** 返回值=是否 COMMIT(false 两臂:[ref]③ 世代序 CAS 拒绝 / 7.10.0 swapPlane 换装拒绝——两臂都在
  *  commit 之前,活配置零触碰)。caller 收到 false 必须把**同一世代的旁路消费**(prompts 采用/pricing/
  *  keyResolver/etag 推进/LKG 落盘)一并跳过——否则 applyEffective 拒了主面、旁路却半应用同一个被拒
@@ -44,7 +30,7 @@ export interface ApplyReport extends ConfigApplyReport {
     readonly fullyApplied: boolean;
     /** S-768:本候选目录的模型拒因判决 —— 逐条(`entries`,stage 判出的那份候选的,键已过名筛)+ 组拒码(`plane`,模型面组被拒时在场,
      *  判决那刻当数据带出)。落地与组拒同一只来源:两者都描述**这一份**候选(组拒时引擎自己的拒因表不换代,这里仍报被拒的那份)。
-     *  候选不管模型面(一条启用条目也没有 —— 幸存的与被丢的都算)⇒ `entries` 空、无 `plane`。`/health.modelRefusals` 与心跳的唯一数据源(config-center 投影)。 */
+     *  候选不管模型面(一条启用条目也没有 —— 幸存的与被丢的都算)⇒ `entries` 空、无 `plane`。`/health.modelRefusals` 与心跳的唯一数据源(web-admin 投影)。 */
     readonly modelRefusals: ModelRefusalVerdict;
 }
 /**
@@ -81,7 +67,7 @@ export declare function applyEffective(config: ServiceConfig, eff: EffectiveConf
  * 读者一律从这里派生,禁手抄:
  *  · stage:{@link stageModelPlane} 产出组内**每个**域的产物({@link ModelPlaneStages} 按本表映射),组被拒 ⇒ 一个域都没有;
  *  · 世代账:整组拒的 `keys` 与落地的 `applied` 都由 {@link MODEL_PLANE_SURFACES} 按本表派生({@link modelPlaneGroupReport});
- *  · boot 按组回落 LKG 的合成文档:{@link withModelPlaneOf}(`boot/config-center.ts`)。
+ *  · boot 按组回落 LKG 的合成文档:{@link withModelPlaneOf}(`boot/web-admin.ts`)。
  * (与 `config.ts` 的配置组视图 `MODEL_PLANE_GROUP_KEYS` 不是一回事:那是 `ServiceConfig` 的分节视图;这里是「中心热应用的
  * 模型面这一组包含哪些 effective 域」。)
  */
@@ -120,72 +106,29 @@ export declare const PLANE_REFUSAL_INVARIANT_OF: {
     readonly "config.model_route_endpoint_missing": "model-route-endpoint";
     readonly "config.gateway_fallback_without_primary": "model-route-endpoint";
 };
-/**
- * UNIFORM presence semantics across the center gates (center `f95438a` adopted this from our sentinel flag —
- * SERVICE-INTEGRATION「Runtime 治理/限额闸」): every gate field is center `.optional()`, so
- *   `undefined` = center isn't managing it → KEEP env;
- *   present (any value, INCLUDING an explicit 0 / [] = "publish the gate OFF") → OVERRIDE env.
- * (Earlier center had `rateLimitPerMin`/`approvalRequire` as `.default(0/[])`, which would have let a default
- *  silently disable an env-set gate — we flagged it, center made them optional, so a plain presence rule is
- *  now both correct and uniform. No sentinel special-casing.)
- *
- * Only guard: `costQuotaWindowSec` must be `> 0` (a 0 window is nonsensical — core divides by it). Center's
- * schema is `.positive()` so it can't send 0; this is belt-and-suspenders.
- *
- * Per-worker overrides ride the per-worker `/effective?worker=` response (center merges WorkerSpec.runtime over
- * the fleet default server-side), so this single "effective beats env" rule already honors per-worker > fleet.
- */
-/** `runtime` 域的限额五闸(= settings-schema `RuntimeConfig` 的全部键,[ref] 件3 对账门钉集合等式),ONE place:
- *  legacy 位的 presence 判据({@link runtimeGatePresent} → stage-limits 的 `legacyGates`)、config-catalog 的
- *  center 在管键、dry-run 现值快照都从这一张表派生。[ref] 批1 起五键**全热**(属主 stage-limits,boot+refresh
- *  双腿),所以本表与 restart-to-apply 再无关系——审批闸不在这里:它住 governance 域({@link stageApprovalGate})。 */
-export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
-export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
-/** Uniform presence rule (center f95438a) for the `runtime` limit gates: "managed" when the field is present —
- *  any number (incl. 0). Sole guard: costQuotaWindowSec must be > 0 (a 0 window is nonsensical — core divides by
- *  it; center's `.positive()` already enforces, belt-and-suspenders here). The approval gate's presence rule
- *  (`Array.isArray`) lives with its owner, {@link stageApprovalGate}. */
 /**
  * DESIGN-278 §5 S2([ref])—— center 这份 effective **当前在管**哪些 `ServiceConfig` 键(配置目录端点
  * `GET /v1/config/catalog` 判 `effectiveLane` 的 center 半场)。
  *
  * 判据与各消费腿**同源**,不自铸第二份:
  *  · limits 域 = `hasOwnProperty`(stage-limits 的 published 判据逐字——present 含显式 0);
- *  · 六闸 legacy 位 = {@link runtimeGatePresent}(旧位 presence 规则的唯一属主);
  *  · governance 三件(autonomy / commandPolicy / approvalRequire)= 键在场(applyRuntimeHot 与 stageApprovalGate
  *    的 non-sticky presence 判据同门:`!== undefined`);
  *  · readFace 域成员 = 键在场(read-face.ts 的逐键 env-wins 合成看的就是成员在场性);
- *  · models 面 = 有启用行(markRosterLanded 同判据);atModelAllowlist 单列(整表重算键)。
+ *  · models 面 = 有启用行(markRosterLanded 同判据);atMention 单列(整只重算键;座位在场即在管 —— 11.x 的读腿恒物化它)。
  * 纯投影零副作用;`undefined` eff(还没拉到 / 纯 env 形)⇒ 空集。
  */
 export declare function centerManagedConfigKeys(eff: EffectiveConfig | undefined): ReadonlySet<string>;
-export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
 /** 独立调用面的兼容壳(测试/外部):stage → 就地赋值 → 通知。applyEffective 不走这里——它把
- *  赋值并进自己的 commit 段以保住整世代原子性([ref]②)。入参是 eff 的两个域([ref] 件3:审批闸
- *  住 governance,限额五闸住 runtime——两位各自的属主判据,这里不再合成视图)。
- *  [ref]:限额五闸的属主已移交热腿,所以本壳**同样**要过 stage-limits —— 否则一个仍叫 applyRuntimeGates
- *  的函数会静默漏掉五个限额键(比改名更坏的那种沉默)。S-668 波 2:审批组的判据依赖腿(④ 只在热腿判),
+ *  赋值并进自己的 commit 段以保住整世代原子性([ref]②)。入参是 eff 的两个域(审批闸住 governance,
+ *  限额键住 limits —— 各自的属主判据,这里不合成视图;settings-schema 11 退役了 `runtime` 域)。
+ *  [ref]:限额键的属主是热腿,所以本壳**同样**要过 stage-limits。S-668 波 2:审批组的判据依赖腿(④ 只在热腿判),
  *  所以本壳与 applyEffective 一样**必须**说是哪条腿。 */
-export declare function applyRuntimeGates(config: ServiceConfig, eff: Pick<EffectiveConfig, "runtime" | "governance"> | undefined, leg: ApplyLeg, logger?: Logger): void;
+export declare function applyRuntimeGates(config: ServiceConfig, eff: Pick<EffectiveConfig, "limits" | "governance"> | undefined, leg: ApplyLeg, logger?: Logger): void;
 export declare function applyRuntimeHot(config: ServiceConfig, gov: EffectiveConfig["governance"], logger?: Logger): void;
 /**
- * [ref]① 显式默认解析——applyEffective 与 dry-run(logEffectiveDiff.wouldDefaultModel)共用的单源。优先级
- * (显式源指向不在目录/未启用的名 ⇒ onDangling 回调后落下一级,绝不静默指错模型):
- *   1) eff.models.default 结构键 —— ✅ 既得路径([ref] registry-core 0.10.11 落 `default?: string` schema
- *      键+per-worker /effective 直通;本地 lane 由 config-provider mapToServiceEffective 直通)。写面悬空 ref
- *      由 registry-core superRefine fail-loud;存量/未经 schema 路径仍走本函数的 warn 降级(双层姿势与
- *      activeTierGroup 同构)。(1.200-1.202 期间此级恒空=当时如实的前行 seam,codex H2 注记已兑现。)
- *   2) roles.default 的显式 {model} 绑定(现有 wire 真源)。
- *   3) activeTierGroup 档绑定,按 {@link DEFAULT_ROLE_TIER_LADDER}(= core 对 "default" 角色的档语义)。
- *   4) fallback(enabled[0]——原兜底,唯一不触发 onDangling 的落点)。
- */
-export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name: string) => boolean, fallback: string, onDangling?: (source: string, name: string) => void): {
-    name: string;
-    source: string;
-};
-/**
- * Read-only comparison (SEMA_REGISTRY_DRY_RUN): log what the center config WOULD change vs the current
- * (env-derived) config, WITHOUT applying it. The safe-rollout step the config-center recommends — verify
+ * Read-only comparison (`WEB_ADMIN_ENV.dryRun`): log what the web-admin config WOULD change vs the current
+ * (env-derived) config, WITHOUT applying it. The safe-rollout step the web-admin recommends — verify
  * the center's models/roles/collab match (or intentionally differ from) the env baseline before going live.
  */
 export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;