@sema-agent/server 7.123.0 → 7.124.1

package/dist/config.js

@@ -1,10 +1,10 @@
 import { readFileSync } from "node:fs";
-import { DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
-import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, CENTER_CREDENTIAL_ENV } from "@sema-agent/settings-schema";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./memory-scope.js";
@@ -13,7 +13,7 @@ import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf } from "./config-types.js";
 import { FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
 import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
-import { centerLaneConfigured, pathBaseUrlRefusal } from "./config-center/center-request.js";
+import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
@@ -22,7 +22,7 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
-import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
@@ -33,7 +33,8 @@ import { createCenterCredentialSource, readCenterCredentialDeclaration } from ".
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
-import { buildHttpUrlRefusal, httpUrlFlaws } from "./url-shape.js";
+import { httpUrlFlaws } from "@sema-agent/settings-schema";
+import { buildHttpUrlRefusal } from "./url-refusal.js";
 import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
@@ -113,74 +114,10 @@ function defaultSkillsDir() {
         return "skills";
     }
 }
-export const RETIRED_ENV_REFUSAL_CODE = "config.env_key_retired";
-export const RETIRED_ENVS = [
-    ["TIDB_HOST", "MYSQL_HOST", "renamed"], ["TIDB_PORT", "MYSQL_PORT", "renamed"], ["TIDB_USER", "MYSQL_USER", "renamed"],
-    ["TIDB_PASSWORD", "MYSQL_PASSWORD", "renamed"], ["TIDB_DATABASE", "MYSQL_DATABASE", "renamed"], ["TIDB_POOL_SIZE", "MYSQL_POOL_SIZE", "renamed"],
-    ["CONFIG_CENTER_URL", "SEMA_REGISTRY_URL", "renamed"], ["CONFIG_CENTER_TOKEN", CENTER_CREDENTIAL_ENV.token, "renamed"],
-    ["CONFIG_CENTER_DRY_RUN", "SEMA_REGISTRY_DRY_RUN", "renamed"], ["CONFIG_CENTER_WORKER", "SEMA_REGISTRY_WORKER", "renamed"],
-    ["ANTHROPIC_BASEURL", "ANTHROPIC_BASE_URL", "renamed"],
-    ["REGISTRY_ADMIN_TOKEN", "SEMA_REGISTRY_ADMIN_TOKEN", "renamed"],
-    ["OA_API_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_SERVICE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_TOKEN", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_BASEURL", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_OWNER", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_REPO", "the OA scenario was removed in 5.0.0", "removed"],
-    ["OA_ISSUE_LABELS", "the OA scenario was removed in 5.0.0", "removed"],
-    ["APPROVAL_POLL_MS", "the OA poll-approval lane was removed in 5.0.0; the durable checkpoint lane is the only gate", "removed"],
-    ["LEADER_CONFLICT_ROUNDS", "the bounded merge-conflict-resolution agent was deleted in 7.83.0 按 C-R63 删除,合不上交用户:leader 交回 result.conflict(分支 + 冲突文件),run 状态 needs_human", "removed"],
-    [
-        "MODEL_CONNECT_TIMEOUT_MS",
-        "MODEL_FIRST_BYTE_TIMEOUT_MS",
-        "replaced",
-        "since core 7.33.0 the TCP + TLS connect clock is the transport's own; the wait from sending the request to its response headers — " +
-            "what this key really bounded — is MODEL_FIRST_BYTE_TIMEOUT_MS (unset = core's own default, plus an upload allowance and one " +
-            "widened retry; 0 = no engine clock on that segment and the transport's header / body clocks off too — the TCP + TLS connect " +
-            "keeps the transport's own clock)",
-    ],
-    ["PROJECT_MEMORY_DISABLED", "PROJECT_MEMORY_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: PROJECT_MEMORY_DISABLED=true is PROJECT_MEMORY_ENABLED=false (the positive name defaults on)"],
-    ["CONFIG_LKG_DISABLED", "CONFIG_LKG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: CONFIG_LKG_DISABLED=true is CONFIG_LKG_ENABLED=false (the positive name defaults on)"],
-    ["HOST_BG_DISABLED", "HOST_BG_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_BG_DISABLED=true is HOST_BG_ENABLED=false (the positive name defaults on)"],
-    ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", "negative-name alias retired in server 3.0.0 — unset it; the polarity is inverted: HOST_EXEC_SPOOL_DISABLED=true is HOST_EXEC_SPOOL_ENABLED=false (the positive name defaults on)"],
-    ["UNATTENDED_PERMISSION_MODE", "since server 7.109.0 the unattended legs (leader workers and their repair legs, run-local, and their durable resumes) always run permissionMode \"default\" with an approver that answers by ask class: a machine answers only \"ordinary\" asks, and every other class goes to the leg's approver seat (run-local's terminal prompt) or parks / is refused — there is no mode to choose", "removed"],
-];
-for (const row of RETIRED_ENVS)
-    Object.freeze(row);
-Object.freeze(RETIRED_ENVS);
-export function buildRetiredEnvWire() {
-    return RETIRED_ENVS.map((row) => {
-        switch (row[2]) {
-            case "renamed":
-                return { name: row[0], kind: row[2], replacement: row[1] };
-            case "replaced":
-                return { name: row[0], kind: row[2], replacement: row[1], reason: row[3] };
-            case "removed":
-                return { name: row[0], kind: row[2], reason: row[1] };
-            default: {
-                const unhandled = row;
-                throw new Error(`unhandled retired-env kind: ${String(unhandled[2])}`);
-            }
-        }
-    });
-}
-const RETIRED_ENV_SENTENCE = {
-    renamed: (hits) => `${hits.map(([old, to]) => `${old} → use ${to}`).join("; ")} — rename the env key(s); the value semantics are unchanged`,
-    replaced: (hits) => `${hits.map(([old, to, , why]) => `${old} → ${to} (${why})`).join("; ")} — set the replacement deliberately: ` +
-        `its value semantics differ from the retired key's, so do not copy the old value across unread`,
-    removed: (hits) => `${hits.map(([old, why]) => `${old} (${why})`).join("; ")} — remove the env key(s): the capability itself was retired, ` +
-        `there is no replacement name and no rename that restores it`,
-};
-function retiredEnvSentence(kind, hit) {
-    const ofKind = hit.filter((h) => h[2] === kind);
-    return ofKind.length > 0 ? [RETIRED_ENV_SENTENCE[kind](ofKind)] : [];
-}
 function rejectRetiredEnvs() {
-    const hit = RETIRED_ENVS.filter(([o]) => process.env[o] !== undefined && process.env[o] !== "");
-    if (hit.length === 0)
-        return;
-    const parts = Object.keys(RETIRED_ENV_SENTENCE).flatMap((kind) => retiredEnvSentence(kind, hit));
-    throw new Error(`retired env name(s) set [${RETIRED_ENV_REFUSAL_CODE}] — refused while present, whether or not the replacement is also set: ${parts.join(" | ")}.`);
+    const refusal = retiredEnvRefusal(process.env);
+    if (refusal !== undefined)
+        throw new Error(refusal);
 }
 export function numEnv(name, fallback) {
     return parseNumOrFail(name, env(name, fallback));
@@ -247,7 +184,7 @@ function parseConfigProvider() {
         return undefined;
     const word = CONFIG_PROVIDER_WORDS.find((w) => w === raw);
     if (word === undefined) {
-        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then SEMA_REGISTRY_URL, if set, selects the center as the config source; otherwise this worker is env-only). ` +
+        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then ${WEB_ADMIN_ENV.url}, if set, selects the center as the config source; otherwise this worker is env-only). ` +
             `The word is matched exactly (no trimming, no case folding). Refusing to boot rather than guessing: the config source, the execution-lane default and the local config root all key on this one word.`);
     }
     return word;
@@ -937,8 +874,8 @@ function parseStoreDomain(ctx) {
             : undefined,
     };
 }
-export function isRosterGateArmed(configCenter) {
-    return configCenter !== undefined && !configCenter.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
+export function isRosterGateArmed(webAdmin) {
+    return webAdmin !== undefined && !webAdmin.dryRun && process.env.CONFIG_REQUIRE_ROSTER === "true";
 }
 function parseModelDomain() {
     const route = readModelRouteEnv(process.env);
@@ -1009,7 +946,7 @@ function parseModelDomain() {
             CONFIG_NOTICES.push({
                 level: "warn",
                 event: "model_cheap_slot_without_main",
-                fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the config center) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
+                fields: { hint: "MODEL_CHEAP_ID is set but MODEL_ID is not — the env cheap slot derives from the env main model, so it is not minted; the catalog (config.d/models.json or the web-admin) serves the roles. Set MODEL_ID to use the env slots, or unset MODEL_CHEAP_ID to silence this line." },
             });
             break;
         case "same_as_main":
@@ -1145,7 +1082,7 @@ function parseModelDomain() {
         tiers: {},
         projects: {},
         roles,
-        atModelAllowlist: [],
+        atMention: DEFAULT_AT_MENTION,
         cascadeLadder: csv("MODEL_CASCADE_LADDER"),
         degrade: process.env.MODEL_DEGRADE_TO
             ? {
@@ -2108,7 +2045,7 @@ function parseLimitsHttpDomain() {
         toolResultTtlSec: (() => {
             const ttl = numEnv("TOOL_RESULT_TTL_SEC", "86400");
             if (ttl <= 0) {
-                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the config center refuses the same value)`);
+                throw new Error(`env TOOL_RESULT_TTL_SEC=${ttl} must be > 0 — it is the age (seconds) after which an offloaded tool result is reaped, so 0 or less puts the cutoff at or after now and every reaper tick would delete ALL of them; there is no "off": set a larger value to keep results longer (the web-admin refuses the same value)`);
             }
             return ttl;
         })(),
@@ -2165,13 +2102,13 @@ function parseGitApiKind(raw, baseUrl) {
 }
 function parseIntegrationsDomain(ctx) {
     const { requirePrincipal, configProvider } = ctx;
-    const registryUrl = parseCenterBaseUrl("SEMA_REGISTRY_URL", process.env.SEMA_REGISTRY_URL, `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
-    const registryLiveUrl = parseCenterBaseUrl("SEMA_REGISTRY_LIVE_URL", process.env.SEMA_REGISTRY_LIVE_URL, `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to SEMA_REGISTRY_URL.`);
-    const registryWebUrl = parseCenterBaseUrl("SEMA_REGISTRY_WEB_URL", process.env.SEMA_REGISTRY_WEB_URL, `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
-    const configCenter = registryUrl !== undefined ? parseConfigCenter(registryUrl, requirePrincipal, registryLiveUrl, registryWebUrl) : undefined;
+    const baseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.url, process.env[WEB_ADMIN_ENV.url], `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
+    const liveBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.liveUrl, process.env[WEB_ADMIN_ENV.liveUrl], `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to ${WEB_ADMIN_ENV.url}.`);
+    const webBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.webUrl, process.env[WEB_ADMIN_ENV.webUrl], `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
+    const webAdmin = baseUrl !== undefined ? parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) : undefined;
     const fleetGeneration = parseFleetGeneration(process.env.FLEET_GENERATION);
     const fleetAdvertiseAddress = parseFleetAdvertiseAddress(process.env.FLEET_ADVERTISE_ADDRESS);
-    fleetFenceLaneOf({ ...fleetGeneration, configCenter, ...fleetAdvertiseAddress });
+    fleetFenceLaneOf({ ...fleetGeneration, webAdmin, ...fleetAdvertiseAddress });
     return {
         pluginsAllowHosts: csvOf(process.env.PLUGINS_ALLOW_HOSTS ?? "github.com"),
         configBootFetchBudgetMs: clampEnvWithWarn("CONFIG_BOOT_FETCH_BUDGET_MS", "1500", 0),
@@ -2181,7 +2118,7 @@ function parseIntegrationsDomain(ctx) {
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
         centerCredentialRenewLeadMs: parseCenterCredentialRenewLeadMs(process.env.CENTER_CREDENTIAL_RENEW_LEAD_MS),
-        configCenter,
+        webAdmin,
         fleetLeaseFailClosed: parseFleetLeaseFailClosed(process.env.FLEET_LEASE_FAIL_CLOSED, requirePrincipal),
         ...fleetGeneration,
         fleetScope: parseFleetScope(process.env.FLEET_SCOPE),
@@ -2239,9 +2176,9 @@ export function fleetFenceLaneOf(cfg) {
         return undefined;
     const laneConfigured = centerLaneConfigured(cfg);
     if (laneConfigured && cfg.fleetAdvertiseAddress !== undefined)
-        return { center: cfg.configCenter, generation };
+        return { center: cfg.webAdmin, generation };
     const missing = [
-        ...(laneConfigured ? [] : [`the center lane (SEMA_REGISTRY_URL + ${CENTER_CREDENTIAL_ENV.token} or ${CENTER_CREDENTIAL_ENV.tokenFile} + SEMA_REGISTRY_WORKER)`]),
+        ...(laneConfigured ? [] : [`the center lane (${WEB_ADMIN_ENV.url} + ${WEB_ADMIN_ENV.token} or ${WEB_ADMIN_ENV.tokenFile} + ${WEB_ADMIN_ENV.worker})`]),
         ...(cfg.fleetAdvertiseAddress === undefined ? ["the announce address (FLEET_ADVERTISE_ADDRESS)"] : []),
     ];
     throw fleetEnvRefusal("member_unfenced", `fleet member cannot be fenced — env FLEET_GENERATION=${JSON.stringify(generation)} makes this engine a fleet member, ` +
@@ -2276,15 +2213,15 @@ function parseCenterBaseUrl(name, raw, role) {
         throw new Error(`${refusal}. ${role}`);
     return raw;
 }
-function parseConfigCenter(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
-    const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+function parseWebAdmin(baseUrl, requirePrincipal, liveBaseUrl, webBaseUrl) {
+    const worker = process.env[WEB_ADMIN_ENV.worker] || undefined;
     const declared = readCenterCredentialDeclaration();
     return {
         baseUrl,
         ...(liveBaseUrl !== undefined ? { liveBaseUrl } : {}),
         ...(webBaseUrl !== undefined ? { webBaseUrl } : {}),
         credential: createCenterCredentialSource(declared.from === "file" ? { ...declared, multiTenant: requirePrincipal } : declared, worker),
-        dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
+        dryRun: boolEnv(WEB_ADMIN_ENV.dryRun, false),
         worker,
     };
 }
@@ -2371,7 +2308,7 @@ const STORE_GROUP_KEYS = [
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "envModel", "models",
-    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atModelAllowlist", "cascadeLadder", "degrade",
+    "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atMention", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
@@ -2411,7 +2348,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "configCenter", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2473,6 +2410,10 @@ export function loadConfig() {
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
     const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
+    const centerIdentity = centerIdentityRefusal({ authBridgeIssuer: auth.authBridgeIssuer, webAdmin: integrations.webAdmin });
+    if (centerIdentity !== undefined) {
+        throw new Error(centerIdentity);
+    }
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
     const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
@@ -2510,7 +2451,7 @@ export function loadConfig() {
         throw new Error(laneRequiredRefusal);
     }
     {
-        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.configCenter) });
+        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.webAdmin) });
         if (routeGap.gap !== "none") {
             throw new Error(routeGap.reason);
         }

package/dist/execution-lane-caps.d.ts

@@ -144,7 +144,7 @@ export declare function laneRequiredEnv(lane: RemoteExecProvider): readonly stri
  *
  * 🔴 病(S-1008,test d327-g6-engine-7112 OBS-4 / OBS-5;2026-10-03 亲核):修前**两份句子**。运行期真拒启的是 `config.ts` 手写 throw
  * (点名 `REQUIRE_EXECUTION_LANE` / `REMOTE_EXEC` + 修法,用户在 stderr 读到的就是它);注册表条目另写了一句短的
- * 「the deployment asked to refuse this state」,而它只在 `config-center/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
+ * 「the deployment asked to refuse this state」,而它只在 `web-admin-client/stage-limits.ts` 的全表校验里被调 —— 候选视图只装
  * `BATCH1_LIMIT_KEYS` 的限额键,带不上这两键 ⇒ 对本条恒 `next === live`,**那一句没有任何读者**(test 六个拒启格 stderr 里零命中)。
  * 改一份另一份不跟。现形:boot 的 throw 与注册表条目的 `check` **都**调本函数 —— 一只判据、一句话,没有第二份文本可漂。
  *

package/dist/fleet/drain-entry.d.ts

@@ -21,7 +21,7 @@
  *     · `worker` / `expectedGeneration`:缺席对缺席(非 fleet 成员没有代际,不带 `expectedGeneration` 的请求是单机形,不是通配)。
  *     · `instanceId`:请求带了才比(它是引擎每进程自铸的身份,`/health` 上可读);「点名的是不是别的进程」与 run 行同一只判据
  *       `runProvenElsewhere`。
- *     引擎自己的 worker / instanceId 读不出 ⇒ 带了这一项的请求不符(认不出自己就不认任何点名;没配 `SEMA_REGISTRY_WORKER` 的引擎因此
+ *     引擎自己的 worker / instanceId 读不出 ⇒ 带了这一项的请求不符(认不出自己就不认任何点名;没配 `SEMA_WEB_ADMIN_WORKER` 的引擎因此
  *     只能用停止信号排空)。
  *  5. **进入那一拍让出在飞**:本副本可抢占的在飞腿经 core `TaskSpec.preemptSignal` 让出(在下一个干净的回合边界耐久停驻,
  *     `resource_limit` / `preempt`;不合格的腿上 core 静默不动,等到期限硬停 —— 既有 `crashed` 臂);活的审批卡按断连同路改路耐久停驻

package/dist/fleet/engine-signal.d.ts

@@ -10,7 +10,7 @@
  *     `ready ∧ ¬draining ∧ leaseState ≠ denied` —— 后两项不是新判据:`draining` 本来就是就绪原因,而租约被拒**同一拍**经
  *     唯一的排空入口进入排空(`fleet/serving-lease.ts`),所以「被拒 ⇒ 排空 ⇒ 不就绪」是构造出来的,不靠第二只谓词。
  *     `leaseState = expired` **不**进就绪(中心不可达不是本实例的病,见租约模块头注)。
- *  3. **重启**:`restart` = 已发布的重启信号;没有已发布信号而有一只**扣着**的候选(config-center 的保留候选状态机)且它确有被扣的片时,
+ *  3. **重启**:`restart` = 已发布的重启信号;没有已发布信号而有一只**扣着**的候选(web-admin 的保留候选状态机)且它确有被扣的片时,
  *     铸 `{reasons: 被扣的片, version, since, withheld: true}`(「要重启,但此刻换掉本实例会丢它手里的候选」)。已发布的信号恒胜(那几片
  *     是安全可重启的,扣着的片不阻止它们);被扣的片为空(只差发布重试)⇒ 不是重启事实,不铸(契约 `RestartSignal.reasons` 至少一词;
  *     那一形的面只有每拍一行运维 warn + 计数)。「扣着」在两出口上只有这一种读法(7.120.x 的 `/health.modelPlaneDeferred` 本版删除)。
@@ -54,7 +54,7 @@ export type ServingLeaseView = {
 export type FleetMembershipKeys = Pick<InstanceAnnouncement, "generation" | "leaseState" | "leaseUntil">;
 /** 非 fleet 成员 / 没装租约客户端时的读数(唯一拼法)。 */
 export declare const LEASE_NONE: ServingLeaseView;
-/** 扣着的候选(config-center 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
+/** 扣着的候选(web-admin 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
 export interface RetainedCandidate {
     readonly version: number;
     readonly since: number;
@@ -62,7 +62,7 @@ export interface RetainedCandidate {
 }
 /**
  * 重启事实的**唯一**合成点(规则 3):已发布信号恒胜;否则扣着的候选有被扣的片 ⇒ `withheld:true` 的信号;否则缺席。
- * `build*` = 纯数据。泛型让 config-center 交进来的窄型(`EngineRestartSignal`,`reasons` 是片闭集)原样回来。
+ * `build*` = 纯数据。泛型让 web-admin 交进来的窄型(`EngineRestartSignal`,`reasons` 是片闭集)原样回来。
  */
 export declare function buildRestartSignal<R extends RestartSignal>(published: R | undefined, retained: (RetainedCandidate & {
     readonly blocked?: readonly R["reasons"][number][];
@@ -72,8 +72,8 @@ export declare const CONFIG_HANDOFF_STATES: readonly ["missing"];
 export type ConfigHandoffState = (typeof CONFIG_HANDOFF_STATES)[number];
 /**
  * `/health.configHandoff`(只在 `/health`,不上心跳)—— 一件**事故**:**在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没在下一次起服将用的身份的桶里确认耐久落盘**
- * (config-center 的接力账 {@link ConfigHandoffLedger}:最后确认耐久的那一代 + 写进的那只身份桶,对比应用着的那一代 + 此刻的凭证身份 —— 离线起服按此刻
- * 的身份选桶;部署形门在 config-center 的取值口,读判「handoff confirmed」的同一只谓词)。凭证换了人(换了身份)而新身份的桶里没有这一代 ⇒ 在场。覆盖 LKG 发布失败(含保留候选、启动期技能债)与部分应用(某组被整拒、其余组已热应用,LKG 停在上一个完整世代)两形。**部署形**不在这里报:
+ * (web-admin 的接力账 {@link ConfigHandoffLedger}:最后确认耐久的那一代 + 写进的那只身份桶,对比应用着的那一代 + 此刻的凭证身份 —— 离线起服按此刻
+ * 的身份选桶;部署形门在 web-admin 的取值口,读判「handoff confirmed」的同一只谓词)。凭证换了人(换了身份)而新身份的桶里没有这一代 ⇒ 在场。覆盖 LKG 发布失败(含保留候选、启动期技能债)与部分应用(某组被整拒、其余组已热应用,LKG 停在上一个完整世代)两形。**部署形**不在这里报:
  * 没有耐久声明(`CONFIG_LKG_DURABLE` 不真 / LKG 关)的部署「重启靠中心重拉」是配置时声明的事实 ⇒ 恒缺席;本地腿 / 没有配置管道 ⇒ 缺席。
  * 与 `restart.withheld` 两个事实两张脸(可同在):要不要重启归 `restart`,声明了的接力缺不缺归本键。
  * `version` = 应用着的那一代;`since` = 这一代开始没有确认接力的时刻(持续缺着时不刷新,确认即清)。
@@ -83,7 +83,7 @@ export interface ConfigHandoff {
     readonly version: number;
     readonly since: number;
 }
-/** 配置接力账(config-center 持有,`/health.configHandoff` 的唯一来源):应用着的那一代、最后一次确认耐久接力的那一代与它写进的身份桶、
+/** 配置接力账(web-admin 持有,`/health.configHandoff` 的唯一来源):应用着的那一代、最后一次确认耐久接力的那一代与它写进的身份桶、
  *  下一次起服将用的身份(此刻的凭证身份 —— 离线起服选桶读的同一只)。 */
 export interface ConfigHandoffLedger {
     readonly applied?: number;
@@ -96,9 +96,9 @@ export interface ConfigHandoffLedger {
 /** 「接力缺着」的**唯一**判据(纯):应用过一代 ∧ 最后确认耐久的不是「这一代 ∧ 下一次起服将用的身份桶」。 */
 export declare function configHandoffMissing(ledger: ConfigHandoffLedger): boolean;
 /** `configHandoff` 的**唯一**合成点(纯):缺着 ⇒ `{ state: "missing", version: 应用着的那一代, since }`;否则缺席。`since` 由持账方锁存(发现缺着的那一拍)。
- *  `build*` = 纯数据;config-center 的 `configHandoffState()` 是唯一调用方。 */
+ *  `build*` = 纯数据;web-admin 的 `configHandoffState()` 是唯一调用方。 */
 export declare function buildConfigHandoff(ledger: ConfigHandoffLedger, since: number | undefined): ConfigHandoff | undefined;
-/** 世代账的一次读数(config-center 的 `configApplyState()` 交出的那一份里本模块读的五键;`/health` 扁平五键与嵌套形的两键读同一份)。 */
+/** 世代账的一次读数(web-admin 的 `configApplyState()` 交出的那一份里本模块读的五键;`/health` 扁平五键与嵌套形的两键读同一份)。 */
 export interface ConfigLedgerReading {
     readonly configTargetVersion: number;
     readonly configAppliedVersion: number;

package/dist/fleet/fleet-bus.d.ts

@@ -566,6 +566,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
         name?: string;
         toolName?: string;
         parentToolCallId?: string;
+        workflowRunId?: string;
         status?: string;
         seq?: number;
     }) => void;
@@ -576,6 +577,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
         name?: string;
         usage?: unknown;
         parentToolCallId?: string;
+        workflowRunId?: string;
         status?: string;
         seq?: number;
     }) => void;
@@ -639,13 +641,20 @@ export declare function fleetRunResiduals(result: {
  * session attribution → unscoped, back-compat visible). Names ride the same redactSecrets discipline.
  */
 export declare function fleetBackgroundChildPublisher(bus?: FleetEventBus, log?: (msg: string, fields: Record<string, unknown>) => void): (e: import("@sema-agent/core").BackgroundChildEvent) => void;
+/**
+ * 🔴 **run 的短名 —— 一只折法、一个输入**:输入 = run 行的预览(`user-authored-text.ts` 的 `buildRunObjectivePreview` 的产物,run 行上存的就是它);
+ * fleet 行的 `name`(发布时由 objective 现算同一只预览)与 `GET /v1/assistant/tasks` 的 `name`(读 run 行上存的预览)读同一只,
+ * 同一个 run 两面同名。预览是 `""`(有记录、剥完没有用户正文)⇒ `(notification turn)`;否则单行折叠、超过 48 字截断带 `…`。预览已脱敏。
+ * 入参只收「有记录」的预览:列上的 NULL(没记录)不是通告轮,由读面自己按契约缺席,不进这只折法。
+ */
+export declare function buildRunName(preview: string): string;
 /** BC-1 (clay-decided 2026-06-27): a top-level run's fleet-row `name` = a SHORT, single-line **objective preview**
  *  (the readable "what is this task" label) — NOT the full objective dumped in, and NOT duplicated into `description`.
  *  `description` is left to the publisher's LIVE-ACTIVITY update (`onEvent` tool_start → the current tool), so the row
  *  shows `name`=objective + `description`=current activity (two DISTINCT things, killing the earlier "objective shown
- *  twice" dup). Whitespace-collapsed + capped ≤48. (A subagent CHILD row's name = its agent-type — BC-2.)
- *  SECRET-SAFE: redact secret shapes (redactSecrets) BEFORE truncating — a secret in the objective must not leak in
- *  the row name. The durable objective is already redacted; the name preview was asymmetric (raw) until this. */
+ *  twice" dup). (A subagent CHILD row's name = its agent-type — BC-2.)
+ *  一只折法({@link buildRunName}),输入 = 与 run 行同一只预览(用户写的那段 → 脱敏 → 截):`GET /v1/assistant/tasks`
+ *  读 run 行上存的预览、过同一只折法 ⇒ 同一个 run 两面同名。剥完没有用户正文 ⇒ `(notification turn)`;闭集外的 XML 头当普通正文标。 */
 export declare function fleetRunLabels(objective: string | undefined): {
     name: string;
 };

package/dist/fleet/fleet-bus.js

@@ -3,6 +3,7 @@ import { DURABLE_AGENT_HANDLE_RE, deriveAgentDisplayStatus, isDelegatedAgentTerm
 import { persistedPlaneOf } from "../terminal.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function isFleetAgentTerminalNotification(n) {
     return isDelegatedAgentTerminal(n);
 }
@@ -206,6 +207,7 @@ export function fleetRunPublisher(bus, run) {
     let settledLeg = false;
     const childId = (taskId) => `${run.runId} ${taskId}`;
     const tickStatus = (st) => (st === "completed" ? "completed" : st === "failed" ? "failed" : "running");
+    const workflowRunIdField = (ev) => (ev.workflowRunId ? { workflowRunId: ev.workflowRunId } : {});
     const toolUsesOf = (usage) => {
         const t = usage?.toolUses;
         return typeof t === "number" ? t : undefined;
@@ -269,7 +271,7 @@ export function fleetRunPublisher(bus, run) {
                     childStartedAt.set(cid, Date.now());
                 if (ev.parentToolCallId)
                     childByToolCall.set(ev.parentToolCallId, cid);
-                bus.publishTask({ id: cid, sourceLane: "run-leg", ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+                bus.publishTask({ id: cid, sourceLane: "run-leg", ...(childName !== undefined ? { name: childName, agentType: childName } : {}), parentId: run.runId, scope: run.scope, ...sessionField, ...workflowRunIdField(ev), status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
             }
             else if (ev.type === "tool_start" && ev.toolName) {
                 bus.publishTask({ id: run.runId, description: ev.toolName });
@@ -290,7 +292,7 @@ export function fleetRunPublisher(bus, run) {
                 childStartedAt.set(cid, Date.now());
             if (ev.parentToolCallId)
                 childByToolCall.set(ev.parentToolCallId, cid);
-            bus.publishTask({ id: cid, sourceLane: "run-leg", ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
+            bus.publishTask({ id: cid, sourceLane: "run-leg", ...(fwdName !== undefined ? { name: fwdName, agentType: fwdName } : {}), parentId, scope: run.scope, ...sessionField, ...workflowRunIdField(ev), status: tickStatus(ev.status), tokens: sumTokens(ev.usage), ...(typeof ev.seq === "number" ? { cycleSeq: ev.seq } : {}), ...(() => { const t = toolUsesOf(ev.usage); return t !== undefined ? { toolUses: t } : {}; })(), elapsedMs: Date.now() - childStartedAt.get(cid) });
         },
         onChildTerminal(taskId, status, altId, toolUseId) {
             if (settledLeg)
@@ -612,14 +614,16 @@ export function fleetBackgroundChildPublisher(bus, log) {
         handleTerminal(e, m);
     };
 }
+const NOTIFICATION_TURN_NAME = "(notification turn)";
+const RUN_NAME_CHARS = 48;
+export function buildRunName(preview) {
+    const oneLine = preview.replace(/\s+/g, " ").trim();
+    if (oneLine === "")
+        return NOTIFICATION_TURN_NAME;
+    return oneLine.length > RUN_NAME_CHARS ? `${oneLine.slice(0, RUN_NAME_CHARS - 1)}…` : oneLine;
+}
 export function fleetRunLabels(objective) {
-    const oneLine = redactSecrets((objective ?? "").replace(/\s+/g, " ")).trim();
-    if (!oneLine)
-        return { name: "task" };
-    if (/^<[a-z][a-z0-9_-]*[\s>/]/i.test(oneLine))
-        return { name: "(notification turn)" };
-    const name = oneLine.length > 48 ? `${oneLine.slice(0, 47)}…` : oneLine;
-    return { name };
+    return { name: buildRunName(buildRunObjectivePreview(objective ?? "")) };
 }
 export function isTerminalFleetStatus(status) {
     switch (status) {

package/dist/fleet/serving-lease.d.ts

@@ -1,5 +1,5 @@
-import { type CenterCapabilities } from "@sema-agent/settings-schema/fleet";
-import { type CenterEndpoint } from "../config-center/center-request.js";
+import { type WebAdminCapabilities } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "../web-admin-client/center-request.js";
 import { type DrainEntry } from "./drain-entry.js";
 import type { ServingLeaseView } from "./engine-signal.js";
 /** 续租请求的上界(ms)—— 与 fleet 心跳同量级(不在提交热路径上)。 */
@@ -34,7 +34,7 @@ export interface ServingLeaseClientOpts {
 }
 export interface ServingLeaseClient {
     /** 一次中心能力读数(`undefined` = `undeclared`,中心没宣告 = 不支持)。每一次读数调一次;`unreadable` 不是读数,不调(`fleet-client.ts` `capabilityReadingOf`)。 */
-    noteCenterCapabilities(caps: CenterCapabilities | undefined): void;
+    noteCenterCapabilities(caps: WebAdminCapabilities | undefined): void;
     /** 此刻的租约读数(铸点与准入判读它)。 */
     view(): ServingLeaseView;
     /** 起步读黏性拒(装配层在唯一排空入口装好之后调一次)。 */

package/dist/fleet/serving-lease.js

@@ -1,7 +1,7 @@
 import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { SERVING_LEASE_TTL_DEFAULT_MS, readServingLeaseResponse } from "@sema-agent/settings-schema/fleet";
-import { centerFetch } from "../config-center/center-request.js";
+import { centerFetch } from "../web-admin-client/center-request.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { leaseDrainActionId } from "./drain-entry.js";
 export const SERVING_LEASE_FETCH_TIMEOUT_MS = 5_000;

package/dist/fleet-client.d.ts

@@ -1,6 +1,6 @@
 /**
  * Fleet worker-side wiring(announce/heartbeat + usage 批报;契约 = registry-core 0.1.48+
- * `/fleet`,center 端点 = sema-registry `/api/fleet/*`)。设计要点:
+ * `/fleet`,center 端点 = web-admin `/api/fleet/*`)。设计要点:
  *  - **可选分层(D3),两条环各自有门(S-866 ④)**:客户端在中心车道配齐时启动(`centerLaneConfigured` —— baseUrl + 声明了
  *    凭证 + worker,与租约管理器、用量累加器**同一只**谓词);**用量环**只要这三件;**公告环**(announce / 心跳 / 注销)另要
  *    配置席 `fleetAdvertiseAddress`(env `FLEET_ADVERTISE_ADDRESS`,`loadConfig` 解析一次;可达性是运维的话,不自猜:k8s pod IP /
@@ -13,13 +13,13 @@
  *  - **`engineSignal`(7.123.0)**:引擎态整只(契约 `EngineSignal`),与扁平键同一次读数;契约包 10.x 的心跳形没有它的座位(10.x 中心
  *    默认 strip 解析丢掉它、照收心跳);扁平布尔 `draining` settings-schema 12.0.0 删、本引擎 7.124.0+ 删发。
  *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
- *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
+ *    `deployment.restartState`,web-admin 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
  *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
  *  - **`modelRefusals?`(S-768)**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
  *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
  *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
  *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
- *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 config-center 的 `onSelfReportChange` 接到 `announceNow`
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`
  *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
@@ -27,9 +27,9 @@
  *    向前合并不会双计 —— 只延迟,不丢量)。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport, type CapabilityReading, type CenterCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -91,7 +91,7 @@ export interface FleetClientOpts {
     /** 编排器片 2:每一次**能力读数**交出去一次(装配层接服务租约客户端的 `noteCenterCapabilities`)。规则见 {@link capabilityReadingOf}:
      *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
      *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
-    onCenterCapabilities?: (caps: CenterCapabilities | undefined) => void;
+    onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
     usage?: FleetUsageAccumulator;
     heartbeatMs?: number;
     usageWindowMs?: number;
@@ -148,7 +148,7 @@ export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
  * deployments); an address set while only the worker is missing is warned (half-configured announce).
  */
 export declare function startFleetClientFromConfig(cfg: {
-    configCenter?: (CenterEndpoint & {
+    webAdmin?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
     fleetAdvertiseAddress?: string | undefined;

package/dist/fleet-client.js

@@ -1,7 +1,8 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
-import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -230,14 +231,14 @@ export function startFleetClient(opts) {
     return { announceNow, stopRouting, flushFinalUsage };
 }
 export function startFleetClientFromConfig(cfg, opts) {
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     const address = cfg.fleetAdvertiseAddress;
     if (!centerLaneConfigured(cfg)) {
         if (address !== undefined && cc?.baseUrl && cc.credential.declared) {
-            opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
+            opts.logger?.warn("fleet_client_no_worker_scope", { note: `FLEET_ADVERTISE_ADDRESS set but ${WEB_ADMIN_ENV.worker} missing — announce needs the worker (dispatch key); fleet client not started` });
         }
         return undefined;
     }
-    return startFleetClient({ ...opts, center: cfg.configCenter, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: cfg.webAdmin, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -1,4 +1,4 @@
-import { type CenterEndpoint } from "./config-center/center-request.js";
+import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
@@ -141,11 +141,11 @@ export declare class FleetLeaseManager {
 /**
  * Env/config gate:中心车道配齐({@link centerLaneConfigured} —— 与 fleet 用量环 / 用量累加器**同一只**谓词,S-866 ④)即启;
  * 不需要 FLEET_ADVERTISE_ADDRESS(它是出站消费面,不是入站可达性声明)。缺任一件 → undefined,非 fleet 部署零行为变化。
- * S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE`(`CENTER_CREDENTIAL_ENV.tokenFile`)在场而
+ * S-651:按**声明**装、不按内容装 —— `SEMA_WEB_ADMIN_TOKEN_FILE`(`WEB_ADMIN_ENV.tokenFile`)在场而
  * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
-    configCenter?: (CenterEndpoint & {
+    webAdmin?: (CenterEndpoint & {
         worker?: string;
     }) | undefined;
     fleetLeaseFailClosed: boolean;

package/dist/fleet-lease.js

@@ -1,6 +1,6 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "./center-credential.js";
-import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
+import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
@@ -174,7 +174,7 @@ export class FleetLeaseManager {
 export function createFleetLeaseFromEnv(cfg, opts) {
     if (!centerLaneConfigured(cfg))
         return undefined;
-    const cc = cfg.configCenter;
+    const cc = cfg.webAdmin;
     return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, failMode: cfg.fleetLeaseFailClosed ? "closed" : "open" });
 }
 //# sourceMappingURL=fleet-lease.js.map

package/dist/host-lsp-manager.d.ts

@@ -18,7 +18,7 @@
  *
  * ## 时刻
  * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
- * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
+ * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走 web-admin,不改 `process.env`),两者在本仓部署上同值。
  *
  * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
  * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的