@sema-agent/server 7.127.2 → 7.129.0

package/dist/boot/side-query-lane.d.ts

@@ -26,9 +26,10 @@
  *    降级成**结构性事实**(这条路上根本没有 wrapper);
  *  · `headers` 半边从此有出路(wrapper 形只注得进 `apiKey`,core 的座位 `{apiKey, headers?}` 两半都收);
  *  · 判据(`gatewayBaseUrl`)与 resolver 一样**按调用现取** —— 见下面 `createSideQueryLane` 的注。
- * `createPerModelKeyBrain` **不删**:它仍是 WebFetch 摘要面(`boot/webfetch-summarize-lane.ts`)的
- * key plane —— core 的 `WebFetchSummarizerOptions` 至今只有 `maxContentChars`,那一面没有座位可换
- * (亲验 core 5.46.0 `dist/tools/web.d.ts`)。
+ * `createPerModelKeyBrain` 当时**没删**:它还是 WebFetch 摘要面(`boot/webfetch-summarize-lane.ts`)的 key plane ——
+ * core 的 `WebFetchSummarizerOptions` 那时只有 `maxContentChars`。core 7.51.0 给摘要器补上了同一签名的座
+ * (`WebFetchSummarizerOptions.getApiKeyAndHeaders`)⇒ 包装退役,四面(任务 / side-query / 记忆整理 / WebFetch 摘要)
+ * 都经 core 的座位供给 per-model 凭据,本仓不再在任何一面包 brain。
  *
  * 🔴 **poison(声明的钥匙拿不到)上抛,绝不静默回落网关 key** —— `resolveModelApiKey` 抛
  * `ModelKeyPoisonedError` 是「这个模型配了自己的钥匙(托管密钥解不开 / S-896 起 `apiKeyEnv` 变量缺席)却拿不到」的响亮态;吞成 undefined 等于用共享
@@ -46,8 +47,9 @@
  * 是配对法的单一实现,三只一方 brain(openai / anthropic / open-responses)在 `buildRequest` 里逐次
  * 复判 —— 部署声明了 `config.baseUrl` 而 entry URL 不在那个根上、凭据又只有部署级那一份 ⇒
  * `route.credential_mismatch` 响亮拒;连部署级凭据都没有 ⇒ `route.credential_missing`。**三面同批**
- * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据、或不声明
- * `config.baseUrl`(core 的 `"unpinned"` 快速起步姿态)。⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
+ * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据(当年还有第二条:不声明
+ * `config.baseUrl`,走 core 的 `"unpinned"` 快速起步姿态 —— core 7.51.0 #1531 起该姿态退役,一份部署凭据只配一个根)。
+ * ⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
  *
  * 于是本席的 `isOffRouteBaseUrl` + `recordFailOpen("server.model-key.off-route-model-uses-gateway-key")`
  * 两件**一并撤线**:那条计数的语义是「这一次调用真把网关凭据发给了别家」,而在 5.57 上那次调用根本
@@ -97,21 +99,6 @@ export interface SideQueryLaneCtx {
 export declare function createPerModelAuthSeat(getKeyResolver: () => KeyResolver, opts?: {
     readonly upstream?: SideQuerySpec["getApiKeyAndHeaders"];
 }): PerModelAuthSeat;
-/**
- * per-model key 注入 brain wrapper —— **[ref] 后只服务 WebFetch 摘要面**
- * (`boot/webfetch-summarize-lane.ts`)。side-query 面已换到 core 的 spec 座位(见顶注「[ref] 换装」);
- * core 的 `WebFetchSummarizerOptions` 至今只有 `maxContentChars`(亲验 5.46.0 `dist/tools/web.d.ts`),
- * 那一面**没有座位可换**,只能继续在 brain 层补凭据。
- *
- * 语义(与 `createPerModelAuthSeat` 同一张表,只是注入位在 `options.apiKey`):
- *  · `options.apiKey` **已在场** ⇒ 原样透传(上游/装饰器已经定了凭据,本层不抢);
- *  · resolver 缺席 / 返回 undefined ⇒ 不注入 ⇒ 网关 key(additive 契约);
- *  · resolver 抛(sealed key 中毒)⇒ **上抛**,本次调用整体失败,一个字节都不发。
- *
- * `complete` 在场时同样包一层:core 的 `Brain.complete` 是 compaction/摘要腿的直调口(WebFetch 摘要器
- * 正是**优先**走它),漏包等于给同一个病留第二条路。
- */
-export declare function createPerModelKeyBrain(brain: Brain, getKeyResolver: () => KeyResolver): Brain;
 /**
  * 装配 side-query 执行席 = 真 `runSideQuery` + core 的 per-model auth 座,models/roles 与 Runner 同源。
  *

package/dist/boot/side-query-lane.js

@@ -8,30 +8,6 @@ export function createPerModelAuthSeat(getKeyResolver, opts = {}) {
         return resolve ? await resolve({ name: model.name }) : undefined;
     };
 }
-export function createPerModelKeyBrain(brain, getKeyResolver) {
-    const seat = createPerModelAuthSeat(getKeyResolver);
-    const keyFor = async (model, given) => {
-        if (given !== undefined)
-            return given;
-        return (await seat(model))?.apiKey;
-    };
-    const stream = async (model, context, options) => {
-        const apiKey = await keyFor(model, options?.apiKey);
-        return brain.stream(model, context, apiKey === undefined ? options : { ...options, apiKey });
-    };
-    const complete = brain.complete?.bind(brain);
-    return {
-        stream,
-        ...(complete
-            ? {
-                complete: async (model, context, options) => {
-                    const apiKey = await keyFor(model, options?.apiKey);
-                    return complete(model, context, apiKey === undefined ? options : { ...options, apiKey });
-                },
-            }
-            : {}),
-    };
-}
 export function createSideQueryLane(ctx) {
     return (spec) => runSideQuery({
         ...spec,

package/dist/boot/stage-01-config.js

@@ -14,8 +14,11 @@ import { setRunTerminalLogObserver } from "../observability/run-terminal.js";
 import { setRedactionObserver } from "../trace/redact.js";
 import { installOutboundDispatcher } from "../outbound-dispatcher.js";
 import { provisionSemaConfigDir } from "../sema-config-dir.js";
+import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "../server-secret-env.js";
 export function runStage01() {
+    declareServerWithheldEnv();
     const config = loadConfig();
+    bindOwnCredentialsConfig(config);
     const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
     if (runStaleFailure !== undefined) {
         throw new Error(runStaleFailure);

package/dist/boot/stage-06-runners.js

@@ -76,7 +76,7 @@ export function runStage06(ctx) {
             onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
             ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
-            writeJudge: createOperatorValveWriteJudge(),
+            writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),
             onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
         })
         : undefined;

package/dist/boot/stores.js

@@ -18,7 +18,7 @@ import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterS
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
-import { logOneTimeMigrations } from "../plugins/one-time-migrations.js";
+import { runAndLogOneTimeMigrations } from "../plugins/one-time-migrations.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
@@ -100,7 +100,7 @@ export async function openStores(ctx) {
             await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
     }
     if (backend)
-        logOneTimeMigrations(logger, backend.kind, await backend.runOneTimeMigrations());
+        await runAndLogOneTimeMigrations(logger, backend);
     if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
         logger.warn("rewind_snapshot_max_mb_retired", {
             note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",

package/dist/boot/web-admin.js

@@ -19,13 +19,14 @@ import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js"
 import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
-import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
+import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { buildUnreadConfigFileFields } from "../web-admin-client/read-warnings.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
+import { buildDeploymentPostureSeats } from "./runner-deps.js";
 function lkgReadNote(scope) {
     switch (scope) {
         case "whole":
@@ -133,6 +134,7 @@ export async function createWebAdminRuntime(ctx) {
             ...(config.configProvider ? { provider: config.configProvider } : {}),
             ...(cc ? { webAdmin: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker, dryRun: cc.dryRun } } : {}),
             localDir: localRoot,
+            ...(config.configLkgEnabled ? { skillBodyCacheDir: defaultSkillCacheDir(config) } : {}),
         })
         : undefined;
     const localDirField = configProvider?.kind === "local" ? { dir: configProvider.root } : {};
@@ -153,16 +155,16 @@ export async function createWebAdminRuntime(ctx) {
             });
         }
     };
-    const rejectionSource = () => {
+    const candidateSource = () => {
         if (configProvider === undefined)
-            throw new Error("config candidate judged without a config provider (no pipeline ⇒ nothing was pulled)");
-        return configProvider.kind;
+            throw new Error("config candidate handled without a config provider (no pipeline ⇒ nothing was pulled)");
+        return configProvider;
     };
     const announceCandidateRejected = (r, verdict, leg, ordinal) => {
         const domains = verdict.domains.join(",");
         if (candidateRejection?.version === r.effective.version && candidateRejection.domains.join(",") === domains)
             return;
-        noteCandidateVerdict(ordinal, candidateRejectionOf(r, verdict, rejectionSource(), Date.now()));
+        noteCandidateVerdict(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
     const selfReportListeners = [];
@@ -372,11 +374,15 @@ export async function createWebAdminRuntime(ctx) {
         }
         const lkgPath = lkgPathFor(identity);
         try {
-            if (effectiveObj.skills && config.webAdmin) {
-                await applyCenterSkills([], effectiveObj.skills, config.webAdmin, logger, undefined, defaultSkillCacheDir(config));
+            const source = candidateSource();
+            const cacheDir = source.skillBodyCacheDir;
+            if (cacheDir === undefined) {
+                logger.warn("config_lkg_save_failed", { err: "the config source declares no skill body cache", note: "LKG NOT written (skill bodies on disk are part of the handoff contract and this source keeps none) — handoff NOT confirmed" });
+                return false;
             }
+            if (effectiveObj.skills)
+                await applySkillsManifest([], effectiveObj.skills, source, logger);
             const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
-            const cacheDir = defaultSkillCacheDir(config);
             for (const m of enabledSkills) {
                 const hex = m.contentHash.replace(/^sha256:/, "").toLowerCase();
                 if (!SHA256_HEX_RE.test(hex))
@@ -626,7 +632,7 @@ export async function createWebAdminRuntime(ctx) {
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
     }
-    const readFaceBaseline = { ...(config.readFace !== undefined ? { readFace: config.readFace } : {}), readFaceSource: config.readFaceSource };
+    const readFaceBaseline = buildReadFaceBaseline(config);
     const readFaceEnvHeld = applyCenterReadFace(config, effective ?? { version: 0, updatedAt: "", models: { models: [], roles: {} } }, effective ? logger : undefined).envHeld;
     if (!modelReadyState.ready)
         logger.warn("model_roster_pending", {
@@ -643,18 +649,21 @@ export async function createWebAdminRuntime(ctx) {
         ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
     const applyLiveReadFace = (eff, swap, phase) => {
-        const before = config.readFace;
-        const beforeSource = config.readFaceSource;
-        const { faceChanged } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
-        if (!faceChanged)
+        const before = buildReadFaceBaseline(config);
+        const { changedSeats } = applyCenterReadFace(config, eff, logger, { phase: "live", baseline: readFaceBaseline });
+        if (changedSeats.length === 0)
             return;
         try {
-            swap({ readFace: config.readFace });
-            logger.info("read_face_swapped", { from: before ?? null, to: config.readFace ?? null, phase, note: "hot seat (core swapDeps) — legs that already prepared keep the face they prepared under" });
+            swap(buildReadFaceSwapCandidate(buildDeploymentPostureSeats(config), changedSeats));
+            logger.info("read_face_swapped", {
+                seats: changedSeats,
+                ...(changedSeats.includes("readFace") ? { from: before.readFace ?? null, to: config.readFace ?? null } : {}),
+                phase,
+                note: "hot seats (core swapDeps) — legs that already prepared keep the read posture they prepared under",
+            });
         }
         catch (err) {
-            config.readFace = before;
-            config.readFaceSource = beforeSource;
+            restoreReadFaceBaseline(config, before);
             throw err;
         }
     };
@@ -692,9 +701,8 @@ export async function createWebAdminRuntime(ctx) {
             return (await manualRefresh()) === "failed" ? "failed" : "triggered";
         },
         async applyCenterCapabilities(skills) {
-            if (effective?.skills && config.webAdmin) {
-                skills = await applyCenterSkills(skills, effective.skills, config.webAdmin, logger, undefined, config.configLkgEnabled ? defaultSkillCacheDir(config) : undefined);
-            }
+            if (effective?.skills)
+                skills = await applySkillsManifest(skills, effective.skills, candidateSource(), logger);
             if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
                     cacheRoot: join(config.localDataRoot ?? join(homedir(), ".ai-agent"), "plugin-cache"),
@@ -972,6 +980,9 @@ export async function createWebAdminRuntime(ctx) {
                         if (configProvider.kind === "remote")
                             lastPull = "ok";
                     }
+                    catch (err) {
+                        logger.warn("web_admin_refresh_failed", { err: String(err), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                    }
                     finally {
                         refreshInFlight = false;
                     }

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -21,13 +21,16 @@
  *
  * ## 修形 = 照 [ref] 的配方接第四面(不是新造语义)
  *
- * brain 换成 `createPerModelKeyBrain(brain, getKeyResolver)`:
- *  · 有 per-model key ⇒ 注入 `options.apiKey`,请求带模型自己的凭据;
- *  · 无 ⇒ 不注入 ⇒ 交回 core 按它自己的 key↔URL 配对法判(core 5.57.0 起:部署根声明了而 entry URL
- *    不在那个根上 ⇒ `route.credential_mismatch` 响亮拒;未声明部署根 = `"unpinned"` 快速起步姿态 ⇒
- *    照旧回落网关 key。[ref] 的具名残余与其 P-DEBT 腿已在源头清偿,见 side-query-lane.ts 顶注);
+ * 当年 core 的摘要器没有凭据座,只能在 brain 外面包一层注入 `options.apiKey`(`createPerModelKeyBrain`)。
+ * core 7.51.0 起 `WebFetchSummarizerOptions.getApiKeyAndHeaders` 是与 `TaskSpec` / `SideQuerySpec` 同一签名的座
+ * (每次摘要按摘要器的模型解一次,`{ apiKey, headers }` 两半都收)⇒ 那层包装退役:`RunnerDeps.brain` 原样交给
+ * 摘要器,座位由与 side-query / 记忆整理**同一只**座位工厂(`createPerModelAuthSeat`)填充:
+ *  · 有 per-model key ⇒ 请求带模型自己的凭据;
+ *  · 无 ⇒ 座位回 `undefined` ⇒ 交回 core 按它自己的 key↔URL 配对法判(部署根上的模型带网关 key;
+ *    entry URL 不在部署根上 ⇒ `route.credential_mismatch` 响亮拒 —— core 7.51.0 起没有「未声明部署根」的
+ *    `unpinned` 快速起步姿态了,一份部署凭据只配一个根。[ref] 的具名残余与其 P-DEBT 腿已在源头清偿,
+ *    见 side-query-lane.ts 顶注);
  *  · 毒丸 ⇒ **上抛**,一个字节都不发(CLAUDE.md [ref] 安全轴 fail-closed)。
- * wrapper 只包本席这一只引用,`RunnerDeps.brain` 零扰动(与 side-query 席同形)。
  *
  * ## 为什么住在 `boot/` 而不是继续躺在 `main()` 的闭包里
  *
@@ -49,7 +52,7 @@ import { type KeyResolver } from "./side-query-lane.js";
 /** WebFetch 摘要执行席(= `ScenarioDeps.webFetchSummarize`,core 的 `WebFetchConfig.summarize` 逐字同形)。 */
 export type WebFetchSummarizeLane = NonNullable<NonNullable<WebFetchConfig["summarize"]>>;
 export interface WebFetchSummarizeLaneCtx {
-    /** 与 `RunnerDeps.brain` **同一只**实例(wrapper 在外面包,不改这只)。 */
+    /** 与 `RunnerDeps.brain` **同一只**实例,原样交给摘要器(凭据走摘要器的座位,不包 brain)。 */
     brain: Brain;
     /** 活配置引用:目录/角色表被 web-admin 就地热应用(`mutateInPlace`),按调用取值才跟得上。 */
     config: ServiceConfig;

package/dist/boot/webfetch-summarize-lane.js

@@ -1,7 +1,6 @@
 import { createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
-import { createPerModelKeyBrain } from "./side-query-lane.js";
+import { createPerModelAuthSeat } from "./side-query-lane.js";
 export function createWebFetchSummarizeLane(ctx) {
-    const brain = createPerModelKeyBrain(ctx.brain, ctx.getKeyResolver);
     return async (content, prompt, signal) => {
         const model = (() => {
             try {
@@ -14,7 +13,7 @@ export function createWebFetchSummarizeLane(ctx) {
         })();
         if (!model)
             throw new Error("summarize model unresolved for this deployment");
-        return createWebFetchSummarizer(brain, model)(content, prompt, signal);
+        return createWebFetchSummarizer(ctx.brain, model, { getApiKeyAndHeaders: createPerModelAuthSeat(ctx.getKeyResolver) })(content, prompt, signal);
     };
 }
 //# sourceMappingURL=webfetch-summarize-lane.js.map

package/dist/brain.js

@@ -54,11 +54,10 @@ export function createBrainAssembly(config, deps = {}) {
             : {};
     const routes = deploymentGatewayRoots(config);
     const openaiBrains = routes.map((baseUrl, i) => {
+        const gatewayKey = deploymentGatewayKey(config);
         const brain = constructRouteBrain(i === 0 ? "gateway route" : `gateway fallback route[${i - 1}]`, [baseUrl], () => createOpenAIBrain({
             baseUrl,
-            get apiKey() {
-                return deploymentGatewayKey(config);
-            },
+            ...(gatewayKey !== undefined ? { apiKey: gatewayKey } : {}),
             ...retryCap,
             fetchImpl,
             ...timeouts,
@@ -106,16 +105,14 @@ export function createBrainAssembly(config, deps = {}) {
             const ownSealed = credential.sealed !== undefined ? { [fallbackModel.name]: credential.sealed } : {};
             const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, ownEnvRef, process.env, ownSealed);
             const anthropicLaneHop = dispatchBrainLane(fallbackModel.provider, anthropicBrain !== undefined) === "anthropic";
+            const fbDeclaredRoot = degradeDeclaredRoot(fallbackModel.baseUrl, config);
+            const fbDeploymentKey = deploymentGatewayKey(config);
             const fallback = anthropicLaneHop && anthropicBrain
                 ?
                     anthropicBrain
                 : constructRouteBrain(`degrade target "${degradeTo}"`, [fallbackModel.baseUrl, config.gatewayBaseUrl], () => createOpenAIBrain({
-                    get baseUrl() {
-                        return degradeDeclaredRoot(fallbackModel.baseUrl, config);
-                    },
-                    get apiKey() {
-                        return deploymentGatewayKey(config) || undefined;
-                    },
+                    ...(fbDeclaredRoot !== undefined ? { baseUrl: fbDeclaredRoot } : {}),
+                    ...(fbDeploymentKey ? { apiKey: fbDeploymentKey } : {}),
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
                     ...timeouts,

package/dist/capabilities/builtin-tools.d.ts

@@ -27,8 +27,8 @@ export interface SubagentExtraToolOptions {
  *
  * core 7.46.0 #1432 —— **工厂与名册一个来源**:返回委派工具的两键,`extraTools`(每次 spawn 交出 `forSpawn` 选中的那几只)与
  * `extraToolNames`(全部可能交出的那几只的名字 / 别名 / 内容来源,从同一批 `ToolSpec` 读出)。名册在场 ⇒ 引擎重新能列出子代的工具池:
- * 定义级 / 工具级 / `TaskSpec.agents` 清单里没有任何工具答应的名字(core 7.49.0 #1623 起含无人挂的名;退役拼法与大小写孪生 7.46.0 起)开跑前拒
- * (`config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
+ * 定义级 / 工具级 / `TaskSpec.agents` 清单里没有任何工具答应的名字由引擎按名册判(core 7.51.0 #1736 起不拒 run:条目原样保留、告知一次并带该写的拼法;
+ * 7.46.0–7.50.x 曾开跑前拒 `config.agent.unknown_tool`),记忆内容来源读者按声明读这几只。
  * 修前(core 7.32.0–7.45.x)工厂恒在场 ⇒ 池不可静态知 ⇒ 那一族拼法只告不拒、委派结果一律按「外部」读。
  * 工厂**不抛**:各组的 `tools` 是装配期就建好的对象;部署 `forSpawn` 的抛由 core 收成「这一 spawn 什么都不继承 + 模型面披露句」(onExtraToolsError 记 warn)。
  * 一种拼法出现在两只工具上(部署工具与 `Now` 撞名 / 别名撞)⇒ core 在建委派工具处抛 `config.extra_tool_names`(`shape`),不静默取其一。

package/dist/capabilities/engine-capabilities.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 引擎能力词 → `GET /v1/capabilities` 顶层布尔键(core 7.51.1 `ENGINE_CAPABILITIES`;[ref]:词由引擎定,投影形由本仓定)。
+ *
+ * 形:引擎的能力词**原样**作顶层键(`"inherit_env.own_credentials_withheld": true`),值 = 该词在**本进程**为真的事实。键集由 `ENGINE_CAPABILITIES`
+ * 机器派生(一只投影循环,不逐词写键);事实表 {@link ENGINE_CAPABILITY_FACTS} 是 `Record<EngineCapability, …>` 型 —— 引擎加词而本表没跟 = tsc 红,
+ * 本表多一个引擎没有的词 = tsc 红(闭集的双向门),所以「这台引擎说它能,本服务也真接上了」不靠人记得登记。
+ * 壳按词闸(cli 读顶层布尔 `true`),不按版本号猜;契约附录 B.1 与 `test/capabilities-doc-appendix.test.ts` 把这些键与引擎词集对拍。
+ */
+import { type EngineCapability } from "@sema-agent/core";
+/** 投影:引擎词集的每一词 → 本进程的事实(键集恒 = `ENGINE_CAPABILITIES`)。 */
+export declare function engineCapabilityBits(): {
+    readonly [W in EngineCapability]: boolean;
+};
+//# sourceMappingURL=engine-capabilities.d.ts.map

package/dist/capabilities/engine-capabilities.js

@@ -0,0 +1,12 @@
+import { ENGINE_CAPABILITIES } from "@sema-agent/core";
+import { ownCredentialsWithheld } from "../server-secret-env.js";
+const ENGINE_CAPABILITY_FACTS = {
+    "inherit_env.own_credentials_withheld": ownCredentialsWithheld,
+};
+export function engineCapabilityBits() {
+    const out = {};
+    for (const word of ENGINE_CAPABILITIES)
+        out[word] = ENGINE_CAPABILITY_FACTS[word]();
+    return out;
+}
+//# sourceMappingURL=engine-capabilities.js.map

package/dist/capabilities/mcp-probe.js

@@ -4,7 +4,8 @@ import { createFixedWindowRateLimiter } from "../device-enrollment.js";
 import { canonicalJson } from "../canonical-json.js";
 import { echoKeyName, keyClosureClause, scanKeyClosure } from "../request-key-closure.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
-import { HTTP_MCP_TRANSPORT_KEYS, MAX_REQUEST_MCP_SERVERS, MCP_ENTRY_EMPTY_ARRAY_KEYS, MCP_ENTRY_EMPTY_RECORD_KEYS, MCP_SERVER_ENTRY_KEYS, MCP_TRANSPORT_EMPTY_ARRAY_KEYS, MCP_TRANSPORT_EMPTY_RECORD_KEYS, STDIO_MCP_TRANSPORT_KEYS, validateRequestMcp, } from "../task-mcp.js";
+import { HTTP_MCP_TRANSPORT_KEYS, MAX_REQUEST_MCP_SERVERS, MCP_ENTRY_EMPTY_ARRAY_KEYS, MCP_ENTRY_EMPTY_RECORD_KEYS, MCP_SERVER_ENTRY_KEYS, MCP_TRANSPORT_EMPTY_ARRAY_KEYS, MCP_TRANSPORT_EMPTY_RECORD_KEYS, STDIO_MCP_TRANSPORT_KEYS, requestEntryIdentityRefusal, validateRequestMcp, } from "../task-mcp.js";
+import { toCoreMcpServerSpec } from "../mcp-assertion-header.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { projectWiringManifestMcpRows } from "../trace/project.js";
 export const MCP_PROBE_REFUSAL_CODES = [
@@ -51,8 +52,12 @@ function entryKeyIssue(entry, at) {
         if (keys !== undefined)
             scanKeyClosure(t, `${at}.transport.`, new Set(keys), NO_TOLERATED_KEYS, buckets);
     }
-    if (buckets.unknown.length === 0)
-        return null;
+    if (buckets.unknown.length === 0) {
+        const refusal = requestEntryIdentityRefusal(entry);
+        if (refusal === undefined)
+            return null;
+        return refusal.errorCode === "request.body_shape" ? shapeRefusal(refusal.message) : fieldRefusal(refusal.message);
+    }
     buckets.unknown.sort();
     return shapeRefusal(`body: unrecognized key(s) on an MCP declaration — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
         `${keyClosureClause(buckets.unknown, "unknown (not an mcpServers[] key — check the spelling)")}. ` +
@@ -71,7 +76,8 @@ function entryValueIssue(entry, at) {
     if (read.badContentOrigin.length > 0) {
         return fieldRefusal(`${at}.contentOrigin must be one of ${CONTENT_ORIGIN_WORDS.map((w) => `"${w}"`).join(" | ")} — got ${describeBadContentOrigin(entry.contentOrigin)} (omit the key for the default: this server's tools classify as external content)`);
     }
-    return declarationDowngradeIssue(entry, read.ok[0], at);
+    const read0 = read.ok[0];
+    return declarationDowngradeIssue(entry, read0 === undefined ? undefined : toCoreMcpServerSpec(read0), at);
 }
 function declarationDowngradeIssue(entry, spec, at) {
     if (spec === undefined)
@@ -171,7 +177,7 @@ export function readMcpProbeBody(raw) {
                 " so nothing in your body needs changing — if you see it, this deployment has a bug worth reporting"),
         };
     }
-    return { ok: true, specs: validated.ok };
+    return { ok: true, specs: validated.ok.map(toCoreMcpServerSpec) };
 }
 export function buildMcpProbeIdentity(principal) {
     return principal !== undefined && principal.length > 0 ? principal : "local";

package/dist/capability-facts.d.ts

@@ -328,5 +328,7 @@ export declare function workspaceCache(c: Pick<ServiceConfig, "remoteExec">): Fa
 }>;
 /** 自唤醒调度器挂在宿主 env 上:`SCHEDULER_ENABLED` ∧ 单用户 ∧ host 车道。装配(`boot/execution-env.ts`)与能力位同调。 */
 export declare function hostScheduler(c: Pick<ServiceConfig, "schedulerEnabled" | "requirePrincipal" | "remoteExec">): Fact<"scheduler_disabled" | "multi_tenant_deployment" | "not_host_lane">;
-export {};
+/** 引擎能力词的事实(core `ENGINE_CAPABILITIES` 每词一只谓词,值 = 本进程的事实;`/v1/capabilities` 以顶层布尔键展开它们)—— 住在
+ *  `capabilities/engine-capabilities.ts`,这里只是把它纳入「能力位只投影事实」的同一张读面,静态门认 `facts.engineCapabilityBits()` 这一只展开。 */
+export { engineCapabilityBits } from "./capabilities/engine-capabilities.js";
 //# sourceMappingURL=capability-facts.d.ts.map

package/dist/capability-facts.js

@@ -378,4 +378,5 @@ export function hostScheduler(c) {
         return no("not_host_lane");
     return YES;
 }
+export { engineCapabilityBits } from "./capabilities/engine-capabilities.js";
 //# sourceMappingURL=capability-facts.js.map

package/dist/config-catalog.js

@@ -432,7 +432,7 @@ export const CONFIG_CATALOG = [
     r("SESSION_SNAPSHOT_PREFIX", "store", "string", "快照 blob key 前缀", { derivedDefaultNote: "缺席 ⇒ blobs/(MinioBlobBackend 默认)" }),
     r("SESSION_SNAPSHOT_TTL_SEC", "store", "number", "快照 presign TTL(秒;坏值省略走默认,绝不 NaN 签名)", { derivedDefaultNote: "缺席 ⇒ 3600(MinioBlobBackend 默认)" }),
     r("SIGHUP_IDLE_GRACE_MS", "limitsHttp", "number", "SIGHUP 空闲关停窗(ms;共享引擎形防误杀)", { staticDefault: "120000", configKey: "sighupIdleGraceMs" }),
-    r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
+    r("SKILLS_DIR", "integrations", "path", "出厂 skill 目录(设了就整个替换包内 skills/,不叠加;配置源的技能再按名盖上)", { derivedDefaultNote: "缺席 ⇒ 包内 skills/(相对模块解析,不是 cwd)", configKey: "skillsDir" }),
     r("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", "store", "boolean", "云形缺 MinIO 时显式接受 SQL 店放快照字节(严格 'true';安全姿势开关不收宽松真值)", { staticDefault: "false", danger: DATA, configKey: "snapshotBlobAllowSql" }),
     r("SNAPSHOT_BLOB_SQL_MAX_BYTES", "store", "number", "SQL 店单 blob 帽(字节)", { derivedDefaultNote: "缺席:mysql 引擎 ⇒ 内建默认帽;pg ⇒ 不设", configKey: "snapshotBlobSqlMaxBytes" }),
     r("SSH_HOST", "orchestration", "string", "ssh 车道目标主机(必需件)"),

package/dist/config-provider.d.ts

@@ -78,8 +78,9 @@ export declare function raceBootFetch<T>(fetch: Promise<T>, budgetMs: number): P
 /**
  * The two transport calls the service makes to obtain config, behind a backend-selectable seam. Both
  * signatures and return shapes match `facade.fetchEffective` / `facade.fetchSkillContent`
- * EXACTLY so that, ONCE WIRED, the caller (main.ts) could swap remote↔local without touching applyEffective
- * et al. (main.ts does not swap on this seam yet — see the NOT-YET-WIRED note at the top of this module).
+ * EXACTLY, so every consumer (boot / refresh / late boot in `boot/web-admin.ts`, and `run-local`) runs one code
+ * path whichever backend answers: candidates through `fetchEffective`, skill bodies through `fetchSkillContent`
+ * (the skills read port `applySkillsManifest`), the body cache wherever the backend declares it.
  */
 export interface ConfigProvider {
     /** "remote" = web-admin HTTP; "local" = on-disk FileConfigStore. */
@@ -92,11 +93,18 @@ export interface ConfigProvider {
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;
     /**
      * Fetch one skill body by content hash (`sha256:<hex>`). Remote: GET the content endpoint + verify the
-     * hash. Local: content-addressed lookup over the local skills domain. Returns `undefined` when the hash
+     * hash. Local: content-addressed lookup over the skills of the candidate this provider last served (the
+     * same read that produced the manifest — S-1556). Returns `undefined` when the hash
      * is unknown (remote 404 / local miss) so the caller keeps its baseline; throws only on a hard error
      * (remote non-404 HTTP / hash mismatch).
      */
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
+    /**
+     * S-1556:这只配置源给技能正文留的**盘缓存目录**(content-addressed;`applySkillsManifest` 的读序 内存 → 盘 → 本配置源,读到即回写)。
+     * 远程:开着 LKG(`CONFIG_LKG_ENABLED`)时 = 配置根下的 `skill-cache` —— 中心不可达时的 LKG 起服不卡在正文拉取上,LKG 落盘的正文完整性门
+     * 也验这同一个目录;关着 = 缺席(不落盘)。本地:恒缺席 —— 正文就内联在本机盘上的 config.d 里,再拷一份是第二份真源。
+     */
+    readonly skillBodyCacheDir: string | undefined;
 }
 /** The config-provider knobs read off ServiceConfig (a structural subset — avoids importing the whole
  *  ServiceConfig type and keeps this module testable with a plain object). */
@@ -117,6 +125,8 @@ export interface ConfigProviderInput {
      *  `process.cwd()`,而工厂只在 `CONFIG_PROVIDER === "local"` 字面上递它 ⇒ 另一条走到 local 的路上配置源读 cwd、
      *  合成步读 localRoot,两个根分家。一个远程源也收它:`remote` 而无中心 URL 的形照样落回 local。 */
     localDir: string;
+    /** S-1556:远程配置源的技能正文盘缓存目录(见 {@link ConfigProvider.skillBodyCacheDir});本地配置源不认它(正文本就在盘上)。缺席 = 不落盘。 */
+    skillBodyCacheDir?: string;
 }
 /**
  * RemoteConfigProvider — DELEGATES to the exported web-admin HTTP functions. No HTTP is reimplemented;
@@ -127,13 +137,14 @@ export interface ConfigProviderInput {
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
     private readonly deps;
+    readonly skillBodyCacheDir: string | undefined;
     readonly kind: "remote";
     constructor(cc: CenterEndpoint & {
         worker?: string;
     }, deps?: {
         fetchEffective?: typeof remoteFetchEffective;
         fetchSkillContent?: typeof remoteFetchSkillContent;
-    });
+    }, skillBodyCacheDir?: string | undefined);
     fetchEffective(etag: string | undefined): Promise<FetchEffectiveResult>;
     fetchSkillContent(contentHash: string): Promise<string | undefined>;
 }
@@ -146,6 +157,8 @@ export declare class RemoteConfigProvider implements ConfigProvider {
 export declare class LocalConfigProvider implements ConfigProvider {
     #private;
     readonly kind: "local";
+    /** 本地配置源不留正文盘缓存:正文就内联在 config.d 里(同一块盘),缓存它是第二份真源。 */
+    readonly skillBodyCacheDir: undefined;
     private readonly store;
     /** [ref]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
      *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */

package/dist/config-provider.js

@@ -38,10 +38,12 @@ export function raceBootFetch(fetch, budgetMs) {
 export class RemoteConfigProvider {
     cc;
     deps;
+    skillBodyCacheDir;
     kind = "remote";
-    constructor(cc, deps = {}) {
+    constructor(cc, deps = {}, skillBodyCacheDir = undefined) {
         this.cc = cc;
         this.deps = deps;
+        this.skillBodyCacheDir = skillBodyCacheDir;
     }
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
@@ -68,6 +70,8 @@ export class RemoteConfigProvider {
 }
 export class LocalConfigProvider {
     kind = "local";
+    skillBodyCacheDir = undefined;
+    #servedSkills = { skills: [] };
     store;
     root;
     #injectedStore;
@@ -115,6 +119,7 @@ export class LocalConfigProvider {
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
+        this.#servedSkills = eff.skills;
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
             etag: tag,
@@ -126,10 +131,7 @@ export class LocalConfigProvider {
         };
     }
     async fetchSkillContent(contentHash) {
-        const skills = await this.store.getDomain("skills");
-        if (!skills)
-            return undefined;
-        return findSkillContent(skills, contentHash);
+        return findSkillContent(this.#servedSkills, contentHash);
     }
 }
 export function mapToServiceEffective(eff, version) {
@@ -234,7 +236,7 @@ export function mapToServiceEffective(eff, version) {
 }
 export function createConfigProvider(input) {
     return configProviderKind(input) === "remote" && input.webAdmin !== undefined
-        ? new RemoteConfigProvider(input.webAdmin)
+        ? new RemoteConfigProvider(input.webAdmin, {}, input.skillBodyCacheDir)
         : new LocalConfigProvider(input.localDir);
 }
 export function configLocalRoot(config) {

package/dist/config-types.d.ts

@@ -274,10 +274,10 @@ export interface ScopedMcpServer {
     spec: McpServerSpec;
 }
 /** The deployment's MCP declaration, resolved (`resolveMcpServers`). `servers` = what actually MOUNTED (env-NAME refs
- *  resolved, `enabled:false` / missing-ref / malformed-`toolFaces` entries skipped, each with its own loud warn);
+ *  resolved, `enabled:false` / missing-ref / malformed-`toolFaces` / malformed-`toolAxes` entries skipped, each with its own loud warn);
  *  `reservedNames` = EVERY name the deployment declared, mounted or not. A name the deployment declared is CLOSED to
  *  request-side injection (`resolveRequestMcp`) whether or not it mounted — otherwise "skipped" would silently mean
- *  "free for the caller to refill without the operator's `toolFaces` / `allowTools`" (车CF codex r2 [high]). */
+ *  "free for the caller to refill without the operator's `toolFaces` / `toolAxes` / `allowTools`" (车CF codex r2 [high]). */
 export interface CenterMcp {
     servers: ScopedMcpServer[];
     reservedNames: readonly string[];
@@ -471,8 +471,9 @@ export interface ServiceConfigFlat {
      *  由 boot(config.ts)与热路径(apply-effective)同一只判据保证。 */
     gatewayBaseUrl?: string;
     /** `MODEL_API_KEY` —— **网关的**凭据,只与网关根配对([ref])。S-623:与 `gatewayBaseUrl` 同进同出 ——
-     *  没有网关就不装载(否则 brain 的声明根为空 ⇒ core 判 `unpinned` ⇒ 这把 key 会被送到每条自带 baseUrl 的
-     *  openai 条目),由 `model_gateway_key_unpaired` 启动通知说出来。 */
+     *  没有网关就不装载(否则 brain 的声明根为空:core 7.51.0 起判 `route.credential_mismatch`,每条自带 baseUrl、没有
+     *  per-model 凭据的 openai 条目被拒;7.51.0 前是 `unpinned`,key 随请求发往那些条目),由 `model_gateway_key_unpaired`
+     *  启动通知说出来。S-1561:brain 在构造时读它一次(core 收据律),本仓没有运行期写者 ⇒ 换值 = 重启。 */
     gatewayApiKey?: string;
     /** Secondary openai-compatible gateways for cross-gateway FAILOVER (same protocol + same model id).
      *  Tried in order after the primary when a gateway fails before streaming any content. */
@@ -1759,7 +1760,7 @@ export interface ServiceConfigFlat {
      *  its own meaning (the sandbox lane's opt-in above) and is unaffected. */
     lspHostEnabled: boolean;
     /** S-699 —— host-lane language-server env **named allowlist** (`LSP_ENV_ALLOW=NAME,NAME`). The language server's env is
-     *  `scrubServerSecrets(process.env)`; each name here is put back **verbatim** from the service's own env on top of that
+     *  the engine's `inheritedHostEnv("scrub")` (shape rules + this deployment's declared own credentials); each name here is put back **verbatim** from the service's own env on top of that
      *  (`allowlistedEnv`, the same "named keys pass" predicate as the host shell's `inheritEnv:[names]`) — the deployer
      *  explicitly accepts handing that value to code the language server runs. Unnamed secret-shaped keys stay stripped.
      *  `[]` = nothing put back (the default: unset / empty string). A malformed list (empty segment / not an env-var name /

package/dist/egress-redirect.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 本服务**自己**发往配置端点的出站请求(hook 直连模型腿 `hooks/hook-llm.ts`、记忆 embedder `plugins/memory-embedder.ts`)的
+ * 重定向律 —— 与 core 7.51.0(#1531)一方 brain 的请求同一条:请求以 `redirect: "manual"` 发出,端点回重定向 ⇒ 拒;
+ * 不跟、不重试、拒句不点名目标。
+ *
+ * 为什么:请求只去被判过的那个根。传输层(undici)跟随 POST 307 / 308 时把请求体(用户内容 / 记忆正文)原样送到
+ * `Location`,跨 origin 只剥 `authorization` —— anthropic 形的 `x-api-key` 随行(`test/hook-llm.test.ts` 的 G1 格在
+ * 7.128.x 上实测送达重定向目标)。判据与拒句与 core 的 brain 请求门同形(`opaqueredirect` 或 3xx)。
+ */
+/** 端点回的是重定向 ⇒ 拒句(调用方在前面冠上自己的面名);否则 `undefined`。命中时丢弃响应体(不读、不留连接)。 */
+export declare function egressRedirectRefusal(res: Response, fix: string): string | undefined;
+//# sourceMappingURL=egress-redirect.d.ts.map