@sema-agent/server 7.135.0 → 7.136.0

package/dist/config.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
-import { join, posix as posixPath } from "node:path";
+import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
@@ -29,7 +29,8 @@ import { NAME_TABLE_BEHAVIOR, TOOL_NAME_ROSTER, describeUnmatchableRuleName, rul
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal, operatorSingleUserRefusal, workflowParkDecisionDomainRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
-import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
+import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude, parseWorkspaceSnapshotPrefix } from "./workspace-space.js";
+import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "./object-store-buckets.js";
 import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
@@ -46,7 +47,7 @@ import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal } from "./url-refusal.js";
 import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
-import { csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
+import { anthropicCredentialRefusal, csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { echoCallerText } from "./caller-text-echo.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
@@ -863,6 +864,18 @@ function parseStoreDomain(ctx) {
         dbBackend,
         dbBackendExplicit: dbBackendSet,
         localDataRoot,
+        ...((d) => (d !== undefined ? { sealedKeyDir: d } : {}))((() => {
+            const raw = process.env.SEALED_KEY_DIR;
+            if (raw === undefined || raw === "")
+                return undefined;
+            if (!isAbsolute(raw)) {
+                throw new Error(`SEALED_KEY_DIR="${raw}" is not an absolute path — it names the model-key custody directory (the sealed-key keypairs ` +
+                    `and their checkpoint-ctx-keys/ subdirectory) that every engine sharing one config.d must point at to hold the same key, ` +
+                    `so a value resolved against each process's working directory would silently split them. Spell it absolutely, or unset it ` +
+                    `to keep the custody directory at <data root>/sealed-key.`);
+            }
+            return raw;
+        })()),
         runStoreStrictHydrate: parseRunStoreStrictHydrate(process.env.RUN_STORE_STRICT_HYDRATE),
         tidb: needsDb && dbBackend === "mysql"
             ? {
@@ -888,7 +901,7 @@ function parseStoreDomain(ctx) {
         snapshotBlobStore: process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
             ? {
                 endpoint: process.env.MINIO_ENDPOINT,
-                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? SESSION_SNAPSHOT_BUCKET_DEFAULT,
                 accessKey: process.env.MINIO_ACCESS_KEY,
                 secretKey: process.env.MINIO_SECRET_KEY,
                 ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
@@ -907,7 +920,7 @@ function parseStoreDomain(ctx) {
                     ? { publicEndpoint: (process.env.S3_PUBLIC_ENDPOINT || process.env.S3_ENDPOINT) }
                     : {}),
                 publicBucket: process.env.S3_PUBLIC_BUCKET ?? "sema-public",
-                privateBucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                privateBucket: process.env.SESSION_SNAPSHOT_BUCKET ?? SESSION_SNAPSHOT_BUCKET_DEFAULT,
                 privateKeyPrefix: "sendfile/",
                 ...(process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT ? { sandboxPutEndpoint: process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT } : {}),
                 accessKey: process.env.MINIO_ACCESS_KEY,
@@ -941,6 +954,10 @@ function parseModelDomain() {
             throw new Error(refusal);
         }
     }
+    const anthropicCredentialConflict = anthropicCredentialRefusal({ apiKey: route.anthropicApiKey, authToken: route.anthropicAuthToken });
+    if (anthropicCredentialConflict !== undefined) {
+        throw new Error(anthropicCredentialConflict);
+    }
     const provider = route.provider;
     if (route.providerSource === "inferred") {
         CONFIG_NOTICES.push({
@@ -2371,7 +2388,7 @@ function parseA2aServeSkills(raw) {
     });
 }
 const STORE_GROUP_KEYS = [
-    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "storeLockWaitMs", "dbBackend", "dbBackendExplicit", "localDataRoot",
+    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "storeLockWaitMs", "dbBackend", "dbBackendExplicit", "localDataRoot", "sealedKeyDir",
     "runStoreStrictHydrate",
     "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "fileHistory", "fileHistoryCapture", "sendUserFile",
 ];
@@ -2463,6 +2480,7 @@ function k8sWorkspaceStore() {
     if (!Number.isInteger(workspaceSnapshotTimeoutMs))
         throw new Error(`env WORKSPACE_SNAPSHOT_TIMEOUT_MS=${workspaceSnapshotTimeoutMs} must be an integer (milliseconds)`);
     const exclude = parseWorkspaceSnapshotExclude(process.env.WORKSPACE_SNAPSHOT_EXCLUDE);
+    const keyPrefix = parseWorkspaceSnapshotPrefix(process.env.WORKSPACE_SNAPSHOT_PREFIX);
     const knobs = { workspacePersist, workspaceSnapshotKeep, workspaceSnapshotTimeoutMs, ...(exclude.length > 0 ? { workspaceSnapshotExclude: exclude } : {}) };
     const endpoint = process.env.MINIO_ENDPOINT;
     const accessKey = process.env.MINIO_ACCESS_KEY;
@@ -2482,11 +2500,11 @@ function k8sWorkspaceStore() {
         ...knobs,
         s3Snapshot: {
             endpoint,
-            bucket: process.env.WORKSPACE_SNAPSHOT_BUCKET ?? "workspaces",
+            bucket: process.env.WORKSPACE_SNAPSHOT_BUCKET ?? WORKSPACE_SNAPSHOT_BUCKET_DEFAULT,
             accessKey,
             secretKey,
             ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-            ...(process.env.WORKSPACE_SNAPSHOT_PREFIX ? { keyPrefix: process.env.WORKSPACE_SNAPSHOT_PREFIX } : {}),
+            ...(keyPrefix !== undefined ? { keyPrefix } : {}),
             ...((n) => (n !== undefined ? { presignTtlSec: n } : {}))(optNumEnvStrict("WORKSPACE_SNAPSHOT_TTL_SEC")),
         },
     };

package/dist/deployment-shape.d.ts

@@ -18,7 +18,7 @@
  * ## 什么进表、什么不进
  * 进表的是**形规则**:只由部署形事实决定的布尔(去重后 14 行;同一条规则的多个消费者读同一行,不各成一行)。
  * 把一行与**非形事实**(锁键、合规档位、审批意图、请求身份、请求体)合取的能力判据是**消费者**,住在它自己的模块
- * (`a2aInjectionHonored` = 锁 ∧ 合规 ∧ `!multiTenant`;`taskHooksHonored`;身份门 …),读行、不读原始键。
+ * (`mcpInjectionHonored` = 锁 ∧ 合规 ∧ `!multiTenant`;`taskHooksHonored`;身份门 …),读行、不读原始键。
  * 车道表(`execution-lane-caps.ts`)按车道词键控的布尔列(`laneIsolated` 等)是车道轴自己的事实表,不是「部署」的谓词;行读它们。
  *
  * 依赖纪律:叶模块 —— 值导入只有 `execution-lane-caps.ts`(它本身是叶),零运行期环。

package/dist/elicitation.d.ts

@@ -20,7 +20,7 @@ export interface ElicitationFrame {
      *  coordinate instead, same posture as the stream-approval frames' `serverNowMs`. */
     serverNowMs?: number;
     /** "elicitation" only (additive; the same window pair `question` carries): the coordinator's OWN answer window —
-     *  at expiry the ask releases as `decline`. Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
+     *  at expiry the ask is released as `cancel` (nobody answered; see RELEASE_ACTION). Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
      *  a form replayed from the ledger can be judged still-waiting (no `elicitation_complete` with this id ∧
      *  `expiresAtMs` not reached) or lapsed even when the close row never landed (a lost write, a crashed replica). */
     expiresInMs?: number;
@@ -37,13 +37,13 @@ export interface ElicitationRunContext {
     abortSignal?: AbortSignal;
 }
 export interface ElicitationThrottle {
-    /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ decline. */
+    /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ refused (`decline`). */
     maxConcurrentPerRun: number;
-    /** Max total elicitations one run leg will surface to the human. Breach ⇒ decline (flood defense). */
+    /** Max total elicitations one run leg will surface to the human. Breach ⇒ refused (`decline`; flood defense). */
     maxTotalPerRun: number;
-    /** Min gap (ms) between two elicitations from the SAME server within a run. Within ⇒ decline (burst guard). */
+    /** Min gap (ms) between two elicitations from the SAME server within a run. Within ⇒ refused (`decline`; burst guard). */
     minIntervalMsPerServer: number;
-    /** An unanswered elicitation auto-declines after this (ms) — the human walked away; don't hold core forever. */
+    /** An unanswered elicitation is released as `cancel` after this (ms) — the human walked away; don't hold core forever. */
     ttlMs: number;
 }
 export declare const DEFAULT_ELICITATION_THROTTLE: ElicitationThrottle;
@@ -75,8 +75,9 @@ export declare class ElicitationCoordinator {
      *  the case where the leg ends/throws while an elicitation is parked but the leg's own loop has already drained. */
     runWithContext<T>(ctx: ElicitationRunContext, fn: () => Promise<T>): Promise<T>;
     /** `RunnerDeps.onElicit`. Core calls this when an opted-in server elicits the END USER mid-tool-call; the resolved
-     *  value is sent back to the server on the still-open connection. Fail-closed (`decline`/`cancel`) in every
-     *  uncertain case. Arrow property so it can be passed as `onElicit: coordinator.elicit` with `this` bound. */
+     *  value is sent back to the server on the still-open connection. Fail-closed (never `accept`) in every uncertain
+     *  case: a rule-based refusal is `decline`, a release nobody answered is `cancel` (RELEASE_ACTION).
+     *  Arrow property so it can be passed as `onElicit: coordinator.elicit` with `this` bound. */
     elicit: (req: McpElicitRequest, signal?: AbortSignal) => Promise<McpElicitResponse>;
     /** `POST /v1/elicitations/:id/respond` — resolve a parked elicitation with the shell's answer. Owner-gated with a
      *  404 (no existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404.

package/dist/elicitation.js

@@ -5,6 +5,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { refusalBody } from "./http/refusal-body.js";
 const MAX_ELICIT_MESSAGE_CHARS = 4096;
 const MAX_ELICIT_SCHEMA_BYTES = 8192;
+const RELEASE_ACTION = { refused: "decline", unanswered: "cancel" };
 export const DEFAULT_ELICITATION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
@@ -65,7 +66,7 @@ export class ElicitationCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle({ action: "cancel" });
+                        p.settle({ action: RELEASE_ACTION.unanswered });
                 }
                 this.counters.delete(ctx.taskId);
             }
@@ -74,18 +75,18 @@ export class ElicitationCoordinator {
     elicit = async (req, signal) => {
         const ctx = this.als.getStore();
         if (!ctx)
-            return { action: "decline" };
+            return { action: RELEASE_ACTION.refused };
         if (typeof req.url === "string" && req.url.length > 0)
-            return { action: "decline" };
+            return { action: RELEASE_ACTION.refused };
         if (signal?.aborted || ctx.abortSignal?.aborted)
-            return { action: "cancel" };
+            return { action: RELEASE_ACTION.unanswered };
         const rc = this.countersFor(ctx.taskId);
         const t = this.now();
         const last = rc.lastByServer.get(req.server);
         if (rc.inflight >= this.throttle.maxConcurrentPerRun ||
             rc.total >= this.throttle.maxTotalPerRun ||
             (last !== undefined && t - last < this.throttle.minIntervalMsPerServer)) {
-            return { action: "decline" };
+            return { action: RELEASE_ACTION.refused };
         }
         const id = uuidv7();
         rc.inflight += 1;
@@ -107,8 +108,8 @@ export class ElicitationCoordinator {
             rc.inflight = Math.max(0, rc.inflight - 1);
             resolveAnswer(r);
         };
-        const onAbort = () => settle({ action: "cancel" });
-        timer = setTimeout(() => settle({ action: "decline" }), this.throttle.ttlMs);
+        const onAbort = () => settle({ action: RELEASE_ACTION.unanswered });
+        timer = setTimeout(() => settle({ action: RELEASE_ACTION.unanswered }), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -124,7 +125,7 @@ export class ElicitationCoordinator {
         }
         else if (delivery === "failed") {
             recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
-            settle({ action: "decline" });
+            settle({ action: RELEASE_ACTION.unanswered });
         }
         const answer = await answerP;
         void emitted

package/dist/file-history-disclosure.d.ts

@@ -23,8 +23,10 @@
  *   前置到它自己的 message 前 —— **不 `instanceof` 单挑任何一个类**(身上有字符串 `code` 就折),该店
  *   的折点全部改走这一只函数。人与模型因此看得到「这是哪一类失败」。
  * · **判断面**(同一只函数的 `fault`,core 7.55.0 `FileHistoryError.permanence`):永久码表里的 typed 码 ⇒
- *   `{ permanence: "terminal" }`,其余 ⇒ `{}`(没判 —— 引擎照旧给重试引导语)。折点把它摊进店答的
- *   `FileHistoryError`;引擎的拒句引导语、rewind 披露、`terminal.detail` 都读这一格,**不读散文**。
+ *   `{ permanence: "terminal" }`;**连接类故障**(到库的连接坏了 / 库此刻不接 —— 判官是整仓唯一一只
+ *   `plugins/store-fault.ts` 的 `storeFaultClassOf`,识别表在 `plugins/sql-errors.ts`,本文件不再抄第二份)⇒
+ *   `{ permanence: "transient" }`;其余 ⇒ `{}`(没判 —— 引擎照旧给重试引导语)。`terminal` 只对永久码。
+ *   折点把它摊进店答的 `FileHistoryError`;引擎的拒句引导语、rewind 披露、`terminal.detail` 都读这一格,**不读散文**。
  * · **机器面**(同一只函数的副作用):码取自 typed 错**对象**、对闭集词表判定,**绝不从散文里抠**。
  *   🔴 这一条是 codex R1-[high] 验真后的定形:文本通道**天然可伪造** —— 一个名叫
  *   `(blob_too_large_for_sql).txt` 的文件读不出来时,它的路径就在 `snapshot_failed` 的散文里,任何
@@ -51,8 +53,8 @@ export interface CaughtFailure {
  *
  * `text` = 散文形:带 typed `code` 的前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
  * 不带的**逐字**是原 message(transient 失败的文案因此与本批之前一字不差)。
- * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;其余 ⇒ `{}`(店不知道 ——
- * 驱动 / 库的错码是不是会自己好,不归本店判)。
+ * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;连接类故障 ⇒ `{ permanence: "transient" }`
+ * (什么都不改稍后再试可能成);其余 ⇒ `{}`(店不知道 —— 认不出的驱动 / 库错是不是会自己好,不归本店判)。永久码先于连接类判(一只错不会两个都是)。
  * 副作用 = 机器形:码取自错误对象,逐次计数 + 每进程每码一条 warn。观测绝不抛。
  */
 export declare function foldCaughtFailure(err: unknown): CaughtFailure;

package/dist/file-history-disclosure.js

@@ -1,4 +1,5 @@
 import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "@sema-agent/core";
+import { storeFaultClassOf } from "./plugins/store-fault.js";
 const PERMANENT_STORE_FAILURE_CODES = {
     blob_too_large_for_sql: {
         note: "a blob is larger than this deployment's SQL snapshot-blob cap — the same file will fail every turn until the deployment changes",
@@ -32,12 +33,27 @@ function drainToMetrics() {
 export function foldCaughtFailure(err) {
     const message = err instanceof Error ? err.message : String(err);
     const code = err?.code;
-    if (typeof code !== "string" || code === "")
-        return { text: message, fault: {} };
-    const permanent = isPermanentCode(code);
-    if (permanent)
-        recordPermanent(code, message);
-    return { text: `(${code}) ${message}`, fault: permanent ? { permanence: "terminal" } : {} };
+    const typedCode = typeof code === "string" && code !== "" ? code : undefined;
+    const permanentCode = typedCode !== undefined && isPermanentCode(typedCode) ? typedCode : undefined;
+    if (permanentCode !== undefined)
+        recordPermanent(permanentCode, message);
+    return {
+        text: typedCode !== undefined ? `(${typedCode}) ${message}` : message,
+        fault: permanentCode !== undefined ? { permanence: "terminal" } : faultOfClass(storeFaultClassOf(err)),
+    };
+}
+function faultOfClass(cls) {
+    switch (cls) {
+        case "connection":
+            return { permanence: "transient" };
+        case "corrupt":
+        case "unclassified":
+            return {};
+        default: {
+            const unhandled = cls;
+            throw new Error(`store fault class without a file-history judgment: ${String(unhandled)}`);
+        }
+    }
 }
 function safely(record) {
     try {

package/dist/fleet-client.d.ts

@@ -25,11 +25,15 @@
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
  *    (worker,instanceId,windowStartMs) 重发安全;**发送失败 → merge 回累计器**,并入下一窗(失败窗从未入账,
  *    向前合并不会双计 —— 只延迟,不丢量)。
+ *  - **用量按中心凭证身份分箱([ref])**:累计器一个身份一只({@link createFleetUsageBins},分箱规则 = `createIdentityBins` 一只),
+ *    tracer 记进记账身份那一箱(执行开始时钉下的身份;执行外 = 此刻身份);用量环只报此刻身份那一箱、经钉在它身份上的凭证发 —— 文件形凭证进程内换人后,上一个人窗里的用量
+ *    不在下一个人的凭证下上报(不记到别人头上);它留在原箱,那个身份回来时照常报出去,收尾时还压着就响亮一行。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
 import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
+import { type CenterCredentialSource } from "./center-credential.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -71,6 +75,32 @@ export declare class FleetUsageAccumulator {
     mergeBack(entries: UsageReport["entries"]): void;
     get size(): number;
 }
+/** [ref] —— 一个中心凭证身份的用量箱:这个身份窗里的累计格,与钉在这个身份上的凭证(用量环只经它报这一箱)。 */
+export interface FleetUsageBin {
+    readonly usage: FleetUsageAccumulator;
+    readonly credential: CenterCredentialSource;
+}
+/**
+ * [ref] —— **按中心凭证身份分箱的用量账**(活对象 ⇒ `create*`)。tracer / side-query 记账写 {@link record}(此刻身份那一箱);
+ * 用量环读 {@link current}(此刻身份那一箱 + 钉住的凭证)。分箱规则只有 `createIdentityBins` 一只(与租约管理器、per-principal caps 同规则)。
+ */
+export interface FleetUsageBins {
+    /** 记进**记账身份**那一箱(执行里 = 执行开始时钉下的身份;执行外 = 此刻身份)。 */
+    record(principal: string | undefined, model: string, taskId: string, d: {
+        inputTokens: number;
+        outputTokens: number;
+        costMicroUsd?: number;
+        weightedTokens?: number;
+        quotaWeightAtUse?: number;
+    }): void;
+    /** 把这次执行的记账身份钉在此刻(tracer 在 `task.start` 调;规则属 `center-credential.ts` `pinAccountingIdentity`)。 */
+    pinExecution(): void;
+    /** 此刻身份那一箱(用量环上报读它)。 */
+    current(): FleetUsageBin;
+    /** **全部**箱里还压着的条目数(收尾那一行 warn 用:最后一窗之后还压着的,进程退出即丢 —— 别的身份的、身份未知的、或最后一窗没报成的,同一待遇)。 */
+    held(): number;
+}
+export declare function createFleetUsageBins(credential: CenterCredentialSource): FleetUsageBins;
 export interface FleetClientOpts {
     /** [ref]:凭证是**来源**(每条公告 / 用量 / 注销请求各取一次值),不是启动期烧进 header 的字符串。 */
     center: CenterEndpoint & {
@@ -92,7 +122,8 @@ export interface FleetClientOpts {
      *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
      *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
     onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
-    usage?: FleetUsageAccumulator;
+    /** [ref]:按凭证身份分箱的用量账(缺席 = 用量环不装)。 */
+    usage?: FleetUsageBins;
     heartbeatMs?: number;
     usageWindowMs?: number;
     logger?: {

package/dist/fleet-client.js

@@ -2,6 +2,7 @@ import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapability
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { createIdentityBins, pinAccountingIdentity } from "./center-credential.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
@@ -67,6 +68,20 @@ export class FleetUsageAccumulator {
         return this.cells.size;
     }
 }
+export function createFleetUsageBins(credential) {
+    const made = [];
+    const bins = createIdentityBins(credential, (pinned) => {
+        const bin = { usage: new FleetUsageAccumulator(), credential: pinned };
+        made.push(bin);
+        return bin;
+    });
+    return {
+        record: (principal, model, taskId, d) => bins.accounting().usage.record(principal, model, taskId, d),
+        pinExecution: () => pinAccountingIdentity(credential),
+        current: bins.now,
+        held: () => made.reduce((n, b) => n + b.usage.size, 0),
+    };
+}
 async function rejectionSnippet(res) {
     try {
         const text = (await res.text()).slice(0, 200).trim();
@@ -90,7 +105,7 @@ export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
     const usageWindowMs = opts.usageWindowMs ?? 60_000;
-    const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
+    const send = (route, method, json, center = opts.center) => centerFetch(center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
     let unreadableStreak = 0;
@@ -177,20 +192,21 @@ export function startFleetClient(opts) {
     const flushUsage = async () => {
         if (!opts.usage)
             return;
+        const bin = opts.usage.current();
         const windowEndMs = Date.now();
-        const entries = opts.usage.drain();
+        const entries = bin.usage.drain();
         const start = windowStartMs;
         windowStartMs = windowEndMs;
         if (entries.length === 0)
             return;
         const report = { worker: opts.center.worker, instanceId: opts.instanceId, windowStartMs: start, windowEndMs, entries };
         try {
-            const { res } = await send("fleet-usage", "POST", { reports: [report] });
+            const { res } = await send("fleet-usage", "POST", { reports: [report] }, { ...opts.center, credential: bin.credential });
             if (!res.ok)
                 throw new Error(`usage ${res.status}${await rejectionSnippet(res)}`);
         }
         catch (err) {
-            opts.usage.mergeBack(entries);
+            bin.usage.mergeBack(entries);
             opts.logger?.warn("fleet_usage_report_failed", { error: err instanceof Error ? err.message : String(err), entries: entries.length });
         }
     };
@@ -227,6 +243,10 @@ export function startFleetClient(opts) {
         if (uw)
             clearInterval(uw);
         await flushUsage();
+        const held = opts.usage?.held() ?? 0;
+        if (held > 0) {
+            opts.logger?.warn("fleet_usage_unreported_identity", { entries: held, note: "usage still held at exit is dropped: it accrued under another center credential identity (never reported under the current one — it would be billed to the wrong account), under an unknown identity (credential unreadable), or its final report failed" });
+        }
     };
     return { announceNow, stopRouting, flushFinalUsage };
 }

package/dist/fleet-lease.d.ts

@@ -3,7 +3,7 @@ import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
 export declare const EXHAUSTED_RETRY_MS: number;
-/** principal 状态表上界(镜像 FLEET_USAGE_KEY_CAP 的姿势):超界丢最旧 —— 被丢的 principal 下次 admit
+/** principal 状态表上界(**每个身份箱各一份**;镜像 FLEET_USAGE_KEY_CAP 的姿势):超界丢最旧 —— 被丢的 principal 下次 admit
  *  重新协商,一次多余 RTT,无正确性影响。 */
 export declare const LEASE_PRINCIPAL_CAP = 4096;
 /** 复审 O1:lease 协商 RTT 的硬上限——leaseDenied 在提交热路径同步 await 它,一个 accept-but-hang 的
@@ -87,8 +87,8 @@ export interface FleetLeaseOpts {
 }
 export declare class FleetLeaseManager {
     private readonly opts;
-    private readonly state;
-    private readonly inflight;
+    /** 记账身份的那一箱(惰建;分箱规则只有 `createIdentityBins` 一只,取箱口 `accounting`)。 */
+    private readonly binNow;
     private readonly f;
     private readonly now;
     private failStreak;
@@ -97,6 +97,8 @@ export declare class FleetLeaseManager {
     /** [ref] ③ 生效姿态(caps `centerWiring.failMode` 读的就是它 —— 与执行的那一只同源)。 */
     readonly failMode: LeaseFailMode;
     constructor(opts: FleetLeaseOpts);
+    /** [ref]:把这次执行的记账身份钉在此刻(tracer 在执行的第一帧 `task.start` 调;规则属 `center-credential.ts` `pinAccountingIdentity`)。 */
+    pinExecution(): void;
     /**
      * Admission check for one billed submission. Fast path is synchronous-shaped (live lease / fresh negative
      * cache → no await beyond the microtask); only first-touch / expiry / exhaustion pays a center RTT.
@@ -119,6 +121,7 @@ export declare class FleetLeaseManager {
     /**
      * [ref] ② —— 调用方这一刻的租约读数(caps `centerWiring.caller` / `leaseHealth` 的唯一来源;7.105.0 的 `peek()` 退役:它只回 kind、
      * 不看 `until`,过期条目照回原 kind)。**纯读**:不打中心、不写状态、不动 LRU 序(`Map.get` 不改插入序)—— caps 路由自己不 admit。
+     * 读的是**此刻凭证身份**那一箱([ref];取箱要读一次凭证,首次见到的身份惰建一只空箱 —— 空箱不是状态)。
      * 规则表(设计稿 v1.1 §2②,逐行钉在 `test/fleet-lease.test.ts`):
      *  · principal 缺席 / 无条目(含被 LRU 逐出)⇒ `unobserved`;
      *  · `not-lease` 且 `now < until` ⇒ `not-enforced`;到期 ⇒ `unobserved`;
@@ -135,6 +138,7 @@ export declare class FleetLeaseManager {
     /** [ref] ③:两条连接级失败臂的**唯一**收尾 —— 按姿态穷举(加一种姿态 = 编译红)。 */
     private connectionFailure;
     private set;
+    /** 单飞在箱内:同一身份同一 principal 的并发谈判共用一条;换了人的谈判各发各的([ref])。 */
     private issueOrRenew;
     private issueOrRenewInner;
 }

package/dist/fleet-lease.js

@@ -1,5 +1,5 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
-import { CenterCredentialUnavailableError } from "./center-credential.js";
+import { CenterCredentialUnavailableError, createIdentityBins, pinAccountingIdentity } from "./center-credential.js";
 import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
@@ -23,8 +23,7 @@ const LEASE_HEALTH_BY_OUTCOME = {
 };
 export class FleetLeaseManager {
     opts;
-    state = new Map();
-    inflight = new Map();
+    binNow;
     f;
     now;
     failStreak = 0;
@@ -35,10 +34,19 @@ export class FleetLeaseManager {
         this.f = opts.fetchImpl ?? fetch;
         this.now = opts.now ?? Date.now;
         this.failMode = opts.failMode;
+        this.binNow = createIdentityBins(opts.center.credential, (pinned) => ({
+            state: new Map(),
+            inflight: new Map(),
+            center: { ...opts.center, credential: pinned },
+        })).accounting;
+    }
+    pinExecution() {
+        pinAccountingIdentity(this.opts.center.credential);
     }
     async admit(principal) {
+        const bin = this.binNow();
         const now = this.now();
-        const st = this.state.get(principal);
+        const st = bin.state.get(principal);
         if (st?.kind === "not-lease" && now < st.until)
             return { ok: true };
         if (st?.kind === "exhausted" && now < st.until) {
@@ -46,15 +54,15 @@ export class FleetLeaseManager {
         }
         if (st?.kind === "lease" && !leaseExhausted(st.lease, now)) {
             if (shouldRenewLease(st.lease, now))
-                void this.issueOrRenew(principal).catch(() => undefined);
+                void this.issueOrRenew(bin, principal).catch(() => undefined);
             return { ok: true };
         }
-        return this.issueOrRenew(principal);
+        return this.issueOrRenew(bin, principal);
     }
     recordSpend(principal, d) {
         if (!principal)
             return;
-        const st = this.state.get(principal);
+        const st = this.binNow().state.get(principal);
         if (st?.kind !== "lease")
             return;
         st.lease.consumed.weightedTokens += d.weightedTokens ?? 0;
@@ -62,7 +70,7 @@ export class FleetLeaseManager {
     }
     snapshot(principal, now) {
         const leaseHealth = LEASE_HEALTH_BY_OUTCOME[this.lastAdmit];
-        const st = principal === undefined ? undefined : this.state.get(principal);
+        const st = principal === undefined ? undefined : this.binNow().state.get(principal);
         if (st === undefined)
             return { leaseHealth, caller: { lease: "unobserved" } };
         switch (st.kind) {
@@ -97,25 +105,25 @@ export class FleetLeaseManager {
             }
         }
     }
-    set(principal, st) {
-        if (!this.state.has(principal) && this.state.size >= LEASE_PRINCIPAL_CAP) {
-            const oldest = this.state.keys().next().value;
-            this.state.delete(oldest);
+    set(bin, principal, st) {
+        if (!bin.state.has(principal) && bin.state.size >= LEASE_PRINCIPAL_CAP) {
+            const oldest = bin.state.keys().next().value;
+            bin.state.delete(oldest);
         }
-        this.state.delete(principal);
-        this.state.set(principal, st);
+        bin.state.delete(principal);
+        bin.state.set(principal, st);
     }
-    issueOrRenew(principal) {
-        const existing = this.inflight.get(principal);
+    issueOrRenew(bin, principal) {
+        const existing = bin.inflight.get(principal);
         if (existing)
             return existing;
-        const p = this.issueOrRenewInner(principal).finally(() => this.inflight.delete(principal));
-        this.inflight.set(principal, p);
+        const p = this.issueOrRenewInner(bin, principal).finally(() => bin.inflight.delete(principal));
+        bin.inflight.set(principal, p);
         return p;
     }
-    async issueOrRenewInner(principal) {
+    async issueOrRenewInner(bin, principal) {
         try {
-            const { res } = await centerFetch(this.opts.center, { kind: "fleet-leases" }, {
+            const { res } = await centerFetch(bin.center, { kind: "fleet-leases" }, {
                 method: "POST",
                 json: { principal, worker: this.opts.center.worker },
                 timeoutMs: LEASE_FETCH_TIMEOUT_MS,
@@ -124,7 +132,7 @@ export class FleetLeaseManager {
             if (res.status === 200) {
                 const body = (await res.json());
                 const lease = QuotaLease.parse(body.lease);
-                this.set(principal, { kind: "lease", lease });
+                this.set(bin, principal, { kind: "lease", lease });
                 if (this.failStreak > 0)
                     this.opts.logger?.info?.("fleet_lease_recovered", { after: this.failStreak });
                 this.failStreak = 0;
@@ -145,11 +153,11 @@ export class FleetLeaseManager {
                         ...(body.pool !== undefined ? { pool: body.pool } : {}),
                     };
                     const hasDetail = Object.keys(detail).length > 0;
-                    this.set(principal, { kind: "exhausted", until, ...(hasDetail ? { detail } : {}) });
+                    this.set(bin, principal, { kind: "exhausted", until, ...(hasDetail ? { detail } : {}) });
                     this.opts.metrics?.inc("fleet_lease_exhausted_total");
                     return { ok: false, reason: "budget_exhausted", retryAfterSec: Math.ceil(EXHAUSTED_RETRY_MS / 1000), ...(hasDetail ? { detail } : {}) };
                 }
-                this.set(principal, { kind: "not-lease", until: this.now() + NOT_LEASE_TTL_MS });
+                this.set(bin, principal, { kind: "not-lease", until: this.now() + NOT_LEASE_TTL_MS });
                 return { ok: true };
             }
             if (res.status === 401 || res.status === 403 || res.status === 400) {

package/dist/hooks/hook-llm.js

@@ -2,6 +2,7 @@ import { admitRouteRequest, BrainError, joinRequestUrl, resolveRouteCredential,
 import { matchCatalogModel, refusedCatalogEntry, servedModelTableLeg } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
+import { anthropicLaneCredentialOf } from "../model-route-gap.js";
 import { anthropicRouteRoot, brainLaneFor, routeTableOf } from "../model-provider.js";
 import { egressRedirectRefusal } from "../egress-redirect.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
@@ -33,6 +34,16 @@ function gateRefusal(pick, e, declaredRoot) {
         error: `hook model "${pick.catalogRef}" cannot be routed (${code}) — ` + buildDisplaySafeRefusal(text, [pick.baseUrl, declaredRoot ?? ""]),
     };
 }
+function routeCredentialHeader(credential) {
+    if (credential === undefined)
+        return {};
+    switch (credential.kind) {
+        case "x-api-key":
+            return { "x-api-key": credential.value };
+        case "bearer":
+            return { authorization: `Bearer ${credential.value}` };
+    }
+}
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
     const anthropicRouteBaseUrl = () => anthropicRouteRoot(config.anthropic ?? {});
@@ -122,9 +133,10 @@ export function createHookLlm(deps) {
             let admitted;
             let declaredRoot;
             if (pick.api === "anthropic-messages") {
+                const routeCredential = anthropicLaneCredentialOf(config.anthropic ?? {});
                 const routeBase = anthropicRouteBaseUrl();
                 declaredRoot = routeBase;
-                const routed = judgeRoute(pick, perModelKey, config.anthropic?.authToken ?? config.anthropic?.apiKey, routeBase);
+                const routed = judgeRoute(pick, perModelKey, routeCredential?.value, routeBase);
                 if (!routed.ok)
                     return routed;
                 admitted = routed.admission;
@@ -132,13 +144,7 @@ export function createHookLlm(deps) {
                 headers = {
                     "content-type": "application/json",
                     "anthropic-version": config.anthropic?.version ?? "2023-06-01",
-                    ...(routed.credential.source === "per-model"
-                        ? { "x-api-key": routed.credential.apiKey ?? "" }
-                        : config.anthropic?.authToken
-                            ? { authorization: `Bearer ${config.anthropic.authToken}` }
-                            : config.anthropic?.apiKey
-                                ? { "x-api-key": config.anthropic.apiKey }
-                                : {}),
+                    ...(routed.credential.source === "per-model" ? { "x-api-key": routed.credential.apiKey ?? "" } : routeCredentialHeader(routeCredential)),
                 };
                 const want = maxOutputTokens ?? 1024;
                 const maxTokens = Math.min(config.models[pick.catalogRef]?.maxTokens ?? want, want);