@sema-agent/server 7.135.0 → 7.137.0

package/dist/config.js

@@ -1,9 +1,9 @@
 import { readFileSync } from "node:fs";
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
-import { join, posix as posixPath } from "node:path";
+import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -29,7 +29,8 @@ import { NAME_TABLE_BEHAVIOR, TOOL_NAME_ROSTER, describeUnmatchableRuleName, rul
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal, operatorSingleUserRefusal, workflowParkDecisionDomainRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
-import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
+import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude, parseWorkspaceSnapshotPrefix } from "./workspace-space.js";
+import { SESSION_SNAPSHOT_BUCKET_DEFAULT, WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "./object-store-buckets.js";
 import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
@@ -44,9 +45,9 @@ import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
-import { buildHttpUrlRefusal } from "./url-refusal.js";
+import { buildHttpUrlRefusal, buildRefusalShownUrl } from "./url-refusal.js";
 import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
-import { csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
+import { anthropicCredentialRefusal, csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { echoCallerText } from "./caller-text-echo.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
@@ -371,6 +372,30 @@ function parseDeviceEnrollTokenTtlEnv() {
     }
     return Number(raw);
 }
+function credentialLawRewriteOf(href) {
+    const scanned = redactSecrets(href);
+    return scanned === href ? undefined : scanned;
+}
+function parseDeviceRelayUrlEnv() {
+    const raw = process.env.DEVICE_RELAY_URL;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const scheme = /^wss?:\/\//i.exec(raw)?.[0];
+    const asHttp = scheme === undefined ? undefined : `${scheme.length === "wss://".length ? "https" : "http"}://${raw.slice(scheme.length)}`;
+    const flaws = asHttp === undefined ? ["not-ws-url"] : httpUrlFlaws(asHttp, ["userinfo", "query", "fragment"]).map((f) => (f === "not-http-url" ? "not-ws-url" : f));
+    if (flaws.length > 0) {
+        throw new Error(`env DEVICE_RELAY_URL must be an absolute ws:// or wss:// URL with no userinfo, query or fragment (ws(s)://host[:port][/path]) — found: ${flaws.join(", ")}; got ${JSON.stringify(buildRefusalShownUrl(raw))}. ` +
+            `It is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl) as the address devices dial, so it has no room for credentials (devices authenticate by signature). ` +
+            `Leave it unset when devices reach this engine at its own address — they then dial it at deviceExecutor.wsPath.`);
+    }
+    const href = new URL(raw).href;
+    const credentialScan = credentialLawRewriteOf(href);
+    if (credentialScan !== undefined) {
+        throw new Error(`env DEVICE_RELAY_URL carries something the credential-redaction law recognizes (${credentialScan}) — it is published verbatim on GET /v1/capabilities (deviceExecutor.relayUrl), ` +
+            `so it must not carry a token-shaped path segment; keep it to ws(s)://host[:port][/path] (devices authenticate by signature, not by the URL).`);
+    }
+    return raw;
+}
 function parseDevicePreAuthPerRemoteEnv() {
     const raw = process.env.DEVICE_MAX_PREAUTH_PER_REMOTE;
     if (raw === undefined || raw === "")
@@ -863,6 +888,18 @@ function parseStoreDomain(ctx) {
         dbBackend,
         dbBackendExplicit: dbBackendSet,
         localDataRoot,
+        ...((d) => (d !== undefined ? { sealedKeyDir: d } : {}))((() => {
+            const raw = process.env.SEALED_KEY_DIR;
+            if (raw === undefined || raw === "")
+                return undefined;
+            if (!isAbsolute(raw)) {
+                throw new Error(`SEALED_KEY_DIR="${raw}" is not an absolute path — it names the model-key custody directory (the sealed-key keypairs ` +
+                    `and their checkpoint-ctx-keys/ subdirectory) that every engine sharing one config.d must point at to hold the same key, ` +
+                    `so a value resolved against each process's working directory would silently split them. Spell it absolutely, or unset it ` +
+                    `to keep the custody directory at <data root>/sealed-key.`);
+            }
+            return raw;
+        })()),
         runStoreStrictHydrate: parseRunStoreStrictHydrate(process.env.RUN_STORE_STRICT_HYDRATE),
         tidb: needsDb && dbBackend === "mysql"
             ? {
@@ -888,7 +925,7 @@ function parseStoreDomain(ctx) {
         snapshotBlobStore: process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
             ? {
                 endpoint: process.env.MINIO_ENDPOINT,
-                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? SESSION_SNAPSHOT_BUCKET_DEFAULT,
                 accessKey: process.env.MINIO_ACCESS_KEY,
                 secretKey: process.env.MINIO_SECRET_KEY,
                 ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
@@ -907,7 +944,7 @@ function parseStoreDomain(ctx) {
                     ? { publicEndpoint: (process.env.S3_PUBLIC_ENDPOINT || process.env.S3_ENDPOINT) }
                     : {}),
                 publicBucket: process.env.S3_PUBLIC_BUCKET ?? "sema-public",
-                privateBucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                privateBucket: process.env.SESSION_SNAPSHOT_BUCKET ?? SESSION_SNAPSHOT_BUCKET_DEFAULT,
                 privateKeyPrefix: "sendfile/",
                 ...(process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT ? { sandboxPutEndpoint: process.env.SEND_USER_FILE_SANDBOX_PUT_ENDPOINT } : {}),
                 accessKey: process.env.MINIO_ACCESS_KEY,
@@ -941,6 +978,10 @@ function parseModelDomain() {
             throw new Error(refusal);
         }
     }
+    const anthropicCredentialConflict = anthropicCredentialRefusal({ apiKey: route.anthropicApiKey, authToken: route.anthropicAuthToken });
+    if (anthropicCredentialConflict !== undefined) {
+        throw new Error(anthropicCredentialConflict);
+    }
     const provider = route.provider;
     if (route.providerSource === "inferred") {
         CONFIG_NOTICES.push({
@@ -1073,7 +1114,7 @@ function parseModelDomain() {
     }
     const cheapRef = cheapModel ? cheapModel.id : DEFAULT_MODEL_REF;
     const verifierEnv = process.env.MODEL_VERIFIER;
-    const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : DEFAULT_MODEL_REF;
+    const verifierRef = verifierEnv && Object.hasOwn(models, verifierEnv) ? verifierEnv : DEFAULT_MODEL_REF;
     const roles = {
         verifier: verifierRef,
     };
@@ -1088,8 +1129,8 @@ function parseModelDomain() {
             continue;
         roles[role] =
             typeof cur === "string"
-                ? { model: cur, systemPrompt: CODE_AGENT_PROMPT }
-                : { ...cur, systemPrompt: CODE_AGENT_PROMPT };
+                ? { model: cur, promptRole: "code" }
+                : { ...cur, promptRole: "code" };
     }
     const degradeOn = parseDegradeOn(csv("MODEL_DEGRADE_ON"));
     return {
@@ -1925,6 +1966,7 @@ function parseOrchestrationDomain(ctx) {
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
                         ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
                         sandboxIpv6: enumEnv("K8S_SANDBOX_IPV6", SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS),
+                        ...(process.env.K8S_SANDBOX_BROKER_IMAGE ? { brokerImage: process.env.K8S_SANDBOX_BROKER_IMAGE } : {}),
                         ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("K8S_SANDBOX_ENV", singleUserTurnkey)),
                         ...k8sWorkspaceStore(),
                         ...((c) => (c !== undefined ? { workspaceCache: c } : {}))(k8sWorkspaceCache()),
@@ -1983,6 +2025,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_MAX_INFLIGHT_PER_DEVICE", process.env.DEVICE_MAX_INFLIGHT_PER_DEVICE, DEVICE_HELLO_ACK_BOUNDS.maxInflight)),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
+                                                                ...((n) => (n !== undefined ? { relayUrl: n } : {}))(parseDeviceRelayUrlEnv()),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
@@ -2224,7 +2267,7 @@ function parseFleetScope(raw) {
     if (raw !== undefined && !ScopeId.safeParse(raw).success) {
         const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
         throw fleetEnvRefusal("scope_invalid", `env ${name}=${JSON.stringify(shown)} is not a scope id: it must be a lowercase slug of letters, digits and inner dashes, 1–64 characters, ` +
-            `not empty. The config renderer sets it on engines that serve a tenant scope; unset it for the default scope ("${fleetScopeOf(undefined)}"). ` +
+            `not empty. The config renderer sets it on every engine it manages (the default scope included); on a hand-wired engine leave it unset for the default scope ("${fleetScopeOf(undefined)}"). ` +
             `Refusing to boot rather than answering drain requests under the wrong identity.`);
     }
     return fleetScopeOf(raw);
@@ -2313,8 +2356,8 @@ function parseA2aServe() {
             `inbound authentication on this endpoint is header-shaped (a service credential), not URL-embedded.`);
     }
     const parsed = new URL(rawUrl);
-    const a2aCredentialScan = redactSecrets(parsed.href);
-    if (a2aCredentialScan !== parsed.href) {
+    const a2aCredentialScan = credentialLawRewriteOf(parsed.href);
+    if (a2aCredentialScan !== undefined) {
         throw new Error(`A2A_SERVE_URL carries something the credential-redaction law recognizes (${a2aCredentialScan}) — this address is published VERBATIM on the ANONYMOUSLY readable agent card (the card's url is a functional address: peers fetch it, so it is never rewritten for display), ` +
             `so it must not carry credentials of ANY shape: no userinfo, no credential-named query parameter (api_key/token/…), no token-shaped path segment or parameter value. ` +
             `Keep A2A_SERVE_URL to scheme://host[:port][/path] and move the secret into the caller's headers.`);
@@ -2371,7 +2414,7 @@ function parseA2aServeSkills(raw) {
     });
 }
 const STORE_GROUP_KEYS = [
-    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "storeLockWaitMs", "dbBackend", "dbBackendExplicit", "localDataRoot",
+    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "storeLockWaitMs", "dbBackend", "dbBackendExplicit", "localDataRoot", "sealedKeyDir",
     "runStoreStrictHydrate",
     "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "fileHistory", "fileHistoryCapture", "sendUserFile",
 ];
@@ -2463,6 +2506,7 @@ function k8sWorkspaceStore() {
     if (!Number.isInteger(workspaceSnapshotTimeoutMs))
         throw new Error(`env WORKSPACE_SNAPSHOT_TIMEOUT_MS=${workspaceSnapshotTimeoutMs} must be an integer (milliseconds)`);
     const exclude = parseWorkspaceSnapshotExclude(process.env.WORKSPACE_SNAPSHOT_EXCLUDE);
+    const keyPrefix = parseWorkspaceSnapshotPrefix(process.env.WORKSPACE_SNAPSHOT_PREFIX);
     const knobs = { workspacePersist, workspaceSnapshotKeep, workspaceSnapshotTimeoutMs, ...(exclude.length > 0 ? { workspaceSnapshotExclude: exclude } : {}) };
     const endpoint = process.env.MINIO_ENDPOINT;
     const accessKey = process.env.MINIO_ACCESS_KEY;
@@ -2482,11 +2526,11 @@ function k8sWorkspaceStore() {
         ...knobs,
         s3Snapshot: {
             endpoint,
-            bucket: process.env.WORKSPACE_SNAPSHOT_BUCKET ?? "workspaces",
+            bucket: process.env.WORKSPACE_SNAPSHOT_BUCKET ?? WORKSPACE_SNAPSHOT_BUCKET_DEFAULT,
             accessKey,
             secretKey,
             ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-            ...(process.env.WORKSPACE_SNAPSHOT_PREFIX ? { keyPrefix: process.env.WORKSPACE_SNAPSHOT_PREFIX } : {}),
+            ...(keyPrefix !== undefined ? { keyPrefix } : {}),
             ...((n) => (n !== undefined ? { presignTtlSec: n } : {}))(optNumEnvStrict("WORKSPACE_SNAPSHOT_TTL_SEC")),
         },
     };

package/dist/deployment-governance.d.ts

@@ -103,8 +103,8 @@ export interface AbsentApprovalSeat {
  * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
  * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
  * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 工具名取 `approval-content-kind.ts` 的单一属主(它 re-export core 根导出的 `ASK_USER_QUESTION_TOOL_NAME`);
- * server.ts 的 pre-CAS 守卫读同一枚([ref]①:此处旧注称该常量「core 未根导出」= 失实,曾据此手抄 13 处)。
+ * 「是不是引擎的问题工具」不在本层判:core 7.56.0 [ref] 起本门**组合** core 原形的答(它读调用的脸 —— 引擎挂载点 + 目录契约 id,不读名字;
+ * 它答 `ask` ⇒ 是;本层只在那之上按活流分腿)。决断口的 pre-CAS 守卫(「批准问答必须带答」)仍按保留名读(core 同版「Not changed here」那一条)。
  * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
  * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
  * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)

package/dist/deployment-governance.js

@@ -1,18 +1,16 @@
 import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
-import { heldRuleName } from "./tool-rule-names.js";
 export function createDurableQuestionGate(live) {
+    const durable = createDurableQuestionPolicy();
     if (live === undefined)
-        return createDurableQuestionPolicy();
+        return durable;
     return {
-        check(req) {
-            if (heldRuleName(req, (n) => n === ASK_USER_QUESTION_TOOL_NAME) === undefined)
-                return { action: "allow" };
-            return live.hasLiveContext()
-                ? { action: "allow" }
-                : { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };
+        async check(req) {
+            const answer = await durable.check(req);
+            if (answer.action !== "ask")
+                return answer;
+            return live.hasLiveContext() ? { action: "allow" } : answer;
         },
     };
 }

package/dist/deployment-shape.d.ts

@@ -18,7 +18,7 @@
  * ## 什么进表、什么不进
  * 进表的是**形规则**:只由部署形事实决定的布尔(去重后 14 行;同一条规则的多个消费者读同一行,不各成一行)。
  * 把一行与**非形事实**(锁键、合规档位、审批意图、请求身份、请求体)合取的能力判据是**消费者**,住在它自己的模块
- * (`a2aInjectionHonored` = 锁 ∧ 合规 ∧ `!multiTenant`;`taskHooksHonored`;身份门 …),读行、不读原始键。
+ * (`mcpInjectionHonored` = 锁 ∧ 合规 ∧ `!multiTenant`;`taskHooksHonored`;身份门 …),读行、不读原始键。
  * 车道表(`execution-lane-caps.ts`)按车道词键控的布尔列(`laneIsolated` 等)是车道轴自己的事实表,不是「部署」的谓词;行读它们。
  *
  * 依赖纪律:叶模块 —— 值导入只有 `execution-lane-caps.ts`(它本身是叶),零运行期环。

package/dist/device-ws-protocol.d.ts

@@ -74,6 +74,7 @@ export declare function asInstructionKind(v: string): DeviceInstructionKind | nu
 export declare const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION: {
     readonly 1: readonly ["aborted", "already_exists", "auth_failed", "callback_error", "invalid", "is_directory", "not_directory", "not_found", "not_supported", "outcome_unknown", "permission_denied", "precondition_failed", "shell_unavailable", "spawn_error", "suspended", "target_unavailable", "timeout", "transport_lost", "unknown"];
     readonly 2: readonly ["liveness_no_output"];
+    readonly 3: readonly ["name_too_long"];
 };
 /** 本包认得的协议修订号(= 增量表的行键)。 */
 export type DeviceProtocolRevision = keyof typeof DEVICE_OUTCOME_ERROR_CODES_BY_REVISION;

package/dist/device-ws-protocol.js

@@ -1,7 +1,7 @@
 import { createPublicKey, randomBytes, randomInt, verify as edVerify } from "node:crypto";
 import { MAX_TIMER_DELAY_MS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
 export const DEVICE_WS_PATH = "/v1/device/ws";
-export const DEVICE_PROTOCOL_VERSION = 2;
+export const DEVICE_PROTOCOL_VERSION = 3;
 export const DEVICE_MIN_PROTOCOL_VERSION = 1;
 export const DEVICE_HELLO_DOMAIN_TAG = "sema.device.hello.v1";
 export const DEVICE_WS_LIMITS = {
@@ -66,6 +66,7 @@ export const DEVICE_OUTCOME_ERROR_CODES_BY_REVISION = {
         "unknown",
     ],
     2: ["liveness_no_output"],
+    3: ["name_too_long"],
 };
 export function deviceOutcomeErrorCodesAt(revision) {
     if (!Number.isInteger(revision) || revision < 1 || revision > DEVICE_PROTOCOL_VERSION) {

package/dist/elicitation.d.ts

@@ -20,7 +20,7 @@ export interface ElicitationFrame {
      *  coordinate instead, same posture as the stream-approval frames' `serverNowMs`. */
     serverNowMs?: number;
     /** "elicitation" only (additive; the same window pair `question` carries): the coordinator's OWN answer window —
-     *  at expiry the ask releases as `decline`. Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
+     *  at expiry the ask is released as `cancel` (nobody answered; see RELEASE_ACTION). Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
      *  a form replayed from the ledger can be judged still-waiting (no `elicitation_complete` with this id ∧
      *  `expiresAtMs` not reached) or lapsed even when the close row never landed (a lost write, a crashed replica). */
     expiresInMs?: number;
@@ -37,13 +37,13 @@ export interface ElicitationRunContext {
     abortSignal?: AbortSignal;
 }
 export interface ElicitationThrottle {
-    /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ decline. */
+    /** Max concurrent in-flight elicitations per run leg (parallel tool calls can each elicit). Breach ⇒ refused (`decline`). */
     maxConcurrentPerRun: number;
-    /** Max total elicitations one run leg will surface to the human. Breach ⇒ decline (flood defense). */
+    /** Max total elicitations one run leg will surface to the human. Breach ⇒ refused (`decline`; flood defense). */
     maxTotalPerRun: number;
-    /** Min gap (ms) between two elicitations from the SAME server within a run. Within ⇒ decline (burst guard). */
+    /** Min gap (ms) between two elicitations from the SAME server within a run. Within ⇒ refused (`decline`; burst guard). */
     minIntervalMsPerServer: number;
-    /** An unanswered elicitation auto-declines after this (ms) — the human walked away; don't hold core forever. */
+    /** An unanswered elicitation is released as `cancel` after this (ms) — the human walked away; don't hold core forever. */
     ttlMs: number;
 }
 export declare const DEFAULT_ELICITATION_THROTTLE: ElicitationThrottle;
@@ -75,8 +75,9 @@ export declare class ElicitationCoordinator {
      *  the case where the leg ends/throws while an elicitation is parked but the leg's own loop has already drained. */
     runWithContext<T>(ctx: ElicitationRunContext, fn: () => Promise<T>): Promise<T>;
     /** `RunnerDeps.onElicit`. Core calls this when an opted-in server elicits the END USER mid-tool-call; the resolved
-     *  value is sent back to the server on the still-open connection. Fail-closed (`decline`/`cancel`) in every
-     *  uncertain case. Arrow property so it can be passed as `onElicit: coordinator.elicit` with `this` bound. */
+     *  value is sent back to the server on the still-open connection. Fail-closed (never `accept`) in every uncertain
+     *  case: a rule-based refusal is `decline`, a release nobody answered is `cancel` (RELEASE_ACTION).
+     *  Arrow property so it can be passed as `onElicit: coordinator.elicit` with `this` bound. */
     elicit: (req: McpElicitRequest, signal?: AbortSignal) => Promise<McpElicitResponse>;
     /** `POST /v1/elicitations/:id/respond` — resolve a parked elicitation with the shell's answer. Owner-gated with a
      *  404 (no existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404.

package/dist/elicitation.js

@@ -5,6 +5,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { refusalBody } from "./http/refusal-body.js";
 const MAX_ELICIT_MESSAGE_CHARS = 4096;
 const MAX_ELICIT_SCHEMA_BYTES = 8192;
+const RELEASE_ACTION = { refused: "decline", unanswered: "cancel" };
 export const DEFAULT_ELICITATION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
@@ -65,7 +66,7 @@ export class ElicitationCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle({ action: "cancel" });
+                        p.settle({ action: RELEASE_ACTION.unanswered });
                 }
                 this.counters.delete(ctx.taskId);
             }
@@ -74,18 +75,18 @@ export class ElicitationCoordinator {
     elicit = async (req, signal) => {
         const ctx = this.als.getStore();
         if (!ctx)
-            return { action: "decline" };
+            return { action: RELEASE_ACTION.refused };
         if (typeof req.url === "string" && req.url.length > 0)
-            return { action: "decline" };
+            return { action: RELEASE_ACTION.refused };
         if (signal?.aborted || ctx.abortSignal?.aborted)
-            return { action: "cancel" };
+            return { action: RELEASE_ACTION.unanswered };
         const rc = this.countersFor(ctx.taskId);
         const t = this.now();
         const last = rc.lastByServer.get(req.server);
         if (rc.inflight >= this.throttle.maxConcurrentPerRun ||
             rc.total >= this.throttle.maxTotalPerRun ||
             (last !== undefined && t - last < this.throttle.minIntervalMsPerServer)) {
-            return { action: "decline" };
+            return { action: RELEASE_ACTION.refused };
         }
         const id = uuidv7();
         rc.inflight += 1;
@@ -107,8 +108,8 @@ export class ElicitationCoordinator {
             rc.inflight = Math.max(0, rc.inflight - 1);
             resolveAnswer(r);
         };
-        const onAbort = () => settle({ action: "cancel" });
-        timer = setTimeout(() => settle({ action: "decline" }), this.throttle.ttlMs);
+        const onAbort = () => settle({ action: RELEASE_ACTION.unanswered });
+        timer = setTimeout(() => settle({ action: RELEASE_ACTION.unanswered }), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -124,7 +125,7 @@ export class ElicitationCoordinator {
         }
         else if (delivery === "failed") {
             recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
-            settle({ action: "decline" });
+            settle({ action: RELEASE_ACTION.unanswered });
         }
         const answer = await answerP;
         void emitted

package/dist/file-history-disclosure.d.ts

@@ -23,8 +23,11 @@
  *   前置到它自己的 message 前 —— **不 `instanceof` 单挑任何一个类**(身上有字符串 `code` 就折),该店
  *   的折点全部改走这一只函数。人与模型因此看得到「这是哪一类失败」。
  * · **判断面**(同一只函数的 `fault`,core 7.55.0 `FileHistoryError.permanence`):永久码表里的 typed 码 ⇒
- *   `{ permanence: "terminal" }`,其余 ⇒ `{}`(没判 —— 引擎照旧给重试引导语)。折点把它摊进店答的
- *   `FileHistoryError`;引擎的拒句引导语、rewind 披露、`terminal.detail` 都读这一格,**不读散文**。
+ *   `{ permanence: "terminal" }`;**连接类故障**(到库的连接坏了 / 库此刻不接 —— 判官是整仓唯一一只
+ *   `plugins/store-fault.ts` 的 `storeFaultClassOf`,识别表在 `plugins/sql-errors.ts`,本文件不再抄第二份)⇒
+ *   `{ permanence: "transient" }`;**部署错配类**(缺表 / 权限拒:连接是好的、重试注定失败,修表 / 授权之前什么都不会变 —— 同一只判官的 `deployment` 一词,表在 `plugins/sql-errors.ts`)⇒
+ *   `{ permanence: "terminal" }`;其余 ⇒ `{}`(没判 —— 引擎照旧给重试引导语)。`terminal` 只对永久码与部署错配类。
+ *   折点把它摊进店答的 `FileHistoryError`;引擎的拒句引导语、rewind 披露、`terminal.detail` 都读这一格,**不读散文**。
  * · **机器面**(同一只函数的副作用):码取自 typed 错**对象**、对闭集词表判定,**绝不从散文里抠**。
  *   🔴 这一条是 codex R1-[high] 验真后的定形:文本通道**天然可伪造** —— 一个名叫
  *   `(blob_too_large_for_sql).txt` 的文件读不出来时,它的路径就在 `snapshot_failed` 的散文里,任何
@@ -51,8 +54,9 @@ export interface CaughtFailure {
  *
  * `text` = 散文形:带 typed `code` 的前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
  * 不带的**逐字**是原 message(transient 失败的文案因此与本批之前一字不差)。
- * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;其余 ⇒ `{}`(店不知道 ——
- * 驱动 / 库的错码是不是会自己好,不归本店判)。
+ * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;连接类故障 ⇒ `{ permanence: "transient" }`
+ * (什么都不改稍后再试可能成);部署错配类故障 ⇒ `{ permanence: "terminal" }`(修表 / 授权之前重试注定失败);其余 ⇒ `{}`(店不知道 —— 认不出的驱动 / 库错是不是会自己好,不归本店判)。
+ * 永久码先于分类判(一只错不会两个都是);分类词只读判官 `storeFaultClassOf`,本文件不写码。
  * 副作用 = 机器形:码取自错误对象,逐次计数 + 每进程每码一条 warn。观测绝不抛。
  */
 export declare function foldCaughtFailure(err: unknown): CaughtFailure;

package/dist/file-history-disclosure.js

@@ -1,4 +1,5 @@
 import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "@sema-agent/core";
+import { storeFaultClassOf } from "./plugins/store-fault.js";
 const PERMANENT_STORE_FAILURE_CODES = {
     blob_too_large_for_sql: {
         note: "a blob is larger than this deployment's SQL snapshot-blob cap — the same file will fail every turn until the deployment changes",
@@ -32,12 +33,29 @@ function drainToMetrics() {
 export function foldCaughtFailure(err) {
     const message = err instanceof Error ? err.message : String(err);
     const code = err?.code;
-    if (typeof code !== "string" || code === "")
-        return { text: message, fault: {} };
-    const permanent = isPermanentCode(code);
-    if (permanent)
-        recordPermanent(code, message);
-    return { text: `(${code}) ${message}`, fault: permanent ? { permanence: "terminal" } : {} };
+    const typedCode = typeof code === "string" && code !== "" ? code : undefined;
+    const permanentCode = typedCode !== undefined && isPermanentCode(typedCode) ? typedCode : undefined;
+    if (permanentCode !== undefined)
+        recordPermanent(permanentCode, message);
+    return {
+        text: typedCode !== undefined ? `(${typedCode}) ${message}` : message,
+        fault: permanentCode !== undefined ? { permanence: "terminal" } : faultOfClass(storeFaultClassOf(err)),
+    };
+}
+function faultOfClass(cls) {
+    switch (cls) {
+        case "connection":
+            return { permanence: "transient" };
+        case "deployment":
+            return { permanence: "terminal" };
+        case "corrupt":
+        case "unclassified":
+            return {};
+        default: {
+            const unhandled = cls;
+            throw new Error(`store fault class without a file-history judgment: ${String(unhandled)}`);
+        }
+    }
 }
 function safely(record) {
     try {

package/dist/fleet-client.d.ts

@@ -25,11 +25,15 @@
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
  *    (worker,instanceId,windowStartMs) 重发安全;**发送失败 → merge 回累计器**,并入下一窗(失败窗从未入账,
  *    向前合并不会双计 —— 只延迟,不丢量)。
+ *  - **用量按中心凭证身份分箱([ref])**:累计器一个身份一只({@link createFleetUsageBins},分箱规则 = `createIdentityBins` 一只),
+ *    tracer 记进记账身份那一箱(执行开始时钉下的身份;执行外 = 此刻身份);用量环只报此刻身份那一箱、经钉在它身份上的凭证发 —— 文件形凭证进程内换人后,上一个人窗里的用量
+ *    不在下一个人的凭证下上报(不记到别人头上);它留在原箱,那个身份回来时照常报出去,收尾时还压着就响亮一行。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
 import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
+import { type CenterCredentialSource } from "./center-credential.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -71,6 +75,32 @@ export declare class FleetUsageAccumulator {
     mergeBack(entries: UsageReport["entries"]): void;
     get size(): number;
 }
+/** [ref] —— 一个中心凭证身份的用量箱:这个身份窗里的累计格,与钉在这个身份上的凭证(用量环只经它报这一箱)。 */
+export interface FleetUsageBin {
+    readonly usage: FleetUsageAccumulator;
+    readonly credential: CenterCredentialSource;
+}
+/**
+ * [ref] —— **按中心凭证身份分箱的用量账**(活对象 ⇒ `create*`)。tracer / side-query 记账写 {@link record}(此刻身份那一箱);
+ * 用量环读 {@link current}(此刻身份那一箱 + 钉住的凭证)。分箱规则只有 `createIdentityBins` 一只(与租约管理器、per-principal caps 同规则)。
+ */
+export interface FleetUsageBins {
+    /** 记进**记账身份**那一箱(执行里 = 执行开始时钉下的身份;执行外 = 此刻身份)。 */
+    record(principal: string | undefined, model: string, taskId: string, d: {
+        inputTokens: number;
+        outputTokens: number;
+        costMicroUsd?: number;
+        weightedTokens?: number;
+        quotaWeightAtUse?: number;
+    }): void;
+    /** 把这次执行的记账身份钉在此刻(tracer 在 `task.start` 调;规则属 `center-credential.ts` `pinAccountingIdentity`)。 */
+    pinExecution(): void;
+    /** 此刻身份那一箱(用量环上报读它)。 */
+    current(): FleetUsageBin;
+    /** **全部**箱里还压着的条目数(收尾那一行 warn 用:最后一窗之后还压着的,进程退出即丢 —— 别的身份的、身份未知的、或最后一窗没报成的,同一待遇)。 */
+    held(): number;
+}
+export declare function createFleetUsageBins(credential: CenterCredentialSource): FleetUsageBins;
 export interface FleetClientOpts {
     /** [ref]:凭证是**来源**(每条公告 / 用量 / 注销请求各取一次值),不是启动期烧进 header 的字符串。 */
     center: CenterEndpoint & {
@@ -92,7 +122,8 @@ export interface FleetClientOpts {
      *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
      *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
     onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
-    usage?: FleetUsageAccumulator;
+    /** [ref]:按凭证身份分箱的用量账(缺席 = 用量环不装)。 */
+    usage?: FleetUsageBins;
     heartbeatMs?: number;
     usageWindowMs?: number;
     logger?: {

package/dist/fleet-client.js

@@ -2,6 +2,7 @@ import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapability
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { createIdentityBins, pinAccountingIdentity } from "./center-credential.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
@@ -67,6 +68,20 @@ export class FleetUsageAccumulator {
         return this.cells.size;
     }
 }
+export function createFleetUsageBins(credential) {
+    const made = [];
+    const bins = createIdentityBins(credential, (pinned) => {
+        const bin = { usage: new FleetUsageAccumulator(), credential: pinned };
+        made.push(bin);
+        return bin;
+    });
+    return {
+        record: (principal, model, taskId, d) => bins.accounting().usage.record(principal, model, taskId, d),
+        pinExecution: () => pinAccountingIdentity(credential),
+        current: bins.now,
+        held: () => made.reduce((n, b) => n + b.usage.size, 0),
+    };
+}
 async function rejectionSnippet(res) {
     try {
         const text = (await res.text()).slice(0, 200).trim();
@@ -90,7 +105,7 @@ export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
     const usageWindowMs = opts.usageWindowMs ?? 60_000;
-    const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
+    const send = (route, method, json, center = opts.center) => centerFetch(center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
     let unreadableStreak = 0;
@@ -177,20 +192,21 @@ export function startFleetClient(opts) {
     const flushUsage = async () => {
         if (!opts.usage)
             return;
+        const bin = opts.usage.current();
         const windowEndMs = Date.now();
-        const entries = opts.usage.drain();
+        const entries = bin.usage.drain();
         const start = windowStartMs;
         windowStartMs = windowEndMs;
         if (entries.length === 0)
             return;
         const report = { worker: opts.center.worker, instanceId: opts.instanceId, windowStartMs: start, windowEndMs, entries };
         try {
-            const { res } = await send("fleet-usage", "POST", { reports: [report] });
+            const { res } = await send("fleet-usage", "POST", { reports: [report] }, { ...opts.center, credential: bin.credential });
             if (!res.ok)
                 throw new Error(`usage ${res.status}${await rejectionSnippet(res)}`);
         }
         catch (err) {
-            opts.usage.mergeBack(entries);
+            bin.usage.mergeBack(entries);
             opts.logger?.warn("fleet_usage_report_failed", { error: err instanceof Error ? err.message : String(err), entries: entries.length });
         }
     };
@@ -227,6 +243,10 @@ export function startFleetClient(opts) {
         if (uw)
             clearInterval(uw);
         await flushUsage();
+        const held = opts.usage?.held() ?? 0;
+        if (held > 0) {
+            opts.logger?.warn("fleet_usage_unreported_identity", { entries: held, note: "usage still held at exit is dropped: it accrued under another center credential identity (never reported under the current one — it would be billed to the wrong account), under an unknown identity (credential unreadable), or its final report failed" });
+        }
     };
     return { announceNow, stopRouting, flushFinalUsage };
 }

package/dist/fleet-lease.d.ts

@@ -3,7 +3,7 @@ import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
 export declare const EXHAUSTED_RETRY_MS: number;
-/** principal 状态表上界(镜像 FLEET_USAGE_KEY_CAP 的姿势):超界丢最旧 —— 被丢的 principal 下次 admit
+/** principal 状态表上界(**每个身份箱各一份**;镜像 FLEET_USAGE_KEY_CAP 的姿势):超界丢最旧 —— 被丢的 principal 下次 admit
  *  重新协商,一次多余 RTT,无正确性影响。 */
 export declare const LEASE_PRINCIPAL_CAP = 4096;
 /** 复审 O1:lease 协商 RTT 的硬上限——leaseDenied 在提交热路径同步 await 它,一个 accept-but-hang 的
@@ -87,8 +87,8 @@ export interface FleetLeaseOpts {
 }
 export declare class FleetLeaseManager {
     private readonly opts;
-    private readonly state;
-    private readonly inflight;
+    /** 记账身份的那一箱(惰建;分箱规则只有 `createIdentityBins` 一只,取箱口 `accounting`)。 */
+    private readonly binNow;
     private readonly f;
     private readonly now;
     private failStreak;
@@ -97,6 +97,8 @@ export declare class FleetLeaseManager {
     /** [ref] ③ 生效姿态(caps `centerWiring.failMode` 读的就是它 —— 与执行的那一只同源)。 */
     readonly failMode: LeaseFailMode;
     constructor(opts: FleetLeaseOpts);
+    /** [ref]:把这次执行的记账身份钉在此刻(tracer 在执行的第一帧 `task.start` 调;规则属 `center-credential.ts` `pinAccountingIdentity`)。 */
+    pinExecution(): void;
     /**
      * Admission check for one billed submission. Fast path is synchronous-shaped (live lease / fresh negative
      * cache → no await beyond the microtask); only first-touch / expiry / exhaustion pays a center RTT.
@@ -119,6 +121,7 @@ export declare class FleetLeaseManager {
     /**
      * [ref] ② —— 调用方这一刻的租约读数(caps `centerWiring.caller` / `leaseHealth` 的唯一来源;7.105.0 的 `peek()` 退役:它只回 kind、
      * 不看 `until`,过期条目照回原 kind)。**纯读**:不打中心、不写状态、不动 LRU 序(`Map.get` 不改插入序)—— caps 路由自己不 admit。
+     * 读的是**此刻凭证身份**那一箱([ref];取箱要读一次凭证,首次见到的身份惰建一只空箱 —— 空箱不是状态)。
      * 规则表(设计稿 v1.1 §2②,逐行钉在 `test/fleet-lease.test.ts`):
      *  · principal 缺席 / 无条目(含被 LRU 逐出)⇒ `unobserved`;
      *  · `not-lease` 且 `now < until` ⇒ `not-enforced`;到期 ⇒ `unobserved`;
@@ -135,6 +138,7 @@ export declare class FleetLeaseManager {
     /** [ref] ③:两条连接级失败臂的**唯一**收尾 —— 按姿态穷举(加一种姿态 = 编译红)。 */
     private connectionFailure;
     private set;
+    /** 单飞在箱内:同一身份同一 principal 的并发谈判共用一条;换了人的谈判各发各的([ref])。 */
     private issueOrRenew;
     private issueOrRenewInner;
 }