@sema-agent/server 7.147.0 → 7.148.0

package/dist/boot/web-admin.js

@@ -12,7 +12,7 @@ import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill }
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, preIdentityLkgLeftover, PRE_IDENTITY_LKG_REASON } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
@@ -20,8 +20,10 @@ import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js"
 import { configSourceKind, createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
 import { REMOTE_CATALOG_SOURCE } from "../env-model-table-gate.js";
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
+import { ConfigPullError, ConfigPullSupersededError, asConfigPullError, configPullFailureNote } from "../config-pull-failure.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
+import { sealedKeyDirOf } from "../sealed-key-layout.js";
 import { anthropicLaneCredentialOf } from "../model-route-gap.js";
 import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, skillManifestEntriesNotInstalled, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
@@ -29,7 +31,7 @@ import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-clien
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "../web-admin-client/read-warnings.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
-import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
+import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneOutcome, refusedGroups } from "../web-admin-client/apply-ledger.js";
 import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
 import { seatText } from "../trace/exit-seat.js";
 const MODELS_REJECTION_PHRASE = {
@@ -133,6 +135,15 @@ export async function createWebAdminRuntime(ctx) {
             validatorIdentity.delete(oldest.value);
     };
     const pullEffective = async (provider, etag) => {
+        try {
+            return await pullEffectiveOnce(provider, etag);
+        }
+        catch (err) {
+            throw asConfigPullError(err);
+        }
+    };
+    const refreshFailureCause = (err) => (err instanceof ConfigPullError ? err.pullCause : "apply_refused");
+    const pullEffectiveOnce = async (provider, etag) => {
         if (provider.kind === "local")
             return provider.fetchEffective(etag);
         const before = currentIdentity();
@@ -140,7 +151,7 @@ export async function createWebAdminRuntime(ctx) {
         const r = await provider.fetchEffective(conditional);
         const used = r === null ? before : r.credentialIdentity;
         if (cc === undefined || !answerStillCurrent(cc.credential, used)) {
-            throw new Error("center credential identity changed while the effective pull was in flight — response discarded; the next pull runs under the current credential");
+            throw new ConfigPullSupersededError("center credential identity changed while the effective pull was in flight — response discarded; the next pull runs under the current credential");
         }
         if (r !== null) {
             candidateIdentity.set(r.effective, used);
@@ -148,7 +159,7 @@ export async function createWebAdminRuntime(ctx) {
         }
         return r;
     };
-    const sealedKeyDir = config.sealedKeyDir ?? join(config.localDataRoot ?? localRoot, "sealed-key");
+    const sealedKeyDir = sealedKeyDirOf(config, localRoot);
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(sealedKeyDir, logger);
@@ -422,8 +433,7 @@ export async function createWebAdminRuntime(ctx) {
         handoff = { ...(applied !== undefined ? { applied } : {}), ...(durable !== undefined ? { durable } : {}) };
         latchHandoff();
     };
-    const markApplied = (gen, eff) => {
-        applyLedger.applied(gen, eff.version);
+    const markApplied = (eff) => {
         if (isNoCenterEffective(eff))
             noteHandoff({ noneApplied: true });
         else
@@ -432,6 +442,7 @@ export async function createWebAdminRuntime(ctx) {
         if (landed !== undefined)
             announceTier(landed);
     };
+    const closeApplied = (gen, eff) => applyLedger.applied(gen, eff.version);
     let lkgBooted = false;
     let bootLkgCandidate;
     let lastPrewarmBodiesVerified = false;
@@ -495,10 +506,13 @@ export async function createWebAdminRuntime(ctx) {
                 return null;
             }
             const lkgPath = lkgPathFor(identity);
-            const read = await loadLkg(lkgPath, cc?.worker, identity);
+            const read = await loadLkg(lkgPath, cc?.worker, identity, { declaredOwnerUid: config.configLocalOwnerUid });
             if (!read.lkg) {
                 if (read.reason !== "absent")
                     logger.warn("config_lkg_unusable", { path: lkgPath, reason: read.reason, note: "ignoring the on-disk LKG — env fallback serves; the cache rewrites on the next clean candidate" });
+                const leftover = read.reason === "absent" && config.configLkgPath === undefined ? preIdentityLkgLeftover(config, cc?.worker, lkgPath) : undefined;
+                if (leftover !== undefined)
+                    logger.warn("config_lkg_unusable", { path: leftover, reason: PRE_IDENTITY_LKG_REASON, note: "a last-known-good written by 7.98.0 or earlier sits at the pre-identity default name and is never read — delete this file (a cache, not data); env fallback serves, and the next clean candidate writes this credential identity's own LKG" });
                 return null;
             }
             if (currentIdentity() !== identity) {
@@ -544,9 +558,10 @@ export async function createWebAdminRuntime(ctx) {
             const lkgIdentity = candidateIdentityOf(lkgR.effective);
             if (lkgSurvivesRestart && lkgIdentity !== undefined)
                 noteHandoff({ durable: { version: lkgR.effective.version, identity: lkgIdentity } });
-            markApplied(lkgGen, lkgR.effective);
+            markApplied(lkgR.effective);
+            closeApplied(lkgGen, lkgR.effective);
             await adoptCenterPrompts(lkgR.effective, lkgR.prompts, "boot-lkg");
-            const lkgPlane = modelPlaneCommitted(lkgReport);
+            const lkgPlane = modelPlaneOutcome(lkgReport) === "landed";
             if (lkgPlane)
                 markRosterLanded(lkgR.effective);
             effective = lkgR.effective;
@@ -592,7 +607,6 @@ export async function createWebAdminRuntime(ctx) {
                                 : "config.d/models.json 空或 CONFIG_LOCAL_DIR 指错目录(选目录旋钮是 CONFIG_LOCAL_DIR,不是 LOCAL_DATA_ROOT)— 模型继续走 env 兜底",
             });
         };
-        let bootApplyPhase = false;
         try {
             const bootFetch = pullEffective(configProvider, undefined);
             const raced = await raceBootFetch(bootFetch, config.configBootFetchBudgetMs);
@@ -611,7 +625,6 @@ export async function createWebAdminRuntime(ctx) {
             }
             const r = raced === BOOT_FETCH_DEFERRED ? null : raced;
             if (r) {
-                bootApplyPhase = true;
                 for (const de of r.domainErrors ?? [])
                     logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: CONFIG_DOMAIN_INVALID_NOTE });
                 if (dryRun) {
@@ -651,18 +664,20 @@ export async function createWebAdminRuntime(ctx) {
                                 recordApply(rep, bootArrival);
                             },
                         });
-                        markApplied(bootGen, r.effective);
+                        markApplied(r.effective);
+                        closeApplied(bootGen, r.effective);
                         const bootClean = fullyLandedForLkg(r, bootReport);
                         if (bootClean)
                             ccEtag = r.etag;
                         await adoptCenterPrompts(r.effective, bootVerdict.prompts, "boot");
-                        let bootPlaneEff = modelPlaneCommitted(bootReport) ? r.effective : undefined;
-                        if (bootPlaneEff === undefined) {
+                        const bootOutcome = modelPlaneOutcome(bootReport);
+                        let bootPlaneEff = bootOutcome === "landed" ? r.effective : undefined;
+                        if (bootOutcome === "refused" || bootOutcome === undefined) {
                             const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
                             if (lkgPlane) {
                                 let planeReport;
                                 applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", catalogSource: lkgPlane.catalogSource, sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
-                                if (modelPlaneCommitted(planeReport)) {
+                                if (modelPlaneOutcome(planeReport) === "landed") {
                                     bootPlaneEff = lkgPlane.effective;
                                     logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (the catalog and what rides with it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
                                 }
@@ -690,11 +705,11 @@ export async function createWebAdminRuntime(ctx) {
         catch (err) {
             if (err instanceof ConfigDirUntrustedError)
                 throw err;
-            if (bootApplyPhase)
-                logger.warn("config_apply_refused", { source: configProvider.kind, err: seatText("operator-log-text", String(err)), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+            if (err instanceof ConfigPullError)
+                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, cause: err.pullCause, err: seatText("operator-log-text", String(err)), note: configPullFailureNote(err.pullCause) });
             else
-                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: seatText("operator-log-text", String(err)) });
-            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${seatText("operator-log-text", String(err))}`);
+                logger.warn("config_apply_refused", { source: configProvider.kind, err: seatText("operator-log-text", String(err)), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+            await bootFallBackWhole(`${err instanceof ConfigPullError ? "boot fetch failed" : "boot apply refused"}: ${seatText("operator-log-text", String(err))}`);
         }
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
@@ -839,6 +854,7 @@ export async function createWebAdminRuntime(ctx) {
         startRefreshLoop(a) {
             const { pricing, limitSync, swapRunnerDeps, ceilingVerdict, consolidationSeat, degradeRoute, checkpointStorePresent } = a;
             const signalRestart = (c) => {
+                closeApplied(c.gen, c.effective);
                 const reasons = restartReasons(c.baseline, c.effective, restartCtx(consolidationSeat?.read(), degradeRoute.read()));
                 const skillsChangeDetected = reasons.includes("skills");
                 if (bootSkillStale && !skillsChangeDetected)
@@ -934,8 +950,8 @@ export async function createWebAdminRuntime(ctx) {
                     if (phase !== "boot-deferred")
                         mcpRevocations.applyEnabledEntries(enabledMcpEntries(eff.mcp));
                     applyLiveReadFace(eff, swapRunnerDeps, phase);
-                    markApplied(gen, eff);
-                    const planeCommitted = modelPlaneCommitted(report);
+                    markApplied(eff);
+                    const planeCommitted = modelPlaneOutcome(report) === "landed";
                     if (planeCommitted)
                         appliedPlaneEff = noCenter ? undefined : eff;
                     planeDeferredNoHandoff = undefined;
@@ -954,6 +970,7 @@ export async function createWebAdminRuntime(ctx) {
                     if (!hot.committed) {
                         throw new Error("the no-center tier was refused (the Runners did not accept the env model table) — the previous account's center configuration is still in force; retried next tick");
                     }
+                    closeApplied(gen, NO_CENTER_EFFECTIVE);
                     if (hot.report !== undefined && !hot.report.fullyApplied) {
                         logger.warn("center_identity_demotion_partial", { groups: refusedGroups(hot.report).map((g) => g.group), note: "a group of the no-center tier was refused — that group keeps its previous values (loud; the env base for that group could not be applied)" });
                     }
@@ -1045,7 +1062,7 @@ export async function createWebAdminRuntime(ctx) {
                                         groups: refused.map((g) => g.group),
                                         note: "a group of this candidate was refused — the live config keeps serving the prior values for it; the LKG and the ETag stay on the last FULLY applied generation (this tree is re-judged next tick)",
                                     });
-                                    const partialSignal = signalRestart({ applied: "partial", effective: r.effective, baseline: effective, refused: refused.map((g) => g.group) });
+                                    const partialSignal = signalRestart({ applied: "partial", gen: tickGen, effective: r.effective, baseline: effective, refused: refused.map((g) => g.group) });
                                     logger.info("web_admin_refreshed", {
                                         version: r.effective.version,
                                         note: "partially applied — the refused group(s) keep their prior values (see config_candidate_partially_applied); the other groups hot-applied; restart fields as on a complete tick",
@@ -1054,7 +1071,7 @@ export async function createWebAdminRuntime(ctx) {
                                     return "ok";
                                 }
                                 const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
-                                const signal = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
+                                const signal = signalRestart({ applied: "complete", gen: tickGen, effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
                                 logger.info("web_admin_refreshed", {
                                     version: r.effective.version,
                                     note: "runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
@@ -1066,7 +1083,7 @@ export async function createWebAdminRuntime(ctx) {
                         }
                     }
                     catch (err) {
-                        logger.warn("web_admin_refresh_failed", { err: seatText("operator-log-text", String(err)), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
+                        logger.warn("web_admin_refresh_failed", { cause: refreshFailureCause(err), err: seatText("operator-log-text", String(err)), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
                         return "failed";
                     }
                     finally {
@@ -1075,16 +1092,17 @@ export async function createWebAdminRuntime(ctx) {
                     return "ok";
                 };
                 let inFlight;
-                const runTick = (arrival) => {
+                const enterLane = (body) => {
                     if (inFlight)
                         return inFlight;
-                    const p = refreshTick(arrival).finally(() => {
+                    const p = body().finally(() => {
                         inFlight = undefined;
                         afterLane();
                     });
                     inFlight = p;
                     return p;
                 };
+                const runTick = (arrival) => enterLane(() => refreshTick(arrival));
                 const requestTick = () => {
                     if (ccTimer === undefined || ownRead)
                         return;
@@ -1115,21 +1133,22 @@ export async function createWebAdminRuntime(ctx) {
                     requestTick();
                 const deferredBootApply = async (r, arrivalGen) => {
                     if (!r)
-                        return;
+                        return "ok";
                     if (refreshInFlight)
-                        return;
+                        return "ok";
                     refreshInFlight = true;
                     try {
                         await deferredBootApplyInner(r, useArrivalGeneration(r.effective.version, arrivalGen));
                         if (configProvider.kind === "remote")
                             lastPull = "ok";
+                        return "ok";
                     }
                     catch (err) {
-                        logger.warn("web_admin_refresh_failed", { err: seatText("operator-log-text", String(err)), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                        logger.warn("web_admin_refresh_failed", { cause: refreshFailureCause(err), err: seatText("operator-log-text", String(err)), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                        return "failed";
                     }
                     finally {
                         refreshInFlight = false;
-                        afterLane();
                     }
                 };
                 const deferredBootApplyInner = async (r, lateGen) => {
@@ -1159,7 +1178,7 @@ export async function createWebAdminRuntime(ctx) {
                             groups: refusedLate.map((g) => g.group),
                             note: "late-boot candidate had a refused group — the LKG/ETag stay on the last FULLY applied generation; the refresh cadence re-judges the same tree",
                         });
-                        const partialSignalLate = signalRestart({ applied: "partial", effective: r.effective, baseline: undefined, refused: refusedLate.map((g) => g.group) });
+                        const partialSignalLate = signalRestart({ applied: "partial", gen: lateGen, effective: r.effective, baseline: undefined, refused: refusedLate.map((g) => g.group) });
                         logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...restartLogFields(partialSignalLate) });
                         return;
                     }
@@ -1167,16 +1186,16 @@ export async function createWebAdminRuntime(ctx) {
                     latestEffective = r.effective;
                     ccEtag = r.etag;
                     const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
-                    const signalLate = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: undefined, lkgPersisted: lkgPersistedLate });
+                    const signalLate = signalRestart({ applied: "complete", gen: lateGen, effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: undefined, lkgPersisted: lkgPersistedLate });
                     logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...restartLogFields(signalLate) });
                 };
                 if (bootConfigPending) {
                     const arrivalGen = reserveArrivalGeneration();
-                    const continueArrival = (r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : deferredBootApply(r, arrivalGen));
+                    const continueArrival = (r) => void (lkgBooted ? runTick({ result: r, ordinal: arrivalGen }) : enterLane(() => deferredBootApply(r, arrivalGen)));
                     void bootConfigPending.then((r) => {
                         if (r !== null && configProvider.kind === "remote" && candidateIdentityOf(r.effective) !== currentIdentity()) {
                             logger.warn("config_boot_arrival_identity_changed", { note: "the late boot pull landed under a center credential that is no longer current — not adopted; re-pulling once under the current credential" });
-                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { err: seatText("operator-log-text", String(err)), note: "the refresh cadence retries under the current credential" }));
+                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { cause: refreshFailureCause(err), err: seatText("operator-log-text", String(err)), note: "the refresh cadence retries under the current credential" }));
                             return;
                         }
                         continueArrival(r);
@@ -1189,9 +1208,10 @@ export async function createWebAdminRuntime(ctx) {
                 clearInterval(ccTimer);
                 ccTimer = undefined;
             }
-            credentialRenewer?.stop();
+            const credentialSettled = credentialRenewer?.stop() ?? Promise.resolve();
             unwatchCredential?.();
             unwatchCredential = undefined;
+            return credentialSettled;
         },
         centerCredentialState() {
             return cc === undefined ? undefined : buildCenterCredentialHealthView(cc.credential.health(), credentialRenewer);

package/dist/boot/webfetch-summarize-lane.d.ts

@@ -24,7 +24,7 @@
  * 当年 core 的摘要器没有凭据座,只能在 brain 外面包一层注入 `options.apiKey`(`createPerModelKeyBrain`)。
  * core 7.51.0 起 `WebFetchSummarizerOptions.getApiKeyAndHeaders` 是与 `TaskSpec` / `SideQuerySpec` 同一签名的座
  * (每次摘要按摘要器的模型解一次,`{ apiKey, headers }` 两半都收)⇒ 那层包装退役:`RunnerDeps.brain` 原样交给
- * 摘要器,座位由与 side-query / 记忆整理**同一只**座位工厂(`createPerModelAuthSeat`)填充:
+ * 摘要器,座位由与 side-query **同一只**座位工厂(`createPerModelAuthSeat`)填充(两面都每次现取模型、不焊模型;记忆整理席焊住 Model,凭据随座冻结,见 `boot/memory-consolidation.ts`):
  *  · 有 per-model key ⇒ 请求带模型自己的凭据;
  *  · 无 ⇒ 座位回 `undefined` ⇒ 交回 core 按它自己的 key↔URL 配对法判(部署根上的模型带网关 key;
  *    entry URL 不在部署根上 ⇒ `route.credential_mismatch` 响亮拒 —— core 7.51.0 起没有「未声明部署根」的

package/dist/boot-reclaim.d.ts

@@ -15,7 +15,9 @@ export interface ReclaimableRunStore {
 }
 /** A checkpoint store just enough to answer "is this session a resume-in-progress?" (pending checkpoint). */
 export interface ReclaimCheckpointProbe {
-    findPendingTokenBySession: (sessionId: string) => Promise<unknown>;
+    findPendingTokenBySession: (sessionId: string, scope: undefined, binding: {
+        readonly axis: "run";
+    }) => Promise<unknown>;
 }
 /**
  * Reclaim runs orphaned by a previous host-lane engine process (flip orphaned `running` → failed + release their

package/dist/boot-reclaim.js

@@ -3,7 +3,7 @@ export async function reclaimOrphansAtBoot(runStore, checkpointStore, logger) {
     if (typeof store?.reclaimOrphanedAtBoot !== "function")
         return 0;
     const isResumable = checkpointStore
-        ? async (sid) => Boolean(await checkpointStore.findPendingTokenBySession(sid))
+        ? async (sid) => Boolean(await checkpointStore.findPendingTokenBySession(sid, undefined, { axis: "run" }))
         : undefined;
     const reclaimedCount = await store.reclaimOrphanedAtBoot(isResumable);
     if (reclaimedCount > 0)

package/dist/brain.d.ts

@@ -1,6 +1,6 @@
 import { type Brain, type BreakerState, type Model } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
-import { type SealedCustodyPoison } from "./key-resolver.js";
+import { type CredentialIdentity } from "./key-resolver.js";
 import { type RestartSliceCtx } from "./web-admin-client/restart-signal.js";
 /**
  * 配了快切层(failover ≥2 路 / 断路器)时,**每路**的重试上限。
@@ -62,24 +62,13 @@ export type DegradeRoutePlane = Pick<ServiceConfig, "degrade" | "models" | "gate
  */
 export declare function degradeTargetOf(config: Pick<ServiceConfig, "degrade" | "models">): Model | undefined;
 /**
- * [ref](R1):降级壳里目标自有凭据的**身份**(不是值)—— 与目标那只 Model 同一代,在 createBrain 组壳那一刻冻结。
- *  · `apiKeyEnv` —— 那一代给目标配的 env 变量**名**;壳每跳按这个名字现读值(同名轮换仍热;变量被删 ⇒ [ref] 起 `env_missing` 毒丸,跳响亮拒 —— 7.105.0 及以前是「与自有凭据缺席同一臂」、落网关 key 档)。
- *  · `sealed` —— 那一代托管密钥的解封产物(明文,或解不开时的毒丸;与 `config.modelApiKeys` 的值同型)。托管密钥的身份是它的密文;
- *    本进程的托管店在 boot 读一次、此后不变(`ensureSealedKeyStore`),同一密文恒解出同一产物 —— 所以持有那一代的产物就是持有
- *    那一代的身份(壳里没有密文与托管店,也不需要)。重贴 = 新 key = 新身份,要重启才进壳 —— `degrade-route` 指纹带它的身份摘要,
- *    所以重贴会签。🔴 明文是活秘密:只活在壳的闭包里,指纹只取摘要({@link degradeRouteFingerprint}),绝不进日志 / 序列化面。
- * 目标没有自有凭据 ⇒ `{}`。两张表至多一个条目有效(registry-core 互斥:带 sealedApiKey 的条目不落 modelApiKeyEnv)。
+ * [ref]:读出 `target`(降级壳焊的那只目标,{@link degradeTargetOf})此刻的凭据**身份**(不是值;读法是 key 链的 `credentialIdentityOf`,
+ * 与记忆整理席同一只)—— 唯一读法:createBrain 组壳时与目标 Model 一起冻结它,`degrade-route` 指纹的两侧读数与启动摘要同读它。
+ * 查的名字与序:目标真名、再 `degrade.to`(后者可能是 `default` 别名,两张 key 表按真名索引、env 车道的目录则反过来);每个名字上托管密钥压过 env 引用。
+ * 托管密钥重贴 = 新身份,要重启才进壳 —— 指纹带它的身份摘要,所以重贴会签。🔴 明文是活秘密:只活在壳的闭包里,指纹只取摘要,绝不进日志 / 序列化面。
+ * 目标没有自有凭据 ⇒ `{}`。
  */
-export interface DegradeCredentialIdentity {
-    readonly apiKeyEnv?: string;
-    readonly sealed?: string | SealedCustodyPoison;
-}
-/**
- * [ref]:读出 `target`(降级壳焊的那只目标,{@link degradeTargetOf})此刻的凭据身份 —— **唯一**读法:createBrain 组壳时冻结它,
- * `degrade-route` 指纹的两侧读数与启动摘要同读它。查表的键与序与修前 `fbOwnApiKey` 同:目标真名、再 `degrade.to`(后者可能是
- * `default` 别名,两张 key 表按真名索引、env 车道的目录则反过来);每个名字上托管密钥压过 env 引用(key-resolver 的序)。
- */
-export declare function degradeCredentialIdentityOf(config: Pick<ServiceConfig, "degrade" | "modelApiKeyEnv" | "modelApiKeys">, target: Pick<Model, "name">): DegradeCredentialIdentity;
+export declare function degradeCredentialIdentityOf(config: Pick<ServiceConfig, "degrade" | "modelApiKeyEnv" | "modelApiKeys">, target: Pick<Model, "name">): CredentialIdentity;
 /**
  * [ref]:降级壳的**路由指纹**(纯数据)—— `degrade-route` 重启片 `baked` / `current` 两侧读数的唯一读法。
  *

package/dist/brain.js

@@ -2,8 +2,7 @@ import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain,
 import { routeKeyOf } from "@sema-agent/core";
 import { buildDefaultResilience } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
-import { createHash } from "node:crypto";
-import { isModelKeyPoison, modelKeyPoisonIdentity } from "./key-resolver.js";
+import { credentialIdentityFingerprint, credentialIdentityOf } from "./key-resolver.js";
 import { anthropicRouteRoot, brainLaneFor, mountRoutes, routeTableOf } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { anthropicLaneCredentialOf, declaredCredential } from "./model-route-gap.js";
@@ -156,12 +155,9 @@ export function degradeTargetOf(config) {
 }
 export function degradeCredentialIdentityOf(config, target) {
     for (const name of config.degrade === undefined ? [target.name] : [target.name, config.degrade.to]) {
-        const sealed = config.modelApiKeys?.[name];
-        if (sealed !== undefined)
-            return { sealed };
-        const apiKeyEnv = config.modelApiKeyEnv?.[name];
-        if (apiKeyEnv !== undefined)
-            return { apiKeyEnv };
+        const identity = credentialIdentityOf(config, name);
+        if (identity.sealed !== undefined || identity.apiKeyEnv !== undefined)
+            return identity;
     }
     return {};
 }
@@ -175,17 +171,9 @@ function degradeWeldFingerprint(config, target, credential) {
     return {
         model: catalogEntryFingerprint(target),
         endpoint: openaiRouteBaseUrl(target.baseUrl, config.gatewayBaseUrl) ?? null,
-        apiKeyEnv: credential.apiKeyEnv ?? null,
-        sealedKey: sealedIdentityFingerprint(credential.sealed),
+        ...credentialIdentityFingerprint(credential),
     };
 }
-function sealedIdentityFingerprint(sealed) {
-    if (sealed === undefined)
-        return null;
-    if (isModelKeyPoison(sealed))
-        return { poisoned: modelKeyPoisonIdentity(sealed), reason: sealed.reason };
-    return { digest: createHash("sha256").update(sealed, "utf8").digest("hex").slice(0, 16) };
-}
 export function buildFailoverFirstByteNotice(config) {
     const r = config.resilience ?? DEFAULT_RESILIENCE;
     const fallbacks = config.gatewayFallbackUrls.length;

package/dist/budget.js

@@ -1,5 +1,5 @@
 import { isModelPriced, modelCostToPricing } from "@sema-agent/core";
-import { currentPrincipal } from "./observability/principal-context.js";
+import { currentPerson } from "./observability/principal-context.js";
 import { isPermissionRuleEventKind, permissionRuleEventWordOf } from "./observability/permission-rule-events.js";
 import { promptManifestRecordOf, configAssembledRecordOf } from "./observability/prompt-manifest.js";
 import { crossBoundaryTaintEventData } from "./trace/project.js";
@@ -85,9 +85,9 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
             metrics.inc("brain_calls_total", { provider: providerName(e.provider ?? "unknown"), model: modelId(e.model) });
             if (e.costMicroUsd) {
                 metrics.inc("model_cost_micro_usd_total", { model: modelId(e.model) }, e.costMicroUsd);
-                const principal = currentPrincipal();
-                if (principal)
-                    costQuota?.add(principal, e.costMicroUsd);
+                const person = currentPerson();
+                if (person)
+                    costQuota?.add(person, e.costMicroUsd);
             }
             else if (e.costMicroUsd === undefined) {
                 metrics.inc("brain_calls_unpriced_total", { model: modelId(e.model) });
@@ -96,8 +96,8 @@ export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLe
             const qwRaw = quotaWeightFor?.(e.model);
             const qw = typeof qwRaw === "number" && Number.isFinite(qwRaw) && qwRaw > 0 ? qwRaw : 1;
             const weightedTokens = Math.round((e.totalInputTokens + e.completionTokens) * qw);
-            fleetUsage?.record(currentPrincipal(), e.model, e.taskId, { inputTokens: e.totalInputTokens, outputTokens: e.completionTokens, ...(e.costMicroUsd !== undefined ? { costMicroUsd: e.costMicroUsd } : {}), weightedTokens, quotaWeightAtUse: qw });
-            fleetLease?.recordSpend(currentPrincipal(), { weightedTokens, ...(e.costMicroUsd !== undefined ? { costMicroUsd: e.costMicroUsd } : {}) });
+            fleetUsage?.record(currentPerson(), e.model, e.taskId, { inputTokens: e.totalInputTokens, outputTokens: e.completionTokens, ...(e.costMicroUsd !== undefined ? { costMicroUsd: e.costMicroUsd } : {}), weightedTokens, quotaWeightAtUse: qw });
+            fleetLease?.recordSpend(currentPerson(), { weightedTokens, ...(e.costMicroUsd !== undefined ? { costMicroUsd: e.costMicroUsd } : {}) });
             if (e.turn !== undefined) {
                 if (e.firstTokenMs !== undefined)
                     metrics.observe("brain_first_token_ms", e.firstTokenMs);

package/dist/capabilities/center-plugins.d.ts

@@ -60,10 +60,16 @@ export declare const PLUGIN_MANIFEST_MAX_BYTES: number;
  *  布局同族)。返回 ok:true+dir:undefined = 插件没有 skills 目录(可以只有 commands——那是 cli 壳的
  *  半场,worker 装 0 个 skill 不算失败);ok:false = 路径逃逸/manifest 本体畸形,整条拒装。
  *  manifest 臂分立(V2-⑦,原 broad-catch 是 fail-open):**不存在**=可选面,缺省 skills/;**存在但**
- *  本体逃逸根外/非普通文件/超界/读失败/JSON 坏 = ok:false 走既有 warning 面。 */
+ *  本体逃逸根外/非普通文件/超界/读失败/JSON 坏 = ok:false 走既有 warning 面。
+ *
+ *  `hooksModule`(ok:true 时同一趟顺带回报,**不**第二次读 manifest):这个插件带不带 hooks 模块 —— 入口有两个,任一在场即真:
+ *  ① manifest 本体是对象且**自有**顶层键 `hooks` 在场(内联对象或路径串都算;只判键在不在,值不判,嵌套里的 `hooks` 字样不算);
+ *  ② `hooks/hooks.json` 条目在场({@link hooksFileEntryMayBePresent},只问条目、不读内容)。
+ *  只是一条事实交给调用方去响(不改上面的装载判定一字:manifest 是非对象 JSON 时照旧可装、缺省 skills/)。 */
 export declare function resolvePluginSkillsRoot(cloneRoot: string): {
     ok: true;
     dir?: string;
+    hooksModule: boolean;
 } | {
     ok: false;
     reason: string;

package/dist/capabilities/center-plugins.js

@@ -2,10 +2,11 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { promises as fsp, realpathSync, existsSync, readFileSync, lstatSync, statSync } from "node:fs";
 import { join, resolve, isAbsolute, sep } from "node:path";
-import { ensureDir } from "@sema-agent/core";
+import { ensureDir, hostOfUrl, HOST_UNREADABLE_SENTENCE } from "@sema-agent/core";
 import { assertConfined, loadSkills } from "./skills.js";
 import { buildDisplaySafeUrl, redactSecrets } from "../trace/redact.js";
 import { gitSubprocessEnv } from "../server-secret-env.js";
+import { errorCodeOf } from "../observability/err-text.js";
 const execFileP = promisify(execFile);
 export const MAX_PLUGIN_SOURCE_URL_CHARS = 2048;
 export const DEFAULT_PLUGIN_ALLOW_HOSTS = ["github.com"];
@@ -36,14 +37,12 @@ export function validatePluginDecl(decl, allowHosts) {
     if (!/^https:\/\//i.test(url)) {
         return { ok: false, name, reason: `plugin source must be an https:// URL (contract: https-only; got ${buildDisplaySafeUrl(url)})` };
     }
-    let host;
-    try {
-        host = new URL(url).hostname.toLowerCase();
-    }
-    catch {
-        return { ok: false, name, reason: "https url does not parse" };
+    const reading = hostOfUrl(url);
+    if ("unreadable" in reading) {
+        return { ok: false, name, reason: `plugin source url names no host this allowlist can judge — ${HOST_UNREADABLE_SENTENCE[reading.unreadable]}` };
     }
-    if (!allowHosts.some((h) => h.toLowerCase() === host)) {
+    const host = reading.host;
+    if (!allowHosts.some((h) => allowlistHostOf(h) === host)) {
         return { ok: false, name, reason: `host ${host} not in PLUGINS_ALLOW_HOSTS (default github.com; extend with a comma-separated https mirror domain list)` };
     }
     if (decl.sha !== undefined) {
@@ -54,6 +53,13 @@ export function validatePluginDecl(decl, allowHosts) {
     }
     return { ok: true, name, url };
 }
+function allowlistHostOf(entry) {
+    const bare = !/[/?#@\\\s]/.test(entry) && (entry.startsWith("[") ? entry.endsWith("]") : !entry.includes(":"));
+    if (!bare || entry === "")
+        return undefined;
+    const reading = hostOfUrl(`https://${entry}/`);
+    return "host" in reading ? reading.host : undefined;
+}
 export function gitClonePlan(o) {
     if (o.sha === undefined) {
         return { steps: [["clone", "--depth", "1", "--quiet", o.url, o.dest]] };
@@ -69,6 +75,7 @@ export function gitClonePlan(o) {
 export const PLUGIN_MANIFEST_MAX_BYTES = 64 * 1024;
 export function resolvePluginSkillsRoot(cloneRoot) {
     let skillsPath = "skills";
+    let manifestHasHooksKey = false;
     const rootReal = realpathSync(cloneRoot);
     const manifestPath = join(cloneRoot, ".claude-plugin", "plugin.json");
     let manifestPresent = false;
@@ -90,11 +97,13 @@ export function resolvePluginSkillsRoot(cloneRoot) {
             const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
             if (typeof manifest.skillsPath === "string" && manifest.skillsPath !== "")
                 skillsPath = manifest.skillsPath;
+            manifestHasHooksKey = Object.hasOwn(manifest, "hooks");
         }
         catch (e) {
             return { ok: false, reason: `plugin manifest rejected: ${e instanceof Error ? e.message : String(e)}` };
         }
     }
+    const hooksModule = manifestHasHooksKey || hooksFileEntryMayBePresent(cloneRoot);
     if (isAbsolute(skillsPath))
         return { ok: false, reason: `skillsPath must be relative (got ${skillsPath})` };
     const candidate = resolve(rootReal, skillsPath);
@@ -102,12 +111,22 @@ export function resolvePluginSkillsRoot(cloneRoot) {
         return { ok: false, reason: `skillsPath escapes the plugin root (${skillsPath})` };
     }
     if (!existsSync(candidate))
-        return { ok: true };
+        return { ok: true, hooksModule };
     const real = realpathSync(candidate);
     if (real !== rootReal && !real.startsWith(rootReal + sep)) {
         return { ok: false, reason: `skillsPath resolves outside the plugin root via symlink (${skillsPath})` };
     }
-    return { ok: true, dir: candidate };
+    return { ok: true, dir: candidate, hooksModule };
+}
+function hooksFileEntryMayBePresent(cloneRoot) {
+    try {
+        lstatSync(join(cloneRoot, "hooks", "hooks.json"));
+        return true;
+    }
+    catch (e) {
+        const code = errorCodeOf(e);
+        return code !== "ENOENT" && code !== "ENOTDIR";
+    }
 }
 const PLUGINS_DOMAIN_FAILURE_NAME = "(plugins domain)";
 function declaredPlugins(eff) {
@@ -198,6 +217,9 @@ export async function applyCenterPlugins(baseline, eff, opts) {
                 opts.logger?.warn("center_plugin_manifest_rejected", { plugin: v.name, reason: rootCheck.reason });
                 continue;
             }
+            if (rootCheck.hooksModule) {
+                opts.logger?.warn("center_plugin_hooks_not_loaded", { plugin: v.name, note: `engine does not load the hooks module of center plugin ${v.name}; skills are loaded` });
+            }
             if (!rootCheck.dir)
                 continue;
             const loaded = loadSkills(rootCheck.dir, { source: "center", confineTo: liveDir, toolsShareThisFilesystem: opts.toolsShareThisFilesystem, ...(opts.logger !== undefined ? { logger: opts.logger } : {}) });

package/dist/capabilities/center-wiring.js

@@ -1,4 +1,4 @@
-import { authBridgeIssuerOf } from "../auth-bridge.js";
+import { authBridgeIssuerOf } from "../identity-source.js";
 import { isDisclosableIdentity } from "@sema-agent/settings-schema";
 export const CENTER_ISSUER_WORDS = ["explicit", "fallback"];
 export function buildCenterWiring(f) {

package/dist/capabilities/composite-members.d.ts

@@ -41,14 +41,14 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly deviceExecutor: readonly ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management", "relayUrl"];
     readonly fleet: readonly ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"];
     readonly memoryEngine: readonly ["backend", "vectorMode"];
-    readonly store: readonly ["declared", "backend", "durable", "degradedReason", "sql"];
+    readonly store: readonly ["declared", "backend", "durability", "degradedReason", "sql"];
     readonly centerWiring: readonly ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"];
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
     readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies", "autoCompactEnabled"];
     readonly settings: readonly ["permissions"];
     readonly settingsContract: readonly ["version", "hookEntryFields"];
-    readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
+    readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "refusedBy", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
     readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];
     readonly retention: readonly ["mode", "maxAgeDays"];

package/dist/capabilities/composite-members.js

@@ -2,14 +2,14 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     deviceExecutor: ["enabled", "protocolVersion", "maxInflightPerDevice", "wsPath", "management", "relayUrl"],
     fleet: ["stream", "sessionScope", "observe", "resume", "bgNotifyFailClosed", "steerPriority", "hookFailureNotice", "leaseClient", "generationEcho"],
     memoryEngine: ["backend", "vectorMode"],
-    store: ["declared", "backend", "durable", "degradedReason", "sql"],
+    store: ["declared", "backend", "durability", "degradedReason", "sql"],
     centerWiring: ["effectivePull", "effectiveRevision", "lease", "leaseHealth", "failMode", "usageReport", "issuer", "worker", "caller"],
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks", "pluginHooks", "managedHookGroups", "httpHookAllowlists", "tightenOnlySeats", "approvalFrameFamilies", "autoCompactEnabled"],
     settings: ["permissions"],
     settingsContract: ["version", "hookEntryFields"],
-    permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
+    permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "refusedBy", "model"],
     writeProtection: ["armed", "rows", "replaced"],
     executionLane: ["provider", "toolsOnThisHost", "isolated"],
     retention: ["mode", "maxAgeDays"],