@sema-agent/server 7.147.0 → 7.149.0

package/dist/audit.d.ts

@@ -2,6 +2,7 @@ import { type StoredPromptEpoch } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type LocalSessionRows } from "./plugins/local-session-window.js";
+import type { Subject } from "./owner-brands.js";
 /**
  * Audit view of a session = its **current context** (the live messages + the last compaction's
  * summary), i.e. the floor-bounded window — never the full raw transcript. This matches the
@@ -38,10 +39,10 @@ export type RewindHandles = ReadonlyMap<string, string>;
 /** 会话视图读口(`ServiceDeps.sessionAudit`)的读者参数:`reader` = 读这张视图的**已验身份**(无身份 = `null`)。给了 ⇒ 这是一次**视图读**:用户消息行投回退手柄、体顶层投 `agent`(`session-agent.ts` 的 `readSessionAgent`);
  *  不给(只要归属的调用方:memory-status / 自助抹除)⇒ 两样投影的读都不付。 */
 export interface SessionAuditReadOpts {
-    readonly reader: string | null;
+    readonly reader: Subject | null;
 }
 /**
- * {@link RewindHandles} 的唯一铸点。一条规则:**一只用户条目带手柄,当且仅当锚店里恰好一行 `entry_id` = 它、`owner` = 读者** ——
+ * {@link RewindHandles} 的唯一铸点。一条规则:**一只用户条目带手柄,当且仅当锚店里恰好一行 `entry_id` = 它、`owner` = 读者**(存储键的桥 `owner-faces.ts` 的 `sameKey`:锚属主经 `ownerKeyOf` 成键,null 只同 null)——
  * 这正是 `resumeAt` 解析的谓词(`resolve(sessionId, eventId, owner)`:同会话、同 event、属主 null-safe 相等),所以行上出现的手柄
  * 读者拿去回退一定解得出;别人的锚(混属主会话)不投,同一条目被两行锚点名不挑(两只都缺席,不猜)。老条目没有锚 ⇒ 缺席。
  * E18 助手文本锚(按 live eventId 键入,指向助手条目)也在锚店里 —— 它们只会点名助手条目,投影只看用户行,所以不上 wire。
@@ -50,7 +51,7 @@ export declare function buildRewindHandles(anchors: ReadonlyArray<{
     readonly eventId: string;
     readonly entryId: string;
     readonly owner: string | null;
-}>, reader: string | null): RewindHandles;
+}>, reader: Subject | null): RewindHandles;
 /** Build the audit view from the durable log. Returns undefined if the session does not exist. `handles` = the reader's
  *  rewind-handle projection ({@link buildRewindHandles}); absent ⇒ no `taskId` keys. */
 export declare function buildSessionAudit(pool: Pool, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
@@ -63,6 +64,12 @@ export declare function buildSessionAuditPg(pool: PgPool, sessionId: string, han
  *  floor — and on every backend that is what the run reads: the SQL twins' run wakes the same window; the local run wakes the whole
  *  tree, and the local window is cut from that tree's branch, with the anchor walking the branch below the floor. */
 export declare function buildSessionAuditLocal(rows: LocalSessionRows, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
+/**
+ * 🔴 **历史读面过脱敏的叶名表**(能力位 `sessionReadRedaction` 的唯一来源)= {@link SESSION_READ_SHAPES} 里处置词不是 `"verbatim"` 的每一叶,写作 `<形>.<键>`(表序)。
+ * 不在表里的叶是**逐字**的(人写的输入、标识 / join 键、闭集词、数字);表外的键 / 角色 / 段类型整只深扫、从不放行,不进名单(名单只列表上登记过的叶)。
+ * `"parts"` 叶(`assistant.content` / `toolResult.content` / `attachmentFrame.content`)按段表读:文本段 / reasoning 段 / 工具实参脱,图片 / 文档字节与签名逐字。
+ */
+export declare const SESSION_READ_REDACTED_LEAVES: readonly string[];
 /**
  * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
  * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;

package/dist/audit.js

@@ -6,10 +6,11 @@ import { redactModelText } from "./observability/run-terminal.js";
 import { redactDeepWith } from "./trace/redact.js";
 import { projectToolStructured } from "./trace/tool-output-media.js";
 import { INJECTED_BLOCK_RE, isAttachmentFrame } from "./user-authored-text.js";
+import { ownerKeyOf, sameKey } from "./owner-faces.js";
 export function buildRewindHandles(anchors, reader) {
     const byEntry = new Map();
     for (const a of anchors) {
-        if ((a.owner ?? null) !== reader)
+        if (!sameKey(reader, ownerKeyOf(a.owner ?? null)))
             continue;
         byEntry.set(a.entryId, byEntry.has(a.entryId) && byEntry.get(a.entryId) !== a.eventId ? null : a.eventId);
     }
@@ -144,14 +145,21 @@ const MESSAGE_READ_TREATMENT = {
     },
 };
 const ATTACHMENT_FRAME_READ_TREATMENT = { ...MESSAGE_READ_TREATMENT.user, content: "parts" };
+const SESSION_READ_SHAPES = { ...MESSAGE_READ_TREATMENT, attachmentFrame: ATTACHMENT_FRAME_READ_TREATMENT };
+export const SESSION_READ_REDACTED_LEAVES = Object.freeze(Object.entries(SESSION_READ_SHAPES).flatMap(([shape, table]) => Object.entries(table)
+    .filter(([, treatment]) => treatment !== "verbatim")
+    .map(([key]) => `${shape}.${key}`)));
+function shapeOf(m) {
+    const role = m.role;
+    if (role === "user" && isAttachmentFrame(m))
+        return "attachmentFrame";
+    return typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role) ? role : undefined;
+}
 function readMessage(m) {
     if (isPlainRecord(m)) {
-        const role = m.role;
-        if (role === "user" && isAttachmentFrame(m))
-            return readByTable(m, ATTACHMENT_FRAME_READ_TREATMENT);
-        if (typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role)) {
-            return readByTable(m, MESSAGE_READ_TREATMENT[role]);
-        }
+        const shape = shapeOf(m);
+        if (shape !== undefined)
+            return readByTable(m, SESSION_READ_SHAPES[shape]);
     }
     return deepScrub(m);
 }

package/dist/auth-bridge.d.ts

@@ -2,20 +2,6 @@ import { VerifiedIdentity, type AuthBridgeErrorCode } from "@sema-agent/settings
 import { type TokenScopeRefusal } from "@sema-agent/settings-schema/api/scopes";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
-/**
- * [ref] ② —— 鉴权桥 issuer 的**唯一**取值(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读,不各写一份回退):
- * 显式 `AUTH_BRIDGE_ISSUER`(`config.authBridgeIssuer`)恒赢 ⇒ `source:"explicit"`;缺席则回退中心基址 `webAdmin.baseUrl`
- * (配了中心即默认开桥)⇒ `source:"fallback"`;两者都没有 ⇒ `undefined`(桥不装)。
- */
-export declare function authBridgeIssuerOf(config: {
-    readonly authBridgeIssuer?: string | undefined;
-    readonly webAdmin?: {
-        readonly baseUrl: string;
-    } | undefined;
-}): {
-    readonly issuer: string;
-    readonly source: "explicit" | "fallback";
-} | undefined;
 export interface WebAdminJwtVerifierOptions {
     /** R4 — 期望 iss(registry 的 SSO_ISSUER;默认=SEMA_WEB_ADMIN_URL,双侧去尾斜杠比较)。 */
     issuer: string;
@@ -72,14 +58,22 @@ type ReportedOutcome = {
  * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
-/** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */
+/**
+ * The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache, and the issuer it verifies for.
+ * This is also the type of the injected seat (`ServiceDeps.webAdminJwtVerifier`): an embedder's verifier states which issuer it verifies, so `createHttpServer`
+ * can pair it with the config's bridge ("which issuer does this deployment accept" has one source — the config — and one comparison, at that seat).
+ */
 export interface WebAdminJwtVerifier {
+    /** The issuer this verifier verifies tokens for, in {@link normalizeBridgeIssuer} form (what the R4 `iss` check compares against). The factory mints it from its own option; the seat compares it with the config's reading. */
+    readonly issuer: string;
     verify: (bearer: string) => Promise<VerifyOutcome>;
 }
 /** 缓存键的常规刷新周期缺省(秒):过期后下一发在后台重拉,当前请求不等。 */
 export declare const DEFAULT_JWKS_TTL_SEC: number;
 /** 一次 JWKS 拉取的时限(毫秒):kid 未知、超离线宽限、后台刷新三条路用同一只拉取,同一个时限。 */
 export declare const JWKS_FETCH_TIMEOUT_MS = 10000;
+/** The one normal form of a bridge issuer: trailing slashes folded. The R4 `iss` check compares both sides in this form, and the `createHttpServer` pairing seat compares the verifier's {@link WebAdminJwtVerifier.issuer} with the config's reading in this same form (one reading, so the two can never disagree about what "the same issuer" means). */
+export declare const normalizeBridgeIssuer: (s: string) => string;
 /**
  * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为拒因闭集
  * {@link AuthBridgeRefusal}(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。

package/dist/auth-bridge.js

@@ -3,13 +3,6 @@ import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTE
 import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { centerJwksFetch } from "./web-admin-client/center-request.js";
-export function authBridgeIssuerOf(config) {
-    if (config.authBridgeIssuer !== undefined)
-        return { issuer: config.authBridgeIssuer, source: "explicit" };
-    if (config.webAdmin !== undefined)
-        return { issuer: config.webAdmin.baseUrl, source: "fallback" };
-    return undefined;
-}
 function recordBridgeRefusal(sinks, error, at = {}) {
     sinks.metrics?.inc("auth_bridge_verify_total", { outcome: error });
     sinks.logger?.warn?.("auth_bridge_rejected", { error, ...(at.kid ? { kid: at.kid.slice(0, 128) } : {}), ...(at.iss !== undefined ? { iss: at.iss } : {}) });
@@ -47,9 +40,9 @@ function b64urlJson(seg) {
         return undefined;
     }
 }
-const stripSlash = (s) => s.replace(/\/+$/, "");
+export const normalizeBridgeIssuer = (s) => s.replace(/\/+$/, "");
 export function createWebAdminJwtVerifier(opts) {
-    const issuer = stripSlash(opts.issuer);
+    const issuer = normalizeBridgeIssuer(opts.issuer);
     const displayIssuer = buildDisplaySafeUrl(issuer);
     const jwksUrl = opts.jwksUrl ?? `${issuer}${WEB_ADMIN_JWKS_PATH}`;
     const clockSkewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
@@ -129,7 +122,7 @@ export function createWebAdminJwtVerifier(opts) {
         const kid = typeof header.kid === "string" ? header.kid : undefined;
         if (!kid)
             return fail("malformed");
-        const iss = typeof payload.iss === "string" ? stripSlash(payload.iss) : undefined;
+        const iss = typeof payload.iss === "string" ? normalizeBridgeIssuer(payload.iss) : undefined;
         if (iss !== issuer)
             return fail("unknown_issuer", kid);
         if (classifyTimeClaims(payload, Math.floor(now() / 1000), clockSkewSec) !== "ok")
@@ -170,6 +163,6 @@ export function createWebAdminJwtVerifier(opts) {
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: "ok" });
         return { ok: true, identity: { ...mapped.identity, scope: scoped.scope } };
     }
-    return { verify };
+    return { issuer, verify };
 }
 //# sourceMappingURL=auth-bridge.js.map

package/dist/auth-keys.d.ts

@@ -2,7 +2,8 @@
  * AUTH KEY-SET parsing ([ref] A4) — the env→key-set decoders for the two D-G credential planes, moved VERBATIM
  * out of security.ts: {@link parseApprovalHmacKeys} (APPROVAL_HMAC_KEYS — the rotating HMAC secret set, decision
  * INTEGRITY) and {@link parsePrincipalJwks} (PRINCIPAL_JWT_PUBKEYS — the rotating issuer public-key set, principal
- * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
+ * IDENTITY), plus {@link parseServiceAuthTokens} (SERVICE_AUTH_TOKENS — the per-system service token table). config.ts consumes
+ * these decoders + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
  * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([ref] 兼容面全清).
@@ -54,4 +55,12 @@ export interface PrincipalJwtKey {
  *  [ref]: fail-closed 语义逐字不变,但每条被丢弃的条目经 `onReject` 报出(序号 + 缺陷字段名,不带值)——
  *  这里的 key 是**公**钥,但 reason 仍只说字段名,与 HMAC 那条同形(两个出口的口径不该分岔)。 */
 export declare function parsePrincipalJwks(raw: string | undefined, onReject: OnKeySetRejection): PrincipalJwtKey[];
+/**
+ * Parse SERVICE_AUTH_TOKENS — the per-system service credential table, `tok=system` pairs separated by commas (token →
+ * system name; the `source` of a run is derived from the token, never self-asserted). Each pair is trimmed and split at
+ * its FIRST `=` (a system name may hold `=`); a pair without `=`, or with an empty token or system, is not an entry.
+ * THE one reading: `loadConfig` builds `authTokens` from it, and the withheld table declares each token as a credential
+ * value of its own (`server-secret-env.ts`) — a copy of one token under another variable name is the same credential.
+ */
+export declare function parseServiceAuthTokens(raw: string | undefined): Record<string, string>;
 //# sourceMappingURL=auth-keys.d.ts.map

package/dist/auth-keys.js

@@ -63,4 +63,12 @@ export function parsePrincipalJwks(raw, onReject) {
     });
     return out;
 }
+export function parseServiceAuthTokens(raw) {
+    return Object.fromEntries((raw ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.includes("="))
+        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
+        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+}
 //# sourceMappingURL=auth-keys.js.map

package/dist/auto-mode-face.d.ts

@@ -45,7 +45,8 @@
  * `entitlementSource`(既有位)说的是「center 源在不在」;`armed` 说的是「按三态谓词此刻会不会武装」。
  * 两者刻意并存:前者告诉壳有没有组织面,后者告诉壳这台机器上 auto 到底是不是 default 的别名。
  */
-import { type PermissionMode, type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
+import { type PermissionMode, type RunnerDeps } from "@sema-agent/core";
+import type { AutoModeRefusedBy, RuntimeCapsReading } from "./runtime-caps-resolver.js";
 /**
  * 分类器席的模型 —— **调 core 的单一解析器** `classifierSeatModel({deps, main})`(core 7.20.0 / [ref],
  * 本仓 [ref] 的跨仓诉求兑现;契约句 `classifier.seat.one_resolver` 逐字:引擎的武装点与**显示这个席**
@@ -97,10 +98,10 @@ export interface AutoModeFaceDeps {
     /** `RunnerDeps.autoMode !== undefined`——**读**装配点那一位,不写字面 true(与 parked-revive 的
      *  `autoModeSeatMounted` 同一纪律:席位哪天改成有条件挂载,这里不能静默错供)。 */
     readonly seatMounted: boolean;
-    /** 合成后的 per-principal caps resolver(= 递给 `RunnerDeps.runtimeCapsResolver` 的同一只:center 客户端
-     *  → observer env 基线 → memory grant → 本地 auto deny,单一属主 boot/runtime-caps.ts)。缺席 = 无任何
-     *  per-principal 源(无 center、无本地 deny)⇒ caps undefined ⇒ 三态之「缺席=不阻」。 */
-    readonly resolveCaps?: ((principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>) | undefined;
+    /** 合成后的 per-principal caps **读数**(与递给 `RunnerDeps.runtimeCapsResolver` 同一段合成:center 客户端
+     *  → observer env 基线 → memory grant → 本地 auto deny,单一属主 boot/runtime-caps.ts 的 `runtimeCapsPeekReading`);读数里的 caps 与中心拒 auto 的来源词
+     *  出自同一个缓存项。缺席 = 无任何 per-principal 源(无 center、无本地 deny)⇒ caps undefined ⇒ 三态之「缺席=不阻」。 */
+    readonly resolveCaps?: ((principal: string | undefined) => RuntimeCapsReading | Promise<RuntimeCapsReading>) | undefined;
     /** 分类器**配置**的模型路由(server 侧按 core 的 role 回落序 `classifier → summarize → default` 从
      *  `config.roles` 读到的 catalog 名)。这是「配置了什么」,不是「这次真用了什么」——core 的
      *  `derivedRouteFallsBack` 可能在运行期回落到主模型;真值候 core 状态座。
@@ -115,8 +116,10 @@ export type AutoModeVerdict = {
 } | {
     readonly armed: false;
     readonly reason: AutoModeUnarmedReason;
-    readonly model?: string; /** 仅 resolver_fault 臂:错误原文(不上 wire,路由记 warn)。 */
-    readonly fault?: string;
+    readonly model?: string;
+    /** 仅 `org_denied` 臂、且中心亲口拒了 auto 时:是中心的哪一键拒的(上 wire 的 `permissionModeAuto.refusedBy`)。中心硬失败的 fail-closed 拒是本层自铸的,不带。 */
+    readonly refusedBy?: AutoModeRefusedBy;
+    /** 仅 resolver_fault 臂:错误原文(不上 wire,路由记 warn)。 */ readonly fault?: string;
 };
 /**
  * 三项合取的 server 侧裁决。`requestedMode` 缺席 = 按 auto 意图答(「若请求会不会武装」);`principal` =

package/dist/auto-mode-face.js

@@ -28,15 +28,18 @@ export async function judgeAutoModeArming(face, input) {
         return { armed: false, reason: entry.clamped ? "operator_floor" : "mode_not_auto", ...model };
     if (face === undefined || !face.seatMounted)
         return { armed: false, reason: "deployment_incapable" };
-    let caps;
+    let reading;
     try {
-        caps = face.resolveCaps !== undefined ? await face.resolveCaps(input.principal) : undefined;
+        reading = face.resolveCaps !== undefined ? await face.resolveCaps(input.principal) : undefined;
     }
     catch (err) {
         return { armed: false, reason: "resolver_fault", ...model, fault: err instanceof Error ? err.message : String(err) };
     }
-    if (caps?.autoMode === false)
-        return { armed: false, reason: input.localDeny ? "local_denied" : "org_denied", ...model };
+    if (reading?.caps?.autoMode === false) {
+        if (input.localDeny)
+            return { armed: false, reason: "local_denied", ...model };
+        return { armed: false, reason: "org_denied", ...model, ...(reading.autoModeRefusedBy !== undefined ? { refusedBy: reading.autoModeRefusedBy } : {}) };
+    }
     return { armed: true, ...model };
 }
 //# sourceMappingURL=auto-mode-face.js.map

package/dist/background-agent-name.d.ts

@@ -1,5 +1,23 @@
+/** 一行的名字读出来没有(判别式):读不出 = 这一行是**坏行**(无名 ∧ 句柄不是引擎形),`problem` 是给人读的一句话(进店的拒绝 / 跳行明细)。 */
+export type BackgroundAgentNameRead = {
+    readonly ok: true;
+    readonly name: string;
+} | {
+    readonly ok: false;
+    readonly problem: string;
+};
+/**
+ * 名字的**唯一读法**(上面那条规则)。判据 = 引擎自己的判据:`engineAgentName` 只为 `DURABLE_AGENT_HANDLE_RE` 形的句柄派生名字(core 导出的同一只正则),
+ * 于是「读不出」与「引擎会抛」是同一个事实,不是本仓另写一份判法。坏行怎么处置由读口按形定(后台子代店:按键读带码拒、列表只在证得不活时跳过 ——
+ * `stores-sql/background-agent-store-sql.ts`);单行读者用 {@link backgroundAgentNameOf}。
+ */
+export declare function readBackgroundAgentName(row: {
+    readonly name?: string | null;
+    readonly handle: string;
+}): BackgroundAgentNameRead;
+/** 单行读者的出口(停驻卡的复活参数、名册投影、写口的展示列):读不出 ⇒ 响亮抛(`TypeError`,与引擎同类)。 */
 export declare function backgroundAgentNameOf(row: {
-    readonly name?: string;
+    readonly name?: string | null;
     readonly handle: string;
 }): string;
 //# sourceMappingURL=background-agent-name.d.ts.map

package/dist/background-agent-name.js

@@ -1,5 +1,15 @@
-import { engineAgentName } from "@sema-agent/core";
+import { DURABLE_AGENT_HANDLE_RE, engineAgentName } from "@sema-agent/core";
+export function readBackgroundAgentName(row) {
+    if (row.name !== undefined && row.name !== null)
+        return { ok: true, name: row.name };
+    if (!DURABLE_AGENT_HANDLE_RE.test(row.handle))
+        return { ok: false, problem: `the row carries no name and its handle ${JSON.stringify(row.handle)} is not an engine agent handle ("a" + 6–32 hex digits), so no name can be derived` };
+    return { ok: true, name: engineAgentName(row.handle) };
+}
 export function backgroundAgentNameOf(row) {
-    return row.name ?? engineAgentName(row.handle);
+    const read = readBackgroundAgentName(row);
+    if (!read.ok)
+        throw new TypeError(`backgroundAgentNameOf: ${read.problem}`);
+    return read.name;
 }
 //# sourceMappingURL=background-agent-name.js.map

package/dist/background-session-reap.d.ts

@@ -11,7 +11,7 @@ export interface HardKillTally {
 /**
  * 受据的**唯一读者**:逐行一条 `background_shell_hard_kill`(`{ taskId, type, outcome, reason, owner?, retained? }` —— 不带
  * pid / shellId:core 契约「pid 不出 env」,受据上本来就没有),返回四词计数。本函数自己不抛;注入形 logger 若抛,异常**原样上抛**
- * 给调用方(kill 已在调用前落地,受据不丢):退出边界与 E21 级联各自在外层 try 里 warn / `console.error`(生产 sink 不抛,
+ * 给调用方(kill 已在调用前落地,受据不丢):退出边界与 E21 级联各自在外层 try 里 warn / 接缝的文本出口 `writeLogText`(生产 sink 不抛,
  * `observability/logger.ts` 的 `emit` 已包),停止口则让它走全局 500 —— 不在这里写静默的空 catch([ref] 棘轮)。
  * `outcome` 按 core 闭集穷举分派:集外词 = 编译红(`never` 臂),不是运行期的静默默认。
  */

package/dist/bake-runner/main.js

@@ -1,12 +1,14 @@
 import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { createLogger } from "../observability/logger.js";
+import { createEgressFetch } from "../egress-redirect.js";
 import { logConfigDiagnostics, parseEnvNameAllowlist, parseNumOrFailNonNegative } from "../config.js";
 import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
 import { declareServerWithheldEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { echoCallerText } from "../caller-text-echo.js";
 import { BakeRunner, } from "./runner.js";
+import { readUpstreamJson } from "../upstream-body.js";
 const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
 const BAKE_HEARTBEAT_FETCH_TIMEOUT_MS = 10_000;
 const BAKE_HOST_PROBE_TIMEOUT_MS = 10_000;
@@ -37,9 +39,10 @@ function loadEnv() {
 }
 function makeApiClient(env, log) {
     const auth = { authorization: `Bearer ${env.token}`, "content-type": "application/json" };
+    const egressFetch = createEgressFetch("declare the final image-api address as IMAGE_API_BASE");
     return {
         async claimNext() {
-            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/claim`, {
+            const res = await egressFetch(`${env.imageApiBase}/v1/images/bakes/claim`, {
                 method: "POST",
                 headers: auth,
                 body: JSON.stringify({ runnerId: env.runnerId }),
@@ -51,7 +54,7 @@ function makeApiClient(env, log) {
                 log.warn("bake_claim_rejected", { status: res.status });
                 return null;
             }
-            const c = (await res.json());
+            const c = (await readUpstreamJson(res));
             if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret) {
                 log.warn("bake_claim_malformed", { status: res.status, bakeId: typeof c.bakeId === "string" ? c.bakeId : undefined });
                 return null;
@@ -68,7 +71,7 @@ function makeApiClient(env, log) {
             };
         },
         async ingest(bakeId, ingestSecret, frame) {
-            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
+            const res = await egressFetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
                 method: "POST",
                 headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
                 body: JSON.stringify(frame),
@@ -77,13 +80,13 @@ function makeApiClient(env, log) {
             await res.arrayBuffer().catch(() => undefined);
         },
         async heartbeat(bakeId, ingestSecret) {
-            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
+            const res = await egressFetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
                 method: "POST",
                 headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
                 body: JSON.stringify({ event: "heartbeat" }),
                 signal: AbortSignal.timeout(BAKE_HEARTBEAT_FETCH_TIMEOUT_MS),
             });
-            const body = res.ok ? (await res.json().catch(() => ({}))) : {};
+            const body = res.ok ? (await readUpstreamJson(res).catch(() => ({}))) : {};
             return {
                 accepted: res.ok,
                 cancelRequested: body.cancelRequested === true,
@@ -304,7 +307,7 @@ async function main() {
 const invokedDirectly = process.argv[1] !== undefined && /bake-runner[/\\]main\.(ts|js)$/.test(process.argv[1]);
 if (invokedDirectly) {
     main().catch((err) => {
-        console.error(JSON.stringify({ ts: new Date().toISOString(), level: "error", msg: "bake_runner_fatal", err: String(err) }));
+        createLogger().error("bake_runner_fatal", { err: String(err) });
         process.exit(1);
     });
 }

package/dist/bench/s1/arms.js

@@ -1,3 +1,4 @@
+import { writeLogText } from "../../observability/logger.js";
 import { pausedCauseOf, outwardPlane } from "../../terminal.js";
 import { leafBudgetFields, s1DebugGit } from "./runner-ctx.js";
 import {} from "./tasks.js";
@@ -61,7 +62,7 @@ export async function driveSupSuspendResume(initial, deps, implSpec, trap, advan
         foldCost(vr.stats);
         const legPlane = outwardPlane(vr.terminal);
         if (process.env.S1_DEBUG_SUPCOST)
-            console.error(`[SUPCOST leg=${leg}] status=${legPlane.status} reason=${vr.verification?.unverifiedReason} c1µ=${vr.stats?.costBreakdown?.llmRootMicroUsd} accC1µ=${c1Acc.llmRootMicroUsd} hrGates=${vr.stats?.humanReview?.gates?.length}`);
+            writeLogText("stderr", `[SUPCOST leg=${leg}] status=${legPlane.status} reason=${vr.verification?.unverifiedReason} c1µ=${vr.stats?.costBreakdown?.llmRootMicroUsd} accC1µ=${c1Acc.llmRootMicroUsd} hrGates=${vr.stats?.humanReview?.gates?.length}`);
         const paused = pausedCauseOf(vr.terminal);
         const gateKind = paused?.gate.kind;
         const parkWord = paused === undefined ? undefined : outwardPlane(paused).status;
@@ -148,7 +149,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         catch (e) {
             if (s1DebugGit())
-                console.error("[S1 SOLO infra throw]", e instanceof Error ? (e.stack ?? e.message) : String(e));
+                writeLogText("stderr", "[S1 SOLO infra throw]", e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
                 stats: captureStats(undefined),
@@ -161,7 +162,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         const soloPlane = outwardPlane(vr.terminal);
         if (s1DebugGit())
-            console.error("[S1 SOLO vr.status]", soloPlane.status, "| stats:", JSON.stringify(vr.stats)?.slice(0, 200));
+            writeLogText("stderr", "[S1 SOLO vr.status]", soloPlane.status, "| stats:", JSON.stringify(vr.stats)?.slice(0, 200));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         return assembleRow({
             arm,
@@ -195,7 +196,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         catch (e) {
             if (s1DebugGit())
-                console.error(`[S1 SUP infra throw driver=${trap.supDriver}]`, e instanceof Error ? (e.stack ?? e.message) : String(e));
+                writeLogText("stderr", `[S1 SUP infra throw driver=${trap.supDriver}]`, e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
                 stats: captureStats(undefined),
@@ -208,7 +209,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         const supPlane = outwardPlane(vr.terminal);
         if (s1DebugGit())
-            console.error(`[S1 SUP vr.status driver=${trap.supDriver}]`, supPlane.status, "| repairTerminal:", repairTerminal, "| verdict:", vr.verification?.verdict, "| unverifiedReason:", vr.verification?.unverifiedReason, "| checkpointGate:", JSON.stringify(pausedCauseOf(vr.terminal)?.gate), "| error:", vr.error, "| stats:", JSON.stringify(vr.stats)?.slice(0, 180));
+            writeLogText("stderr", `[S1 SUP vr.status driver=${trap.supDriver}]`, supPlane.status, "| repairTerminal:", repairTerminal, "| verdict:", vr.verification?.verdict, "| unverifiedReason:", vr.verification?.unverifiedReason, "| checkpointGate:", JSON.stringify(pausedCauseOf(vr.terminal)?.gate), "| error:", vr.error, "| stats:", JSON.stringify(vr.stats)?.slice(0, 180));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         const runStatus = classifyRunStatus({ status: supPlane.status, repairTerminal });
         const lastGate = vr.stats?.humanReview?.gates?.at(-1);

package/dist/bench/s1/live-deps.js

@@ -1,6 +1,8 @@
+import { writeLogText } from "../../observability/logger.js";
 import { outwardPlane } from "../../terminal.js";
 import { Runner, runWithVerification, resumeWithVerification, runRepairLoop, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, } from "@sema-agent/core";
 import { loadConfig } from "../../config.js";
+import { declareServerWithheldEnv } from "../../server-secret-env.js";
 import { composeDeclaredExecutionLane } from "../../boot/execution-lane.js";
 import { ALL_EXECUTION_LANES } from "../../execution-lane-caps.js";
 import { assertServedModelRoute } from "../../model-route-endpoint.js";
@@ -53,6 +55,7 @@ function buildBrainIngredients(rt) {
         process.env.MODEL_COST_CACHE_READ = String(rt.costCacheRead);
     if (rt.costCacheWrite != null)
         process.env.MODEL_COST_CACHE_WRITE = String(rt.costCacheWrite);
+    declareServerWithheldEnv();
     const config = composeDeclaredExecutionLane(loadConfig(), { info: () => { } }, { name: "the s1 bench", runs: ALL_EXECUTION_LANES, declares: "none" });
     assertServedModelRoute(config, { envTableIsPlaceholder: false });
     const brain = createBrain(config, {});
@@ -121,7 +124,7 @@ async function transferWorkerTreeToGrader(worker, grader) {
     if (ext.code !== 0 || !ext.out.includes("EXTRACTED="))
         throw new Error(`s1 grader tar extract failed: ${ext.out.slice(-400)}`);
     if (s1DebugGit())
-        console.error(`[S1_DEBUG_TAR] head=${head.slice(0, 8)} base=${base.slice(0, 8)} tarBytes=${buf.length} ${ext.out.slice(-60)}`);
+        writeLogText("stderr", `[S1_DEBUG_TAR] head=${head.slice(0, 8)} base=${base.slice(0, 8)} tarBytes=${buf.length} ${ext.out.slice(-60)}`);
     return { head, base };
 }
 function oracleTaskFromTrap(trap) {
@@ -171,7 +174,7 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
         const task = { ...oracleTaskFromTrap(trap), ...(state.shas ? { deliveredShas: state.shas } : {}) };
         const v = await runStandaloneOracle(grader, graderTransport(grader), worker, task);
         if (s1DebugGit())
-            console.error(`[S1_DEBUG_ORACLE ${trap.id}] delivered=${v.delivered} tests=${v.hiddenTestsGreen} build=${v.buildPassed} inv=${v.invariantsOk} | raw=`, JSON.stringify(v.raw)?.slice(0, 700));
+            writeLogText("stderr", `[S1_DEBUG_ORACLE ${trap.id}] delivered=${v.delivered} tests=${v.hiddenTestsGreen} build=${v.buildPassed} inv=${v.invariantsOk} | raw=`, JSON.stringify(v.raw)?.slice(0, 700));
         return v;
     };
     const deps = {

package/dist/bench/s1/run-firm.js

@@ -1,3 +1,4 @@
+import { writeLogText } from "../../observability/logger.js";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { AppendLog, Runner, InMemoryCheckpointStore } from "@sema-agent/core";
@@ -213,7 +214,7 @@ export function positiveIntArg(raw, def, flag) {
         return def;
     const n = Number(raw);
     if (!Number.isInteger(n) || n < 1) {
-        console.error(`[s1 run-firm] ${flag} must be a positive integer, got: ${raw}`);
+        writeLogText("stderr", `[s1 run-firm] ${flag} must be a positive integer, got: ${raw}`);
         process.exit(2);
     }
     return n;
@@ -251,13 +252,13 @@ export async function main(argv = process.argv.slice(2)) {
     setS1DebugGit(args.debugGit);
     const liveRuntime = liveRuntimeConfigFromEnv();
     if (!args.dryRun && !liveRuntime) {
-        console.error("[s1 run-firm] LIVE path refused: E2B_API_KEY + DEEPSEEK_API_KEY are required (the brain gateway). " +
+        writeLogText("stderr", "[s1 run-firm] LIVE path refused: E2B_API_KEY + DEEPSEEK_API_KEY are required (the brain gateway). " +
             "Run with --dry-run for the deterministic loop, or export the keys for the owner's gated live run.");
         process.exit(2);
         return;
     }
     const modelId = liveRuntime?.modelId ?? "deepseek-v4-flash";
-    const log = (msg, meta) => console.error(`[s1 run-firm] ${msg}`, meta ? JSON.stringify(meta) : "");
+    const log = (msg, meta) => writeLogText("stderr", `[s1 run-firm] ${msg}`, meta ? JSON.stringify(meta) : "");
     const result = await runFirm({
         seeds: args.seeds,
         cellTimeoutMs: args.cellTimeoutMs,
@@ -271,7 +272,7 @@ export async function main(argv = process.argv.slice(2)) {
         ...(args.dryRun ? { mockDepsFactory: dryRunMockFactory() } : { liveRuntime: liveRuntime }),
         log,
     });
-    console.log(JSON.stringify({
+    writeLogText("stdout", JSON.stringify({
         runId: args.runId,
         mode: args.dryRun ? "dry-run" : "live",
         ranThisPass: result.ranThisPass,
@@ -297,7 +298,7 @@ const isMain = (() => {
 })();
 if (isMain) {
     void main().catch((e) => {
-        console.error("[s1 run-firm] fatal:", e instanceof Error ? e.stack : String(e));
+        writeLogText("stderr", "[s1 run-firm] fatal:", e instanceof Error ? e.stack : String(e));
         process.exit(1);
     });
 }

package/dist/bind-host.d.ts

@@ -0,0 +1,25 @@
+/** 读监听地址要的那几格(取自配置的同名键)。 */
+export interface BindHostConfig {
+    bindHost?: string;
+    /** 缝合审 M5:`bindHost` 的**来源**决定它算不算 operator 明示,见 {@link resolveBindHost}。 */
+    bindHostSource?: "BIND_HOST" | "HOST";
+    allowUnauthedWrites?: boolean;
+    authToken?: string;
+    authTokens?: Record<string, string>;
+}
+/** 这台部署配了任何一把 service 凭据吗(`SERVICE_AUTH_TOKEN` / `SERVICE_AUTH_TOKENS`)。 */
+export declare function anyServiceCredential(config: Pick<BindHostConfig, "authToken" | "authTokens">): boolean;
+/** 无鉴权写面(`ALLOW_UNAUTHED_WRITES`)+ 零凭据 ⇒ 起服把监听地址收窄到 loopback(见 {@link resolveBindHost})。 */
+export declare function bindMustNarrow(config: Pick<BindHostConfig, "allowUnauthedWrites" | "authToken" | "authTokens">): boolean;
+/**
+ * 这台进程的监听地址(绑址旋钮 + 无鉴权自收窄)。`undefined` = Node 缺省全接口。
+ * `BIND_HOST`(兼容 `HOST`)显式值恒生效;缺省:**无鉴权写面(`allowUnauthedWrites` 且零凭据)自动收窄到 127.0.0.1**,其余维持全接口。
+ */
+export declare function resolveBindHost(config: BindHostConfig): string | undefined;
+/**
+ * 监听地址是不是**只在本机回环上**(别的主机连不上这个口)。`undefined`(Node 缺省全接口)、`0.0.0.0` / `::`(全接口)、任何别的地址或主机名 ⇒ 否。
+ * 认:IPv4 `127.0.0.0/8`、IPv6 `::1`、它们的 IPv4 映射拼法(经 {@link canonicalAddress} 折回点分 IPv4)、字面 `localhost`(大小写不敏感;
+ * 刻意不认 `*.localhost` 与别的主机名 —— 落不落在本机取决于系统解析器,不是这个值本身的事实)。
+ */
+export declare function listensLoopbackOnly(bindHost: string | undefined): boolean;
+//# sourceMappingURL=bind-host.d.ts.map

package/dist/bind-host.js

@@ -0,0 +1,25 @@
+import { isIP } from "node:net";
+import { canonicalAddress } from "./net-address.js";
+export function anyServiceCredential(config) {
+    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+}
+export function bindMustNarrow(config) {
+    return Boolean(config.allowUnauthedWrites) && !anyServiceCredential(config);
+}
+export function resolveBindHost(config) {
+    const mustNarrow = bindMustNarrow(config);
+    if (config.bindHost && !(mustNarrow && config.bindHostSource === "HOST"))
+        return config.bindHost;
+    return mustNarrow ? "127.0.0.1" : undefined;
+}
+export function listensLoopbackOnly(bindHost) {
+    if (bindHost === undefined)
+        return false;
+    if (bindHost.toLowerCase() === "localhost")
+        return true;
+    const address = canonicalAddress(bindHost);
+    if (address === undefined)
+        return false;
+    return isIP(address) === 4 ? address.startsWith("127.") : address === "::1";
+}
+//# sourceMappingURL=bind-host.js.map

package/dist/boot/adoption.d.ts

@@ -1,6 +1,9 @@
+import type { AdoptionWiring } from "../adoption/plan.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 export interface AdoptionBootCtx {
     backend: StoreBackend | undefined;
+    /** 可选存储面的接线事实(必填、无默认值;与 `POST /v1/adoption` 路由读的是同一对 boot 事实,见 {@link AdoptionWiring})。 */
+    wiring: AdoptionWiring;
     logger: {
         info?(msg: string, meta?: unknown): void;
         warn?(msg: string, meta?: unknown): void;

package/dist/boot/adoption.js

@@ -8,6 +8,7 @@ export async function runAdoptionBootScan(ctx) {
         store,
         dialect: ctx.backend?.kind === "pg" ? "pg" : "mysql",
         now: ctx.now ?? Date.now,
+        wiring: ctx.wiring,
         logger: ctx.logger,
     });
     try {

package/dist/boot/deployment-mods.d.ts

@@ -44,7 +44,7 @@ export interface LoadedModPackage {
 export interface DeploymentModsAssembly {
     readonly registrations: readonly ModRegistration<EngineDollar>[];
     readonly loaded: readonly LoadedModPackage[];
-    /** 部署座在**任务座之下**挂了链成员(不是观察者)的站点式样 —— 引擎这一次准入的记录读出({@link belowTaskChainPatternsOf})。读者:请求 `settings.hooks` 托管车道的只许收紧判据(`hooks/hook-runner.ts` 的 `managedTightenOnlyOn`)。 */
+    /** 部署座在**任务座之下**挂了链成员(不是观察者)的站点式样 —— 引擎这一次准入的记录读出({@link belowTaskChainPatternsOf})。读者:请求 `settings.hooks` 两条车道的只许收紧判据(`hooks/hook-runner.ts` 的 `chainsBelowTaskOn` 一处)。 */
     readonly belowTaskChainPatterns: readonly string[];
 }
 /**