@sema-agent/server 7.51.0 → 7.52.1

package/dist/boot/session-faces.js

@@ -6,7 +6,7 @@ import { setLeafAdvanceListener } from "../session-leaf-bus.js";
 import { SessionWatchRegistry, posIntEnv } from "../session-watch.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
 export function createSessionFaces(ctx) {
-    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileSnapshotStore, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, } = ctx;
+    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryStore, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, } = ctx;
     const mysqlPool = backend?.mysqlPool();
     const auditPgPool = backend?.pgPool();
     const auditLocalRoot = backend?.kind === "local" ? (config.localDataRoot ?? localRoot) : undefined;
@@ -66,8 +66,19 @@ export function createSessionFaces(ctx) {
             if (deviceStore)
                 await deviceStore.deleteByRootSession(sessionId);
             dropSessionScoped?.(sessionId);
-            if (fileSnapshotStore?.deleteBySession)
-                await fileSnapshotStore.deleteBySession(sessionId);
+            if (fileHistoryStore) {
+                if (typeof fileHistoryStore.deleteBySession === "function")
+                    await fileHistoryStore.deleteBySession(sessionId);
+                else {
+                    await fileHistoryStore.reap(sessionId, []);
+                    logger.warn("session_file_history_baselines_retained", {
+                        sessionId,
+                        note: "the local file-history store has no whole-scope purge verb; boundaries were reaped but v1 baselines (original file bytes) remain under the data root until the upstream purge seam lands — recorded as an open deletion-rights gap, not silent",
+                    });
+                }
+            }
+            if (backend?.legacySnapshotPurge)
+                await backend.legacySnapshotPurge(sessionId);
             if (workflowCompletionInbox)
                 await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: String(err) }));
             await purgeScratchpadDir(config.localDataRoot ?? localRoot, sessionId);

package/dist/boot/stores.js

@@ -21,8 +21,9 @@ import { ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
-import { assertPermissionRuleApprovalSchema } from "../plugins/permission-rule-store-sql.js";
+import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
+import { assertFileHistorySchema } from "../plugins/file-history-store-sql.js";
 import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
@@ -56,6 +57,10 @@ export async function openStores(ctx) {
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
             else if (mysqlPool)
                 await assertPermissionRuleApprovalSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+            if (pgPool)
+                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+            else if (mysqlPool)
+                await assertPermissionRuleTicketSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         }
         if (resolveStreamApprovalGate({
             toolApprovalEnabled: config.toolApprovalEnabled === true,
@@ -68,6 +73,31 @@ export async function openStores(ctx) {
             else if (mysqlPool)
                 await assertApprovalAskRuleMaterialSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
         }
+        if (pgPool)
+            await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+        else if (mysqlPool)
+            await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+        {
+            const legacyProbeSql = "SELECT 1 FROM snapshot_manifest LIMIT 1";
+            const hasLegacyRows = await (pgPool
+                ? pgPool.query(legacyProbeSql).then((r) => r.rows.length > 0)
+                : mysqlPool
+                    ? mysqlPool.query(legacyProbeSql).then(([rows]) => rows.length > 0)
+                    : Promise.resolve(false)).catch(() => false);
+            if (hasLegacyRows) {
+                logger.warn("legacy_snapshot_epoch_rows_present", {
+                    note: "rows from the RETIRED whole-tree snapshot epoch (snapshot_manifest/snapshot_blob) exist. They are NOT " +
+                        "migrated (whole-tree manifests and per-file history are structurally different); rewind refusals for " +
+                        "legacy-era boundaries name the retired epoch via the boundary probe; the retention lane keeps sweeping " +
+                        "these rows by session, and the maintenance tick GCs their orphaned blob bytes.",
+                });
+            }
+        }
+    }
+    if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
+        logger.warn("rewind_snapshot_max_mb_retired", {
+            note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",
+        });
     }
     {
         const minioReq = ["MINIO_ENDPOINT", "MINIO_ACCESS_KEY", "MINIO_SECRET_KEY"];

package/dist/boot/task-list-lane.d.ts

@@ -21,7 +21,7 @@
  *    高水位(next_id)与插入序(next_sort)都由 meta 行的事务计数器持有,`mutate` 是真后端事务。
  *  - `memory`:无 SQL 后端(local/file 形、纯内存 dev)⇒ **进程级** per-session 内存店。跨 turn
  *    存活(这就是 F2 的修点),但**跨进程重启丢失**,且 LRU 溢出(> `maxSessions`)时最老的会话
- *    会被逐出=那条会话的待办清空。诚实登记在 USAGE(「local 形重启丢待办」),不伪造持久性:
+ *    会被逐出=那条会话的待办清空。诚实登记在 USAGE(「local 形重启丢待办」),不自造持久性:
  *    这与 local 形其余会话态设施(perSessionCwd / TtlSessionStore)是同一姿势。
  *
  * ## 为什么 SQL 形也进同一只缓存
@@ -50,7 +50,7 @@ export interface TaskListLane {
      * 🔴 为什么必须有:会话 id 由调用方自选、会话删除后可被**别人** `register` 重新登记(security.ts
      * 的 claim-create),而本车道的 listKey 是 `sessionId` 的确定性派生 ⇒ 不级联的话,新化身第一次
      * 打开清单就读到上一位主人的任务标题/描述,`TaskCreate` 还会从上一位的高水位续号(「这里以前
-     * 建过 47 条」本身也是泄漏)。同族腿(anchors / approval-exemption / session-policy / attachment /
+     * 建过 47 条」本身也是外泄)。同族腿(anchors / approval-exemption / session-policy / attachment /
      * snapshot / scratchpad)全部走同一条级联,本条与它们同 scoping 理由:路由已在 DELETE 门证过会话
      * 所有权,故按 sessionId 单键删。
      *

package/dist/brain.js

@@ -1,8 +1,6 @@
-import { createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, } from "@sema-agent/core";
+import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, hasAuthCarrier, resolveRouteCredential, routeRefusalText, } from "@sema-agent/core";
 import { normalizeBaseUrl } from "@sema-agent/core";
 import { resolveModelApiKey } from "./key-resolver.js";
-import { isSealedKeyPoison } from "./sealed-key.js";
-import { recordFailOpen } from "./observability/fail-open.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -11,6 +9,10 @@ function isOffDeploymentRoot(baseUrl, config) {
         return false;
     return ![config.gatewayBaseUrl, ...config.gatewayFallbackUrls].some((u) => normalizeBaseUrl(u) === entry);
 }
+function degradeDeclaredRoot(fallbackBaseUrl, config) {
+    const armed = Boolean(config.gatewayApiKey) && isOffDeploymentRoot(fallbackBaseUrl, config);
+    return armed ? config.gatewayBaseUrl : (fallbackBaseUrl || config.gatewayBaseUrl);
+}
 export const FAST_FAIL_MAX_RETRIES = 2;
 const DEFAULT_RESILIENCE = {
     connectTimeoutMs: 30_000,
@@ -61,7 +63,7 @@ export function createBrain(config, deps = {}) {
             ...(config.anthropic.authToken
                 ? { headers: { Authorization: `Bearer ${config.anthropic.authToken}` } }
                 : { apiKey: config.anthropic.apiKey }),
-            baseUrl: config.anthropic.baseUrl,
+            baseUrl: config.anthropic.baseUrl ?? "https://api.anthropic.com",
             version: config.anthropic.version,
             cacheBreakpoints: config.anthropic.cacheBreakpoints,
             ...(config.anthropic.maxRetries !== undefined ? { maxRetries: config.anthropic.maxRetries } : {}),
@@ -76,44 +78,42 @@ export function createBrain(config, deps = {}) {
         const degradeTo = config.degrade.to;
         const fallbackModel = config.models[degradeTo];
         if (fallbackModel) {
-            const fbApiKey = () => {
-                const own = resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
-                    resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
-                return own ?? config.gatewayApiKey;
-            };
-            const hopBorrowsGatewayKey = () => {
-                const keys = config.modelApiKeys ?? {};
-                if (isSealedKeyPoison(keys[fallbackModel.name]) || isSealedKeyPoison(keys[degradeTo]))
-                    return false;
-                const own = resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, keys) ??
-                    resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, keys);
-                return own === undefined && config.gatewayApiKey !== undefined && isOffDeploymentRoot(fallbackModel.baseUrl, config);
-            };
+            const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
+                resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
             const anthropicLaneHop = fallbackModel.provider === "anthropic" && anthropicBrain !== undefined;
             const fallback = fallbackModel.provider === "anthropic" && anthropicBrain
                 ?
                     anthropicBrain
                 : createOpenAIBrain({
-                    baseUrl: fallbackModel.baseUrl || config.gatewayBaseUrl,
+                    get baseUrl() {
+                        return degradeDeclaredRoot(fallbackModel.baseUrl, config);
+                    },
                     get apiKey() {
-                        return fbApiKey();
+                        return config.gatewayApiKey || undefined;
                     },
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
                     ...timeouts,
                 });
-            const fallbackWithDebtProbe = anthropicLaneHop
-                ? fallback
-                : {
-                    stream: (m, c, o) => {
-                        if (hopBorrowsGatewayKey())
-                            recordFailOpen("server.model-key.degrade-hop-borrows-gateway-key", fallbackModel.name);
-                        return fallback.stream(m, c, o);
-                    },
-                    ...(fallback.adjudicateRoute !== undefined ? { adjudicateRoute: (m, a) => fallback.adjudicateRoute?.(m, a) } : {}),
-                    ...(fallback.complete !== undefined ? { complete: (m, c, o) => fallback.complete(m, c, o) } : {}),
-                };
-            brain = createDegradingBrain({ primary: brain, fallbacks: [{ brain: fallbackWithDebtProbe, model: fallbackModel }], downgradeOn: config.degrade.downgradeOn });
+            const degradeEntryModel = {
+                ...fallbackModel,
+                get headers() {
+                    const own = fbOwnApiKey();
+                    if (own === undefined)
+                        return fallbackModel.headers;
+                    const kept = {};
+                    for (const [k, v] of Object.entries(fallbackModel.headers ?? {})) {
+                        if (!hasAuthCarrier({ [k]: v }))
+                            kept[k] = v;
+                    }
+                    return { ...kept, authorization: `Bearer ${own}` };
+                },
+            };
+            brain = createDegradingBrain({
+                primary: brain,
+                fallbacks: [{ brain: fallback, model: anthropicLaneHop ? fallbackModel : degradeEntryModel }],
+                downgradeOn: config.degrade.downgradeOn,
+            });
         }
     }
     return brain;
@@ -143,6 +143,26 @@ export function brainSummary(config) {
         reactiveDegradeBaseUrl: config.degrade?.reactive && config.models?.[config.degrade.to]
             ? config.models[config.degrade.to].baseUrl || config.gatewayBaseUrl
             : null,
+        ...((() => {
+            const target = config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;
+            if (!target)
+                return { reactiveDegradeRoutePairing: null, reactiveDegradeRouteRefusal: null };
+            if (target.provider === "anthropic" && config.anthropic) {
+                return { reactiveDegradeRoutePairing: "anthropic-lane", reactiveDegradeRouteRefusal: null };
+            }
+            const declaresOwnCredential = config.modelApiKeyEnv?.[target.name] !== undefined ||
+                config.modelApiKeyEnv?.[config.degrade.to] !== undefined ||
+                config.modelApiKeys?.[target.name] !== undefined ||
+                config.modelApiKeys?.[config.degrade.to] !== undefined ||
+                hasAuthCarrier(target.headers);
+            if (declaresOwnCredential) {
+                return { reactiveDegradeRoutePairing: "per-model-declared", reactiveDegradeRouteRefusal: null };
+            }
+            const verdict = adjudicateModelRoute({ id: target.id, baseUrl: target.baseUrl }, resolveRouteCredential({ ...(config.gatewayApiKey ? { configApiKey: config.gatewayApiKey } : {}) }), { baseUrl: degradeDeclaredRoot(target.baseUrl, config) });
+            return verdict.ok
+                ? { reactiveDegradeRoutePairing: `ok:${verdict.posture}`, reactiveDegradeRouteRefusal: null }
+                : { reactiveDegradeRoutePairing: `broken:${verdict.code}`, reactiveDegradeRouteRefusal: routeRefusalText(verdict) };
+        })()),
     };
 }
 //# sourceMappingURL=brain.js.map

package/dist/budget.d.ts

@@ -27,7 +27,7 @@ export declare function buildPricing(models: Record<string, Model>): Record<stri
 export declare function isPricingConfigured(pricing: Record<string, ModelPricing>): boolean;
 /**
  * Bound the cardinality of a free-form metric label value (BL-11/BL-21). A label fed by untrusted/unbounded
- * input — MCP tool names (a misconfigured/malicious server can emit thousands of dynamic names) or center
+ * input — MCP tool names (a misconfigured/untrusted server can emit thousands of dynamic names) or center
  * model ids (a malformed roster) — would otherwise mint an unbounded number of metric series: a slow memory
  * leak in the registry + a /metrics scrape blow-up. We track the DISTINCT values seen; once the cap is hit,
  * further NEW values collapse into one `__other__` bucket (already-seen values still report exactly). The
@@ -66,7 +66,7 @@ export declare class ModelUsageTracker {
     private readonly active;
     /** Mark a TOP-LEVEL run active so its `brain.call` usage is tracked. **Required** — `record` ignores any taskId
      *  that isn't registered. This is the leak fence: delegated SUB-TASKS (team members,
-     *  adversarial verifiers) run on throwaway core-minted sessionIds that the run lifecycle never registers/drains,
+     *  independent verifiers) run on throwaway core-minted sessionIds that the run lifecycle never registers/drains,
      *  so without this gate their usage would accumulate under ids nothing ever clears → an unbounded process-lifetime
      *  leak. Sub-task spend is intentionally NOT in the per-run `modelUsage` echo (it lands in `TaskStats.nested`);
      *  `modelUsage` is the TOP-LEVEL run's own per-model usage. Call at run start; {@link clear} unregisters. */

package/dist/capabilities/center-plugins.d.ts

@@ -29,7 +29,7 @@ export type PluginValidation = {
 };
 /** 条款 1/2/4:https-only、host 全等白名单、sha 40hex。纯函数,worker 侧纵深复验(不信任 wire 已验过)。 */
 export declare function validatePluginDecl(decl: PluginDeclWire, allowHosts: readonly string[]): PluginValidation;
-/** 条款 3/5:clone 计划(argv 序列 + 隔离 env)。纯数据,让"姿势"可被钉死。 */
+/** 条款 3/5:clone 计划(argv 序列 + 隔离 env)。纯数据,让"姿势"可被锚定。 */
 export declare function gitClonePlan(o: {
     url: string;
     dest: string;

package/dist/capabilities/collab-workflows.d.ts

@@ -37,7 +37,7 @@ export declare function registerCollabWorkflows(workflows: Record<string, Collab
 /** composite WorkflowScriptStore 的 resolveName 前段:collab 命中 ⇒ 内置 team-discussion 脚本+本模板
  *  defaultArgs(同名 SHADOW core 内置,design/140 §6 1c)。🔴 Object.hasOwn — `name` 是模型供给的
  *  (run-workflow-tool 原样传 rawName):裸索引会让 Object.prototype 成员名("constructor"/"toString"/
- *  "__proto__"…)假命中 ⇒ 零模板注册也能烧真讨论、且同名文件 store 条目被遮蔽(对抗评审 2026-07-11 MED)。 */
+ *  "__proto__"…)假命中 ⇒ 零模板注册也能烧真讨论、且同名文件 store 条目被遮蔽(交叉评审 2026-07-11 MED)。 */
 export declare function resolveCollabWorkflow(name: string): {
     script: string;
     defaultArgs: unknown;

package/dist/capabilities/hands-lane.d.ts

@@ -1,7 +1,7 @@
 /**
  * #196 场景 hands lane —— 「要手的场景」与「无手的场景」在装配层分家。
  *
- * 病根(设计小票 §1,案源 [3208]/[3209]/[3212]):core 的手带工具面是 **per-Runner 表态**
+ * 根本问题(设计小票 §1,案源 [3208]/[3209]/[3212]):core 的手带工具面是 **per-Runner 表态**
  * (`prepare-task`:`handsEnabled = ownedEnv || deps.executionEnv`,ownedEnv 只要挂了
  * `executionEnvFactory` 就每任务必铸)。server 此前全场景共享一只 runner + 一只 subRunner,
  * 于是任何 REMOTE_EXEC 部署里,声明 clone-free 的 `scan`、只有 `run_council` 的评审团、
@@ -37,7 +37,7 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
  *
  * 两段来源,都不是拍脑袋:
  *  · `HAND_TOOL_EFFECTS`(core 导出面,`tools/fs`)—— band 的 effect 表,11 名。
- *  · 下方钉死补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
+ *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
  *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
  *    core 加/改 band 成员时红,防漂移)。
  *
@@ -50,7 +50,7 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
  * `hands: none` 三场景(scan/code-review/team)在**所有部署**上零 turn 全灭。core 5.21.1 已删
  * 那条死条目([3249]),这道 filter 是结构性防御:将来 core 再退役任何 band 名都不会重演
  * (test/scenario-hands-lane.test.ts 格7/格8 双钉:真 Runner 过审计 + 零交集门)。
- * filter 打在**整表**(effect 表 + 钉死补集)之后 —— caret floor 下装置会解析到更新的 core,
+ * filter 打在**整表**(effect 表 + 锚定补集)之后 —— caret floor 下装置会解析到更新的 core,
  * 补集名哪天被退役,只滤前半就是同一次故障换个名字(codex 复审 finding,2026-08-09)。
  */
 export declare const HANDS_BAND_TOOL_NAMES: readonly string[];

package/dist/capabilities/scenarios.d.ts

@@ -65,7 +65,7 @@ export interface ScenarioDeps {
     skills: LoadedSkill[];
     repoClient?: RepoReadClient;
     /** Multi-tenant deployment (REQUIRE_PRINCIPAL). Gates the full-body `WebFetch` tool out of the
-     *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/malicious tenant model
+     *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/untrusted tenant model
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
     /** Deployment-injected WebSearch backend (Brave/Tavily/SearXNG via `WEB_SEARCH_PROVIDER`). When set,
@@ -164,7 +164,7 @@ export declare function semaIdentityProvider(): PromptProvider;
  * `code` 场景的提示词提供者([849] 造,[891] clay 裁定改名 autonomous→code):role 基底 = core
  * {@link CODE_SYSTEM_PROMPT}(core 1.298 [891] 改名批正名,旧名 FULL_BODY_SYSTEM_PROMPT=恒等
  * 别名过渡窗;CODE_AGENT persona + AUTONOMY_SELF_AUDIT + ANTI_VERBOSITY +
- * TOOL_PARAM_JSON;[891] 血缘定论 = CC 生产编码提示词的蒸馏去牌版,底本随 CC 版本对表 cc-anchors,
+ * TOOL_PARAM_JSON;[891] 谱系定论 = CC 生产编码提示词的蒸馏去牌版,底本随 CC 版本对表 cc-anchors,
  * 非自研)——与 bench 的请求组装完全同源,引用 core 常量随版本走,绝不复制字符串(tb bench 实测:
  * 产品默认请求与同引擎 bench 态的差距根因就在这三件 persona/自检/终验)。品牌层与
  * {@link semaIdentityProvider} 同构:brandIdentity 开时 SEMA_IDENTITY 叠在 role 基底之上;任务自带
@@ -252,7 +252,7 @@ export declare function centerScenarios(deps: ScenarioDeps, specs: CenterScenari
  * by the HTTP layer (validateUserSkills); this stays pure merge policy.
  */
 export declare function mergeUserSkills(scenarioSkills: SkillSpec[] | undefined, userSkills: SkillSpec[] | undefined, logger?: Logger): SkillSpec[] | undefined;
-/** center caps view 的解析结果两键(形状钉死)。`scenario` null = 三层皆未配。 */
+/** center caps view 的解析结果两键(形状锚定)。`scenario` null = 三层皆未配。 */
 export interface ScenarioRuling {
     scenario: string | null;
     /** 纯场景名集合(principal/组名不上 wire);空 = 该 principal 无任何指派 = 无治理。 */

package/dist/capabilities/skills.d.ts

@@ -35,7 +35,7 @@ export interface LoadedSkill {
  *  ——那个便利是有意的(`foo.md -> 共享文件`)。`confineTo` 在场(**不可信 lane**:第三方 git checkout,
  *  见 center-plugins 的 plugin 装载)= 每个被读条目 realpath 后必须仍在该根之内,逃逸即抛。
  *  🔴 为什么信任级必须是**参数**而不是注释里的假设:本函数的头注原写着「skills dir 全受控」,而
- *  center-plugins 把它原样复用在 attacker-controlled 的 git checkout 上——git 原样保留仓里的 symlink,
+ *  center-plugins 把它原样复用在 不可信来源的 git checkout 上——git 原样保留仓里的 symlink,
  *  于是 checkout 里某个 skill 条目(`任意 .md -> /宿主/任意文件`)会被读进 spec.files 进入提示词。resolvePluginSkillsRoot
  *  只 realpath 守了 skills **根**,根下逐条目没守。 */
 export interface LoadSkillsOptions {

package/dist/config-center/hot-keys-registry.js

@@ -17,6 +17,11 @@ export const BATCH1_LIMIT_KEYS = [
 ];
 const B_SETTER_KEYS = ["rateLimitPerMin", "maxPrincipalCostUsd"];
 export const DEFERRED_LIMIT_KEYS = [
+    {
+        key: "workspaceFileMaxBytes",
+        restartReason: "workspace-face-retired",
+        why: "the workspace browse face was retired with the whole-tree snapshot epoch (S-15) — this knob has no consumer left; the value is still validated and recorded for center-push compatibility, but applies to nothing (restart does not change that). Removal follows the settings-schema deprecation lane",
+    },
     {
         key: "costQuotaWindowSec",
         restartReason: "cost-quota-window",

package/dist/config-center/http-client.d.ts

@@ -68,7 +68,7 @@ export declare class ConfigCenterHttpError extends Error {
 }
 /**
  * Fetch one skill's body by content hash (`GET /api/config/skills/content/<hash>`, Bearer) and VERIFY its
- * sha256 matches the manifest hash (integrity + tamper check). The content is immutable per hash, so the
+ * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
  * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
@@ -77,7 +77,7 @@ export declare class ConfigCenterHttpError extends Error {
 export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
 /** [985]b / [1285]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
  *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
- *  本函数只做传输与形读,不越权解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
+ *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
  *  digest 参数收带前缀/裸 hex 两形([1285] 参数口径)。 */
 export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
 export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;

package/dist/config-center/read-face.d.ts

@@ -8,7 +8,7 @@ import type { CenterReadFace, EffectiveConfig } from "./types.js";
  * 返回值 = **本机 env 显式占住的 center 键名**(与本次发布内容无关的部署事实)。调用方把它喂给
  * `RestartSliceCtx.readFaceEnvHeld`,`read-face` restart 片于是只指纹「真会 boot-bake 的那部分」——
  * 否则 center 改一个本机永远用不上的键,整片 fleet 会为一次对自己毫无影响的发布滚动重启一遍
- * (codex 对抗复审 finding 2,验真后采纳的那一半)。
+ * (codex 交叉复审 finding 2,验真后采纳的那一半)。
  */
 export declare function applyCenterReadFace(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): readonly (keyof CenterReadFace)[];
 //# sourceMappingURL=read-face.d.ts.map

package/dist/config-center/restart-signal.d.ts

@@ -7,7 +7,7 @@ export interface RestartSliceCtx {
     /** `config.degrade.to` when REACTIVE degrade is on (env `MODEL_DEGRADE_TO` + `MODEL_DEGRADE_REACTIVE`);
      *  undefined = the lane is off ⇒ no degrading brain was composed ⇒ nothing is boot-frozen. */
     reactiveDegradeTo?: string;
-    /** #A4(codex 对抗复审 finding 2,验真后采纳):本机 env **显式占住**的 readFace 键
+    /** #A4(codex 交叉复审 finding 2,验真后采纳):本机 env **显式占住**的 readFace 键
      *  (`applyCenterReadFace` 的返回值,由 boot 存下)。这些键的 center 值在本机**永不 boot-bake**,
      *  所以它们的变化不该产生 restart 理由 —— 否则 center 改一个本机用不上的键,整片 fleet 会为一次
      *  对自己毫无影响的发布滚动重启一遍。缺席 = 没有 env 覆盖 ⇒ 整域都算数(与旧行为一致)。 */