@sema-agent/server 7.87.2 → 7.88.0

package/dist/auth-bridge.js

@@ -1,5 +1,6 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 const MAX_JWKS_BYTES = 256 * 1024;
 const MAX_TOKEN_CHARS = 16 * 1024;
@@ -19,6 +20,7 @@ function b64urlJson(seg) {
 const stripSlash = (s) => s.replace(/\/+$/, "");
 export function createRegistryJwtVerifier(opts) {
     const issuer = stripSlash(opts.issuer);
+    const displayIssuer = buildDisplaySafeUrl(issuer);
     const jwksUrl = opts.jwksUrl ?? `${issuer}${REGISTRY_JWKS_PATH}`;
     const clockSkewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
     const refreshMin = opts.jwksRefreshMinIntervalSec ?? DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC;
@@ -32,7 +34,7 @@ export function createRegistryJwtVerifier(opts) {
     let inflight;
     const fail = (error, kid) => {
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: error });
-        opts.logger?.warn?.("auth_bridge_rejected", { error, ...(kid ? { kid: kid.slice(0, 128) } : {}), iss: issuer });
+        opts.logger?.warn?.("auth_bridge_rejected", { error, ...(kid ? { kid: kid.slice(0, 128) } : {}), iss: displayIssuer });
         return { ok: false, error };
     };
     async function refreshJwks() {
@@ -57,7 +59,7 @@ export function createRegistryJwtVerifier(opts) {
                         next.set(k.kid, createPublicKey({ key: { kty: "RSA", n: k.n, e: k.e }, format: "jwk" }));
                     }
                     catch {
-                        opts.logger?.warn?.("auth_bridge_jwk_unusable", { kid: k.kid.slice(0, 128), iss: issuer });
+                        opts.logger?.warn?.("auth_bridge_jwk_unusable", { kid: k.kid.slice(0, 128), iss: displayIssuer });
                     }
                 }
                 keys.clear();
@@ -66,7 +68,7 @@ export function createRegistryJwtVerifier(opts) {
                 lastFetchSuccessMs = now();
             }
             catch (e) {
-                opts.logger?.warn?.("auth_bridge_jwks_fetch_failed", { iss: issuer, error: String(e).slice(0, 200) });
+                opts.logger?.warn?.("auth_bridge_jwks_fetch_failed", { iss: displayIssuer, error: String(e).slice(0, 200) });
             }
             finally {
                 inflight = undefined;

package/dist/boot/device-lane.d.ts

@@ -13,13 +13,12 @@
  * 「这台机器上,device lane 的三件装配得起来吗」。装不起来就返回 `undefined`,由
  * {@link assertDeviceLaneWired} 响亮拒启([ref]:执行车道上没有静默降级臂)。
  */
-import { type DeviceEnrollRateLimiter, type DeviceEnrollment } from "../device-enrollment.js";
+import { type DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
 import { type DeviceWsHub } from "../device-ws-hub.js";
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
-import type { RateGate } from "../observability/rate-limit.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 export interface DeviceLaneCtx {
     config: ServiceConfig;
@@ -28,15 +27,6 @@ export interface DeviceLaneCtx {
     backend: StoreBackend | undefined;
     /** 本副本 id(写进连接租约行 —— §4.6 的跨副本排障面)。 */
     replicaId: string;
-    /**
-     * 既有的**跨副本** RateGate(SQL 后端形 = `TiDBRateLimiter`/`PgRateLimiter`;单副本形 = 进程内
-     * `RateLimiter`)。A-2 的移交义务③:enrollment 的限速不自建第二套计数面,适配这一只。
-     *
-     * 🔴 传的是**取值器**不是值:那一只建在 main.ts 的下游(它要 `counterDegradeHook`),而 device lane
-     * 必须建在 `createExecutionEnv` 之前 —— 顺序对不上。取值器让「谁先建」不再是正确性问题:boot 期
-     * 不可能有 enroll 请求,取不到 ⇒ 座**抛**(fail-closed,enrollment 翻成 429),不是放行。
-     */
-    rateGate?: (() => RateGate | undefined) | undefined;
 }
 export interface DeviceLane {
     store: DeviceStore;
@@ -44,17 +34,20 @@ export interface DeviceLane {
     hub: DeviceWsHub;
 }
 /**
- * 把既有的**同步** {@link RateGate} 适配成 enrollment 要的异步座(A-2 移交义务③)。
+ * 注册口(`POST /v1/devices/enroll`,pre-auth)的限速策略 —— **本车道自己的地板,不挂任何运维旋钮**。
  *
- * 🔴 为什么是适配而不是新建一只:限速面在本仓已有属主(`observability/rate-limit.ts` + 两支 SQL 孪生),
- * 而 SQL 孪生是**跨副本**的 —— enrollment 自带的 `createFixedWindowRateLimiter` 诚实地只是每副本窗
- * (它自己的头注就这么写),对 token 撞库来说「N 个副本 = N 倍配额」。适配既有的那一只,撞库预算才是
- * 全局的一份。
+ * 🔴 此前这里把全局 RateGate 适配成注册限速器,于是限额**值**也跟着全局 `RATE_LIMIT_RPM` 走;而它缺省是 0,
+ * 0 在那只限速器里是「关断哨兵」⇒ 缺省部署上注册口**完全不限速**(实测同一窗 200 次尝试拒绝 0 次),
+ * 设计 §7-T5 ⑤ 对 enroll token 撞库的那道防线在出厂形上不存在。安全地板挂在一根语义无关的运维旋钮上,
+ * 是「部署级旋钮禁挂派生腿」那条教训的又一形。⇒ 注册限速恒用本策略的固定窗,与 `RATE_LIMIT_RPM` 无关。
  *
- * 键前缀 `device-enroll:` 是必须的:RateGate 的键空间与 HTTP 面的 principal 键**共用一张表**,不加前缀
- * 会让一次 enrollment 尝试吃掉调用方的普通请求配额(反过来也一样)。
+ * 诚实边界:窗是**每副本**的。device 车道的部署形是单副本(`docs/DEPLOY-PREREQS.md`),滚动期两个进程
+ * 短暂重叠时上界 = 限额 × 重叠副本数;不声称跨副本全局上界。
  */
-export declare function createDeviceEnrollRateLimiter(gate: () => RateGate | undefined): DeviceEnrollRateLimiter;
+export declare const DEVICE_ENROLL_RATE_POLICY: {
+    readonly limit: 10;
+    readonly windowMs: 60000;
+};
 /**
  * 建齐 device lane 的三件。返回 `undefined` = **建不起来**(没有 SQL 后端 ⇒ 没有四表店)。
  *

package/dist/boot/device-lane.js

@@ -1,16 +1,6 @@
 import { createDeviceEnrollment, createFixedWindowRateLimiter } from "../device-enrollment.js";
 import { createDeviceWsHub } from "../device-ws-hub.js";
-export function createDeviceEnrollRateLimiter(gate) {
-    return {
-        check: async (key) => {
-            const g = gate();
-            if (!g)
-                throw new Error("device enrollment rate gate is not wired yet (boot window) — refusing rather than admitting unmetered enrollment attempts");
-            const verdict = g.check(`device-enroll:${key}`);
-            return { allowed: verdict.allowed, retryAfterSec: verdict.retryAfterSec };
-        },
-    };
-}
+export const DEVICE_ENROLL_RATE_POLICY = { limit: 10, windowMs: 60_000 };
 export function createDeviceLane(ctx) {
     const { config, logger, metrics, backend, replicaId } = ctx;
     const store = backend?.device?.();
@@ -19,7 +9,7 @@ export function createDeviceLane(ctx) {
     const knobs = config.remoteExec?.provider === "device" ? config.remoteExec : undefined;
     const enrollment = createDeviceEnrollment({
         store,
-        ...(ctx.rateGate ? { rateLimiter: createDeviceEnrollRateLimiter(ctx.rateGate) } : { rateLimiter: createFixedWindowRateLimiter({ limit: 10, windowMs: 60_000 }) }),
+        rateLimiter: createFixedWindowRateLimiter(DEVICE_ENROLL_RATE_POLICY),
     });
     const hub = createDeviceWsHub({
         store,
@@ -41,7 +31,7 @@ export function createDeviceLane(ctx) {
         replicaId,
         maxInflightPerDevice: knobs?.maxInflightPerDevice ?? 4,
         maxPreAuthPerRemote: knobs?.maxPreAuthPerRemote ?? 8,
-        crossReplicaEnrollRateLimit: ctx.rateGate !== undefined,
+        enrollRateLimit: `${DEVICE_ENROLL_RATE_POLICY.limit}/${DEVICE_ENROLL_RATE_POLICY.windowMs / 1000}s per caller identity (per replica; independent of RATE_LIMIT_RPM)`,
     });
     return { store, enrollment, hub };
 }

package/dist/boot/stage-05-execution-env.js

@@ -2,10 +2,9 @@ import { createToolTracer, createPermissionDeniedMeter } from "../observability/
 import { composeHooks } from "../hooks/hook-runner.js";
 import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
 import { createExecutionEnv } from "./execution-env.js";
-import { rateLimiter } from "./late-binds.js";
 export function runStage05(ctx) {
     const { backend, config, instanceId, logger, metrics, taskAttachmentStore } = ctx;
-    const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId, rateGate: () => rateLimiter }) : undefined;
+    const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId }) : undefined;
     const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
     const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -20,6 +20,7 @@ import { createParkedReviveInheritedGate } from "./parked-revive-gate.js";
 import { createWebFetchSummarizeLane } from "./webfetch-summarize-lane.js";
 import { createRunnerDepsOnAsk } from "./runner-deps.js";
 import { bindRateLimiter, bindRunStore } from "./late-binds.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage07(ctx) {
     const { backend, backgroundAgentStore, brain, checkpointStore, config, configCenter, counterDegradeHook, durableEnabled, handslessSubRunner, localRoot, logger, memoryEngine, metrics, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
     const authorize = createAuthorizer(config, sessionStore);
@@ -66,7 +67,7 @@ export async function runStage07(ctx) {
         logger.info("a2a_serve_enabled", {
             card: "/.well-known/agent-card.json",
             rpc: "/v1/a2a",
-            advertisedUrl: config.a2aServe.url,
+            advertisedUrl: buildDisplaySafeUrl(config.a2aServe.url),
             skills: config.a2aServe.skills.length,
             blockingWaitMs: config.a2aServe.blockingWaitMs,
             tasksUsable: runStore !== undefined,

package/dist/boot/stage-09-leader.js

@@ -4,6 +4,7 @@ import { createRegistryJwtVerifier } from "../auth-bridge.js";
 import { createSessionFaces } from "./session-faces.js";
 import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
     const { approvalExemptionStore, backend, brain, checkpointStore, config, configCenter, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryStore, governanceSeams, localRoot, logger, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
@@ -26,7 +27,7 @@ export function runStage09(ctx) {
         })
         : undefined;
     if (registryJwtVerifier)
-        logger.info("auth_bridge_enabled", { issuer: authBridgeIssuer });
+        logger.info("auth_bridge_enabled", { issuer: buildDisplaySafeUrl(authBridgeIssuer ?? "") });
     const hookWakeBus = {};
     const wiringSpecTemplate = durableEnabled
         ? { checkpointStore, durableApproval: { scope: encodeCheckpointScope(undefined) } }

package/dist/boot/stage-10-http-server.js

@@ -21,6 +21,7 @@ import { createRunnerDepsOnAsk } from "./runner-deps.js";
 import { installShutdownHandlers } from "./shutdown.js";
 import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
     const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveTool, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionShellGateRegistry, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, singleUserAutoAcceptBaseline, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storeBackendDegraded, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
@@ -67,6 +68,7 @@ export async function runStage10(ctx) {
     const seams = {
         deviceHub: deviceLane?.hub,
         deviceStore: deviceLane?.store,
+        deviceEnrollment: deviceLane?.enrollment,
         sessionAudit,
         routeJudgeBrain: brain,
         purgeSession: purgeSession ? purgeSession : undefined,
@@ -237,7 +239,7 @@ export async function runStage10(ctx) {
         logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}) },
     });
     if (fleetClient)
-        logger.info("fleet_client_started", { worker: config.configCenter?.worker, address: process.env.FLEET_ADVERTISE_ADDRESS });
+        logger.info("fleet_client_started", { worker: config.configCenter?.worker, address: buildDisplaySafeUrl(process.env.FLEET_ADVERTISE_ADDRESS ?? "") });
     logger.info("listening", {
         port: config.port,
         bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
@@ -255,7 +257,7 @@ export async function runStage10(ctx) {
         maxPrincipalCostUsd: config.maxPrincipalCostUsd || null,
         costQuota: config.maxPrincipalCostUsd > 0 ? counterStoreLabel(backend?.costQuota, backend?.kind) : "off",
         toolResultStore: toolResultStore ? (backend?.kind === "local" ? "file(local)" : "shared(sql)") : "in-process",
-        otel: config.otel ? config.otel.endpoint : null,
+        otel: config.otel ? buildDisplaySafeUrl(config.otel.endpoint) : null,
         perModelKeys: Object.keys(config.modelApiKeyEnv).length,
         sealedModelKeys: Object.values(config.modelApiKeys).filter((v) => typeof v === "string").length,
         sealedPoisonedModels: Object.values(config.modelApiKeys).filter((v) => typeof v !== "string").length,

package/dist/boot/stores.js

@@ -32,6 +32,7 @@ import { resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildMemoryWriteBoundaryAudit, effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { buildMemoryPosture } from "../memory-posture.js";
 import { establishSqlEnginePosture } from "../sql-engine-posture.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 const DARK_REASON_PROSE = {
     engine_off: () => "MEMORY_ENGINE=off",
     multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|tidb to light up)",
@@ -361,7 +362,7 @@ export async function openStores(ctx) {
                 ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
                 ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
             });
-            logger.info("memory_sync_enabled", { url: config.memorySync.url, scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPath });
+            logger.info("memory_sync_enabled", { url: buildDisplaySafeUrl(config.memorySync.url), scope: config.memorySync.scope, cursorPath: memorySyncRunner.cursorPath });
             memorySyncRunner.trigger("boot");
         }
         else {

package/dist/brain.js

@@ -3,6 +3,7 @@ import { normalizeBaseUrl } from "@sema-agent/core";
 import { buildDefaultResilience } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
 import { catalogBrainLane } from "./model-provider.js";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -119,7 +120,7 @@ export function brainSummary(config) {
     const hasFailover = config.gatewayFallbackUrls.length > 0;
     const breakerActive = r.circuitBreaker && hasFailover;
     return {
-        gateway: config.gatewayBaseUrl,
+        gateway: buildDisplaySafeUrl(config.gatewayBaseUrl),
         gatewayFallbacks: config.gatewayFallbackUrls.length,
         failover: hasFailover,
         anthropicRoute: Boolean(config.anthropic),
@@ -137,7 +138,7 @@ export function brainSummary(config) {
         circuitBreakerNoop: r.circuitBreaker && !hasFailover ? "needs ≥2 gateway routes" : null,
         reactiveDegradeTo: config.degrade?.reactive && config.models?.[config.degrade.to] ? config.degrade.to : null,
         reactiveDegradeBaseUrl: config.degrade?.reactive && config.models?.[config.degrade.to]
-            ? config.models[config.degrade.to].baseUrl || config.gatewayBaseUrl
+            ? buildDisplaySafeUrl(config.models[config.degrade.to].baseUrl || config.gatewayBaseUrl)
             : null,
         ...((() => {
             const target = config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;

package/dist/config-catalog.js

@@ -55,7 +55,7 @@ export const CONFIG_CATALOG = [
     r("ALLOW_UNAUTHED_WRITES", "auth", "boolean", "无 service token 时仍接受任务提交(本地开发逃生口;缺省 fail-closed 拒提交)", { staticDefault: "false", danger: SEC, configKey: "allowUnauthedWrites" }),
     r("ANTHROPIC_API_KEY", "modelPlane", "secret", "Anthropic 协议路线的 x-api-key 凭据(与 AUTH_TOKEN 二选一,AUTH_TOKEN 优先;与 BASE_URL 同在时可推断 provider)", { danger: [...SEC, ...BILL] }),
     r("ANTHROPIC_AUTH_TOKEN", "modelPlane", "secret", "Anthropic 兼容生态的 Bearer 凭据(设了则不发 x-api-key)", { danger: [...SEC, ...BILL] }),
-    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice)"),
+    r("ANTHROPIC_BASE_URL", "modelPlane", "url", "Anthropic 协议路线 base URL(与凭据同在且 MODEL_PROVIDER 未设 ⇒ 推断 provider=anthropic 并 boot notice;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo`)"),
     r("ANTHROPIC_CACHE_BREAKPOINTS", "modelPlane", "boolean", "Anthropic 路线 prompt-cache breakpoints 开关", { staticDefault: "true" }),
     r("ANTHROPIC_MAX_RETRIES", "modelPlane", "number", "Anthropic 路线 SDK 每次调用重试上限", { derivedDefaultNote: "缺席 ⇒ 不传引擎,core/SDK 默认当家" }),
     r("ANTHROPIC_VERSION", "modelPlane", "string", "Anthropic API version 头(缺省由 SDK 定)"),
@@ -107,6 +107,7 @@ export const CONFIG_CATALOG = [
     r("DELEGATION_MAX_CONCURRENT", "orchestration", "number", "委派入口并发帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 20)" }),
     r("DELEGATION_MAX_PER_SESSION", "orchestration", "number", "委派入口每会话累计帽", { derivedDefaultNote: "缺席 ⇒ 不铸键,core 自缺省(CC parity 200)" }),
     r("DEVICE_DELIVERY_TIMEOUT_MS", "orchestration", "number", "device 车道等在途槽上限(ms;到期 device.busy)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 10s" }),
+    r("DEVICE_ENROLL_TOKEN_TTL_SEC", "orchestration", "number", "enrollment token 有效期(整秒,自 DB now 起算;域 [1,86400],坏值拒启)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 签发点默认 900(15min)" }),
     r("DEVICE_EXEC_TIMEOUT_MS", "orchestration", "number", "device 车道指令级默认超时(ms;per-command 可收紧)", { derivedDefaultNote: "缺席 ⇒ adapter 默认 1800s" }),
     r("DEVICE_MAX_INFLIGHT_PER_DEVICE", "orchestration", "number", "per-device 在途上限(超额云侧排队)", { derivedDefaultNote: "缺席 ⇒ 4(§11-O3 裁定值)" }),
     r("DEVICE_MAX_PREAUTH_PER_REMOTE", "orchestration", "number", "未鉴权握手的 per-remote 并发帽(正整数或字面 off;XFF/NAT 形用 off+全局帽)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 8" }),
@@ -281,8 +282,8 @@ export const CONFIG_CATALOG = [
     r("MODEL_EXTRA_BODY", "modelPlane", "opaque", "生成参数直通 JSON(top_k/logit_bias 等;必须静态 —— 前缀缓存键序)", { danger: SEC }),
     r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0=关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
-    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
-    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV)", { configKey: "gatewayFallbackUrls" }),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(默认 localhost 占位 —— 公开分发不烤内网坐标;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY)", { staticDefault: "http://127.0.0.1:8000/v1", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`)", { configKey: "gatewayFallbackUrls" }),
     r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
     r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0=关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),

package/dist/config-center/apply-effective.js

@@ -6,6 +6,7 @@ import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { stageLimits } from "./stage-limits.js";
 import { BATCH1_LIMIT_KEYS } from "./hot-keys-registry.js";
+import { buildDisplaySafeUrl } from "../trace/redact.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
 function envDerivedModel(config) {
     const m = config.envModel;
@@ -200,9 +201,9 @@ function stageEffective(config, eff, logger, opts) {
                     ok = false;
                 }
                 if (ok)
-                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: rawBaseUrl, hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
+                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: buildDisplaySafeUrl(rawBaseUrl), hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
                 else {
-                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: String(rawBaseUrl).slice(0, 120), hint: "only http(s) URLs are honored — falling back to the boot-env gateway" });
+                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: buildDisplaySafeUrl(String(rawBaseUrl)).slice(0, 120), hint: "only http(s) URLs are honored — falling back to the boot-env gateway" });
                     safeUrl = undefined;
                 }
             }

package/dist/config-center/http-client.d.ts

@@ -1,10 +1,18 @@
-import { type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
+import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
- *  boot/refresh 的候选门直接消费。 */
+ *  boot/refresh 的候选门直接消费。
+ *
+ *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义。折叠是**有损**的——
+ *  `hosts-grandfathered` / `legacy-governance-lifted` 两员按律折成 `null`(值已被收编接受,见
+ *  `read-warnings.ts` 头注),于是只看 `domainErrors` 的人**永远**看不见兼容臂有没有开着;而契约把
+ *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
+ *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
+ *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
+ *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。 */
 export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     effective: EffectiveConfig;
     etag?: string;
@@ -12,6 +20,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
         domain: string;
         error: string;
     }>;
+    readWarnings: readonly EffectiveReadWarning[];
 } | null>;
 /**
  * [ref] §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime

package/dist/config-center/http-client.js

@@ -29,7 +29,7 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
             domainErrors.push(f);
     }
     const effective = wire;
-    return { effective, etag: res.headers.get("etag") ?? undefined, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
+    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
 }
 export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
     const raw = await requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker);

package/dist/config-center/read-warnings.d.ts

@@ -19,7 +19,7 @@
  * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
  * `onWarning` 流),不借候选门这条带副作用的通道传信息。
  */
-import type { EffectiveReadWarning } from "@sema-agent/settings-schema";
+import { type EffectiveReadWarning } from "@sema-agent/settings-schema";
 export type FoldedReadWarning = {
     readonly domain: string;
     readonly error: string;

package/dist/config-center/read-warnings.js

@@ -1,3 +1,4 @@
+import { formatConfigPath } from "@sema-agent/settings-schema";
 const MAX_ERROR_CHARS = 600;
 const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
 const errorText = (e) => (e instanceof Error ? e.message : String(e));
@@ -8,10 +9,11 @@ const keyList = (prefix, keys, truncatedFrom) => {
     let used = 0;
     const suffixFor = (n) => (n < total ? ` (+${total - n} more, list truncated)` : "");
     for (const k of keys) {
-        const piece = (shown.length > 0 ? ", " : "") + k;
+        const rendered = formatConfigPath(k);
+        const piece = (shown.length > 0 ? ", " : "") + rendered;
         if (used + piece.length + suffixFor(shown.length + 1).length > budget)
             break;
-        shown.push(k);
+        shown.push(rendered);
         used += piece.length;
     }
     return `${prefix}${shown.join(", ")}${suffixFor(shown.length)}`;
@@ -24,7 +26,7 @@ export function foldEffectiveReadWarning(w) {
         case "domain-defaulted":
             return { domain: w.domain, error: cap(errorText(w.error)) };
         case "entry-dropped":
-            return { domain: w.domain, error: cap(`entry dropped by domain schema: ${w.path} (${errorText(w.error)})`) };
+            return { domain: w.domain, error: cap(`entry dropped by domain schema: ${formatConfigPath(w.path)} (${errorText(w.error)})`) };
         case "unknown-keys-dropped":
             return { domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
         case "unknown-keys-carried":

package/dist/config-center/types.d.ts

@@ -61,7 +61,9 @@ export interface CenterModel {
      * ⚠️ 前身两键 `defaultThinking` / `reasoningEffortLevels` 已随本件删除:它们从来没有声明面 ——
      * settings-schema 的 `ModelEntry` 里没有这两个键,**两条腿**(本地 `parseDomainLoud` / 远端
      * `readEffectiveWire`)都把它们当未知键剥掉(1.10.0 夹具实测:`unknown-keys-dropped
-     * {keys:["models.0.defaultThinking","models.0.reasoningEffortLevels"]}`),`mapToServiceEffective` 的
+     * {keys:["models.0.defaultThinking","models.0.reasoningEffortLevels"]}`;settings-schema 3.0.0 起同一条
+     * 告警的坐标是**段数组** `{keys:[["models",0,"defaultThinking"],…]}`,出门形走 `formatConfigPath`),
+     * `mapToServiceEffective` 的
      * CLOSED 投影也从未列过它们。留着 = 一份读不到任何东西的类型承诺 + `compat.reasoningEffortLevels`
      * 之外的第二个写者([ref]:同一语义面禁两个写者)。roster 级 `defaultThinking` 若要真做,归 schema 补键
      * 另立单据(见 CHANGELOG 未闭环)。

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -1,5 +1,6 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
 import { modelProviderRefusal } from "./model-provider.js";
+import { modelRouteUrlRefusal } from "./model-route-url.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
@@ -137,6 +138,17 @@ export const CONFIG_CROSS_INVARIANTS = [
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:model-provider-word" },
         check: ({ next }) => (next.envModel.provider === undefined ? undefined : modelProviderRefusal(next.envModel.provider)),
     },
+    {
+        id: "gateway-url-userinfo",
+        keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic"],
+        restartReason: "model-route-url",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:gateway-url-userinfo" },
+        check: ({ next }) => modelRouteUrlRefusal("MODEL_GATEWAY_BASEURL", next.gatewayBaseUrl, "MODEL_API_KEY") ??
+            next.gatewayFallbackUrls
+                .map((u, i) => modelRouteUrlRefusal(`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"))
+                .find((r) => r !== undefined) ??
+            modelRouteUrlRefusal("ANTHROPIC_BASE_URL", next.anthropic?.baseUrl ?? "", "ANTHROPIC_API_KEY"),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);

package/dist/config-provider.d.ts

@@ -1,5 +1,5 @@
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { type EffectiveConfig as AgentConfigEffective } from "@sema-agent/settings-schema";
+import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
 /** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
@@ -10,6 +10,13 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
+/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义。折叠是有损的——
+ *  `hosts-grandfathered` / `legacy-governance-lifted` 按律折成 `null`,只看 `domainErrors` 的人永远看不见
+ *  兼容臂还开着,而契约铸出 `legacy-governance-lifted` 的理由正是「关窗的前提是有人知道它还开着」
+ *  (`legacyGovernanceFromRuntime` SUNSET 注)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
+ *  ——缺席/空两形并存就是又一处二义。
+ *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
+ *  路由进日志/审计流的消费者必须自己先脱敏。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -17,6 +24,7 @@ export type FetchEffectiveResult = {
         domain: string;
         error: string;
     }>;
+    readWarnings: readonly EffectiveReadWarning[];
 } | null;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */

package/dist/config-provider.js

@@ -61,9 +61,11 @@ export class LocalConfigProvider {
     }
     async fetchEffective(etag) {
         const parseWarnings = [];
+        const readWarnings = [];
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
                 onWarning: (w) => {
+                    readWarnings.push(w);
                     const f = foldEffectiveReadWarning(w);
                     if (f !== null)
                         parseWarnings.push(f);
@@ -82,7 +84,7 @@ export class LocalConfigProvider {
         }
         const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
-        return { effective: mapToServiceEffective(eff, eff.version), etag: tag, ...(errors.length > 0 ? { domainErrors: errors } : {}) };
+        return { effective: mapToServiceEffective(eff, eff.version), etag: tag, readWarnings, ...(errors.length > 0 ? { domainErrors: errors } : {}) };
     }
     async fetchSkillContent(contentHash) {
         const skills = await this.store.getDomain("skills");

package/dist/config-types.d.ts

@@ -778,6 +778,13 @@ export interface ServiceConfigFlat {
          *  形会把全员折叠成单键,per-remote 层退化成共享预算而非公平层,`off` + 全局帽 64 是诚实形)。
          *  坏值拒启([ref] A 档),词表与拒因见 config.ts `parseDevicePreAuthPerRemoteEnv`。 */
         maxPreAuthPerRemote?: number | "off";
+        /** `DEVICE_ENROLL_TOKEN_TTL_SEC`(§4.7 第五个旋钮;默认 900 = §7-T5 ① 的 15min)= enrollment
+         *  token 的有效期**时长**(整秒,自 **DB now** 起算 —— 时间权威是库,不是副本墙钟)。唯一消费点 =
+         *  签发动词 `POST /v1/devices/enroll-tokens`(`http/routes/devices.ts`);S-470 之前它刻意未铸
+         *  (端点不存在 ⇒ 铸了就是一个「配了不生效」的死键,[ref] 病族),随该端点同批铸 + 接线。
+         *  域 = `[1, 86400]` 的十进制正整数,坏值**拒启**([ref] A 档;解析器 `parseDeviceEnrollTokenTtlEnv`)。
+         *  缺席 ⇒ 签发点的属主默认 900(不在 config 层抄第二份默认,与本族其余旋钮同姿势)。 */
+        enrollTokenTtlSec?: number;
         /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
         supersede?: "stale_only" | "deny";
     } | {

package/dist/config.js

@@ -18,6 +18,8 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { modelProviderRefusal } from "./model-provider.js";
+import { modelRouteUrlRefusal } from "./model-route-url.js";
+import { buildDisplaySafeUrl } from "./trace/redact.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -333,6 +335,18 @@ function optNumEnvStrict(name) {
         return undefined;
     return parseNumOrFail(name, raw);
 }
+function parseDeviceEnrollTokenTtlEnv() {
+    const raw = process.env.DEVICE_ENROLL_TOKEN_TTL_SEC;
+    if (raw === undefined || raw === "")
+        return undefined;
+    if (!/^[1-9]\d*$/.test(raw) || Number(raw) > 86_400) {
+        throw new Error(`env DEVICE_ENROLL_TOKEN_TTL_SEC=${JSON.stringify(raw)} must be a whole number of seconds in [1, 86400] — ` +
+            `a malformed TTL would otherwise run as the default (900s) while the operator believes their value is in force ` +
+            `(#210: deployment knobs never fall back silently). "0"/negative would issue tokens that are already expired; ` +
+            `an over-a-day enrollment window is a hoarding surface (device-executor-lane-v2 §7-T5 ①).`);
+    }
+    return Number(raw);
+}
 function parseDevicePreAuthPerRemoteEnv() {
     const raw = process.env.DEVICE_MAX_PREAUTH_PER_REMOTE;
     if (raw === undefined || raw === "")
@@ -783,6 +797,16 @@ function parseModelDomain() {
             throw new Error(refusal);
         }
     }
+    for (const [envKey, raw, knob] of [
+        ["MODEL_GATEWAY_BASEURL", gatewayBaseUrl, "MODEL_API_KEY"],
+        ...csv("MODEL_GATEWAY_FALLBACK_URLS").map((u, i) => [`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"]),
+        ["ANTHROPIC_BASE_URL", firstSetEnv("ANTHROPIC_BASE_URL") ?? "", "ANTHROPIC_API_KEY"],
+    ]) {
+        const refusal = modelRouteUrlRefusal(envKey, raw, knob);
+        if (refusal !== undefined) {
+            throw new Error(refusal);
+        }
+    }
     const inferredAnthropicBaseUrl = firstSetEnv("ANTHROPIC_BASE_URL");
     const inferredAnthropicCred = firstSetEnv("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN");
     const provider = (() => {
@@ -793,7 +817,7 @@ function parseModelDomain() {
                 event: "model_provider_inferred",
                 fields: {
                     provider: "anthropic",
-                    baseUrl: inferredAnthropicBaseUrl,
+                    baseUrl: buildDisplaySafeUrl(inferredAnthropicBaseUrl),
                     hint: "MODEL_PROVIDER is unset but an explicit ANTHROPIC base URL + credential are configured — inferred provider=anthropic (set MODEL_PROVIDER explicitly to override)",
                 },
             });
@@ -1728,6 +1752,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { execTimeoutMs: n } : {}))(optNumEnvStrict("DEVICE_EXEC_TIMEOUT_MS")),
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(optNumEnvStrict("DEVICE_MAX_INFLIGHT_PER_DEVICE")),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
+                                                                ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
@@ -1878,7 +1903,7 @@ function parseGitApiKind(raw, baseUrl) {
     if (!baseUrl)
         return kind;
     if (!URL.canParse(baseUrl)) {
-        throw new Error(`GIT_API_BASEURL="${baseUrl}" is not a valid URL (expected e.g. https://git.example.com)`);
+        throw new Error(`GIT_API_BASEURL="${buildDisplaySafeUrl(baseUrl)}" is not a valid URL (expected e.g. https://git.example.com)`);
     }
     const u = new URL(baseUrl);
     const host = u.hostname.replace(/\.$/, "").toLowerCase();
@@ -1894,7 +1919,7 @@ function parseGitApiKind(raw, baseUrl) {
             throw new Error(`GIT_API_BASEURL for github.com must be exactly https://api.github.com (no path; got path "${u.pathname}"). GHE uses https://<ghe-host>/api/v3.`);
         }
         if (u.search || u.hash) {
-            throw new Error(`GIT_API_BASEURL must not carry a query or fragment (got "${baseUrl}")`);
+            throw new Error(`GIT_API_BASEURL must not carry a query or fragment (got "${buildDisplaySafeUrl(baseUrl)}")`);
         }
     }
     return kind;