@sema-agent/server 7.97.0 → 7.99.0

package/dist/config-center/http-client.js

@@ -2,15 +2,11 @@ import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
 import { foldEffectiveReadWarning } from "./read-warnings.js";
-export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective${worker ? `?worker=${encodeURIComponent(worker)}` : ""}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
+import { centerFetch } from "./center-request.js";
+import { answerStillCurrent } from "../center-credential.js";
+const CENTER_PULL_TIMEOUT_MS = 8000;
+export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
+    const { res, identity } = await centerFetch(center, { kind: "effective", worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (res.status === 304)
         return null;
     if (!res.ok)
@@ -29,10 +25,10 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
             domainErrors.push(f);
     }
     const effective = wire;
-    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
+    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, credentialIdentity: identity, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
 }
-export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
-    const raw = await requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker);
+export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(center, principal, etag, fetchImpl, worker);
     if (raw === null)
         return null;
     const parsedBody = PrincipalCapsWire.safeParse(raw.json);
@@ -84,31 +80,29 @@ function assertPrincipalEcho(echoed, principal) {
         throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
     }
 }
-async function requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const params = new URLSearchParams({ principal });
-    if (worker)
-        params.set("worker", worker);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
+async function requestPrincipalView(center, principal, etag, fetchImpl, worker) {
+    const { res, identity } = await centerFetch(center, { kind: "effective", principal, worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
+    const stillCurrent = () => {
+        if (!answerStillCurrent(center.credential, identity)) {
+            throw new Error("center credential identity changed while the principal view was in flight — response discarded; the next lookup runs under the current credential");
+        }
+    };
     if (res.status === 304) {
         if (!etag)
             throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+        stillCurrent();
         return null;
     }
     if (!res.ok)
         throw new Error(`config-center principal-caps HTTP ${res.status}`);
     const responseEtag = res.headers.get("etag");
-    return { json: await res.json(), ...(responseEtag !== null ? { etag: responseEtag } : {}) };
+    const json = await res.json();
+    stillCurrent();
+    return { json, ...(responseEtag !== null ? { etag: responseEtag } : {}) };
 }
 const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, orgMemory: true });
-export async function fetchPrincipalOrgMemory(baseUrl, token, principal, fetchImpl = fetch, worker) {
-    const raw = await requestPrincipalView(baseUrl, token, principal, undefined, fetchImpl, worker);
+export async function fetchPrincipalOrgMemory(center, principal, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(center, principal, undefined, fetchImpl, worker);
     if (raw === null)
         throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
     const parsed = PrincipalOrgMemoryEnvelope.safeParse(raw.json);
@@ -126,9 +120,8 @@ export class ConfigCenterHttpError extends Error {
         this.name = "ConfigCenterHttpError";
     }
 }
-export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/skills/content/${encodeURIComponent(contentHash)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchSkillContent(center, contentHash, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "skill-content", contentHash }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
     const content = await res.text();
@@ -138,16 +131,14 @@ export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl =
         throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
     return content;
 }
-export async function fetchPromptArtifact(baseUrl, token, artifactDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/epoch-artifacts/${encodeURIComponent(artifactDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchPromptArtifact(center, artifactDigest, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "prompt-artifact", digest: artifactDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
     return await res.json();
 }
-export async function fetchPromptBlob(baseUrl, token, contentDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/blobs/${encodeURIComponent(contentDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchPromptBlob(center, contentDigest, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "prompt-blob", digest: contentDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
     const bytes = new Uint8Array(await res.arrayBuffer());

package/dist/config-center/skills-mcp.d.ts

@@ -2,6 +2,7 @@ import type { A2aServerSpec, McpServerSpec } from "@sema-agent/core";
 import type { CenterMcp, ScopedA2aPeer } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
+import type { CenterEndpoint } from "./center-request.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
  * Merge center skills OVER the image baseline ([ref]-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
@@ -13,7 +14,9 @@ import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./type
  */
 export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
     skills: CenterSkillManifest[];
-}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch, 
+}, 
+/** S-651:中心端点(基址 + 凭证来源;每次正文拉取取一次值)。 */
+center: CenterEndpoint, logger?: Logger, fetchImpl?: typeof fetch, 
 /** LKG 姊妹面(clay 拍 2026-07-18):skill 正文的 content-addressed 盘缓存目录。读序=内存→盘(验
  *  hash,坏文件忽略)→中心(成功后 best-effort 回写)。让 LKG-boot 在中心不可达时不再于正文拉取上
  *  挂数秒(live 实测黑洞 +5.3s/skill 批),顺带省正常 refresh 的重复拉取。undefined=无盘缓存(原行为)。 */

package/dist/config-center/skills-mcp.js

@@ -5,7 +5,7 @@ import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } f
 import { fetchSkillContent } from "./http-client.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { describeBadWireName, isUsableWireName } from "../wire-name-bound.js";
-export async function applyCenterSkills(baseline, manifest, baseUrl, token, logger, fetchImpl = fetch, diskCacheDir) {
+export async function applyCenterSkills(baseline, manifest, center, logger, fetchImpl = fetch, diskCacheDir) {
     const { promises: fsp } = await import("node:fs");
     const { join: joinPath } = await import("node:path");
     const diskRead = async (hash) => {
@@ -50,7 +50,7 @@ export async function applyCenterSkills(baseline, manifest, baseUrl, token, logg
             if (content === undefined)
                 content = await diskRead(m.contentHash);
             if (content === undefined) {
-                content = await fetchSkillContent(baseUrl, token, m.contentHash, fetchImpl);
+                content = await fetchSkillContent(center, m.contentHash, fetchImpl);
                 diskWrite(m.contentHash, content);
             }
             contentCache.set(m.contentHash, content);

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "require-execution-lane" | "hosted-requires-principal";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "require-execution-lane";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "authBridgeIssuer">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -1,7 +1,7 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
-import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
+import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 export const LIVENESS_HEARTBEAT_MS = 30_000;
 const anyServiceAuth = (v) => Boolean(v.authToken) || Object.keys(v.authTokens ?? {}).length > 0;
 const mustNarrowBind = (v) => Boolean(v.allowUnauthedWrites) && !anyServiceAuth(v);
@@ -81,13 +81,6 @@ export const CONFIG_CROSS_INVARIANTS = [
             ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
             : undefined,
     },
-    {
-        id: "hosted-requires-principal",
-        keys: ["requirePrincipal", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "authBridgeIssuer"],
-        restartReason: "hosted-posture",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:hosted-requires-principal" },
-        check: ({ next }) => hostedPrincipalRefusal(next),
-    },
     {
         id: "sensitive-write-patterns",
         keys: ["sensitiveWritePatterns"],
@@ -160,12 +153,19 @@ export const CONFIG_CROSS_INVARIANTS = [
         keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic"],
         restartReason: "model-route-url",
         bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:gateway-url-userinfo" },
-        check: ({ next }) => modelRouteUrlRefusal("MODEL_GATEWAY_BASEURL", next.gatewayBaseUrl, "MODEL_API_KEY") ??
+        check: ({ next }) => modelRouteUrlRefusal("MODEL_GATEWAY_BASEURL", next.gatewayBaseUrl ?? "", "MODEL_API_KEY") ??
             next.gatewayFallbackUrls
                 .map((u, i) => modelRouteUrlRefusal(`MODEL_GATEWAY_FALLBACK_URLS[${i}]`, u, "MODEL_API_KEY"))
                 .find((r) => r !== undefined) ??
             modelRouteUrlRefusal("ANTHROPIC_BASE_URL", next.anthropic?.baseUrl ?? "", "ANTHROPIC_API_KEY"),
     },
+    {
+        id: "model-route-endpoint",
+        keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic", "models"],
+        restartReason: "model-route-endpoint",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
+        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next)),
+    },
 ];
 export function crossInvariant(id) {
     const inv = CONFIG_CROSS_INVARIANTS.find((i) => i.id === id);

package/dist/config-lkg.d.ts

@@ -1,8 +1,10 @@
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。 */
 export interface PersistedLkg {
-    formatVersion: 1;
+    formatVersion: 2;
     savedAt: string;
     worker: string;
+    /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
+    identity: string;
     etag?: string;
     effective: Record<string, unknown>;
 }
@@ -10,21 +12,58 @@ export interface PersistedLkg {
  *  hash 另拉)——黑洞中心下 LKG-boot 会在 skill 正文拉取上再挂数秒(live 实测 +5.3s)。正文按
  *  `<dir>/<sha-hex>` 落盘,读侧**必验 hash**(content-addressed 的全部意义;坏文件=忽略重拉)。 */
 export declare function defaultSkillCacheDir(): string;
-/** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema)。`CONFIG_LKG_PATH` 覆写;
- *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关)。🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是
- *  **fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
-export declare function defaultLkgPath(worker: string | undefined): string;
+/** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema),按「worker + 凭证身份」分箱。`CONFIG_LKG_PATH`
+ *  覆写(单一路径 ⇒ 不分箱,信封的 worker + identity 核仍守读回);`CONFIG_LKG_ENABLED=false` 关闭(读写双关)。
+ *  🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是**fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
+export declare function defaultLkgPath(worker: string | undefined, identity: string): string;
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
-export declare function saveLkg(path: string, worker: string | undefined, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
+export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
 /**
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
- * 文件缺席/JSON 坏/信封形不对/worker 不匹配(防同名文件跨 worker 串包)/prompts 面复判失败。
+ * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
+ * 单一路径时这是唯一的一道)/prompts 面复判失败。
  */
-export declare function loadLkg(path: string, worker: string | undefined): Promise<{
+export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
 } | {
     lkg?: undefined;
     reason: string;
 }>;
+/** 7.98.0 及以前的默认 LKG 路径(按当时的写法逐字保留 —— 这是盘上已有文件的名字,不是现行分箱规则)。 */
+export declare function legacyV1LkgPath(worker: string | undefined): string;
+export type LegacyLkgMigration = {
+    readonly outcome: "none";
+}
+/** `retireError`:新箱已写好,只是旧文件没退役成(改名 / 留副本失败)—— 只响一行,不影响已写好的箱。 */
+ | {
+    readonly outcome: "migrated";
+    readonly from: string;
+    readonly retiredTo: string;
+    readonly retireError?: string;
+} | {
+    readonly outcome: "not-migrated";
+    readonly path: string;
+    readonly reason: string;
+};
+/**
+ * formatVersion 1 LKG 的一次性迁移(规则一句:**身份推得出来才迁,推不出来就响亮拒**)。判序:
+ *  1. `legacyPath` ≠ `binPath` 时**先看本身份的箱**:箱里已有文件 ⇒ `none`(箱自己说话,旧文件是好是坏都不再相关,
+ *     不许一个坏旧文件把有效的箱挡成 env 兜底 —— 7.99.0 修复验证 N4)。箱查不了(非 ENOENT)⇒ 响亮拒。
+ *  2. 旧文件没有(ENOENT / ENOTDIR)或不是 formatVersion 1 信封 ⇒ `none`。旧默认路径上却读不了 / 不是 JSON ⇒
+ *     `not-migrated`(响亮,不当它不存在);`CONFIG_LKG_PATH` 同路径时这两形由 loadLkg 自己报(不重复打一行)。
+ *  3. v1 信封只记 worker:唯一推得出身份的形是拉取令牌(身份 = worker,`pullTokenIdentity`)。此刻身份正是它、worker
+ *     对得上、载荷过 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
+ *     0600),写成了才把旧文件改名 `<legacyPath>.migrated-v1`。写失败 ⇒ `not-migrated`,旧文件原样留在原位,下一次
+ *     照常可迁;写成之后改名失败 ⇒ 仍是 `migrated`(`retireError` 响一行),箱已在 ⇒ 下一次按判序 1 不再看旧文件。
+ *     同路径(`CONFIG_LKG_PATH`)时新箱的写入会原子替换旧文件本身,所以旧字节在写之前留一份 `.migrated-v1` 副本
+ *     (副本失败同样只进 `retireError`:载荷正要写进新箱,不是丢数据)。
+ *  4. 其余一律 `not-migrated`:拒因点名旧文件路径与出路(删掉它;中心下一份干净候选会写本身份自己的 LKG),不改名、不读回。
+ */
+export declare function migrateV1Lkg(o: {
+    legacyPath: string;
+    binPath: string;
+    worker: string | undefined;
+    identity: string;
+}): Promise<LegacyLkgMigration>;
 //# sourceMappingURL=config-lkg.d.ts.map

package/dist/config-lkg.js

@@ -3,22 +3,22 @@ import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
+import { centerStateBin, pullTokenIdentity } from "./center-credential.js";
 export function defaultSkillCacheDir() {
     return join(process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema"), "skill-cache");
 }
-export function defaultLkgPath(worker) {
+export function defaultLkgPath(worker, identity) {
     const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
-    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
-    return join(dir, `config-lkg-${key}.json`);
+    return join(dir, `config-lkg-${centerStateBin(worker, identity)}.json`);
 }
-export async function saveLkg(path, worker, effective, etag) {
-    const body = { formatVersion: 1, savedAt: new Date().toISOString(), worker: worker ?? "global", ...(etag !== undefined ? { etag } : {}), effective };
+export async function saveLkg(path, worker, identity, effective, etag) {
+    const body = { formatVersion: 2, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
     await fs.rename(tmp, path);
 }
-export async function loadLkg(path, worker) {
+export async function loadLkg(path, worker, identity) {
     let text;
     try {
         text = await fs.readFile(path, "utf8");
@@ -36,38 +36,125 @@ export async function loadLkg(path, worker) {
     if (parsed === null || typeof parsed !== "object")
         return { reason: "bad envelope" };
     const p = parsed;
-    if (p.formatVersion !== 1)
-        return { reason: `unknown formatVersion ${String(p.formatVersion)}` };
+    const formatVersion = p.formatVersion;
+    if (formatVersion === 1)
+        return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
+    if (formatVersion !== 2)
+        return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
-    if (p.effective === null || typeof p.effective !== "object")
-        return { reason: "bad effective" };
-    if (p.etag !== undefined && typeof p.etag !== "string")
-        return { reason: "bad etag" };
-    const eff = p.effective;
+    if (typeof p.identity !== "string" || p.identity !== identity)
+        return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
+    const problem = lkgPayloadProblem(p.effective, p.etag);
+    return problem === undefined ? { lkg: p } : { reason: problem };
+}
+function lkgPayloadProblem(effective, etag) {
+    if (effective === null || typeof effective !== "object")
+        return "bad effective";
+    if (etag !== undefined && typeof etag !== "string")
+        return "bad etag";
+    const eff = effective;
     if (typeof eff.version !== "number")
-        return { reason: "bad effective.version" };
+        return "bad effective.version";
     for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
         if (v === null || typeof v !== "object" || Array.isArray(v))
-            return { reason: `bad effective.${domain}` };
+            return `bad effective.${domain}`;
         if (arrayKey !== null) {
             const arr = v[arrayKey];
             if (arr !== undefined && !Array.isArray(arr))
-                return { reason: `bad effective.${domain}.${arrayKey}` };
+                return `bad effective.${domain}.${arrayKey}`;
         }
     }
     {
         const rt = eff.runtime;
         if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
-            return { reason: "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance" };
+            return "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance";
         }
     }
-    const promptsRaw = p.effective.prompts;
+    const promptsRaw = eff.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
-        return { reason: "prompts face fails re-validation" };
-    return { lkg: p };
+        return "prompts face fails re-validation";
+    return undefined;
+}
+export function legacyV1LkgPath(worker) {
+    const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
+    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
+    return join(dir, `config-lkg-${key}.json`);
+}
+export async function migrateV1Lkg(o) {
+    const refuse = (why) => ({
+        outcome: "not-migrated",
+        path: o.legacyPath,
+        reason: `pre-identity LKG (formatVersion 1) at ${o.legacyPath} not migrated: ${why}. Way out: delete that file — the next clean candidate from the center writes this credential identity's own LKG (${o.binPath})`,
+    });
+    const sameFile = o.legacyPath === o.binPath;
+    if (!sameFile) {
+        try {
+            await fs.access(o.binPath);
+            return { outcome: "none" };
+        }
+        catch (err) {
+            const code = errnoOf(err);
+            if (code !== "ENOENT")
+                return refuse(`this credential identity's bin ${o.binPath} could not be checked (${code})`);
+        }
+    }
+    let text;
+    try {
+        text = await fs.readFile(o.legacyPath, "utf8");
+    }
+    catch (err) {
+        const code = errnoOf(err);
+        return code === "ENOENT" || code === "ENOTDIR" || sameFile ? { outcome: "none" } : refuse(`it could not be read (${code})`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        return sameFile ? { outcome: "none" } : refuse(`it is not valid JSON (${err instanceof Error ? err.name : "parse error"})`);
+    }
+    if (parsed === null || typeof parsed !== "object" || !("formatVersion" in parsed) || parsed.formatVersion !== 1)
+        return { outcome: "none" };
+    const v1 = parsed;
+    if (v1.worker !== (o.worker ?? "global"))
+        return refuse(`it belongs to worker ${JSON.stringify(v1.worker)}`);
+    if (o.identity !== pullTokenIdentity(o.worker)) {
+        return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
+    }
+    const problem = lkgPayloadProblem(v1.effective, v1.etag);
+    if (problem !== undefined)
+        return refuse(`its payload is unusable (${problem})`);
+    const retiredTo = `${o.legacyPath}.migrated-v1`;
+    let retireError;
+    if (sameFile) {
+        try {
+            await fs.copyFile(o.legacyPath, retiredTo);
+        }
+        catch (err) {
+            retireError = `the formatVersion 1 bytes could not be kept as ${retiredTo} (${errnoOf(err)})`;
+        }
+    }
+    try {
+        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, typeof v1.etag === "string" ? v1.etag : undefined);
+    }
+    catch (err) {
+        return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);
+    }
+    if (!sameFile) {
+        try {
+            await fs.rename(o.legacyPath, retiredTo);
+        }
+        catch (err) {
+            retireError = `the old file could not be renamed to ${retiredTo} (${errnoOf(err)}) — harmless: the bin now exists, so the old file is never read again`;
+        }
+    }
+    return { outcome: "migrated", from: o.legacyPath, retiredTo, ...(retireError !== undefined ? { retireError } : {}) };
+}
+function errnoOf(err) {
+    return err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "unknown";
 }
 //# sourceMappingURL=config-lkg.js.map

package/dist/config-provider.d.ts

@@ -1,6 +1,7 @@
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
+import type { CenterEndpoint } from "./config-center/center-request.js";
 /** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
@@ -17,6 +18,8 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
+/** `credentialIdentity`(S-651 / [ref] E-15):远程腿恒在场 = 这次拉取所用凭证的身份(分箱键来源);本地腿
+ *  缺席(没有凭证 —— config.d 就在本机盘上)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -25,6 +28,7 @@ export type FetchEffectiveResult = {
         error: string;
     }>;
     readWarnings: readonly EffectiveReadWarning[];
+    credentialIdentity?: string;
 } | null;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
@@ -67,9 +71,7 @@ export interface ConfigProviderInput {
     /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
      *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: CenterEndpoint & {
         worker?: string;
         dryRun?: boolean;
     };
@@ -84,16 +86,15 @@ export interface ConfigProviderInput {
 }
 /**
  * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
- * baseUrl/token/worker are bound once and passed through. The two delegate fns are injectable (defaulting
+ * the center endpoint (baseUrl + credential SOURCE — S-651: read per request, never a bound token) and worker
+ * are passed through. The two delegate fns are injectable (defaulting
  * to the real config-center exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
     private readonly deps;
     readonly kind: "remote";
-    constructor(cc: {
-        baseUrl: string;
-        token: string;
+    constructor(cc: CenterEndpoint & {
         worker?: string;
     }, deps?: {
         fetchEffective?: typeof remoteFetchEffective;

package/dist/config-provider.js

@@ -2,7 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, } from "@sema-agent/settings-schema";
+import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
@@ -32,7 +32,7 @@ export class RemoteConfigProvider {
     }
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
-        const r = await fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
+        const r = await fn(this.cc, etag, undefined, this.cc.worker);
         if (r === null || r.domainErrors === undefined)
             return r;
         return { ...r, domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) };
@@ -40,7 +40,7 @@ export class RemoteConfigProvider {
     async fetchSkillContent(contentHash) {
         const fn = this.deps.fetchSkillContent ?? remoteFetchSkillContent;
         try {
-            return await fn(this.cc.baseUrl, this.cc.token, contentHash);
+            return await fn(this.cc, contentHash);
         }
         catch (err) {
             if (err instanceof ConfigCenterHttpError && err.status === 404)
@@ -77,10 +77,10 @@ export class LocalConfigProvider {
             return null;
         const refErrors = [];
         const resolve = createSiblingResolver(store, eff);
-        for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
+        for (const d of REF_CHECKED_DOMAINS) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
             if (issues.length > 0)
-                refErrors.push({ domain: d, error: issues.map((i) => `${i.path.join(".")}: ${redactConfigError(i.message)}`).join("; ") });
+                refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
         }
         const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];

package/dist/config-types.d.ts

@@ -15,6 +15,7 @@ import type { QuestionThrottle } from "./question.js";
 import type { UnattendedApprovalPolicy } from "./tool-approval.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
+import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -366,8 +367,18 @@ export interface ImageBakeConfig {
  *  fixtures that CONSTRUCT a config literal build this type and hand it to `attachConfigGroups`. */
 export interface ServiceConfigFlat {
     port: number;
-    /** OpenAI-compatible model gateway base URL (without /chat/completions). */
-    gatewayBaseUrl: string;
+    /** OpenAI-compatible model gateway base URL (without /chat/completions) — `MODEL_GATEWAY_BASEURL`.
+     *
+     *  🔴 S-623:**缺席 = 这台部署没有网关**(没有出厂缺省;旧的本机占位值在读入那一步抹掉「来源」,让没配网关的
+     *  部署起得来、第一次调用才炸)。形取「可选键」而不是判别联合:消费方问的只有「有没有声明网关根、是哪个」,
+     *  一个只带一位载荷的联合不比 `string | undefined` 多说任何事,且与紧邻的 `gatewayApiKey?` / `gatewayMaxRetries?`
+     *  的「缺席不铸键」同一条 presence 律。一条 openai 路由请求打到哪儿,只经 `model-route-endpoint.ts` 的
+     *  `openaiRouteBaseUrl` 求(路由自己的 `baseUrl` 胜、网关次之);「配置能派发到的每条 openai 路由都解析得到」
+     *  由 boot(config.ts)与热路径(apply-effective)同一只判据保证。 */
+    gatewayBaseUrl?: string;
+    /** `MODEL_API_KEY` —— **网关的**凭据,只与网关根配对([ref])。S-623:与 `gatewayBaseUrl` 同进同出 ——
+     *  没有网关就不装载(否则 brain 的声明根为空 ⇒ core 判 `unpinned` ⇒ 这把 key 会被送到每条自带 baseUrl 的
+     *  openai 条目),由 `model_gateway_key_unpaired` 启动通知说出来。 */
     gatewayApiKey?: string;
     /** Secondary openai-compatible gateways for cross-gateway FAILOVER (same protocol + same model id).
      *  Tried in order after the primary when a gateway fails before streaming any content. */
@@ -1230,8 +1241,8 @@ export interface ServiceConfigFlat {
     principalJwtAud?: string;
     /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
      *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
-     *  `boot/stage-09-leader.ts` 的桥装配处)—— 本字段是「运维**点名了**一个外部签发方」这个事实的载体,
-     *  而那条回退的事实来源是「配了 center」= fleet 管理轴,不是租户轴(理由全文见 `hosted-posture.ts`)。 */
+     *  `boot/stage-09-leader.ts` 的桥装配处)。唯一消费方是桥;S-671([ref] ①)起它**不是**托管证据 ——
+     *  显式与回退 issuer 在租户轴上同判(理由见 `hosted-posture.ts`)。 */
     authBridgeIssuer?: string;
     /** Max accepted principal-JWT lifetime (exp − now), seconds — caps the replay window past the short-lived mandate.
      *  0 = no cap. `PRINCIPAL_JWT_MAX_TTL_SEC` (default 120). */
@@ -1897,10 +1908,13 @@ export interface ServiceConfigFlat {
      *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true; legacy CONFIG_CENTER_DRY_RUN now boot-rejects, no dual-read): pull + LOG what the registry would change vs the env-derived
      *  config, but do NOT apply it — a safe-rollout verification step before flipping to live.
      *  `worker` (SEMA_REGISTRY_WORKER=<name>; legacy CONFIG_CENTER_WORKER now boot-rejects, no dual-read; injected per-worker by the reconciler): scopes the pull to
-     *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible). */
+     *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible).
+     *  `credential`(S-651,BREAKING:取代 7.98.0 及以前的 `token: string` 启动快照):凭证来源活对象
+     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_REGISTRY_TOKEN`(值)或
+     *  `SEMA_REGISTRY_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一。 */
     configCenter?: {
         baseUrl: string;
-        token: string;
+        credential: CenterCredentialSource;
         dryRun: boolean;
         worker?: string;
     };