@sema-agent/server 7.97.0 → 7.99.0

package/dist/project-memory.d.ts

@@ -1,3 +1,4 @@
+import { type PlatformPath } from "node:path";
 import type { ProjectMemoryLoad } from "@sema-agent/core";
 interface ProjectMemoryCtx {
     cwd: string;
@@ -7,9 +8,35 @@ interface ProjectMemoryCtx {
     sessionId?: string;
     phase?: "fresh" | "resume" | "post-compact" | "post-clear";
 }
+/** The instruction-file name chain: the CLAUDE family first, the AGENTS family only when no CLAUDE file is
+ *  present. The FIRST hit is the single declared instruction source.
+ *
+ *  Order follows CC 2.1.280 (clay ruling [ref], 2026-09-23, board [ref] RG-2). It replaces the core 1.302 S-1
+ *  order, where AGENTS.md won over CLAUDE.md; [ref] supersedes that. In CC 2.1.280:
+ *   - cli280.js:185162 — the default mode `claude-md-or-agents-md`: "a project with no CLAUDE.md of its own gets its
+ *     AGENTS.md files instead, loaded exactly where and how CLAUDE.md would be";
+ *   - cli280.js:245920 — the two name families: AGENTS `["AGENTS.md", ".claude/AGENTS.md"]`,
+ *     CLAUDE `["CLAUDE.md", ".claude/CLAUDE.md", "CLAUDE.local.md"]`;
+ *   - cli280.js:226831 — the 2.1.277 changelog entry "in a project with no CLAUDE.md, Claude Code reads AGENTS.md
+ *     instead".
+ *  Not followed here (CC divergences, registration drafted in the che-MN closing note): `CLAUDE.local.md` is not read;
+ *  CC's other `instructionFiles` modes (`claude-md-and-agents-md` loads both, `managed-only`) are not offered; CC loads
+ *  every CLAUDE file it finds, per directory level up the ancestor chain, whereas this loader reads one root and
+ *  takes the single first hit. */
+declare const INSTRUCTION_FILE_CHAIN: readonly ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
+type ChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
+/** Recover (root, rel) for a path the LOADER declared — every declared path is `root + one chain member`.
+ *  The probe needs this to re-run the loader's parent-directory symlink gate each round (self-review: the probe
+ *  checked only the final component, so swapping `.claude` for a symlink out of the repo MID-RUN made the probe
+ *  fingerprint an outside file). Exported only for its path-matrix pin (posix / win32 through `p`); the probe
+ *  calls it with the host `node:path`. */
+export declare function instructionChainCoordinates(absPath: string, p?: PlatformPath): {
+    root: string;
+    rel: ChainMember;
+} | null;
 /**
  * Build a `loadProjectMemory` for the host lane. Returns null (skip) unless hands are enabled AND cwd is a local
- * directory. Reads the instruction-file chain (AGENTS.md → CLAUDE.md → .claude/CLAUDE.md, S-1) + (non-subagent)
+ * directory. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
  * `git log -5` / `git status`, redacts secrets, and caps the total. A subagent gets a trimmed instruction file and
  * no git narrative (cost control, H7). When an instruction file is hit the return is a `ProjectMemoryLoad`
  * declaring it in `instructionSources` (path + sha256 over the raw bounded-read window) so core's

package/dist/project-memory.js

@@ -1,11 +1,11 @@
 import { promises as fs, constants as fsConstants } from "node:fs";
 import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
-import { isAbsolute, join, sep } from "node:path";
-import { scrubSecretEnv } from "@sema-agent/core";
+import hostPath, { isAbsolute, join } from "node:path";
 import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
+import { scrubServerSecrets } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
-const INSTRUCTION_FILE_CHAIN = ["AGENTS.md", "CLAUDE.md", ".claude/CLAUDE.md"];
+const INSTRUCTION_FILE_CHAIN = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
 const INSTRUCTION_READ_CAP = 24 * 1024;
 function capUtf8(s, maxBytes) {
     const buf = Buffer.from(s, "utf8");
@@ -41,15 +41,16 @@ function instructionHash(raw) {
     return `hmac-sha256:${createHmac("sha256", INSTRUCTION_HASH_KEY).update(raw).digest("hex")}`;
 }
 const ABSENT_HASH = null;
-function chainCoordinates(absPath) {
-    let best = null;
-    for (const rel of INSTRUCTION_FILE_CHAIN) {
-        const suffix = sep + rel.split("/").join(sep);
-        if (absPath.endsWith(suffix) && (best === null || suffix.length > best.len)) {
-            best = { root: absPath.slice(0, -suffix.length), rel, len: suffix.length };
-        }
+export function instructionChainCoordinates(absPath, p = hostPath) {
+    const candidates = INSTRUCTION_FILE_CHAIN.filter((rel) => absPath.endsWith(p.sep + rel.split("/").join(p.sep))).sort((a, b) => b.length - a.length);
+    for (const rel of candidates) {
+        let root = absPath;
+        for (let i = 0; i < rel.split("/").length; i++)
+            root = p.dirname(root);
+        if (p.join(root, rel) === absPath)
+            return { root, rel };
     }
-    return best && { root: best.root, rel: best.rel };
+    return null;
 }
 async function hasSymlinkedParent(root, rel) {
     const parts = rel.split("/").slice(0, -1);
@@ -62,10 +63,15 @@ async function hasSymlinkedParent(root, rel) {
     }
     return false;
 }
+async function readChainMember(root, rel, maxBytes, truncatedFlag) {
+    if (rel.includes("/") && (await hasSymlinkedParent(root, rel)))
+        return null;
+    return readRawCapped(join(root, rel), maxBytes, truncatedFlag);
+}
 function git(root, args, maxBytes) {
     const safeArgs = ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args];
     const scrubFindings = [];
-    const scrubbedEnv = scrubSecretEnv(process.env, scrubFindings);
+    const scrubbedEnv = scrubServerSecrets(process.env, scrubFindings);
     recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings);
     return new Promise((res) => {
         execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env: { ...scrubbedEnv, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }, (err, stdout, stderr) => {
@@ -156,9 +162,7 @@ export function makeLoadProjectMemory(opts) {
             hitIndex = -1;
             for (let i = 0; i < INSTRUCTION_FILE_CHAIN.length; i++) {
                 const rel = INSTRUCTION_FILE_CHAIN[i];
-                if (rel.includes("/") && (await hasSymlinkedParent(root, rel)))
-                    continue;
-                const raw = await readRawCapped(join(root, rel), claudeCap, claudeTrunc);
+                const raw = await readChainMember(root, rel, claudeCap, claudeTrunc);
                 if (raw !== null) {
                     claudeRaw = capUtf8(raw.toString("utf8"), claudeCap);
                     hitFile = rel;
@@ -171,8 +175,7 @@ export function makeLoadProjectMemory(opts) {
                 break;
             let appeared = false;
             for (const rel of INSTRUCTION_FILE_CHAIN.slice(0, hitIndex)) {
-                const higher = await fs.lstat(join(root, rel)).catch(() => null);
-                if (higher && !higher.isSymbolicLink()) {
+                if ((await readChainMember(root, rel, claudeCap)) !== null) {
                     appeared = true;
                     break;
                 }
@@ -229,11 +232,8 @@ export function makeProbeInstructionSources() {
             return await Promise.all(sources.map(async ({ path }) => {
                 if (!isAbsolute(path))
                     return { path, contentHash: null };
-                const coords = chainCoordinates(path);
-                if (coords && coords.rel.includes("/") && (await hasSymlinkedParent(coords.root, coords.rel))) {
-                    return { path, contentHash: null };
-                }
-                const raw = await readRawCapped(path, INSTRUCTION_READ_CAP);
+                const coords = instructionChainCoordinates(path);
+                const raw = coords ? await readChainMember(coords.root, coords.rel, INSTRUCTION_READ_CAP) : await readRawCapped(path, INSTRUCTION_READ_CAP);
                 return { path, contentHash: raw === null ? null : instructionHash(raw) };
             }));
         }

package/dist/run-local.d.ts

@@ -47,10 +47,20 @@ export declare function parseArgs(argv: string[]): RunLocalArgs;
 export declare class UsageError extends Error {
 }
 /**
- * The model GATEWAY pre-flight (mirrors the doctor message): the engine cannot run a real
- * task without (a) a gateway base URL that ends in `/v1` and (b) the gateway/model API key resolvable from
- * env. We surface a "you still need to set: …" list rather than letting the first brain call crash with a
- * cryptic auth/connect error. Returns a list of missing items (empty = OK).
+ * The model GATEWAY pre-flight (mirrors the doctor message): the engine cannot run a real task through a
+ * declared gateway without the gateway/model API key resolvable from env. We surface a "you still need to
+ * set: …" list rather than letting the first brain call crash with a cryptic auth error. Returns a list of
+ * missing items (empty = OK).
+ *
+ * 🔴 S-623:这里**不再**判网关 base URL。「配置能派发到的每一条 openai 路由都解析到显式端点」是 `loadConfig()`
+ * 那一层的拒启判据(`model-route-endpoint.ts`,本入口在预检之前就调 `loadConfig()` —— 没设网关的配置根本走不到
+ * 这里),原来那条臂(a)是它的一份更弱的手抄:注释要求「本机用户必须指向自己的网关」,判据却只查 `/v1` 后缀,
+ * 旧的出厂缺省值恰好以 `/v1` 结尾 ⇒ 缺省值照样过(本仓自己也被骗)。`/v1` 后缀本身也一并删,理由三条:
+ *  ① 同一个问题两个判官 —— `serve` 从不要求 `/v1`,同一份 .env 在 `serve` 起得来、在 `run-local` 被拒;
+ *  ② 它会误拒真实存在的 OpenAI 兼容端点(DeepSeek 根路径直接服务 `/chat/completions`,本仓
+ *     `src/bench/s1/live-deps.ts` 用的正是 `https://api.deepseek.com`;Gemini 的兼容面 `…/v1beta/openai`、Azure 的
+ *     `…/openai/deployments/<name>` 也都不以 `/v1` 结尾);
+ *  ③ 规则集只许变小:端点判据只有 loadConfig 那一只。
  *
  * NOTE: with an injected mock `brain` the gateway is irrelevant (no real call is made), so the caller skips
  * this check in that case — the check is about a REAL run, not the assembly.

package/dist/run-local.js

@@ -18,7 +18,6 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
-import { clearHostedEvidenceEnv } from "./hosted-posture.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
@@ -34,7 +33,8 @@ import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutExecutionEnv } from "./capabilities/hands-lane.js";
 import { HttpError } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+import { memoryEngineBackendFor, memoryProjectKeyFor, memorySpecForRequest } from "./memory-scope.js";
+import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
@@ -99,9 +99,8 @@ export class UsageError extends Error {
 }
 export function missingGatewayRequirements(config) {
     const missing = [];
-    if (!config.gatewayBaseUrl || !/\/v1\/?$/.test(config.gatewayBaseUrl)) {
-        missing.push("MODEL_GATEWAY_BASEURL (the OpenAI-compatible gateway URL, must end in /v1)");
-    }
+    if (config.gatewayBaseUrl === undefined)
+        return missing;
     const perModelEnvs = Object.values(config.modelApiKeyEnv ?? {});
     const haveGatewayKey = !!config.gatewayApiKey;
     const catalogModelNames = new Set(Object.values(config.models ?? {}).map((m) => m.name));
@@ -176,7 +175,6 @@ export async function runLocal(argv, deps = {}) {
         process.env.CONFIG_PROVIDER = "local";
     process.env.SESSION_BACKEND = "memory";
     process.env.REQUIRE_PRINCIPAL = "false";
-    clearHostedEvidenceEnv();
     const root = args.root ?? process.env.CONFIG_LOCAL_DIR ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
     if (args.root)
         process.env.CONFIG_LOCAL_DIR = args.root;
@@ -209,6 +207,9 @@ export async function runLocal(argv, deps = {}) {
     catch (err) {
         logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
     }
+    const endpointRefusal = modelRouteEndpointRefusal(config);
+    if (endpointRefusal !== undefined)
+        throw new Error(endpointRefusal);
     const unpricedCeiling = buildUnpricedCeilingNotice(config.models, config);
     if (unpricedCeiling)
         logger.warn(unpricedCeiling.event, unpricedCeiling.fields);
@@ -477,7 +478,7 @@ export async function runLocal(argv, deps = {}) {
         backgroundScope: "session",
         oneShot: true,
         principal: scope,
-        ...(memoryEngine ? { memory: memorySpecForRequest(scope, undefined) } : {}),
+        ...(memoryEngine ? { memory: memorySpecForRequest(scope, memoryProjectKeyFor(config, scope, workspaceDir), undefined) } : {}),
         model: mention.model ?? "default",
         getApiKeyAndHeaders: keyResolver,
         tools: cap.tools,

package/dist/runtime-caps-resolver.d.ts

@@ -54,6 +54,11 @@
  * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
  * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
+ * 🔐 [ref] E-15(7.99.0 合并复审 F2):缓存、在飞去重与 ETag 都在**凭证身份的箱**里(`center-credential.ts`
+ * `createIdentityBins`,org 记忆目录同一只)——此前只按 principal 键,同机换账号后 TTL 内同一 principal 吃上一个
+ * 人的授予、搭上一个人的在飞请求、带上一个人的 etag 去换 304。在飞期间换了人,答复由传输层丢弃
+ * (`http-client.ts` `requestPrincipalView`),按这一次取数失败走下面的 fail-closed 臂(降级项落在发起那一箱)。
+ *
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
  * this seam feeds the ENGINE, and `allowUltracode` is enforced at the service settings-resolution layer, not here.
@@ -61,14 +66,15 @@
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
+import type { CenterEndpoint } from "./config-center/center-request.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 import type { ServiceConfig } from "./config-types.js";
 import { type Logger } from "./observability/logger.js";
 /** test-only: reset the once-per-process trace so each test observes a fresh "first hit". */
 export declare function resetExecutionLaneDefaultTraceForTest(): void;
 export interface EntitlementsResolverOpts {
-    baseUrl: string;
-    token: string;
+    /** S-651:中心端点(基址 + 凭证**来源**;每次抓取取一次值,不持有启动快照)。 */
+    center: CenterEndpoint;
     /** This worker's name (`SEMA_REGISTRY_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
      *  resolve its OWN worker's principal caps (caps-only); harmless on a full token (the caps value
      *  is worker-independent). Omitted ⇒ no `?worker=` (a full-token, non-fleet deployment). */
@@ -136,12 +142,6 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
-/** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
- *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403
- *  on every caps fetch → fail-closed DENY ALL workflows for ALL principals (correct degrade, but otherwise silent
- *  bar per-task warns). True ⇒ the caller should log a one-shot BOOT warning so the misconfig is diagnosable.
- *  (The orchestrator normally injects SEMA_REGISTRY_WORKER alongside a wpt_ token, so this is a hand-misconfig.) */
-export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
     /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;

package/dist/runtime-caps-resolver.js

@@ -1,4 +1,5 @@
 import { fetchPrincipalCaps } from "./config-center/facade.js";
+import { createIdentityBins } from "./center-credential.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
@@ -54,9 +55,6 @@ export function toCoreRuntimeCaps(ent) {
 export function centerEntitlementSourceWired(config) {
     return config.configCenter !== undefined && !config.configCenter.dryRun;
 }
-export function scopedTokenNeedsWorker(token, worker) {
-    return token.startsWith("wpt_") && !worker;
-}
 export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
     if (!ruling) {
         traceExecutionLaneDefault("no_ruling", ownLane, logger);
@@ -80,11 +78,14 @@ export function createPrincipalEntitlementsClient(opts) {
     const fetchCaps = opts.fetchCaps ?? fetchPrincipalCaps;
     const now = opts.now ?? (() => Date.now());
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
-    const cache = new Map();
-    const inflight = new Map();
+    const binNow = createIdentityBins(opts.center.credential, (credential) => ({
+        center: { baseUrl: opts.center.baseUrl, credential },
+        cache: new Map(),
+        inflight: new Map(),
+    }));
     const readMintedDeny = new WeakSet();
     const MAX_CACHE = 10_000;
-    const putCache = (key, entry) => {
+    const putCache = (cache, key, entry) => {
         if (cache.size >= MAX_CACHE) {
             const t = now();
             for (const [k, v] of cache)
@@ -100,15 +101,16 @@ export function createPrincipalEntitlementsClient(opts) {
         return entry;
     }
     async function loadRaw(principal, recordDeny) {
-        const cached = cache.get(principal);
+        const bin = binNow();
+        const cached = bin.cache.get(principal);
         if (cached && cached.expiresAt > now() && !(recordDeny && readMintedDeny.has(cached)))
             return cached;
-        const dup = inflight.get(principal);
+        const dup = bin.inflight.get(principal);
         if (dup)
             return dup;
         const p = (async () => {
             try {
-                const r = await fetchCaps(opts.baseUrl, opts.token, principal, cached?.etag, fetchImpl, opts.worker);
+                const r = await fetchCaps(bin.center, principal, cached?.etag, fetchImpl, opts.worker);
                 if (r === null) {
                     const entry = {
                         caps: cached?.caps,
@@ -117,7 +119,7 @@ export function createPrincipalEntitlementsClient(opts) {
                         ...(cached?.etag ? { etag: cached.etag } : {}),
                         expiresAt: now() + ttlMs,
                     };
-                    putCache(principal, entry);
+                    putCache(bin.cache, principal, entry);
                     return entry;
                 }
                 if (r.executionDrift) {
@@ -133,7 +135,7 @@ export function createPrincipalEntitlementsClient(opts) {
                     ...(r.etag ? { etag: r.etag } : {}),
                     expiresAt: now() + ttlMs,
                 };
-                putCache(principal, entry);
+                putCache(bin.cache, principal, entry);
                 return entry;
             }
             catch (err) {
@@ -147,7 +149,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
-                putCache(principal, entry);
+                putCache(bin.cache, principal, entry);
                 try {
                     onError(e, principal);
                 }
@@ -155,10 +157,10 @@ export function createPrincipalEntitlementsClient(opts) {
                 return entry;
             }
             finally {
-                inflight.delete(principal);
+                bin.inflight.delete(principal);
             }
         })();
-        inflight.set(principal, p);
+        bin.inflight.set(principal, p);
         return p;
     }
     return {

package/dist/sealed-key.js

@@ -3,6 +3,8 @@ import { chmod, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import _sodium from "libsodium-wrappers";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { createCenterCredentialSource } from "./center-credential.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
 const SEAL_OVERHEAD_BYTES = 48;
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
@@ -114,13 +116,7 @@ export async function reportExecutionPublicKey(opts) {
         return;
     }
     try {
-        const doFetch = opts.fetchImpl ?? fetch;
-        const res = await doFetch(`${baseUrl.replace(/\/$/, "")}/api/config/execution-keys`, {
-            method: "POST",
-            headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
-            body: JSON.stringify({ publicKey: key.publicKey, publicKeyId: key.publicKeyId, ...(notes ? { notes } : {}) }),
-            signal: AbortSignal.timeout(10_000),
-        });
+        const { res } = await centerFetch({ baseUrl, credential: createCenterCredentialSource({ from: "env", token: adminToken }, undefined) }, { kind: "execution-keys" }, { method: "POST", json: { publicKey: key.publicKey, publicKeyId: key.publicKeyId, ...(notes ? { notes } : {}) }, timeoutMs: 10_000, ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}) });
         if (res.ok) {
             let idempotent = false;
             try {

package/dist/server-secret-env.d.ts

@@ -0,0 +1,41 @@
+/**
+ * 7.99.0 合并复审 F7(web-admin [ref] 实测;安全轴;DEBTS S-684)—— 子进程 env 交出去之前的**本仓**密钥剥除。
+ *
+ * ## 病
+ * 本仓两条子进程腿 —— 模型可驱动的 host shell(`inheritEnv:"scrub"` 缺省腿,`plugins/remote-env-host.ts`)与
+ * project-memory 的 git 子进程(`project-memory.ts`)—— 此前只调 core 的 `scrubSecretEnv`。它按键名**形状**判
+ * (`*_KEY` / `*_TOKEN` / `*_SECRET` …),而本仓自己的凭据键里有形状规则认不出的:`SERVICE_AUTH_TOKENS`(复数,
+ * per-system 凭据表)、`APPROVAL_HMAC_KEYS`(直连门 HMAC 密钥集)、`OTEL_EXPORTER_OTLP_HEADERS`(常载鉴权头)⇒
+ * 原样进子进程,模型选的一句 `printenv` 就读得到。
+ *
+ * ## 规则(一句)
+ * 本仓**知道**哪些 env 键是凭据 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,
+ * 不手抄第二份名单 —— 这些键按名剥;其余照旧交 core 按形剥。{@link scrubServerSecrets} = 目录派生剥除 ∘ core
+ * `scrubSecretEnv`,两条腿都只调它。core 形状规则的缺口由 core 源头修(另案);本层不改 core 的判据,也不自造
+ * 第二份形状规则。目录里加一个 secret 型键,两条腿当场就剥它。
+ *
+ * ## 不变的面
+ * `inheritEnv:"all"`(显式全继承)与显式 allowlist 两形不经本函数,行为逐字不变;调用方显式传入的 env
+ * (`cfg.env` / 单次命令的 `env`)照旧原样覆盖在剥除结果之上。
+ */
+import { type SecretEnvFinding } from "@sema-agent/core";
+/** 目录派生臂的一条剥除记录(形同 core 的 `SecretEnvFinding`:键名 / 规则 / 置信度 / 来源;值永不携带)。
+ *  `source` 用本仓自己的词 `server-config-catalog`,与 core 的 `secret-env` 分开 —— 读观测面的人要分得清
+ *  「形状规则剥的」与「本仓目录点名剥的」(后者多出来的那部分正是 core 形状规则的缺口)。 */
+export interface CatalogSecretEnvFinding {
+    readonly key: string;
+    readonly kind: "config-catalog";
+    readonly confidence: "high";
+    readonly source: "server-config-catalog";
+}
+/** 本仓两条子进程腿的剥除记录:core 的形状臂 ∪ 本仓的目录臂。 */
+export type ServerSecretEnvFinding = SecretEnvFinding | CatalogSecretEnvFinding;
+/** 配置目录里 `type:"secret"` 的 env 名(大写 —— Windows 的 env 名不分大小写,按大写比才不会漏)。 */
+export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
+/**
+ * 先交 core 按形剥,再按目录名剥它漏下的。`findings` 是调用方持有的收集器(交给 `recordSecretEnvScrub` 留痕):
+ * 形状臂剥掉的记 core 的 finding;目录臂只记**形状臂漏下、被目录点名剥掉**的键 —— 于是既有的形状臂计数不变,
+ * 目录臂的计数恰好就是 core 形状规则的缺口读数。
+ */
+export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
+//# sourceMappingURL=server-secret-env.d.ts.map

package/dist/server-secret-env.js

@@ -0,0 +1,18 @@
+import { scrubSecretEnv } from "@sema-agent/core";
+import { CONFIG_CATALOG } from "./config-catalog.js";
+export const CATALOG_SECRET_ENV_NAMES = new Set(CONFIG_CATALOG.filter((spec) => spec.type === "secret").map((spec) => spec.name.toUpperCase()));
+export function scrubServerSecrets(env, findings) {
+    const shapeFindings = [];
+    const shaped = scrubSecretEnv(env, shapeFindings);
+    findings.push(...shapeFindings);
+    const out = {};
+    for (const key of Object.keys(shaped)) {
+        if (CATALOG_SECRET_ENV_NAMES.has(key.toUpperCase())) {
+            findings.push({ key, kind: "config-catalog", confidence: "high", source: "server-config-catalog" });
+            continue;
+        }
+        out[key] = shaped[key];
+    }
+    return out;
+}
+//# sourceMappingURL=server-secret-env.js.map

package/dist/tool-approval.d.ts

@@ -76,6 +76,50 @@ export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<{
     status: number;
     body: Record<string, unknown>;
 }>;
+/**
+ * 一问身上与「站着的答案」有关的三个事实位 —— {@link standingAnswerMayRetire} 的全部入参。
+ *
+ * 🔴 **三格全必填布尔**,刻意不做 `?: true` 的「只记真」形:判据哪天多一位,每个读者都要当场编译红,
+ * 而不是漏传一格被静默读成 `false`(那是安全轴上的 fail-open)。读者各自从自己手里的形折成这三格:
+ * live 读侧取 `req` + 本地治理 peek,live 写侧取 pending 条目。本型**不绑** live 条目 —— 耐久 `/decide`
+ * 腿候 core 给 `PendingAction` 补 `mandated` 孪生位后按同一形接入(见 S-663;今天行上只有
+ * `requiresRealApproval` 孪生与依赖车道的 `ruleOffersAbsence`,缺一位不先接两位)。
+ */
+export interface StandingAnswerFacts {
+    /** 本仓治理层(`AUTONOMY` / `commandPolicy` / shellGate / `SENSITIVE_WRITE_PATTERNS`)产的门。 */
+    readonly governanceForced: boolean;
+    /** core 闸站盖的「必须真人逐次批」位(连一揽子 `onAsk:"allow"` 席也不得答)。 */
+    readonly requiresRealApproval: boolean;
+    /** core 闸站盖的强制位([ref]):规则清不掉、站着的答案退不掉,只有对**这一次调用**的应答能答。 */
+    readonly mandated: boolean;
+}
+/**
+ * 🔴 **S-660 —— 会话级放行的唯一判据:站着的答案能不能退掉这一问。** 纯谓词,两个(将来三个)读者:
+ *  · **读侧**(`askBroadcast` 的会话授权短路):`true` 才可能由既有 grant 代答,否则往下走真出卡;
+ *  · **写侧**(`finishRespond` 的 `grantable`):`true` 才可能把这张卡上的 `allow_session` 铸成 grant,
+ *    否则只放行这一次、`rememberApplied:false`。
+ * 两臂读同一份事实、说同一句话:一问若不许被记住的放行答掉,它的应答也不许变成一条记住的放行 —— 否则
+ * 同一只卡「重跑一遍」就被自己上一次的回答代答(test [ref] U1s-off 的真形)。
+ *
+ * **为什么三位是同一类**(「站着的答案退不掉的一问」):会话授权 = **上一次**应答记下的一揽子放行,不是对
+ * **这一次**调用的应答 —— 与持久 allow 规则同族,只是更短命(`askBroadcast` 短路处的注早已这么定性)。
+ *  · `mandated`:core 7.29.0 `PermissionResult` ask 臂 `mandated` 成员的文档「no persisted allow rule and no standing
+ *    posture may retire it, only an answer to THIS call」;`ruleClearanceOf` 的文档「Allow rules silence the
+ *    classifier's questions, never a mandated one」。core 09-23 澄清(将在 7.30.0 落进 d.ts):「从早先某次
+ *    回答记住的放行,**任何 scope、会话级也算**」都是站着的答案。它**不**绑这一次调用的应答者(人、hook、
+ *    部署的一揽子 `onAsk:"allow"` 席、mandate 表允许的活判定者)—— 那一半本仓不动(见 `mandated` 帧键顶注)。
+ *  · `requiresRealApproval`([ref]):更强的那条,连一揽子席也不得答,当然也不许记住的放行答。
+ *  · `governanceForced`([ref]):运维治理层的门,客户端表态掀不掉;持久规则车道早已同判(`buildRuleLaneMaterial`)。
+ * 本谓词**不重推** core 的 `ruleClearanceOf` / `ruleMayClear`(core 刻意不导出:闸外重算拿不到同一份标记快照,
+ * 会分叉),只读闸站**盖好**的两位 + 本仓自己的治理标。
+ *
+ * **为什么读侧的行复核(`sessionGrantUncontestedByRow`)不必为 `mandated` 加一次行读**:`mandated` 是 `req`
+ * **自己**的位 —— core 每一次过闸(含 failover / 重启后的重入)都由 `runGateLanes` 里的 `stampAskOrigin`
+ * 重新盖、经同一处的 `carryOf` 带上 `AskRequest`,读侧手里的 `req` 恒是这一次过闸的真值。`governanceForced`
+ * 需要行读,是因为它来自本仓的**进程内**治理标表:failover / 重启后幂等命中既有行时本地表恒空,行上的卡才
+ * 存着落库那一刻的判定。何况行上本来就没有 `mandated`(耐久面不造孪生座)—— 读了也读不到。
+ */
+export declare function standingAnswerMayRetire(facts: StandingAnswerFacts): boolean;
 /** A live approval frame delivered to whoever tails this run's stream. `type` IS the SSE event name (named-event
  *  convention, same as question). The shell renders `tool_approval` as the CC three-choice card and dismisses on
  *  `tool_approval_complete`. */
@@ -150,7 +194,10 @@ export interface ToolApprovalFrame {
      * 「不是强制」「老引擎」「这是一张从 park 行上重铸的耐久卡」三形 —— **耐久面上本仓不造孪生座**:core 的
      * 寄存行(`PendingAction`)没有这一位(KL-997a 亲读登记),行上强制表现为 `ruleOffersAbsence:"mandated"`
      * 且无 `ruleOffers`;在 `card_json` 侧自铸一个就是本仓成了这个事实的第二个源(而 park 那侧根本没有输入)。
-     * 🔴 echo-only:server 不据它做任何裁决(强制的判定属主在 core 的闸站)。
+     * 🔴 **server 不判「是不是强制」**(判定属主在 core 的闸站),只**读**闸站盖好的这一位 —— 读者恰一个:
+     * S-660 起的会话级放行判据 {@link standingAnswerMayRetire}(会话授权是**上一次**应答记下的站着的答案,
+     * 不是对这一次调用的应答 ⇒ 强制卡上既不被既有 grant 代答、也不铸 grant)。上一段「一揽子 `onAsk:"allow"`
+     * 席照常答得了」说的是**这一次调用的应答者**,本仓不改它。
      */
     mandated?: true;
     /**

package/dist/tool-approval.js

@@ -79,6 +79,9 @@ function sessionAllowCategory(toolName) {
 function sessionAllowKey(owner, sessionId, category) {
     return JSON.stringify([owner, sessionId, category]);
 }
+export function standingAnswerMayRetire(facts) {
+    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated;
+}
 export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty string of at most ${MAX_RULE_TEXT_CHARS} characters`;
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
@@ -829,8 +832,7 @@ export class ToolApprovalCoordinator {
         }
         const primary = aliveCtxs[0];
         const governanceForced = (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
-        if (!governanceForced &&
-            req.requiresRealApproval !== true &&
+        if (standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }) &&
             origin.sessionId &&
             this.allowAllSessions.has(sessionAllowKey(origin.owner, origin.sessionId, sessionAllowCategory(req.toolName))) &&
             (await this.sessionGrantUncontestedByRow(origin, req))) {
@@ -1385,6 +1387,7 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(req.mandated === true ? { mandated: true } : {}),
             ...(askId !== undefined && batchId !== undefined ? { askId, batchId } : {}),
         };
         selfEntry = pendingEntry;
@@ -1962,7 +1965,11 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(id, entry, parsed, opts) {
         let rememberApplied;
-        const grantable = entry.requiresRealApproval !== true && entry.governanceForced !== true;
+        const grantable = standingAnswerMayRetire({
+            governanceForced: entry.governanceForced === true,
+            requiresRealApproval: entry.requiresRealApproval === true,
+            mandated: entry.mandated === true,
+        });
         if (parsed.value === "allow_session")
             rememberApplied = Boolean(entry.sessionId) && grantable;
         if (parsed.value === "allow_session" && entry.sessionId && grantable) {

package/dist/trace/redact.d.ts

@@ -190,7 +190,7 @@ export declare function isHierarchicalUrl(raw: string): boolean;
  *  ① **有效性闸**:配置里的那一位应当是一个**绝对 URL**。`new URL(raw)` 解析不动 ⇒ 这一位根本不是 URL
  *     (裸 `host:port`、相对路径、手滑的散文),自由文本的 URL 律对它没有定界依据 ⇒ 返回**占位**
  *     {@link DISPLAY_SAFE_URL_TOKEN},**不回落原值**([ref]:安全轴上的兜底必须 fail-closed 或响亮)。
- *     成文代价:`MODEL_GATEWAY_BASEURL=127.0.0.1:8000` 这种缺 scheme 的配置在日志上变成 `«redacted:url»`
+ *     成文代价:`MODEL_GATEWAY_BASEURL=gw.internal:8000` 这种缺 scheme 的配置在日志上变成 `«redacted:url»`
  *     —— 而它在 `fetch` 那一侧本来就是必然失败的形(WHATWG 要求绝对 URL),日志上响亮一点方向一致。
  *  ② **空串 = 未设**:里面没有凭据,原样回空串(不铸占位 —— 占位会让「没配」读成「配了但看不见」)。
  * ⚠️ **保形只到 host / port / path 这一层**(S-483 起如实改口;`test/config-url-display-safe.test.ts`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.97.0",
+  "version": "7.99.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -38,10 +38,11 @@
     "sema-up": "deploy/sema-up/sema-up.sh"
   },
   "engines": {
-    "node": ">=20"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "scripts": {
     "typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
+    "typecheck:scripts": "tsc --noEmit -p tsconfig.scripts.json",
     "build": "rm -rf dist && tsc -p tsconfig.build-js.json && tsc -p tsconfig.build-dts.json && node scripts/scrub-dist-refs.mjs dist",
     "prepublishOnly": "npm run build && vitest run test/pack-hygiene.test.ts",
     "start": "node dist/main.js",
@@ -61,7 +62,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.29.0",
-    "@sema-agent/settings-schema": "3.0.0",
+    "@sema-agent/settings-schema": "5.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",