@sema-agent/server 7.98.0 → 7.100.0

package/dist/project-memory.d.ts

@@ -1,3 +1,4 @@
+import { type PlatformPath } from "node:path";
 import type { ProjectMemoryLoad } from "@sema-agent/core";
 interface ProjectMemoryCtx {
     cwd: string;
@@ -7,9 +8,35 @@ interface ProjectMemoryCtx {
     sessionId?: string;
     phase?: "fresh" | "resume" | "post-compact" | "post-clear";
 }
+/** The instruction-file name chain: the CLAUDE family first, the AGENTS family only when no CLAUDE file is
+ *  present. The FIRST hit is the single declared instruction source.
+ *
+ *  Order follows CC 2.1.280 (clay ruling [ref], 2026-09-23, board [ref] RG-2). It replaces the core 1.302 S-1
+ *  order, where AGENTS.md won over CLAUDE.md; [ref] supersedes that. In CC 2.1.280:
+ *   - cli280.js:185162 — the default mode `claude-md-or-agents-md`: "a project with no CLAUDE.md of its own gets its
+ *     AGENTS.md files instead, loaded exactly where and how CLAUDE.md would be";
+ *   - cli280.js:245920 — the two name families: AGENTS `["AGENTS.md", ".claude/AGENTS.md"]`,
+ *     CLAUDE `["CLAUDE.md", ".claude/CLAUDE.md", "CLAUDE.local.md"]`;
+ *   - cli280.js:226831 — the 2.1.277 changelog entry "in a project with no CLAUDE.md, Claude Code reads AGENTS.md
+ *     instead".
+ *  Not followed here (CC divergences, registration drafted in the che-MN closing note): `CLAUDE.local.md` is not read;
+ *  CC's other `instructionFiles` modes (`claude-md-and-agents-md` loads both, `managed-only`) are not offered; CC loads
+ *  every CLAUDE file it finds, per directory level up the ancestor chain, whereas this loader reads one root and
+ *  takes the single first hit. */
+declare const INSTRUCTION_FILE_CHAIN: readonly ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
+type ChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
+/** Recover (root, rel) for a path the LOADER declared — every declared path is `root + one chain member`.
+ *  The probe needs this to re-run the loader's parent-directory symlink gate each round (self-review: the probe
+ *  checked only the final component, so swapping `.claude` for a symlink out of the repo MID-RUN made the probe
+ *  fingerprint an outside file). Exported only for its path-matrix pin (posix / win32 through `p`); the probe
+ *  calls it with the host `node:path`. */
+export declare function instructionChainCoordinates(absPath: string, p?: PlatformPath): {
+    root: string;
+    rel: ChainMember;
+} | null;
 /**
  * Build a `loadProjectMemory` for the host lane. Returns null (skip) unless hands are enabled AND cwd is a local
- * directory. Reads the instruction-file chain (AGENTS.md → CLAUDE.md → .claude/CLAUDE.md, S-1) + (non-subagent)
+ * directory. Reads the instruction-file chain (CLAUDE.md → .claude/CLAUDE.md → AGENTS.md → .claude/AGENTS.md, [ref]) + (non-subagent)
  * `git log -5` / `git status`, redacts secrets, and caps the total. A subagent gets a trimmed instruction file and
  * no git narrative (cost control, H7). When an instruction file is hit the return is a `ProjectMemoryLoad`
  * declaring it in `instructionSources` (path + sha256 over the raw bounded-read window) so core's

package/dist/project-memory.js

@@ -1,11 +1,11 @@
 import { promises as fs, constants as fsConstants } from "node:fs";
 import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
-import { isAbsolute, join, sep } from "node:path";
-import { scrubSecretEnv } from "@sema-agent/core";
+import hostPath, { isAbsolute, join } from "node:path";
 import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
+import { scrubServerSecrets } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
-const INSTRUCTION_FILE_CHAIN = ["AGENTS.md", "CLAUDE.md", ".claude/CLAUDE.md"];
+const INSTRUCTION_FILE_CHAIN = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
 const INSTRUCTION_READ_CAP = 24 * 1024;
 function capUtf8(s, maxBytes) {
     const buf = Buffer.from(s, "utf8");
@@ -41,15 +41,16 @@ function instructionHash(raw) {
     return `hmac-sha256:${createHmac("sha256", INSTRUCTION_HASH_KEY).update(raw).digest("hex")}`;
 }
 const ABSENT_HASH = null;
-function chainCoordinates(absPath) {
-    let best = null;
-    for (const rel of INSTRUCTION_FILE_CHAIN) {
-        const suffix = sep + rel.split("/").join(sep);
-        if (absPath.endsWith(suffix) && (best === null || suffix.length > best.len)) {
-            best = { root: absPath.slice(0, -suffix.length), rel, len: suffix.length };
-        }
+export function instructionChainCoordinates(absPath, p = hostPath) {
+    const candidates = INSTRUCTION_FILE_CHAIN.filter((rel) => absPath.endsWith(p.sep + rel.split("/").join(p.sep))).sort((a, b) => b.length - a.length);
+    for (const rel of candidates) {
+        let root = absPath;
+        for (let i = 0; i < rel.split("/").length; i++)
+            root = p.dirname(root);
+        if (p.join(root, rel) === absPath)
+            return { root, rel };
     }
-    return best && { root: best.root, rel: best.rel };
+    return null;
 }
 async function hasSymlinkedParent(root, rel) {
     const parts = rel.split("/").slice(0, -1);
@@ -62,10 +63,15 @@ async function hasSymlinkedParent(root, rel) {
     }
     return false;
 }
+async function readChainMember(root, rel, maxBytes, truncatedFlag) {
+    if (rel.includes("/") && (await hasSymlinkedParent(root, rel)))
+        return null;
+    return readRawCapped(join(root, rel), maxBytes, truncatedFlag);
+}
 function git(root, args, maxBytes) {
     const safeArgs = ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args];
     const scrubFindings = [];
-    const scrubbedEnv = scrubSecretEnv(process.env, scrubFindings);
+    const scrubbedEnv = scrubServerSecrets(process.env, scrubFindings);
     recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings);
     return new Promise((res) => {
         execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env: { ...scrubbedEnv, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }, (err, stdout, stderr) => {
@@ -156,9 +162,7 @@ export function makeLoadProjectMemory(opts) {
             hitIndex = -1;
             for (let i = 0; i < INSTRUCTION_FILE_CHAIN.length; i++) {
                 const rel = INSTRUCTION_FILE_CHAIN[i];
-                if (rel.includes("/") && (await hasSymlinkedParent(root, rel)))
-                    continue;
-                const raw = await readRawCapped(join(root, rel), claudeCap, claudeTrunc);
+                const raw = await readChainMember(root, rel, claudeCap, claudeTrunc);
                 if (raw !== null) {
                     claudeRaw = capUtf8(raw.toString("utf8"), claudeCap);
                     hitFile = rel;
@@ -171,8 +175,7 @@ export function makeLoadProjectMemory(opts) {
                 break;
             let appeared = false;
             for (const rel of INSTRUCTION_FILE_CHAIN.slice(0, hitIndex)) {
-                const higher = await fs.lstat(join(root, rel)).catch(() => null);
-                if (higher && !higher.isSymbolicLink()) {
+                if ((await readChainMember(root, rel, claudeCap)) !== null) {
                     appeared = true;
                     break;
                 }
@@ -229,11 +232,8 @@ export function makeProbeInstructionSources() {
             return await Promise.all(sources.map(async ({ path }) => {
                 if (!isAbsolute(path))
                     return { path, contentHash: null };
-                const coords = chainCoordinates(path);
-                if (coords && coords.rel.includes("/") && (await hasSymlinkedParent(coords.root, coords.rel))) {
-                    return { path, contentHash: null };
-                }
-                const raw = await readRawCapped(path, INSTRUCTION_READ_CAP);
+                const coords = instructionChainCoordinates(path);
+                const raw = coords ? await readChainMember(coords.root, coords.rel, INSTRUCTION_READ_CAP) : await readRawCapped(path, INSTRUCTION_READ_CAP);
                 return { path, contentHash: raw === null ? null : instructionHash(raw) };
             }));
         }

package/dist/run-local.js

@@ -8,8 +8,8 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
-import { hasOperatorGateIntent } from "./approval.js";
+import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -18,7 +18,6 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
-import { clearHostedEvidenceEnv } from "./hosted-posture.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
@@ -49,6 +48,7 @@ import { fatalExit } from "./boot/fatal-exit.js";
 import { installProcessExitBoundary } from "./boot/exit-boundary.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
+import { createHostLspManager } from "./host-lsp-manager.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 export function parseArgs(argv) {
     let objective;
@@ -176,7 +176,6 @@ export async function runLocal(argv, deps = {}) {
         process.env.CONFIG_PROVIDER = "local";
     process.env.SESSION_BACKEND = "memory";
     process.env.REQUIRE_PRINCIPAL = "false";
-    clearHostedEvidenceEnv();
     const root = args.root ?? process.env.CONFIG_LOCAL_DIR ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
     if (args.root)
         process.env.CONFIG_LOCAL_DIR = args.root;
@@ -197,7 +196,7 @@ export async function runLocal(argv, deps = {}) {
             for (const de of r.domainErrors ?? [])
                 logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "domain fell to schema defaults; other domains applied normally" });
             effective = r.effective;
-            applyEffective(config, r.effective, logger);
+            applyEffective(config, r.effective, logger, { leg: "boot" });
             if (effective?.mcp)
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
             if (effective?.a2a)
@@ -244,7 +243,7 @@ export async function runLocal(argv, deps = {}) {
     }
     const ungatedCompensation = buildOnlySensitiveBaselineWarning(config, {
         durableEnabled: false,
-        singleUserAutoAcceptBaseline: config.requirePrincipal !== true && !hasOperatorGateIntent(config),
+        singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
     });
     if (ungatedCompensation)
         logger.warn(ungatedCompensation.event, ungatedCompensation.fields);
@@ -287,7 +286,7 @@ export async function runLocal(argv, deps = {}) {
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
-    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? new NodeLspManager({ log: (event, fields) => logger.info(event, fields) }) : undefined;
+    const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager((event, fields) => logger.info(event, fields)) : undefined;
     const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     let memorySync;
     if (config.memorySync && memoryEngine) {

package/dist/runs.js

@@ -1,4 +1,4 @@
-import { runWithVerification, runCascade, defaultTaskRegistry, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
+import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
@@ -12,7 +12,7 @@ import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "./orchestration/workflow-completion-inbox.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { errorText as errText } from "./observability/err-text.js";
 import { LIVENESS_HEARTBEAT_MS } from "./config-invariants.js";
@@ -256,8 +256,9 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             const { type, ...rest } = frame;
             const f = frame;
             const write = append(type, rest);
-            if (f.type === "task_notification" && f.task_id)
-                notifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
+            const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+            if (fKey !== undefined)
+                notifiedKeys.set(fKey, write.then(() => true, () => false));
             return write;
         }, completionDiagLog ? { route: "bg-run-start", connection: "durable-append", log: completionDiagLog } : undefined);
         const runBody = async () => {
@@ -285,7 +286,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId, opts?.priority)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                     }
                     else if (legLive) {
-                        const key = taskNotificationStreamKey(n);
+                        const key = taskNotificationDedupKey(n);
                         if (notifiedKeys.get(key) === undefined) {
                             notifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                         }

package/dist/runtime-caps-resolver.d.ts

@@ -54,6 +54,11 @@
  * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
  * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
+ * 🔐 [ref] E-15(7.99.0 合并复审 F2):缓存、在飞去重与 ETag 都在**凭证身份的箱**里(`center-credential.ts`
+ * `createIdentityBins`,org 记忆目录同一只)——此前只按 principal 键,同机换账号后 TTL 内同一 principal 吃上一个
+ * 人的授予、搭上一个人的在飞请求、带上一个人的 etag 去换 304。在飞期间换了人,答复由传输层丢弃
+ * (`http-client.ts` `requestPrincipalView`),按这一次取数失败走下面的 fail-closed 臂(降级项落在发起那一箱)。
+ *
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
  * this seam feeds the ENGINE, and `allowUltracode` is enforced at the service settings-resolution layer, not here.
@@ -61,14 +66,15 @@
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
+import type { CenterEndpoint } from "./config-center/center-request.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 import type { ServiceConfig } from "./config-types.js";
 import { type Logger } from "./observability/logger.js";
 /** test-only: reset the once-per-process trace so each test observes a fresh "first hit". */
 export declare function resetExecutionLaneDefaultTraceForTest(): void;
 export interface EntitlementsResolverOpts {
-    baseUrl: string;
-    token: string;
+    /** S-651:中心端点(基址 + 凭证**来源**;每次抓取取一次值,不持有启动快照)。 */
+    center: CenterEndpoint;
     /** This worker's name (`SEMA_REGISTRY_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
      *  resolve its OWN worker's principal caps (caps-only); harmless on a full token (the caps value
      *  is worker-independent). Omitted ⇒ no `?worker=` (a full-token, non-fleet deployment). */
@@ -136,12 +142,6 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
-/** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
- *  resolve per-principal caps — so a `wpt_` token with NO `SEMA_REGISTRY_WORKER` set will 403
- *  on every caps fetch → fail-closed DENY ALL workflows for ALL principals (correct degrade, but otherwise silent
- *  bar per-task warns). True ⇒ the caller should log a one-shot BOOT warning so the misconfig is diagnosable.
- *  (The orchestrator normally injects SEMA_REGISTRY_WORKER alongside a wpt_ token, so this is a hand-misconfig.) */
-export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
     /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;

package/dist/runtime-caps-resolver.js

@@ -1,4 +1,5 @@
 import { fetchPrincipalCaps } from "./config-center/facade.js";
+import { createIdentityBins } from "./center-credential.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
@@ -54,9 +55,6 @@ export function toCoreRuntimeCaps(ent) {
 export function centerEntitlementSourceWired(config) {
     return config.configCenter !== undefined && !config.configCenter.dryRun;
 }
-export function scopedTokenNeedsWorker(token, worker) {
-    return token.startsWith("wpt_") && !worker;
-}
 export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
     if (!ruling) {
         traceExecutionLaneDefault("no_ruling", ownLane, logger);
@@ -80,11 +78,14 @@ export function createPrincipalEntitlementsClient(opts) {
     const fetchCaps = opts.fetchCaps ?? fetchPrincipalCaps;
     const now = opts.now ?? (() => Date.now());
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
-    const cache = new Map();
-    const inflight = new Map();
+    const binNow = createIdentityBins(opts.center.credential, (credential) => ({
+        center: { baseUrl: opts.center.baseUrl, credential },
+        cache: new Map(),
+        inflight: new Map(),
+    }));
     const readMintedDeny = new WeakSet();
     const MAX_CACHE = 10_000;
-    const putCache = (key, entry) => {
+    const putCache = (cache, key, entry) => {
         if (cache.size >= MAX_CACHE) {
             const t = now();
             for (const [k, v] of cache)
@@ -100,15 +101,16 @@ export function createPrincipalEntitlementsClient(opts) {
         return entry;
     }
     async function loadRaw(principal, recordDeny) {
-        const cached = cache.get(principal);
+        const bin = binNow();
+        const cached = bin.cache.get(principal);
         if (cached && cached.expiresAt > now() && !(recordDeny && readMintedDeny.has(cached)))
             return cached;
-        const dup = inflight.get(principal);
+        const dup = bin.inflight.get(principal);
         if (dup)
             return dup;
         const p = (async () => {
             try {
-                const r = await fetchCaps(opts.baseUrl, opts.token, principal, cached?.etag, fetchImpl, opts.worker);
+                const r = await fetchCaps(bin.center, principal, cached?.etag, fetchImpl, opts.worker);
                 if (r === null) {
                     const entry = {
                         caps: cached?.caps,
@@ -117,7 +119,7 @@ export function createPrincipalEntitlementsClient(opts) {
                         ...(cached?.etag ? { etag: cached.etag } : {}),
                         expiresAt: now() + ttlMs,
                     };
-                    putCache(principal, entry);
+                    putCache(bin.cache, principal, entry);
                     return entry;
                 }
                 if (r.executionDrift) {
@@ -133,7 +135,7 @@ export function createPrincipalEntitlementsClient(opts) {
                     ...(r.etag ? { etag: r.etag } : {}),
                     expiresAt: now() + ttlMs,
                 };
-                putCache(principal, entry);
+                putCache(bin.cache, principal, entry);
                 return entry;
             }
             catch (err) {
@@ -147,7 +149,7 @@ export function createPrincipalEntitlementsClient(opts) {
                 const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org" }, expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
-                putCache(principal, entry);
+                putCache(bin.cache, principal, entry);
                 try {
                     onError(e, principal);
                 }
@@ -155,10 +157,10 @@ export function createPrincipalEntitlementsClient(opts) {
                 return entry;
             }
             finally {
-                inflight.delete(principal);
+                bin.inflight.delete(principal);
             }
         })();
-        inflight.set(principal, p);
+        bin.inflight.set(principal, p);
         return p;
     }
     return {

package/dist/runtime-governance.d.ts

@@ -23,7 +23,7 @@
  * path-prefixed commands all bypass the argv[0] match (they route to `ask`, fail-closed, but are not blocked by
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
-import { type TaskSpec, type ToolPolicy } from "@sema-agent/core";
+import { type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
@@ -142,13 +142,60 @@ export declare function autonomyOverrides(autonomy: Autonomy | undefined): Parti
  *    并不要求 always),之后运维把 autonomy 热改成 `ask`,那条老行会被标成治理出身 —— 五个前提要**同时**
  *    成立,且该行仍未决。
  * 根治要**在 mint 那一刻把出身写进行里**(core 的 `CheckpointGate` 属主面,不是本仓能单方面做的);
- * 在那之前这一位的定位是**分诊提示**,不是裁决输入 —— 它不参与任何门/CAS/resume 判定,消费端也只拿它
- * 渲染徽标。登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
+ * 在那之前这一位的定位是**分诊提示**,不参与任何门/CAS/resume 判定 —— 唯一的例外是**只收窄**的那一个读者:
+ * 耐久 `/decide` 腿的会话级 remember 可记性(NP-1,7.100.0,`tool-approval.ts` 的 `parkRowStandingAnswerFacts`)。
+ * 在那里两个失真方向的代价都不越过修前:在场向 ⇒ 一次 `remember:"session"` 只放行本次、不铸会话免询问(安全
+ * 方向,代价 = 下一次再问一遍);缺席向 ⇒ 照旧可记(= NP-1 之前的行为)。它从不**放宽**任何裁决。
+ * 登记在此,不加特征化测试(把已知残留钉成契约是另一种病)。
  */
 export declare function governanceMandatesShellGateAlways(governance: {
     autonomy?: Autonomy;
     manualModeShellGate?: "always" | "classify";
 }): boolean;
+/** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 {@link governanceMandatesShellGateAlways})。 */
+export interface GovernancePosture {
+    autonomy?: Autonomy;
+    manualModeShellGate?: "always" | "classify";
+}
+/**
+ * [ref]:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
+ *
+ *   行上的取证格 `gate.riskDescriptor.shellGateDoctrine === "always"`
+ *   ∧ 本部署的治理层本来就要求 always({@link governanceMandatesShellGateAlways},那里写着为什么单看行不够 ——
+ *     SUP 路由姿态同样产 `"always"`)
+ *
+ * 第一半:core 在 mint 这道门时把「当时活着的 doctrine」如实写进 `riskDescriptor.shellGateDoctrine`
+ * (2026-08-05 取证裁定;`prepare-task` 只在**被 shell 门铸**的 ask 上写它),所以持久行自己带着证据 ——
+ * park 腿天然跨副本、跨重启,活卡腿那张 ALS 标记表在这里结构上够不着。
+ * 第二半:把「有效档 always」收窄到「治理层是真成因」,否则一条 SUP 路由出来的门会被谎报成治理强制。
+ *
+ * ⚠️ 残留(双向失真的窄在场向 + 根治路径)与「只收窄」的那一个裁决读者,都登记在
+ * {@link governanceMandatesShellGateAlways} 的顶注,别在这里复述。
+ *
+ * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
+ * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
+ *
+ * 🔴 **单一属主,四个读者**(不在任何读面另写一份判据 —— 这一位恰恰是靠「行上取证 ∧ 部署姿态」的合取才不
+ * 谎报的,两份必漂):409 体的待批门材料(`http/active-run-conflict.ts`)、两条 durable 读面
+ * `GET /v1/approvals` / `/v1/approvals/stream` 的 `projectPendingForWire`([ref]②)、耐久 `/decide` 腿的
+ * remember 可记性(NP-1,经 `tool-approval.ts` 的 `parkRowStandingAnswerFacts`)。
+ * 住在本文件而不是 `http/active-run-conflict.ts` 的理由:它的另一半判据属主就在这里,而第四个读者
+ * (`tool-approval.ts`)从 `http/` 那侧值引会闭合一条 ESM 值环(`active-run-conflict` → `checkpoint-store-sql` →
+ * `tool-approval`),本文件是三者共同的叶。
+ *
+ * ⚠️ **askId 为什么不在这里**([ref] 的另一半,如实记账):待批 ask 的 `askId` 只活在 `approval_ask` 行上
+ * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
+ * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
+ * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
+ * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)与 `parentToolCallId`,
+ * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
+ * 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
+ */
+export declare function governanceOriginOf(gate: {
+    riskDescriptor?: {
+        shellGateDoctrine?: ShellGateDoctrine;
+    };
+} | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** spec 序里的秩(0 起,越大越严)。入参收 `string`(fail-loud 边界:schema `trustRank` 同款姿势)——词表外 ⇒
  *  RangeError,绝不 undefined/NaN 让比较静默成 false。导出只为对表钉(test/safety-merge-spec-consumption.test.ts,
  *  [ref] 件4)——运行时消费仍走上表(键类型闭集)。 */

package/dist/runtime-governance.js

@@ -116,6 +116,11 @@ export function autonomyOverrides(autonomy) {
 export function governanceMandatesShellGateAlways(governance) {
     return autonomyOverrides(governance.autonomy).shellGate === "always" || governance.manualModeShellGate === "always";
 }
+export function governanceOriginOf(gate, governance) {
+    if (gate?.riskDescriptor?.shellGateDoctrine !== "always")
+        return undefined;
+    return governanceMandatesShellGateAlways(governance ?? {}) ? true : undefined;
+}
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");

package/dist/sealed-key.js

@@ -3,6 +3,8 @@ import { chmod, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import _sodium from "libsodium-wrappers";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { createCenterCredentialSource } from "./center-credential.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
 const SEAL_OVERHEAD_BYTES = 48;
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
@@ -114,13 +116,7 @@ export async function reportExecutionPublicKey(opts) {
         return;
     }
     try {
-        const doFetch = opts.fetchImpl ?? fetch;
-        const res = await doFetch(`${baseUrl.replace(/\/$/, "")}/api/config/execution-keys`, {
-            method: "POST",
-            headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
-            body: JSON.stringify({ publicKey: key.publicKey, publicKeyId: key.publicKeyId, ...(notes ? { notes } : {}) }),
-            signal: AbortSignal.timeout(10_000),
-        });
+        const { res } = await centerFetch({ baseUrl, credential: createCenterCredentialSource({ from: "env", token: adminToken }, undefined) }, { kind: "execution-keys" }, { method: "POST", json: { publicKey: key.publicKey, publicKeyId: key.publicKeyId, ...(notes ? { notes } : {}) }, timeoutMs: 10_000, ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}) });
         if (res.ok) {
             let idempotent = false;
             try {

package/dist/server-secret-env.d.ts

@@ -0,0 +1,43 @@
+/**
+ * 7.99.0 合并复审 F7(web-admin [ref] 实测;安全轴;DEBTS S-684)—— 子进程 env 交出去之前的**本仓**密钥剥除。
+ *
+ * ## 病
+ * 本仓两条子进程腿 —— 模型可驱动的 host shell(`inheritEnv:"scrub"` 缺省腿,`plugins/remote-env-host.ts`)与
+ * project-memory 的 git 子进程(`project-memory.ts`)—— 此前只调 core 的 `scrubSecretEnv`。它按键名**形状**判
+ * (`*_KEY` / `*_TOKEN` / `*_SECRET` …),而本仓自己的凭据键里有形状规则认不出的:`SERVICE_AUTH_TOKENS`(复数,
+ * per-system 凭据表)、`APPROVAL_HMAC_KEYS`(直连门 HMAC 密钥集)、`OTEL_EXPORTER_OTLP_HEADERS`(常载鉴权头)⇒
+ * 原样进子进程,模型选的一句 `printenv` 就读得到。
+ *
+ * ## 规则(一句)
+ * 本仓**知道**哪些 env 键是凭据 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,
+ * 不手抄第二份名单 —— 这些键按名剥;其余照旧交 core 按形剥。{@link scrubServerSecrets} = 目录派生剥除 ∘ core
+ * `scrubSecretEnv`,本仓三条子进程腿(host shell / git 子进程 / 本地语言服务器,后者见 `host-lsp-manager.ts`)都只调它。
+ * core 形状规则的缺口由 core 源头修 —— 7.30.1 #1072 已补 `KEYS|TOKENS|PASSWORDS`(S-616 提货),目录臂独担的只剩
+ * `OTEL_EXPORTER_OTLP_HEADERS`(`*_HEADERS` 不在形状规则射程,是边界不是缺陷票)。本层不改 core 的判据,也不自造
+ * 第二份形状规则。目录里加一个 secret 型键,三条腿当场就剥它。
+ *
+ * ## 不变的面
+ * `inheritEnv:"all"`(显式全继承)与显式 allowlist 两形不经本函数,行为逐字不变;调用方显式传入的 env
+ * (`cfg.env` / 单次命令的 `env`)照旧原样覆盖在剥除结果之上。
+ */
+import { type SecretEnvFinding } from "@sema-agent/core";
+/** 目录派生臂的一条剥除记录(形同 core 的 `SecretEnvFinding`:键名 / 规则 / 置信度 / 来源;值永不携带)。
+ *  `source` 用本仓自己的词 `server-config-catalog`,与 core 的 `secret-env` 分开 —— 读观测面的人要分得清
+ *  「形状规则剥的」与「本仓目录点名剥的」(后者多出来的那部分正是 core 形状规则的缺口)。 */
+export interface CatalogSecretEnvFinding {
+    readonly key: string;
+    readonly kind: "config-catalog";
+    readonly confidence: "high";
+    readonly source: "server-config-catalog";
+}
+/** 本仓两条子进程腿的剥除记录:core 的形状臂 ∪ 本仓的目录臂。 */
+export type ServerSecretEnvFinding = SecretEnvFinding | CatalogSecretEnvFinding;
+/** 配置目录里 `type:"secret"` 的 env 名(大写 —— Windows 的 env 名不分大小写,按大写比才不会漏)。 */
+export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
+/**
+ * 先交 core 按形剥,再按目录名剥它漏下的。`findings` 是调用方持有的收集器(交给 `recordSecretEnvScrub` 留痕):
+ * 形状臂剥掉的记 core 的 finding;目录臂只记**形状臂漏下、被目录点名剥掉**的键 —— 于是既有的形状臂计数不变,
+ * 目录臂的计数恰好就是 core 形状规则的缺口读数。
+ */
+export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
+//# sourceMappingURL=server-secret-env.d.ts.map

package/dist/server-secret-env.js

@@ -0,0 +1,18 @@
+import { scrubSecretEnv } from "@sema-agent/core";
+import { CONFIG_CATALOG } from "./config-catalog.js";
+export const CATALOG_SECRET_ENV_NAMES = new Set(CONFIG_CATALOG.filter((spec) => spec.type === "secret").map((spec) => spec.name.toUpperCase()));
+export function scrubServerSecrets(env, findings) {
+    const shapeFindings = [];
+    const shaped = scrubSecretEnv(env, shapeFindings);
+    findings.push(...shapeFindings);
+    const out = {};
+    for (const key of Object.keys(shaped)) {
+        if (CATALOG_SECRET_ENV_NAMES.has(key.toUpperCase())) {
+            findings.push({ key, kind: "config-catalog", confidence: "high", source: "server-config-catalog" });
+            continue;
+        }
+        out[key] = shaped[key];
+    }
+    return out;
+}
+//# sourceMappingURL=server-secret-env.js.map

package/dist/task-settings.d.ts

@@ -264,7 +264,7 @@ export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
 /** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
  *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 与两个 `skillListing*` 在
- *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
+ *  {@link parseTaskSettings};`webSearch` 在 `capabilities/scenarios.ts`(判决 `judgeRequestWebSearch`,单用户闸;形错在受理面 400,S-199)。
  *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。
  *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明