@sema-agent/server 7.98.0 → 7.100.0

package/dist/config-lkg.js

@@ -3,22 +3,22 @@ import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
+import { centerStateBin, pullTokenIdentity } from "./center-credential.js";
 export function defaultSkillCacheDir() {
     return join(process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema"), "skill-cache");
 }
-export function defaultLkgPath(worker) {
+export function defaultLkgPath(worker, identity) {
     const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
-    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
-    return join(dir, `config-lkg-${key}.json`);
+    return join(dir, `config-lkg-${centerStateBin(worker, identity)}.json`);
 }
-export async function saveLkg(path, worker, effective, etag) {
-    const body = { formatVersion: 1, savedAt: new Date().toISOString(), worker: worker ?? "global", ...(etag !== undefined ? { etag } : {}), effective };
+export async function saveLkg(path, worker, identity, effective, etag) {
+    const body = { formatVersion: 2, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
     await fs.rename(tmp, path);
 }
-export async function loadLkg(path, worker) {
+export async function loadLkg(path, worker, identity) {
     let text;
     try {
         text = await fs.readFile(path, "utf8");
@@ -36,38 +36,125 @@ export async function loadLkg(path, worker) {
     if (parsed === null || typeof parsed !== "object")
         return { reason: "bad envelope" };
     const p = parsed;
-    if (p.formatVersion !== 1)
-        return { reason: `unknown formatVersion ${String(p.formatVersion)}` };
+    const formatVersion = p.formatVersion;
+    if (formatVersion === 1)
+        return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
+    if (formatVersion !== 2)
+        return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
-    if (p.effective === null || typeof p.effective !== "object")
-        return { reason: "bad effective" };
-    if (p.etag !== undefined && typeof p.etag !== "string")
-        return { reason: "bad etag" };
-    const eff = p.effective;
+    if (typeof p.identity !== "string" || p.identity !== identity)
+        return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
+    const problem = lkgPayloadProblem(p.effective, p.etag);
+    return problem === undefined ? { lkg: p } : { reason: problem };
+}
+function lkgPayloadProblem(effective, etag) {
+    if (effective === null || typeof effective !== "object")
+        return "bad effective";
+    if (etag !== undefined && typeof etag !== "string")
+        return "bad etag";
+    const eff = effective;
     if (typeof eff.version !== "number")
-        return { reason: "bad effective.version" };
+        return "bad effective.version";
     for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
         if (v === null || typeof v !== "object" || Array.isArray(v))
-            return { reason: `bad effective.${domain}` };
+            return `bad effective.${domain}`;
         if (arrayKey !== null) {
             const arr = v[arrayKey];
             if (arr !== undefined && !Array.isArray(arr))
-                return { reason: `bad effective.${domain}.${arrayKey}` };
+                return `bad effective.${domain}.${arrayKey}`;
         }
     }
     {
         const rt = eff.runtime;
         if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
-            return { reason: "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance" };
+            return "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance";
         }
     }
-    const promptsRaw = p.effective.prompts;
+    const promptsRaw = eff.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
-        return { reason: "prompts face fails re-validation" };
-    return { lkg: p };
+        return "prompts face fails re-validation";
+    return undefined;
+}
+export function legacyV1LkgPath(worker) {
+    const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
+    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
+    return join(dir, `config-lkg-${key}.json`);
+}
+export async function migrateV1Lkg(o) {
+    const refuse = (why) => ({
+        outcome: "not-migrated",
+        path: o.legacyPath,
+        reason: `pre-identity LKG (formatVersion 1) at ${o.legacyPath} not migrated: ${why}. Way out: delete that file — the next clean candidate from the center writes this credential identity's own LKG (${o.binPath})`,
+    });
+    const sameFile = o.legacyPath === o.binPath;
+    if (!sameFile) {
+        try {
+            await fs.access(o.binPath);
+            return { outcome: "none" };
+        }
+        catch (err) {
+            const code = errnoOf(err);
+            if (code !== "ENOENT")
+                return refuse(`this credential identity's bin ${o.binPath} could not be checked (${code})`);
+        }
+    }
+    let text;
+    try {
+        text = await fs.readFile(o.legacyPath, "utf8");
+    }
+    catch (err) {
+        const code = errnoOf(err);
+        return code === "ENOENT" || code === "ENOTDIR" || sameFile ? { outcome: "none" } : refuse(`it could not be read (${code})`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        return sameFile ? { outcome: "none" } : refuse(`it is not valid JSON (${err instanceof Error ? err.name : "parse error"})`);
+    }
+    if (parsed === null || typeof parsed !== "object" || !("formatVersion" in parsed) || parsed.formatVersion !== 1)
+        return { outcome: "none" };
+    const v1 = parsed;
+    if (v1.worker !== (o.worker ?? "global"))
+        return refuse(`it belongs to worker ${JSON.stringify(v1.worker)}`);
+    if (o.identity !== pullTokenIdentity(o.worker)) {
+        return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
+    }
+    const problem = lkgPayloadProblem(v1.effective, v1.etag);
+    if (problem !== undefined)
+        return refuse(`its payload is unusable (${problem})`);
+    const retiredTo = `${o.legacyPath}.migrated-v1`;
+    let retireError;
+    if (sameFile) {
+        try {
+            await fs.copyFile(o.legacyPath, retiredTo);
+        }
+        catch (err) {
+            retireError = `the formatVersion 1 bytes could not be kept as ${retiredTo} (${errnoOf(err)})`;
+        }
+    }
+    try {
+        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, typeof v1.etag === "string" ? v1.etag : undefined);
+    }
+    catch (err) {
+        return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);
+    }
+    if (!sameFile) {
+        try {
+            await fs.rename(o.legacyPath, retiredTo);
+        }
+        catch (err) {
+            retireError = `the old file could not be renamed to ${retiredTo} (${errnoOf(err)}) — harmless: the bin now exists, so the old file is never read again`;
+        }
+    }
+    return { outcome: "migrated", from: o.legacyPath, retiredTo, ...(retireError !== undefined ? { retireError } : {}) };
+}
+function errnoOf(err) {
+    return err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "unknown";
 }
 //# sourceMappingURL=config-lkg.js.map

package/dist/config-provider.d.ts

@@ -1,6 +1,7 @@
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
+import type { CenterEndpoint } from "./config-center/center-request.js";
 /** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
@@ -17,6 +18,8 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
+/** `credentialIdentity`(S-651 / [ref] E-15):远程腿恒在场 = 这次拉取所用凭证的身份(分箱键来源);本地腿
+ *  缺席(没有凭证 —— config.d 就在本机盘上)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -25,6 +28,7 @@ export type FetchEffectiveResult = {
         error: string;
     }>;
     readWarnings: readonly EffectiveReadWarning[];
+    credentialIdentity?: string;
 } | null;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
@@ -67,9 +71,7 @@ export interface ConfigProviderInput {
     /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
      *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: CenterEndpoint & {
         worker?: string;
         dryRun?: boolean;
     };
@@ -84,16 +86,15 @@ export interface ConfigProviderInput {
 }
 /**
  * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
- * baseUrl/token/worker are bound once and passed through. The two delegate fns are injectable (defaulting
+ * the center endpoint (baseUrl + credential SOURCE — S-651: read per request, never a bound token) and worker
+ * are passed through. The two delegate fns are injectable (defaulting
  * to the real config-center exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
     private readonly deps;
     readonly kind: "remote";
-    constructor(cc: {
-        baseUrl: string;
-        token: string;
+    constructor(cc: CenterEndpoint & {
         worker?: string;
     }, deps?: {
         fetchEffective?: typeof remoteFetchEffective;

package/dist/config-provider.js

@@ -2,7 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, } from "@sema-agent/settings-schema";
+import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
@@ -32,7 +32,7 @@ export class RemoteConfigProvider {
     }
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
-        const r = await fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
+        const r = await fn(this.cc, etag, undefined, this.cc.worker);
         if (r === null || r.domainErrors === undefined)
             return r;
         return { ...r, domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) };
@@ -40,7 +40,7 @@ export class RemoteConfigProvider {
     async fetchSkillContent(contentHash) {
         const fn = this.deps.fetchSkillContent ?? remoteFetchSkillContent;
         try {
-            return await fn(this.cc.baseUrl, this.cc.token, contentHash);
+            return await fn(this.cc, contentHash);
         }
         catch (err) {
             if (err instanceof ConfigCenterHttpError && err.status === 404)
@@ -77,10 +77,10 @@ export class LocalConfigProvider {
             return null;
         const refErrors = [];
         const resolve = createSiblingResolver(store, eff);
-        for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
+        for (const d of REF_CHECKED_DOMAINS) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
             if (issues.length > 0)
-                refErrors.push({ domain: d, error: issues.map((i) => `${i.path.join(".")}: ${redactConfigError(i.message)}`).join("; ") });
+                refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
         }
         const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];

package/dist/config-types.d.ts

@@ -15,6 +15,7 @@ import type { QuestionThrottle } from "./question.js";
 import type { UnattendedApprovalPolicy } from "./tool-approval.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
+import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -471,8 +472,9 @@ export interface ServiceConfigFlat {
     /** registry-core 0.9.0 档位组: the resolved active tier table (`tier word → catalog model name`,
      *  e.g. `{pro: "ds-pro"}`) fed to `RunnerDeps.tiers` (core 1.265 expandTiers — tier words + CC aliases become
      *  catalog keys). NO env source — populated ONLY by applyEffective from `models.tierGroups`/`activeTierGroup`
-     *  via registry-core `resolveActiveTiers` (single semantic source). Empty = INERT (core contract). Consumed at
-     *  Runner CONSTRUCTION (restart-to-apply, same tier as models/roles); mutateInPlace keeps the reference. */
+     *  via registry-core `resolveActiveTiers` (single semantic source). Empty = INERT (core contract). Expanded at
+     *  Runner construction and re-expanded on every refresh-time plane swap (`Runner.swapDeps`) — HOT, same as
+     *  models/roles; mutateInPlace keeps the reference. */
     tiers: Record<string, string>;
     /** 142-S4(registry-core 0.10.0 projects 域):center 项目登记簿的 service 消费面 —
      *  键=projectId(PROJECT_ID_REGEX,generic lowercase UUID)。消费点:①`memoryScopeFor` 第三参数
@@ -1240,8 +1242,8 @@ export interface ServiceConfigFlat {
     principalJwtAud?: string;
     /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
      *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
-     *  `boot/stage-09-leader.ts` 的桥装配处)—— 本字段是「运维**点名了**一个外部签发方」这个事实的载体,
-     *  而那条回退的事实来源是「配了 center」= fleet 管理轴,不是租户轴(理由全文见 `hosted-posture.ts`)。 */
+     *  `boot/stage-09-leader.ts` 的桥装配处)。唯一消费方是桥;S-671([ref] ①)起它**不是**托管证据 ——
+     *  显式与回退 issuer 在租户轴上同判(理由见 `hosted-posture.ts`)。 */
     authBridgeIssuer?: string;
     /** Max accepted principal-JWT lifetime (exp − now), seconds — caps the replay window past the short-lived mandate.
      *  0 = no cap. `PRINCIPAL_JWT_MAX_TTL_SEC` (default 120). */
@@ -1737,6 +1739,12 @@ export interface ServiceConfigFlat {
      * 位:与「查无活流」同一件事实的两个时刻,详见 `askBroadcast` 的该臂注))。`"timeout"` 宿主自报只留在 (b)(c) ——
      * 结束等待的确实是本仓的窗;其余三臂结束等待的是容量/连接/装配,自报恒缺席。
      *
+     * 🔴 **`deny` 交给引擎的形(S-689)**:部署政策拒对象臂 `{allow:false, settledBy:"policy", reason}` ⇒ 引擎结算
+     * `policy_refused`(`who.party:"none"`)、模型读策略句(「部署政策拒了、此处没有交互审批,别重试、做不需审批的
+     * 部分」)、run 不以「用户拒绝」收束而是继续。修前是裸 `false` —— 引擎契约里那就是「一个人拒了」
+     * (`human_refused` / `haltedOnUserRejection`),与本键「没有人会来」的自声明正好相反。(b)(c) 两臂照旧带
+     * `"timeout"` 自报(`approval_window_expired`)。
+     *
      * 🔴 **射程边界(成文,不是遗漏)**:
      *  · 唯一让本旋钮**无处施加**的键是 `TOOL_APPROVAL_ENABLED=false`(协调器整体不构造,core 走它自己的
      *    headless 姿态)。**不造推断腿**:旋钮只在协调器在场时有意义,这一句是成文而不是代码分支。
@@ -1746,16 +1754,24 @@ export interface ServiceConfigFlat {
      *    而不是 server 的 ask 行,「无 askStore 但有 durable 设施」正是 R-13 点名的**主受益部署**。
      *    要回滚 R-13 的行为面,键是 `UNATTENDED_APPROVAL_POLICY=deny`,**不是**协议开关。
      *    射程钉:`test/unattended-approval-policy.test.ts` 的 codex R2-F2 两格。
-     *  · APPROVAL_REQUIRE 名单工具走 `createApprovalBaselinePolicy` 的 durable gate 类,**不经流内臂**,
-     *    结构上不受本旋钮影响(裁定「非名单工具」的限定因此无需码内名单分支)。
+     *  · APPROVAL_REQUIRE 名单工具:**要不要 ask** 由 `createApprovalBaselinePolicy` 的 durable gate 类裁决,那一层
+     *    结构上读不到本旋钮;但那只 ask 的**答法**在协调器在场时与治理 ask 同走流内臂、同政策(引擎先问活席
+     *    `onAsk`,答 `"unavailable"` 才 park)⇒ `deny` 部署对名单工具同样当场拒。旧注「不经流内臂、不受本旋钮
+     *    影响」失实(test 黑盒证伪;S-689 的真 HTTP 格 `test/unattended-deny-settlement-e2e.test.ts` 用的正是
+     *    名单工具)。
      *  · **持久回放**(窗到期后向真源收敛、`ensureAsk` 幂等重入撞上已终结的行)读出 PARKING/PARKED 时
      *    **同样按旋钮改判** —— 它们与 (a) 是同一件事(赢家可能是别的副本或上一次调用),不统一的话同一只
      *    ask 的终局会取决于「谁赢了那把 CAS / 重试没重试」。人的真决议回放不受影响。
      *  · 唯一**不受**改判的是 `ensureAsk` 身份未定 / 坏行两臂(「身份不确定」的处置,不是「没有人」的
      *    处置),于是 `deny` 部署上仍可能落极少数 park(店抖动期),已知且有意的残余。
-     *  · `deny` 部署上 ask **行**仍会经 PARKING 记账(旋钮改的是交给引擎的终局,不是店语义)。收敛器只把
-     *    PARKING 行绑到**已经存在的** checkpoint 上,而 deny 部署里引擎从不 park ⇒ 绑不上,行按 run 终局
-     *    自行收敛成 DENIED/VOID,不会凭空生出 park;残余 = 那类行的归因记成 `routing_failure`。
+     *  · 🔴 `deny` 部署上政策结算**当场落行**(NP-2,7.100.0):窗到期 / emit 全灭两臂的店终局 claim 是 `refuse` 意图
+     *    —— 这一只 ask 行 CAS 成 DECIDED(deny) + `settled_by="policy"`(按 ask 作用域,不碰批、不连坐兄弟),与交给
+     *    引擎的那一只同一个来源词 ⇒ 重入 / 收敛后重入回放同一个政策拒,不退化成裸 `false`(人拒)。修前行停 PARKING,
+     *    run 完成后收敛器转 DENIED 且不带来源。仍按 PARKING 记账的只剩别的写者推进的行(park 政策副本 / 切换政策之前)
+     *    与崩溃后收敛器孤儿腿代打 expire 的行(后者 run 终局后成 DENIED、归因 `routing_failure`,已知残余)。
+     *  · 🔴 `deny` 部署上**批是单 ask 批**(S-689 codex R1-F1;`deriveAskScopedBatchId`):批是 park 路由的单位,
+     *    整腿一批的前提是「批一关腿就随 park 结束」;deny 下引擎拿到部署政策拒后腿继续跑,整腿一批会让首只到期
+     *    把批关掉(同腿后续的卡人批不动)、把兄弟连坐成 VOID(裸 `false` = 人拒)。
      */
     unattendedApprovalPolicy: UnattendedApprovalPolicy;
     /** [ref]① (clay A 案 = workflow 权限全面 CC parity): workflow 子 agent 的默认权限基线与主 LLM 同权(base `{}`)。
@@ -1907,10 +1923,13 @@ export interface ServiceConfigFlat {
      *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true; legacy CONFIG_CENTER_DRY_RUN now boot-rejects, no dual-read): pull + LOG what the registry would change vs the env-derived
      *  config, but do NOT apply it — a safe-rollout verification step before flipping to live.
      *  `worker` (SEMA_REGISTRY_WORKER=<name>; legacy CONFIG_CENTER_WORKER now boot-rejects, no dual-read; injected per-worker by the reconciler): scopes the pull to
-     *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible). */
+     *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible).
+     *  `credential`(S-651,BREAKING:取代 7.98.0 及以前的 `token: string` 启动快照):凭证来源活对象
+     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_REGISTRY_TOKEN`(值)或
+     *  `SEMA_REGISTRY_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一。 */
     configCenter?: {
         baseUrl: string;
-        token: string;
+        credential: CenterCredentialSource;
         dryRun: boolean;
         worker?: string;
     };

package/dist/config.js

@@ -16,10 +16,10 @@ import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
-import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
@@ -1965,19 +1965,21 @@ function parseIntegrationsDomain() {
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
-        configCenter: process.env.SEMA_REGISTRY_URL
-            ? {
-                baseUrl: env("SEMA_REGISTRY_URL"),
-                token: process.env.SEMA_REGISTRY_TOKEN || "",
-                dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
-                worker: process.env.SEMA_REGISTRY_WORKER || undefined,
-            }
-            : undefined,
+        configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL")) : undefined,
         configProvider: process.env.CONFIG_PROVIDER || undefined,
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
 }
+function parseConfigCenter(baseUrl) {
+    const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+    return {
+        baseUrl,
+        credential: createCenterCredentialSource(readCenterCredentialDeclaration(), worker),
+        dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
+        worker,
+    };
+}
 const A2A_SERVE_MAX_SKILLS = 64;
 const A2A_SERVE_MAX_ID_CHARS = 128;
 const A2A_SERVE_MAX_TEXT_CHARS = 2048;
@@ -2195,10 +2197,6 @@ export function loadConfig() {
     if (dgDurable && requirePrincipal && dgOperators.length === 0) {
         throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
     }
-    const hostedRefusal = hostedPrincipalRefusal({ requirePrincipal, principalJwtPubkeys, principalJwtIss, principalJwtAud, authBridgeIssuer: auth.authBridgeIssuer });
-    if (hostedRefusal !== undefined) {
-        throw new Error(hostedRefusal);
-    }
     if (imageBakesEnabled && dgOperators.length === 0) {
         throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
     }

package/dist/cross-session-settings.js

@@ -1,7 +1,7 @@
 export const CROSS_SESSION_INBOUND_LAYER_NAMES = ["managed", "user", "repo"];
 export const CROSS_SESSION_INBOUND_LAYER_SOURCES = {
     managed: {
-        source: "CROSS_SESSION_INBOUND —— 部署/组织层旋钮(词表 accept|hold|refuse,未设=本层不设)",
+        source: "CROSS_SESSION_INBOUND —— 部署/组织层旋钮(词表取自 core CROSS_SESSION_INBOUND_SETTINGS:7.30.0 起 wake|next-turn|hold|refuse,旧词 accept 拒启;未设=本层不设)",
         wired: true,
     },
     user: {

package/dist/fleet-client.d.ts

@@ -13,6 +13,7 @@
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
 import { UsageReport } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "./config-center/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -55,9 +56,8 @@ export declare class FleetUsageAccumulator {
     get size(): number;
 }
 export interface FleetClientOpts {
-    center: {
-        baseUrl: string;
-        token: string;
+    /** S-651:凭证是**来源**(每条公告 / 用量 / 注销请求各取一次值),不是启动期烧进 header 的字符串。 */
+    center: CenterEndpoint & {
         worker: string;
     };
     instanceId: string;
@@ -88,16 +88,16 @@ export interface FleetClient {
  */
 export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
 /**
- * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl+token+worker)
+ * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl + a DECLARED credential
+ * + worker — S-651: declared, not "currently readable": a token file that is unreadable right now still starts the
+ * client, every request re-reads it)
  * AND the operator explicitly declared this instance's reachable address. Anything missing → undefined (zero
  * behavior change for non-fleet deployments); worker missing is warned when the rest is present (half-configured).
  */
 export declare function startFleetClientFromEnv(cfg: {
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: (CenterEndpoint & {
         worker?: string;
-    };
+    }) | undefined;
 }, opts: Omit<FleetClientOpts, "center" | "advertiseAddress"> & {
     advertiseAddress?: string;
 }): FleetClient | undefined;

package/dist/fleet-client.js

@@ -1,5 +1,6 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -77,8 +78,7 @@ export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
     const usageWindowMs = opts.usageWindowMs ?? 60_000;
-    const base = opts.center.baseUrl.replace(/\/+$/, "");
-    const headers = { authorization: `Bearer ${opts.center.token}`, "content-type": "application/json" };
+    const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
     const announceNow = async () => {
@@ -92,7 +92,7 @@ export function startFleetClient(opts) {
             heartbeatMs,
         };
         try {
-            const res = await f(`${base}/api/fleet/instances`, { method: "POST", headers, body: JSON.stringify(body), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
                 throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
             if (failStreak > 0)
@@ -117,7 +117,7 @@ export function startFleetClient(opts) {
             return;
         const report = { worker: opts.center.worker, instanceId: opts.instanceId, windowStartMs: start, windowEndMs, entries };
         try {
-            const res = await f(`${base}/api/fleet/usage`, { method: "POST", headers, body: JSON.stringify({ reports: [report] }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            const { res } = await send("fleet-usage", "POST", { reports: [report] });
             if (!res.ok)
                 throw new Error(`usage ${res.status}${await rejectionSnippet(res)}`);
         }
@@ -140,7 +140,7 @@ export function startFleetClient(opts) {
             clearInterval(uw);
         await flushUsage();
         try {
-            await f(`${base}/api/fleet/instances`, { method: "DELETE", headers, body: JSON.stringify({ instanceId: opts.instanceId, worker: opts.center.worker }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            await send("fleet-instances", "DELETE", { instanceId: opts.instanceId, worker: opts.center.worker });
         }
         catch {
         }
@@ -150,7 +150,7 @@ export function startFleetClient(opts) {
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
     const address = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    if (!cc?.baseUrl || !cc.token || !address)
+    if (!cc?.baseUrl || !cc.credential.declared || !address)
         return undefined;
     let parsed;
     try {
@@ -166,6 +166,6 @@ export function startFleetClientFromEnv(cfg, opts) {
         opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         return undefined;
     }
-    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker }, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -24,6 +24,7 @@
  * - 全部 swallow-guarded:lease 面绝不 fault 任务提交路径。
  */
 import { QuotaLease } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "./config-center/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
@@ -62,9 +63,8 @@ export type LeaseAdmission = {
     detail?: QuotaDenyDetail;
 };
 export interface FleetLeaseOpts {
-    center: {
-        baseUrl: string;
-        token: string;
+    /** S-651:凭证是**来源**(每次协商取一次值),不是构造期烧进 header 的字符串。 */
+    center: CenterEndpoint & {
         worker: string;
     };
     fetchImpl?: typeof fetch;
@@ -82,8 +82,6 @@ export declare class FleetLeaseManager {
     private readonly state;
     private readonly inflight;
     private readonly f;
-    private readonly base;
-    private readonly headers;
     private readonly now;
     private failStreak;
     constructor(opts: FleetLeaseOpts);
@@ -108,21 +106,23 @@ export declare class FleetLeaseManager {
     }): void;
     /** Test/observability hook: the current state kind for a principal (never exposes the token). */
     peek(principal: string): PrincipalState["kind"] | undefined;
+    /** 🔴 复审 O2(Opus)的鉴权失败臂,S-651 起两个入口共用(中心 401/403/400;凭证文件不可读):运维配置事故,
+     *  不是可用性事件。仍 fail-open(凭证抖一下不许把租户锁在门外),但**每次**都 warn + 专用计数,且**不缓存**。 */
+    private authFailOpen;
     private set;
     private issueOrRenew;
     private issueOrRenewInner;
 }
 /**
  * Env/config gate(与 startFleetClientFromEnv 同 D3 分层姿势,但 lease 不需要 FLEET_ADVERTISE_ADDRESS ——
- * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl+token+worker)即启;任一缺失 →
- * undefined,非 fleet 部署零行为变化。
+ * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl + **声明了**凭证 + worker)即启;任一缺失 →
+ * undefined,非 fleet 部署零行为变化。S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE` 在场而
+ * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: (CenterEndpoint & {
         worker?: string;
-    };
+    }) | undefined;
 }, opts: Omit<FleetLeaseOpts, "center">): FleetLeaseManager | undefined;
 export {};
 //# sourceMappingURL=fleet-lease.d.ts.map