@sema-agent/server 7.98.0 → 7.99.0

package/dist/config-lkg.js

@@ -3,22 +3,22 @@ import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
+import { centerStateBin, pullTokenIdentity } from "./center-credential.js";
 export function defaultSkillCacheDir() {
     return join(process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema"), "skill-cache");
 }
-export function defaultLkgPath(worker) {
+export function defaultLkgPath(worker, identity) {
     const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
-    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
-    return join(dir, `config-lkg-${key}.json`);
+    return join(dir, `config-lkg-${centerStateBin(worker, identity)}.json`);
 }
-export async function saveLkg(path, worker, effective, etag) {
-    const body = { formatVersion: 1, savedAt: new Date().toISOString(), worker: worker ?? "global", ...(etag !== undefined ? { etag } : {}), effective };
+export async function saveLkg(path, worker, identity, effective, etag) {
+    const body = { formatVersion: 2, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
     await fs.rename(tmp, path);
 }
-export async function loadLkg(path, worker) {
+export async function loadLkg(path, worker, identity) {
     let text;
     try {
         text = await fs.readFile(path, "utf8");
@@ -36,38 +36,125 @@ export async function loadLkg(path, worker) {
     if (parsed === null || typeof parsed !== "object")
         return { reason: "bad envelope" };
     const p = parsed;
-    if (p.formatVersion !== 1)
-        return { reason: `unknown formatVersion ${String(p.formatVersion)}` };
+    const formatVersion = p.formatVersion;
+    if (formatVersion === 1)
+        return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
+    if (formatVersion !== 2)
+        return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
-    if (p.effective === null || typeof p.effective !== "object")
-        return { reason: "bad effective" };
-    if (p.etag !== undefined && typeof p.etag !== "string")
-        return { reason: "bad etag" };
-    const eff = p.effective;
+    if (typeof p.identity !== "string" || p.identity !== identity)
+        return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
+    const problem = lkgPayloadProblem(p.effective, p.etag);
+    return problem === undefined ? { lkg: p } : { reason: problem };
+}
+function lkgPayloadProblem(effective, etag) {
+    if (effective === null || typeof effective !== "object")
+        return "bad effective";
+    if (etag !== undefined && typeof etag !== "string")
+        return "bad etag";
+    const eff = effective;
     if (typeof eff.version !== "number")
-        return { reason: "bad effective.version" };
+        return "bad effective.version";
     for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
         if (v === null || typeof v !== "object" || Array.isArray(v))
-            return { reason: `bad effective.${domain}` };
+            return `bad effective.${domain}`;
         if (arrayKey !== null) {
             const arr = v[arrayKey];
             if (arr !== undefined && !Array.isArray(arr))
-                return { reason: `bad effective.${domain}.${arrayKey}` };
+                return `bad effective.${domain}.${arrayKey}`;
         }
     }
     {
         const rt = eff.runtime;
         if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
-            return { reason: "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance" };
+            return "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance";
         }
     }
-    const promptsRaw = p.effective.prompts;
+    const promptsRaw = eff.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
-        return { reason: "prompts face fails re-validation" };
-    return { lkg: p };
+        return "prompts face fails re-validation";
+    return undefined;
+}
+export function legacyV1LkgPath(worker) {
+    const dir = process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema");
+    const key = (worker ?? "global").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 64);
+    return join(dir, `config-lkg-${key}.json`);
+}
+export async function migrateV1Lkg(o) {
+    const refuse = (why) => ({
+        outcome: "not-migrated",
+        path: o.legacyPath,
+        reason: `pre-identity LKG (formatVersion 1) at ${o.legacyPath} not migrated: ${why}. Way out: delete that file — the next clean candidate from the center writes this credential identity's own LKG (${o.binPath})`,
+    });
+    const sameFile = o.legacyPath === o.binPath;
+    if (!sameFile) {
+        try {
+            await fs.access(o.binPath);
+            return { outcome: "none" };
+        }
+        catch (err) {
+            const code = errnoOf(err);
+            if (code !== "ENOENT")
+                return refuse(`this credential identity's bin ${o.binPath} could not be checked (${code})`);
+        }
+    }
+    let text;
+    try {
+        text = await fs.readFile(o.legacyPath, "utf8");
+    }
+    catch (err) {
+        const code = errnoOf(err);
+        return code === "ENOENT" || code === "ENOTDIR" || sameFile ? { outcome: "none" } : refuse(`it could not be read (${code})`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        return sameFile ? { outcome: "none" } : refuse(`it is not valid JSON (${err instanceof Error ? err.name : "parse error"})`);
+    }
+    if (parsed === null || typeof parsed !== "object" || !("formatVersion" in parsed) || parsed.formatVersion !== 1)
+        return { outcome: "none" };
+    const v1 = parsed;
+    if (v1.worker !== (o.worker ?? "global"))
+        return refuse(`it belongs to worker ${JSON.stringify(v1.worker)}`);
+    if (o.identity !== pullTokenIdentity(o.worker)) {
+        return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
+    }
+    const problem = lkgPayloadProblem(v1.effective, v1.etag);
+    if (problem !== undefined)
+        return refuse(`its payload is unusable (${problem})`);
+    const retiredTo = `${o.legacyPath}.migrated-v1`;
+    let retireError;
+    if (sameFile) {
+        try {
+            await fs.copyFile(o.legacyPath, retiredTo);
+        }
+        catch (err) {
+            retireError = `the formatVersion 1 bytes could not be kept as ${retiredTo} (${errnoOf(err)})`;
+        }
+    }
+    try {
+        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, typeof v1.etag === "string" ? v1.etag : undefined);
+    }
+    catch (err) {
+        return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);
+    }
+    if (!sameFile) {
+        try {
+            await fs.rename(o.legacyPath, retiredTo);
+        }
+        catch (err) {
+            retireError = `the old file could not be renamed to ${retiredTo} (${errnoOf(err)}) — harmless: the bin now exists, so the old file is never read again`;
+        }
+    }
+    return { outcome: "migrated", from: o.legacyPath, retiredTo, ...(retireError !== undefined ? { retireError } : {}) };
+}
+function errnoOf(err) {
+    return err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "unknown";
 }
 //# sourceMappingURL=config-lkg.js.map

package/dist/config-provider.d.ts

@@ -1,6 +1,7 @@
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
+import type { CenterEndpoint } from "./config-center/center-request.js";
 /** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
@@ -17,6 +18,8 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
+/** `credentialIdentity`(S-651 / [ref] E-15):远程腿恒在场 = 这次拉取所用凭证的身份(分箱键来源);本地腿
+ *  缺席(没有凭证 —— config.d 就在本机盘上)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -25,6 +28,7 @@ export type FetchEffectiveResult = {
         error: string;
     }>;
     readWarnings: readonly EffectiveReadWarning[];
+    credentialIdentity?: string;
 } | null;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
@@ -67,9 +71,7 @@ export interface ConfigProviderInput {
     /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
      *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: CenterEndpoint & {
         worker?: string;
         dryRun?: boolean;
     };
@@ -84,16 +86,15 @@ export interface ConfigProviderInput {
 }
 /**
  * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
- * baseUrl/token/worker are bound once and passed through. The two delegate fns are injectable (defaulting
+ * the center endpoint (baseUrl + credential SOURCE — S-651: read per request, never a bound token) and worker
+ * are passed through. The two delegate fns are injectable (defaulting
  * to the real config-center exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
     private readonly deps;
     readonly kind: "remote";
-    constructor(cc: {
-        baseUrl: string;
-        token: string;
+    constructor(cc: CenterEndpoint & {
         worker?: string;
     }, deps?: {
         fetchEffective?: typeof remoteFetchEffective;

package/dist/config-provider.js

@@ -2,7 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, } from "@sema-agent/settings-schema";
+import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
@@ -32,7 +32,7 @@ export class RemoteConfigProvider {
     }
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
-        const r = await fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
+        const r = await fn(this.cc, etag, undefined, this.cc.worker);
         if (r === null || r.domainErrors === undefined)
             return r;
         return { ...r, domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) };
@@ -40,7 +40,7 @@ export class RemoteConfigProvider {
     async fetchSkillContent(contentHash) {
         const fn = this.deps.fetchSkillContent ?? remoteFetchSkillContent;
         try {
-            return await fn(this.cc.baseUrl, this.cc.token, contentHash);
+            return await fn(this.cc, contentHash);
         }
         catch (err) {
             if (err instanceof ConfigCenterHttpError && err.status === 404)
@@ -77,10 +77,10 @@ export class LocalConfigProvider {
             return null;
         const refErrors = [];
         const resolve = createSiblingResolver(store, eff);
-        for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
+        for (const d of REF_CHECKED_DOMAINS) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
             if (issues.length > 0)
-                refErrors.push({ domain: d, error: issues.map((i) => `${i.path.join(".")}: ${redactConfigError(i.message)}`).join("; ") });
+                refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
         }
         const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];

package/dist/config-types.d.ts

@@ -15,6 +15,7 @@ import type { QuestionThrottle } from "./question.js";
 import type { UnattendedApprovalPolicy } from "./tool-approval.js";
 import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
+import type { CenterCredentialSource } from "./center-credential.js";
 import type { GitApiKind } from "./git-api-kind.js";
 /** [ref]:记忆向量面的 embedder 坐标(env `MEMORY_EMBEDDER_*` 解析结果;单一属主 = 本类型,
  *  `plugins/memory-embedder.ts` 的工厂直接消费它,不复制形状)。语义与三问见
@@ -1240,8 +1241,8 @@ export interface ServiceConfigFlat {
     principalJwtAud?: string;
     /** S-591:registry SSO-JWT 的**显式** issuer(`AUTH_BRIDGE_ISSUER`)。
      *  🔴 **只是显式 env,不含 boot 期那条 `?? configCenter.baseUrl` 回退**(回退仍在
-     *  `boot/stage-09-leader.ts` 的桥装配处)—— 本字段是「运维**点名了**一个外部签发方」这个事实的载体,
-     *  而那条回退的事实来源是「配了 center」= fleet 管理轴,不是租户轴(理由全文见 `hosted-posture.ts`)。 */
+     *  `boot/stage-09-leader.ts` 的桥装配处)。唯一消费方是桥;S-671([ref] ①)起它**不是**托管证据 ——
+     *  显式与回退 issuer 在租户轴上同判(理由见 `hosted-posture.ts`)。 */
     authBridgeIssuer?: string;
     /** Max accepted principal-JWT lifetime (exp − now), seconds — caps the replay window past the short-lived mandate.
      *  0 = no cap. `PRINCIPAL_JWT_MAX_TTL_SEC` (default 120). */
@@ -1907,10 +1908,13 @@ export interface ServiceConfigFlat {
      *  `dryRun` (SEMA_REGISTRY_DRY_RUN=true; legacy CONFIG_CENTER_DRY_RUN now boot-rejects, no dual-read): pull + LOG what the registry would change vs the env-derived
      *  config, but do NOT apply it — a safe-rollout verification step before flipping to live.
      *  `worker` (SEMA_REGISTRY_WORKER=<name>; legacy CONFIG_CENTER_WORKER now boot-rejects, no dual-read; injected per-worker by the reconciler): scopes the pull to
-     *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible). */
+     *  that worker's roster via `/effective?worker=<name>`. Unset → the global roster (backward compatible).
+     *  `credential`(S-651,BREAKING:取代 7.98.0 及以前的 `token: string` 启动快照):凭证来源活对象
+     *  (`center-credential.ts`),每条出站请求经它取一次值 —— `SEMA_REGISTRY_TOKEN`(值)或
+     *  `SEMA_REGISTRY_TOKEN_FILE`(每次读文件,轮换 / 换账号不重启)二选一。 */
     configCenter?: {
         baseUrl: string;
-        token: string;
+        credential: CenterCredentialSource;
         dryRun: boolean;
         worker?: string;
     };

package/dist/config.js

@@ -16,10 +16,10 @@ import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { readFaceForPosture } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
-import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf } from "./execution-lane-caps.js";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
+import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
@@ -1965,19 +1965,21 @@ function parseIntegrationsDomain() {
         gitApiKind: parseGitApiKind(process.env.GIT_API_KIND, process.env.GIT_API_BASEURL),
         defaultScenario: env("DEFAULT_SCENARIO", "code"),
         skillsDir: env("SKILLS_DIR", defaultSkillsDir()),
-        configCenter: process.env.SEMA_REGISTRY_URL
-            ? {
-                baseUrl: env("SEMA_REGISTRY_URL"),
-                token: process.env.SEMA_REGISTRY_TOKEN || "",
-                dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
-                worker: process.env.SEMA_REGISTRY_WORKER || undefined,
-            }
-            : undefined,
+        configCenter: process.env.SEMA_REGISTRY_URL ? parseConfigCenter(env("SEMA_REGISTRY_URL")) : undefined,
         configProvider: process.env.CONFIG_PROVIDER || undefined,
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
         a2aServe: parseA2aServe(),
     };
 }
+function parseConfigCenter(baseUrl) {
+    const worker = process.env.SEMA_REGISTRY_WORKER || undefined;
+    return {
+        baseUrl,
+        credential: createCenterCredentialSource(readCenterCredentialDeclaration(), worker),
+        dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false),
+        worker,
+    };
+}
 const A2A_SERVE_MAX_SKILLS = 64;
 const A2A_SERVE_MAX_ID_CHARS = 128;
 const A2A_SERVE_MAX_TEXT_CHARS = 2048;
@@ -2195,10 +2197,6 @@ export function loadConfig() {
     if (dgDurable && requirePrincipal && dgOperators.length === 0) {
         throw new Error("DURABLE_APPROVAL=true + REQUIRE_PRINCIPAL=true but OPERATOR_PRINCIPALS is empty — on a multi-tenant worker the empty operator set makes isOperator() true-for-all, so every authenticated tenant could read every other tenant's pending-approval queue (GET /v1/approvals & siblings). Set OPERATOR_PRINCIPALS, or unset REQUIRE_PRINCIPAL if this is a single-tenant deployment (#157-① boot invariant)");
     }
-    const hostedRefusal = hostedPrincipalRefusal({ requirePrincipal, principalJwtPubkeys, principalJwtIss, principalJwtAud, authBridgeIssuer: auth.authBridgeIssuer });
-    if (hostedRefusal !== undefined) {
-        throw new Error(hostedRefusal);
-    }
     if (imageBakesEnabled && dgOperators.length === 0) {
         throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
     }

package/dist/fleet-client.d.ts

@@ -13,6 +13,7 @@
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
 import { UsageReport } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "./config-center/center-request.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;
@@ -55,9 +56,8 @@ export declare class FleetUsageAccumulator {
     get size(): number;
 }
 export interface FleetClientOpts {
-    center: {
-        baseUrl: string;
-        token: string;
+    /** S-651:凭证是**来源**(每条公告 / 用量 / 注销请求各取一次值),不是启动期烧进 header 的字符串。 */
+    center: CenterEndpoint & {
         worker: string;
     };
     instanceId: string;
@@ -88,16 +88,16 @@ export interface FleetClient {
  */
 export declare function startFleetClient(opts: FleetClientOpts): FleetClient;
 /**
- * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl+token+worker)
+ * Env/config gate (D3 可选分层): start ONLY when the sema-registry lane is configured (baseUrl + a DECLARED credential
+ * + worker — S-651: declared, not "currently readable": a token file that is unreadable right now still starts the
+ * client, every request re-reads it)
  * AND the operator explicitly declared this instance's reachable address. Anything missing → undefined (zero
  * behavior change for non-fleet deployments); worker missing is warned when the rest is present (half-configured).
  */
 export declare function startFleetClientFromEnv(cfg: {
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: (CenterEndpoint & {
         worker?: string;
-    };
+    }) | undefined;
 }, opts: Omit<FleetClientOpts, "center" | "advertiseAddress"> & {
     advertiseAddress?: string;
 }): FleetClient | undefined;

package/dist/fleet-client.js

@@ -1,5 +1,6 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {
@@ -77,8 +78,7 @@ export function startFleetClient(opts) {
     const f = opts.fetchImpl ?? fetch;
     const heartbeatMs = opts.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
     const usageWindowMs = opts.usageWindowMs ?? 60_000;
-    const base = opts.center.baseUrl.replace(/\/+$/, "");
-    const headers = { authorization: `Bearer ${opts.center.token}`, "content-type": "application/json" };
+    const send = (route, method, json) => centerFetch(opts.center, { kind: route }, { method, json, timeoutMs: FLEET_CLIENT_FETCH_TIMEOUT_MS, fetchImpl: f });
     let stopped = false;
     let failStreak = 0;
     const announceNow = async () => {
@@ -92,7 +92,7 @@ export function startFleetClient(opts) {
             heartbeatMs,
         };
         try {
-            const res = await f(`${base}/api/fleet/instances`, { method: "POST", headers, body: JSON.stringify(body), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)
                 throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
             if (failStreak > 0)
@@ -117,7 +117,7 @@ export function startFleetClient(opts) {
             return;
         const report = { worker: opts.center.worker, instanceId: opts.instanceId, windowStartMs: start, windowEndMs, entries };
         try {
-            const res = await f(`${base}/api/fleet/usage`, { method: "POST", headers, body: JSON.stringify({ reports: [report] }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            const { res } = await send("fleet-usage", "POST", { reports: [report] });
             if (!res.ok)
                 throw new Error(`usage ${res.status}${await rejectionSnippet(res)}`);
         }
@@ -140,7 +140,7 @@ export function startFleetClient(opts) {
             clearInterval(uw);
         await flushUsage();
         try {
-            await f(`${base}/api/fleet/instances`, { method: "DELETE", headers, body: JSON.stringify({ instanceId: opts.instanceId, worker: opts.center.worker }), signal: AbortSignal.timeout(FLEET_CLIENT_FETCH_TIMEOUT_MS) });
+            await send("fleet-instances", "DELETE", { instanceId: opts.instanceId, worker: opts.center.worker });
         }
         catch {
         }
@@ -150,7 +150,7 @@ export function startFleetClient(opts) {
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
     const address = opts.advertiseAddress ?? process.env.FLEET_ADVERTISE_ADDRESS;
-    if (!cc?.baseUrl || !cc.token || !address)
+    if (!cc?.baseUrl || !cc.credential.declared || !address)
         return undefined;
     let parsed;
     try {
@@ -166,6 +166,6 @@ export function startFleetClientFromEnv(cfg, opts) {
         opts.logger?.warn("fleet_client_no_worker_scope", { note: "FLEET_ADVERTISE_ADDRESS set but SEMA_REGISTRY_WORKER missing — announce needs the worker (dispatch key); fleet client not started" });
         return undefined;
     }
-    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker }, advertiseAddress: address });
+    return startFleetClient({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker }, advertiseAddress: address });
 }
 //# sourceMappingURL=fleet-client.js.map

package/dist/fleet-lease.d.ts

@@ -24,6 +24,7 @@
  * - 全部 swallow-guarded:lease 面绝不 fault 任务提交路径。
  */
 import { QuotaLease } from "@sema-agent/settings-schema/fleet";
+import { type CenterEndpoint } from "./config-center/center-request.js";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */
@@ -62,9 +63,8 @@ export type LeaseAdmission = {
     detail?: QuotaDenyDetail;
 };
 export interface FleetLeaseOpts {
-    center: {
-        baseUrl: string;
-        token: string;
+    /** S-651:凭证是**来源**(每次协商取一次值),不是构造期烧进 header 的字符串。 */
+    center: CenterEndpoint & {
         worker: string;
     };
     fetchImpl?: typeof fetch;
@@ -82,8 +82,6 @@ export declare class FleetLeaseManager {
     private readonly state;
     private readonly inflight;
     private readonly f;
-    private readonly base;
-    private readonly headers;
     private readonly now;
     private failStreak;
     constructor(opts: FleetLeaseOpts);
@@ -108,21 +106,23 @@ export declare class FleetLeaseManager {
     }): void;
     /** Test/observability hook: the current state kind for a principal (never exposes the token). */
     peek(principal: string): PrincipalState["kind"] | undefined;
+    /** 🔴 复审 O2(Opus)的鉴权失败臂,S-651 起两个入口共用(中心 401/403/400;凭证文件不可读):运维配置事故,
+     *  不是可用性事件。仍 fail-open(凭证抖一下不许把租户锁在门外),但**每次**都 warn + 专用计数,且**不缓存**。 */
+    private authFailOpen;
     private set;
     private issueOrRenew;
     private issueOrRenewInner;
 }
 /**
  * Env/config gate(与 startFleetClientFromEnv 同 D3 分层姿势,但 lease 不需要 FLEET_ADVERTISE_ADDRESS ——
- * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl+token+worker)即启;任一缺失 →
- * undefined,非 fleet 部署零行为变化。
+ * 它是出站消费面,不是入站可达性声明):sema-registry lane 配齐(baseUrl + **声明了**凭证 + worker)即启;任一缺失 →
+ * undefined,非 fleet 部署零行为变化。S-651:按**声明**装、不按内容装 —— `SEMA_REGISTRY_TOKEN_FILE` 在场而
+ * 文件此刻不可读,管理器照样装上(每次协商取值,失败走响亮的鉴权失败臂;文件恢复即恢复)。
  */
 export declare function createFleetLeaseFromEnv(cfg: {
-    configCenter?: {
-        baseUrl: string;
-        token: string;
+    configCenter?: (CenterEndpoint & {
         worker?: string;
-    };
+    }) | undefined;
 }, opts: Omit<FleetLeaseOpts, "center">): FleetLeaseManager | undefined;
 export {};
 //# sourceMappingURL=fleet-lease.d.ts.map

package/dist/fleet-lease.js

@@ -1,4 +1,6 @@
 import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
+import { CenterCredentialUnavailableError } from "./center-credential.js";
+import { centerFetch } from "./config-center/center-request.js";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;
@@ -8,15 +10,11 @@ export class FleetLeaseManager {
     state = new Map();
     inflight = new Map();
     f;
-    base;
-    headers;
     now;
     failStreak = 0;
     constructor(opts) {
         this.opts = opts;
         this.f = opts.fetchImpl ?? fetch;
-        this.base = opts.center.baseUrl.replace(/\/+$/, "");
-        this.headers = { authorization: `Bearer ${opts.center.token}`, "content-type": "application/json" };
         this.now = opts.now ?? Date.now;
     }
     async admit(principal) {
@@ -46,6 +44,11 @@ export class FleetLeaseManager {
     peek(principal) {
         return this.state.get(principal)?.kind;
     }
+    authFailOpen(principal, status, note) {
+        this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status, principal, note });
+        this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(status) });
+        return { ok: true };
+    }
     set(principal, st) {
         if (!this.state.has(principal) && this.state.size >= LEASE_PRINCIPAL_CAP) {
             const oldest = this.state.keys().next().value;
@@ -64,11 +67,11 @@ export class FleetLeaseManager {
     }
     async issueOrRenewInner(principal) {
         try {
-            const res = await this.f(`${this.base}/api/fleet/leases`, {
+            const { res } = await centerFetch(this.opts.center, { kind: "fleet-leases" }, {
                 method: "POST",
-                headers: this.headers,
-                body: JSON.stringify({ principal, worker: this.opts.center.worker }),
-                signal: AbortSignal.timeout(LEASE_FETCH_TIMEOUT_MS),
+                json: { principal, worker: this.opts.center.worker },
+                timeoutMs: LEASE_FETCH_TIMEOUT_MS,
+                fetchImpl: this.f,
             });
             if (res.status === 200) {
                 const body = (await res.json());
@@ -100,13 +103,14 @@ export class FleetLeaseManager {
                 return { ok: true };
             }
             if (res.status === 401 || res.status === 403 || res.status === 400) {
-                this.opts.logger?.warn?.("fleet_lease_auth_error_fail_open", { status: res.status, principal, note: "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)" });
-                this.opts.metrics?.inc("fleet_lease_auth_error_total", { status: String(res.status) });
-                return { ok: true };
+                return this.authFailOpen(principal, res.status, "center rejected the lease request — check the service token / worker id / center URL (budget NOT enforced until fixed)");
             }
             throw new Error(`lease ${res.status}`);
         }
         catch (err) {
+            if (err instanceof CenterCredentialUnavailableError) {
+                return this.authFailOpen(principal, "credential-unreadable", `${err.reason} — no lease request sent (budget NOT enforced until the credential is readable)`);
+            }
             this.failStreak += 1;
             if (this.failStreak === 1)
                 this.opts.logger?.warn?.("fleet_lease_unavailable_fail_open", { error: err instanceof Error ? err.message : String(err) });
@@ -117,8 +121,8 @@ export class FleetLeaseManager {
 }
 export function createFleetLeaseFromEnv(cfg, opts) {
     const cc = cfg.configCenter;
-    if (!cc?.baseUrl || !cc.token || !cc.worker)
+    if (!cc?.baseUrl || !cc.credential.declared || !cc.worker)
         return undefined;
-    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, token: cc.token, worker: cc.worker } });
+    return new FleetLeaseManager({ ...opts, center: { baseUrl: cc.baseUrl, credential: cc.credential, worker: cc.worker } });
 }
 //# sourceMappingURL=fleet-lease.js.map