@sema-agent/settings-schema 6.2.0 → 6.3.0

package/dist/config-fns.js

@@ -17,6 +17,7 @@
 // its entry collections. zod is this package's one runtime dependency, so this costs nothing new.
 import { z } from "zod";
 import { MODEL_ENTRY_REFUSAL_CODES, ModelRefusalsWire } from "./fleet.js";
+import { carriesUserinfo, secretScanForms } from "./secret-scan.js"; // package-private display-side normalization + the userinfo judgement (not in the barrel)
 import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken } from "./types.js";
 /** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
  *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
@@ -24,20 +25,32 @@ import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX,
  *  any secret-shaped run (`%` kept in the run so a percent-encoded secret stays whole for the percent-aware
  *  containsSecretToken). invariant ①: a secret VALUE never rides an error. R13/R14.
  *
- *  **Output invariant** (S-712 verification pass N1 + codex review [high] ×2): a string holding a private-key PEM
- *  header ANYWHERE ({@link PRIVATE_KEY_PEM_HEADER}) is withheld WHOLE, and no result trips `containsSecretToken`.
- *  The PEM header is judged on the ORIGINAL text, before any replacement: the token pass can rewrite the header
- *  itself away (`sk-note:-----BEGIN` is one token-charset run that starts with `sk-`, so it becomes
- *  `[redacted-secret]` and the key body after it would ride out untouched — codex verification round). A PEM header
- *  carries spaces, so the targeted passes can never isolate it, and the detector only sees it at the very start of
- *  a string. Every warning face that goes through here (coordinates, error text, entry identity) inherits the same
- *  guarantee. The validation-side detector `containsSecretToken` is deliberately NOT widened here: making it reject
- *  a mid-string PEM would tighten every field it validates (a major). */
+ *  **Output invariant** (S-712 verification pass N1 + codex review [high] ×2; 6.3.0): a string holding a private-key
+ *  PEM header ANYWHERE ({@link PRIVATE_KEY_PEM_HEADER}) in ANY of its {@link secretScanForms} `forms` is withheld WHOLE, a
+ *  string whose normalization did not finish (`unresolved`) is withheld WHOLE, and no result trips `containsSecretToken` on
+ *  any of its forms.
+ *  The whole-string judgement is ONE rule — both detectors run over the normalized forms: the PEM header on every form of
+ *  the ORIGINAL text, `containsSecretToken` on every form of the targeted result; what could not be normalized does not go
+ *  out (6.3.0, codex r1 F1: `-----BEGIN+PRIVATE+KEY` form-encoded headers and four-layer encodings both rode out).
+ *  6.3.0 (codex review of v6.1.0 [high]): `key=` + a percent-encoded PEM showed its header only on a decoded form
+ *  (`-----BEGIN%20PRIVATE%20KEY` — `%20` is not in `[A-Z0-9 ]`), and the detector's anchored decode missed it behind
+ *  the `key=` prefix, so the whole key rode out through coordinates, zod `received` / `message` and entry identity.
+ *  The PEM header is judged BEFORE any replacement: the token pass can rewrite the header itself away
+ *  (`sk-note:-----BEGIN` is one token-charset run that starts with `sk-`, so it becomes `[redacted-secret]` and the
+ *  key body after it would ride out untouched — codex verification round). A PEM header carries spaces, so the
+ *  targeted passes can never isolate it, and the detector only sees it at the very start of a string. Every
+ *  free-text warning face that goes through here (coordinates, error text) inherits the same guarantee; the entry
+ *  identity face additionally has to be an identifier ({@link isDisclosableIdentity}). The validation-side detector
+ *  `containsSecretToken` is deliberately NOT widened here: making it reject a mid-string PEM would tighten every field
+ *  it validates (a major). */
 export function redactSecrets(text) {
     const targeted = text
         .replace(/\b(bearer|basic)(\s+)\S+/gi, "$1$2[redacted-secret]")
         .replace(/[A-Za-z0-9_./:+=%-]{6,}/g, (tok) => (containsSecretToken(tok) ? "[redacted-secret]" : tok));
-    return PRIVATE_KEY_PEM_HEADER.test(text) || containsSecretToken(targeted) ? "[redacted-secret]" : targeted;
+    const scan = secretScanForms(text);
+    const targetedForms = targeted === text ? scan.forms : secretScanForms(targeted).forms; // 没替换过(最常见)⇒ 同一组形,不再归一化一遍
+    const whole = scan.unresolved || scan.forms.some((form) => PRIVATE_KEY_PEM_HEADER.test(form)) || targetedForms.some((form) => containsSecretToken(form));
+    return whole ? "[redacted-secret]" : targeted;
 }
 /** Sanitize a ZodError IN PLACE so no surfaced error (message / `received` / nested `unionErrors`) echoes a
  *  pasted secret. RECURSES into `unionErrors` (a `z.union` failure nests a ZodError per member — e.g. RoleTarget
@@ -185,23 +198,55 @@ const PLAIN_PATH_SEGMENT = /^(?!(?:0|[1-9]\d*)$)[^."\u0000-\u001f]+$/;
 export function formatConfigPath(p) {
     return p.map((seg) => (typeof seg === "number" ? String(seg) : PLAIN_PATH_SEGMENT.test(seg) ? seg : JSON.stringify(seg))).join(".");
 }
-/** 身份串 —— 「一个用户写的身份串(条目的 `name` / `id`)能不能**原样**出门」的**唯一**判据:
- *  {@link redactSecrets} 原样放行。入参是 `string`、返回 `boolean`,**刻意不是**类型谓词(`v is string`):它对一些
- *  字符串答 false,谓词形会让调用方的否定分支把一个 `string` 收窄成 `never`;「是不是字符串」由调用点自己判
- *  (运行期收到非字符串照答 false、不抛)。秘密形的串按**无名**处置(不带,而不是打码:打过码的串不再是身份)。
- *  与坐标段脱敏、`error` 文案脱敏({@link sanitizeZodError})**同一只**判据:告警面上任何一处用户写的串,要么过这一只
- *  脱敏器出门,要么(可缺的身份)不出门。两只判据会在同一条告警里给出两种答案(对抗轮 #2 真复现:`Bearer` 后接 NBSP
- *  或短令牌时,旧判据放行、坐标却打码)。
+/** 本文件铸的、带用户写的键段的告警坐标出门前的**唯一**一道(6.3.0,codex r1 F2):字符串段过 {@link outgoingSegment} —— 与 `error` 文案
+ *  ({@link sanitizeZodError})、身份否决({@link isDisclosableIdentity})**同一只**脱敏器,不另设判据;数字段(下标)原样。
+ *  键段是用户写的,完全可能就是一条粘错位置的凭据:被丢 Record 条目的键、未知键告警(`unknown-keys-dropped` /
+ *  `-carried`)的键名都一样(后者 0.19.0 起从不过脱敏器,`sk-…` 形的未知键名原样进告警与投影)。schema 已知的字段名
+ *  脱敏器原样放行,所以坐标里「它是哪个字段」照旧可读。经它的坐标就是出门形 —— {@link droppedKeys} /
+ *  {@link carriedUnknownKeys} 这两只导出函数给消费方的 `keys` 同样是它的产物。`legacy-governance-lifted.keys` 不经它:那些键只来自
+ *  闭集 {@link GOVERNANCE_MIRROR_KEYS},按构造没有用户写的串(opus 腿 I1)。 */
+function outgoingPath(p) {
+    return p.map((seg) => (typeof seg === "string" ? outgoingSegment(seg) : seg));
+}
+/** 一段用户写的串(坐标键段、`hosts-grandfathered` 被夹紧的主机名)出门前的那一道:长过 {@link DISCLOSABLE_IDENTITY_MAX}(与身份白名单同一只上界)
+ *  ⇒ 不扫描、整段 `[redacted-secret]`(标识符不会那么长;fail-closed 且 O(1) —— opus 独立腿 M1:6.3.0 首稿让每个未知键名
+ *  不论多长都过脱敏器,64 个 16 KB 的键名把一次读拖到 20 s 以上);否则过 {@link redactSecrets}。 */
+function outgoingSegment(seg) {
+    return seg.length > DISCLOSABLE_IDENTITY_MAX ? "[redacted-secret]" : redactSecrets(seg);
+}
+/** 可披露身份与出门坐标段的**长度上界**(一只常量,两处用:{@link DISCLOSABLE_IDENTITY_RE} 的上限、{@link outgoingSegment}
+ *  的「超长不扫描」界)。与 web-admin 读侧名长上限 256 对齐。 */
+const DISCLOSABLE_IDENTITY_MAX = 256;
+/** 可披露身份的**闭形**(6.3.0):字符集 `A-Z a-z 0-9 . _ : / @ + -`、长度 1–256(上限与 web-admin 读侧名长上限 256 对齐;`ModelEntry.name`
+ *  本身不设上限,超 256 字的合法名按无名处置)。身份是**标识符**不是自由文本 ——
+ *  允许集才是它的语义:上游模型 id 的真实形(`accounts/fireworks/models/…`、`Qwen/Qwen2.5-72B-Instruct`、
+ *  `claude-3-5-sonnet@20240620`、`deepseek-v4-flash:free`、`o3-mini+high`)都在集内;`%` / `=` / 空白 / 引号 / 反斜杠 /
+ *  控制与零宽字符 / 非 ASCII 一律在集外 —— 编码过的、带前缀的、多行的、会在日志里伪造行的串,不可能是一个标识符。
+ *  无旗标(无 `g` ⇒ `.test` 无状态,可放心共享这一只)。判据只有 {@link isDisclosableIdentity} 一只,消费方要
+ *  「这个名能不能写出去」问它,不要拿本常量自拼(集内仍有密钥形,见那一只的否决项)。 */
+export const DISCLOSABLE_IDENTITY_RE = new RegExp(`^[A-Za-z0-9._:/@+-]{1,${DISCLOSABLE_IDENTITY_MAX}}$`);
+/** 身份串 —— 「一个用户写的身份串(条目的 `name` / `id`)能不能**原样**出门」的**唯一**判据(6.3.0 起两项合取):
+ *   ① **形**:落在 {@link DISCLOSABLE_IDENTITY_RE} 白名单闭形里(不再是「不像密钥就可披露」—— 6.1.0 / 6.2.0 的黑名单
+ *      判据放行过 `key=` + 百分号编码的整把 PEM 私钥,codex 对 v6.1.0 复审 [high]);
+ *   ② **否决**(「无密钥形」):坐标脱敏器 {@link redactSecrets} 原样放行 —— 集内照样有密钥形(`sk-…` / `ghp_…` /
+ *      `AKIA…` / 三段 JWT 的字符全在集内),而且判它的必须是坐标段、`error` 文案({@link sanitizeZodError})用的**同一只**
+ *      脱敏器:两只判据会在同一条告警里给出两种答案(对抗轮 #2 真复现;集内的残例 = `@` 之后的单点 `eyJ…` 串,裸探测器
+ *      判阴、脱敏器会改,语料 c41 钉着);∧ 不是带 userinfo 的 URL —— 校验侧 `NON_SECRET_URL` 拒写的同一只判定
+ *      (`carriesUserinfo`,包内私有;opus 腿 L1:`postgres://svc:pw@h` 的字符全在集内)。
+ *  入参是 `string`、返回 `boolean`,**刻意不是**类型谓词(`v is string`):它对一些字符串答 false,谓词形会让调用方的
+ *  否定分支把一个 `string` 收窄成 `never`;「是不是字符串」由调用点自己判(运行期收到非字符串照答 false、不抛)。
+ *  不可披露的串按**无名**处置(不带,而不是打码:打过码的串不再是身份)。
  *  执法面(同一条律):被丢条目的身份({@link DroppedEntryIdentity},本文件铸);`ModelRefusalsWire` 的 `entries` 键
  *  (经 {@link isReportableRefusalName},S-768);引擎自己的日志 / 拒因句里要不要写出一个名字,同样问这一只。 */
 export function isDisclosableIdentity(v) {
-    return typeof v === "string" && redactSecrets(v) === v; // 非字符串(JS / any 调用方)⇒ false,不抛(秘密轴 fail-closed)
+    // 非字符串(JS / any 调用方)⇒ false,不抛(秘密轴 fail-closed)
+    return typeof v === "string" && DISCLOSABLE_IDENTITY_RE.test(v) && redactSecrets(v) === v && !carriesUserinfo(v);
 }
 /** S-768 —— 「一个目录条目名能不能当 {@link ModelRefusalsWire} `entries` 的键」的**唯一**判据;引擎铸键前只调这一只,
  *  不过 ⇒ 按无名处置(不进键、不计数)。两条律的合取,不手抄任何一条:
  *   ① 这只 schema **自己载得住**这个键 —— 就地拿 schema 判(空串不过键规则;`__proto__` 这类名被 zod 的 record 静默丢掉,
  *      载不住),不写名单;
- *   ② {@link isDisclosableIdentity}(秘密形 ⇒ 不出门)。
+ *   ② {@link isDisclosableIdentity}(不是白名单闭形里的标识符,或是秘密形 ⇒ 不出门)。
  *  非字符串 ⇒ false。住在本文件而不是 `./fleet`:`fleet.ts` 被 `types.ts` 引,它再引本文件会成环。 */
 export function isReportableRefusalName(name) {
     if (!isDisclosableIdentity(name))
@@ -274,7 +319,7 @@ function judgeEntry(schema, value) {
  * 造出一个空集合**。
  *
  * 🔴 **告警不许比它诊断的东西更危险**(复审 R1 两条,红先复现):① Record 的键是用户写的,完全可能就是
- * 一条粘错位置的凭据,所以路径里的键段过 {@link redactSecrets} 才出门(不变量①:secret 值永不随错误外流,
+ * 一条粘错位置的凭据,所以路径里的键段过 {@link redactSecrets} 才出门(6.3.0 起经 `outgoingPath` 这一道;不变量①:secret 值永不随错误外流,
  * 与 parseDomain 的 R13/R14 同一条);② 整段遍历包 try/catch —— 读字段、枚举 Record 都会触发访问器,
  * 抛出来的文案可能带 secret。抢救是**尽力而为**的:抢不动就当没抢救(返回原引用),让既有的整域档位去裁,
  * 绝不把解析拖下水、更不回显它的错误(与同文件 {@link droppedKeys} 逐字同纪律)。
@@ -320,7 +365,7 @@ function salvageEntriesUnsafe(schema, raw) {
                     keptFrom.push(i); // 压缩后第 keptFrom.length-1 条 = 原文档第 i 条
                     return true;
                 }
-                bad.push(droppedEntry([field, i], error, entry));
+                bad.push(droppedEntry(outgoingPath([field, i]), error, entry));
                 return false;
             });
             // 零幸存者 ⇒ 没有要抢救的东西(见头注:绝不凭空造出一个空集合)。
@@ -340,7 +385,7 @@ function salvageEntriesUnsafe(schema, raw) {
                 if (error === undefined)
                     kept[key] = entry;
                 else
-                    bad.push(droppedEntry([field, redactSecrets(key)], error, entry)); // 键是用户写的,可能就是一条粘错位置的凭据
+                    bad.push(droppedEntry(outgoingPath([field, key]), error, entry)); // 键是用户写的,可能就是一条粘错位置的凭据
             }
             if (bad.length > 0 && Object.keys(kept).length > 0) {
                 dropped.push(...bad);
@@ -420,7 +465,7 @@ export const WARNING_KINDS = [
 export function projectWarning(w) {
     switch (w.kind) {
         case "hosts-grandfathered":
-            return { kind: w.kind, domain: w.domain, droppedNames: w.droppedNames, ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
+            return { kind: w.kind, domain: w.domain, droppedNames: w.droppedNames, ...(w.droppedTotal === undefined ? {} : { droppedTotal: w.droppedTotal }), ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
         case "domain-defaulted":
             return { kind: w.kind, domain: w.domain };
         // 两臂字段相同但**不合并**:合并后 `kind` 塌成两员的联合,TS 就再也认不出它属于投影联合的哪一员
@@ -597,7 +642,7 @@ function collectDropped(domain, raw, parsed, prefix, depth, spared, acc) {
                 continue; // 扩展命名空间:按契约放的键,不是未知键
             acc.total += 1;
             if (acc.keys.length < DROP_SCAN_MAX_KEYS)
-                acc.keys.push([...prefix, k]);
+                acc.keys.push(outgoingPath([...prefix, k]));
             continue;
         }
         collectDropped(domain, raw[k], parsed[k], [...prefix, k], depth + 1, spared, acc);
@@ -683,7 +728,7 @@ export function carriedUnknownKeys(domain, parsed) {
                 continue;
             acc.total += 1;
             if (acc.keys.length < DROP_SCAN_MAX_KEYS)
-                acc.keys.push([...at, k]);
+                acc.keys.push(outgoingPath([...at, k]));
         }
     }
     return acc;
@@ -767,15 +812,23 @@ export const DOMAIN_READ_FALLBACK = {
  *  observable: a deployment that has not seen that warning across a full read cycle no longer needs the arm. */
 export function grandfatherHostsRead(raw) {
     if (raw === null || typeof raw !== "object" || !Array.isArray(raw.hosts)) {
-        return { raw, droppedNames: [], keptIndex: NO_ENTRIES_DROPPED }; // not the expected shape — let parseDomain rule on it
+        return { raw, droppedNames: [], droppedTotal: 0, keptIndex: NO_ENTRIES_DROPPED }; // not the expected shape — let parseDomain rule on it
     }
     const original = raw.hosts;
     const droppedNames = [];
+    let droppedTotal = 0;
     const keptFrom = [];
     let hosts = original.filter((h, i) => {
         const name = h !== null && typeof h === "object" ? h.name : undefined;
         if (typeof name === "string" && name.length > HOST_NAME_MAX) {
-            droppedNames.push(name.slice(0, HOST_NAME_MAX) + "…"); // audit label — clipped so the warning itself stays bounded
+            droppedTotal += 1;
+            // 先钳后扫(S-813):只给前 DROP_SCAN_MAX_KEYS 个铸标签,其余只计数 —— 出门那一道每个名都要归一化一遍,不能随文档条数放大。
+            if (droppedNames.length >= DROP_SCAN_MAX_KEYS)
+                return false;
+            // 出门前先过同一道(6.3.0,opus 腿 M2):用户写的主机名完全可能就是一条粘错位置的凭据,夹紧只管载荷上界、不管秘密 ——
+            // 此前 `sk-live-…` 形 / 编码 PEM 形以 63 字原文前缀出门。判在夹紧**之前**(截断会把秘密形截成探测器认不出的半截)。
+            const out = outgoingSegment(name);
+            droppedNames.push(out.length > HOST_NAME_MAX ? out.slice(0, HOST_NAME_MAX) + "…" : out); // audit label — clipped so the warning itself stays bounded
             return false;
         }
         keptFrom.push(i); // 夹紧后第 keptFrom.length-1 条 = 原文档第 i 条
@@ -786,11 +839,11 @@ export function grandfatherHostsRead(raw) {
         truncatedFrom = hosts.length;
         hosts = hosts.slice(0, HOSTS_ARRAY_MAX);
     }
-    if (droppedNames.length === 0 && truncatedFrom === undefined)
-        return { raw, droppedNames, keptIndex: NO_ENTRIES_DROPPED }; // identity — byte-stable
+    if (droppedTotal === 0 && truncatedFrom === undefined)
+        return { raw, droppedNames, droppedTotal, keptIndex: NO_ENTRIES_DROPPED }; // identity — byte-stable
     // 位移**只**来自按名剔条目;纯截断留下的是原数组前缀,幸存者下标不动 ⇒ 不登记(见 EntryKeptIndex)。
-    const keptIndex = droppedNames.length > 0 ? { hosts: keptFrom.slice(0, hosts.length) } : NO_ENTRIES_DROPPED;
-    return { raw: { ...raw, hosts }, droppedNames, truncatedFrom, keptIndex };
+    const keptIndex = droppedTotal > 0 ? { hosts: keptFrom.slice(0, hosts.length) } : NO_ENTRIES_DROPPED;
+    return { raw: { ...raw, hosts }, droppedNames, droppedTotal, truncatedFrom, keptIndex };
 }
 export function buildEffective(version, getRaw, updatedAt, onWarning) {
     // 0.19.0 静默剥键/静默承运门:解析**成功**的域,把 schema 丢掉的键、以及 open-world 域里承运但本包
@@ -867,8 +920,9 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
     // hosts: the PRECISE grandfather for the 0.8.0 tightening runs BEFORE parse (0.7-era legal data over the
     // new bounds reads on, clamped + warned); any residual corruption falls to the generic guardrail above.
     const hostsGf = grandfatherHostsRead(getRaw("hosts"));
-    if (hostsGf.droppedNames.length > 0 || hostsGf.truncatedFrom !== undefined) {
-        onWarning?.({ domain: "hosts", kind: "hosts-grandfathered", droppedNames: hostsGf.droppedNames, truncatedFrom: hostsGf.truncatedFrom });
+    if (hostsGf.droppedTotal > 0 || hostsGf.truncatedFrom !== undefined) {
+        const clipped = hostsGf.droppedTotal > hostsGf.droppedNames.length ? { droppedTotal: hostsGf.droppedTotal } : {};
+        onWarning?.({ domain: "hosts", kind: "hosts-grandfathered", droppedNames: hostsGf.droppedNames, ...clipped, truncatedFrom: hostsGf.truncatedFrom });
     }
     return {
         version,

package/dist/cross-session.d.ts

@@ -15,11 +15,11 @@
  *   HELD cross-session message awaits approval」。**注意它有两个消费面**:远端停靠的审批对话框,与
  *   停审的跨会话消息;本模块只声明键形,哪个宿主消费哪一面由宿主自陈。
  *
- * ## `"default"` 这第四个拼写
+ * ## `"default"` 这第五个拼写
  *
- * 设置 UI 的选择器需要一个「不设」的可写值,CC 用字面量 `"default"`。它**不是第四种策略**:读取器
+ * 设置 UI 的选择器需要一个「不设」的可写值,CC 用字面量 `"default"`。它**不是第五种策略**:读取器
  * (`readCrossSessionInbound` / `readDialogExpiry`)把它与 `null`/缺席一同折成 `undefined`。所以
- * `CrossSessionInboundSetting` 的受理面是四拼写,而**值域闭集**(`CROSS_SESSION_INBOUND_VALUES`)只有三个。
+ * `CrossSessionInboundSetting` 的受理面是五拼写,而**值域闭集**(`CROSS_SESSION_INBOUND_VALUES`)只有四个。
  *
  * ## 坏值方向 = 响亮,不静默
  *
@@ -29,8 +29,11 @@
  *
  * ## 与引擎词表的锁步
  *
- * 引擎另有一份同词表(判定纯函数的输入域)。两份**必须逐字相等**;等值由消费方(同时装了本包与引擎
- * 的那一侧)用一格锁步钉住 —— 任一侧加词/改序,那一格先红。本包不 import 引擎(纯度不变量)。
+ * 两张词表与 dialogExpiry 缺省的语义属主是引擎(判定纯函数的输入域;缺省也铸在引擎),本模块的三只常量是
+ * 它们的**登记镜像** —— 保留镜像是因为本包不能运行期依赖引擎,删掉它们两键的 schema 就只剩 `z.string()`。
+ * 两份**必须逐字同序相等**;等值由**本仓自证**:`test/upstream-drift.test.ts` ④ 在 dev 期读引擎的运行期导出,
+ * 登记表恒空(零豁免)、顺序另钉 —— 任一侧加词/改序/改缺省,那一格先红。消费方不再替本仓守这面镜像,只钉
+ * 「自己读的是引擎那份」。本包不 import 引擎(纯度不变量;引擎只在 devDependency)。
  */
 import { z } from "zod";
 /**

package/dist/cross-session.js

@@ -15,11 +15,11 @@
  *   HELD cross-session message awaits approval」。**注意它有两个消费面**:远端停靠的审批对话框,与
  *   停审的跨会话消息;本模块只声明键形,哪个宿主消费哪一面由宿主自陈。
  *
- * ## `"default"` 这第四个拼写
+ * ## `"default"` 这第五个拼写
  *
- * 设置 UI 的选择器需要一个「不设」的可写值,CC 用字面量 `"default"`。它**不是第四种策略**:读取器
+ * 设置 UI 的选择器需要一个「不设」的可写值,CC 用字面量 `"default"`。它**不是第五种策略**:读取器
  * (`readCrossSessionInbound` / `readDialogExpiry`)把它与 `null`/缺席一同折成 `undefined`。所以
- * `CrossSessionInboundSetting` 的受理面是四拼写,而**值域闭集**(`CROSS_SESSION_INBOUND_VALUES`)只有三个。
+ * `CrossSessionInboundSetting` 的受理面是五拼写,而**值域闭集**(`CROSS_SESSION_INBOUND_VALUES`)只有四个。
  *
  * ## 坏值方向 = 响亮,不静默
  *
@@ -29,8 +29,11 @@
  *
  * ## 与引擎词表的锁步
  *
- * 引擎另有一份同词表(判定纯函数的输入域)。两份**必须逐字相等**;等值由消费方(同时装了本包与引擎
- * 的那一侧)用一格锁步钉住 —— 任一侧加词/改序,那一格先红。本包不 import 引擎(纯度不变量)。
+ * 两张词表与 dialogExpiry 缺省的语义属主是引擎(判定纯函数的输入域;缺省也铸在引擎),本模块的三只常量是
+ * 它们的**登记镜像** —— 保留镜像是因为本包不能运行期依赖引擎,删掉它们两键的 schema 就只剩 `z.string()`。
+ * 两份**必须逐字同序相等**;等值由**本仓自证**:`test/upstream-drift.test.ts` ④ 在 dev 期读引擎的运行期导出,
+ * 登记表恒空(零豁免)、顺序另钉 —— 任一侧加词/改序/改缺省,那一格先红。消费方不再替本仓守这面镜像,只钉
+ * 「自己读的是引擎那份」。本包不 import 引擎(纯度不变量;引擎只在 devDependency)。
  */
 import { z } from "zod";
 // ── crossSessionInbound ────────────────────────────────────────────────────────────────────────────

package/dist/fleet.d.ts

@@ -132,8 +132,9 @@ export type ModelPlaneRefusalCode = z.infer<typeof ModelPlaneRefusalCode>;
  *    broken row held, and the sentence is prose, not contract. "Which name, which reason" is the whole wire. A name that
  *    cannot ride out is treated as NAMELESS — the engine leaves it out of this map entirely (not keyed, not counted). The
  *    ONE predicate is `isReportableRefusalName(name)` (main barrel): this schema can carry the key (non-empty; `__proto__`
- *    is silently dropped by the record, so it cannot) AND `isDisclosableIdentity(name)` (not secret-shaped — the rule the
- *    dropped-entry identity on read warnings already uses). A producer calls it before keying; this schema deliberately
+ *    is silently dropped by the record, so it cannot) AND `isDisclosableIdentity(name)` (an identifier in the closed allowlist
+ *    `DISCLOSABLE_IDENTITY_RE` — `A-Z a-z 0-9 . _ : / @ + -`, 1–256 chars — AND not secret-shaped, a URL userinfo included; the
+ *    rule the dropped-entry identity on read warnings already uses, 6.3.0). A producer calls it before keying; this schema deliberately
  *    does not re-judge secrecy (see the 6.2.0 notes).
  *  - `plane` — present ⇔ the model plane of the latest catalog the engine was handed was refused as a group (the engine
  *    keeps serving the model plane it had); ONE code, never a list — one candidate has exactly one group verdict (the

package/dist/fleet.js

@@ -139,8 +139,9 @@ export const ModelPlaneRefusalCode = z.enum(MODEL_PLANE_REFUSAL_CODES);
  *    broken row held, and the sentence is prose, not contract. "Which name, which reason" is the whole wire. A name that
  *    cannot ride out is treated as NAMELESS — the engine leaves it out of this map entirely (not keyed, not counted). The
  *    ONE predicate is `isReportableRefusalName(name)` (main barrel): this schema can carry the key (non-empty; `__proto__`
- *    is silently dropped by the record, so it cannot) AND `isDisclosableIdentity(name)` (not secret-shaped — the rule the
- *    dropped-entry identity on read warnings already uses). A producer calls it before keying; this schema deliberately
+ *    is silently dropped by the record, so it cannot) AND `isDisclosableIdentity(name)` (an identifier in the closed allowlist
+ *    `DISCLOSABLE_IDENTITY_RE` — `A-Z a-z 0-9 . _ : / @ + -`, 1–256 chars — AND not secret-shaped, a URL userinfo included; the
+ *    rule the dropped-entry identity on read warnings already uses, 6.3.0). A producer calls it before keying; this schema deliberately
  *    does not re-judge secrecy (see the 6.2.0 notes).
  *  - `plane` — present ⇔ the model plane of the latest catalog the engine was handed was refused as a group (the engine
  *    keeps serving the model plane it had); ONE code, never a list — one candidate has exactly one group verdict (the

package/dist/secret-scan.d.ts

@@ -0,0 +1,39 @@
+/**
+ * 秘密扫描读的**归一化**,外加「URL 的 userinfo 就是凭据」那一只判定({@link carriesUserinfo})—— 包内私有模块(6.3.0):不进主 barrel、
+ * 不进 `package.json` 的 `exports`,消费方拿不到。
+ * 校验侧探测器 `containsSecretToken`(`./types`)只读 {@link percentLayers};展示侧脱敏器 `redactSecrets`(`./config-fns`)
+ * 读 {@link secretScanForms}。展示侧的读法(边界读法、`+` 读法、「没走完」那一位)刻意不做公开契约:它们以后要随新发现的
+ * 编码形调整,调整不该是契约变更(opus 独立腿 L7)。
+ *
+ * **单遍、零异常**(opus 独立腿 M1,对 6.2.0 的读路径 CPU 回归):6.2.0 起的宽容解码对每个 `%HH` 各 `try decodeURIComponent`,
+ * 非 ASCII 的转义每个都抛一次异常(≈ 20–30 µs / 字节,同步阻塞);6.3.0 首稿又让探测器顺带算它不用的展示形。这里两处解码都
+ * 不靠异常:单个转义的判据写成字符集(只有 ASCII 的 `%00`–`%7F` 单独解得开),转义串的判据写成 UTF-8 良构判定 ——
+ * 结果与原来的 try/catch 逐字相同(`test/disclosable-identity-6.3.0.test.ts` 的两只冻结 oracle 钉着)。
+ *
+ * 本模块零 import(`./types` 引它,它不回引,不成环)。
+ */
+/** How many percent-decoded layers a secret scan reads beyond the raw string (a multi-encoded `%2573%256B…` →
+ *  `%73%6B…` → `sk-…`). Bounded → deterministic. */
+export declare const SECRET_SCAN_DECODE_LAYERS = 3;
+/** The raw string first, then up to {@link SECRET_SCAN_DECODE_LAYERS} tolerant percent-decoded layers, stopping at the first
+ *  layer that decodes nothing — the forms the validation detector `containsSecretToken` reads, and nothing else. */
+export declare function percentLayers(text: string): readonly string[];
+/** What {@link secretScanForms} returns — plain data, no behavior. */
+export interface SecretScanForms {
+    /** {@link percentLayers} of the text. */
+    readonly percentLayers: readonly string[];
+    /** The forms the display-side redactor judges a whole string on: `percentLayers`, each layer's {@link boundaryReading}, and
+     *  each of those read the application/x-www-form-urlencoded way (`+` as a space); duplicates dropped, first seen first. */
+    readonly forms: readonly string[];
+    /** Normalization did not finish: the layer budget ran out while one more layer would still decode something. A caller that
+     *  shows text withholds it whole — what could not be normalized does not go out. (A lone undecodable escape is a fixed
+     *  point, not an unfinished one: `%E4%B8%AD` stays as it is and is not flagged.) */
+    readonly unresolved: boolean;
+}
+/** The display-side normalization — only `redactSecrets` (config-fns) calls it. */
+export declare function secretScanForms(text: string): SecretScanForms;
+/** 「URL 的 userinfo 就是凭据」的**唯一**判定(6.3.0,opus 腿 L1):username / password 任一在场即是。校验侧 `NON_SECRET_URL` 与 https
+ *  插件源据此拒写(`./types`),身份面据此否决(`./config-fns` 的 `isDisclosableIdentity` —— `https://admin:hunter2@db…` /
+ *  `postgres://svc:pw@h` 的字符全在身份白名单里)。串解析不成 URL ⇒ false:这只判定只说「一个 URL 带没带 userinfo」,
+ *  不是 URL 的串不在它的射程里(无 scheme 的 `svc:pw@host` 解析成不透明路径,同样答 false —— 如实登记的边界)。 */
+export declare function carriesUserinfo(u: URL | string): boolean;

package/dist/secret-scan.js

@@ -0,0 +1,110 @@
+/**
+ * 秘密扫描读的**归一化**,外加「URL 的 userinfo 就是凭据」那一只判定({@link carriesUserinfo})—— 包内私有模块(6.3.0):不进主 barrel、
+ * 不进 `package.json` 的 `exports`,消费方拿不到。
+ * 校验侧探测器 `containsSecretToken`(`./types`)只读 {@link percentLayers};展示侧脱敏器 `redactSecrets`(`./config-fns`)
+ * 读 {@link secretScanForms}。展示侧的读法(边界读法、`+` 读法、「没走完」那一位)刻意不做公开契约:它们以后要随新发现的
+ * 编码形调整,调整不该是契约变更(opus 独立腿 L7)。
+ *
+ * **单遍、零异常**(opus 独立腿 M1,对 6.2.0 的读路径 CPU 回归):6.2.0 起的宽容解码对每个 `%HH` 各 `try decodeURIComponent`,
+ * 非 ASCII 的转义每个都抛一次异常(≈ 20–30 µs / 字节,同步阻塞);6.3.0 首稿又让探测器顺带算它不用的展示形。这里两处解码都
+ * 不靠异常:单个转义的判据写成字符集(只有 ASCII 的 `%00`–`%7F` 单独解得开),转义串的判据写成 UTF-8 良构判定 ——
+ * 结果与原来的 try/catch 逐字相同(`test/disclosable-identity-6.3.0.test.ts` 的两只冻结 oracle 钉着)。
+ *
+ * 本模块零 import(`./types` 引它,它不回引,不成环)。
+ */
+/** How many percent-decoded layers a secret scan reads beyond the raw string (a multi-encoded `%2573%256B…` →
+ *  `%73%6B…` → `sk-…`). Bounded → deterministic. */
+export const SECRET_SCAN_DECODE_LAYERS = 3;
+/** One TOLERANT percent-decode layer: an escape decodes on its own iff `decodeURIComponent` would accept it alone — exactly
+ *  the ASCII ones, `%00`–`%7F` — and every other escape (`%C2`, a lone `%E4`, `%ZZ` is not an escape at all) stays as it
+ *  is, so one bad escape elsewhere can't abort the whole decode (R13's all-or-nothing decodeURIComponent did). Same result
+ *  as the per-escape try/catch loop it replaces, with no exception per non-ASCII escape. */
+function percentDecodeLayer(s) {
+    return s.indexOf("%") === -1 ? s : s.replace(/%([0-7][0-9A-Fa-f])/g, (_m, hex) => String.fromCharCode(parseInt(hex, 16)));
+}
+/** The raw string first, then up to {@link SECRET_SCAN_DECODE_LAYERS} tolerant percent-decoded layers, stopping at the first
+ *  layer that decodes nothing — the forms the validation detector `containsSecretToken` reads, and nothing else. */
+export function percentLayers(text) {
+    const layers = [text];
+    let cur = text;
+    for (let i = 0; i < SECRET_SCAN_DECODE_LAYERS; i++) {
+        const next = percentDecodeLayer(cur);
+        if (next === cur)
+            break;
+        layers.push(next);
+        cur = next;
+    }
+    return layers;
+}
+/** Is this byte sequence well-formed UTF-8 (Unicode Table 3-7: no overlongs, no surrogates, nothing above U+10FFFF)? That is
+ *  exactly when `decodeURIComponent` accepts a run of escapes spelling these bytes — decided without throwing. */
+function isWellFormedUtf8(bytes) {
+    for (let i = 0; i < bytes.length;) {
+        const lead = bytes[i];
+        if (lead < 0x80) {
+            i += 1;
+            continue;
+        }
+        // [续字节个数, 第一个续字节的下界, 上界];其余续字节恒为 80..BF。
+        const shape = lead >= 0xc2 && lead <= 0xdf ? [1, 0x80, 0xbf]
+            : lead === 0xe0 ? [2, 0xa0, 0xbf]
+                : (lead >= 0xe1 && lead <= 0xec) || lead === 0xee || lead === 0xef ? [2, 0x80, 0xbf]
+                    : lead === 0xed ? [2, 0x80, 0x9f]
+                        : lead === 0xf0 ? [3, 0x90, 0xbf]
+                            : lead >= 0xf1 && lead <= 0xf3 ? [3, 0x80, 0xbf]
+                                : lead === 0xf4 ? [3, 0x80, 0x8f]
+                                    : undefined;
+        if (shape === undefined)
+            return false;
+        const [need, lo, hi] = shape;
+        for (let k = 1; k <= need; k++) {
+            const c = bytes[i + k];
+            if (c === undefined || c < (k === 1 ? lo : 0x80) || c > (k === 1 ? hi : 0xbf))
+                return false;
+        }
+        i += need + 1;
+    }
+    return true;
+}
+/** The display-side BOUNDARY reading of one layer (codex r2): every run of %HH escapes is decoded as UTF-8 in one go when it
+ *  is well-formed (an encoded NBSP / zero-width space becomes the delimiter it really is); otherwise its ASCII escapes decode
+ *  on their own and every other escape reads as a space — an escape never glues its hex digits onto the token after it
+ *  (`%C2%A0sk-live-…` read escape by escape is `%C2%A0sk-…`, whose tokens are `C2` / `A0sk-…`: the `sk-` boundary is gone,
+ *  though any standard decoder restores it). Display-only: the validation detector never reads it. */
+function boundaryReading(s) {
+    if (s.indexOf("%") === -1)
+        return s;
+    return s.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
+        const bytes = [];
+        for (let i = 0; i < run.length; i += 3)
+            bytes.push(parseInt(run.slice(i + 1, i + 3), 16));
+        return isWellFormedUtf8(bytes) ? decodeURIComponent(run) : bytes.map((b) => (b < 0x80 ? String.fromCharCode(b) : " ")).join("");
+    });
+}
+/** The display-side normalization — only `redactSecrets` (config-fns) calls it. */
+export function secretScanForms(text) {
+    const layers = percentLayers(text);
+    const last = layers[layers.length - 1];
+    const unresolved = layers.length === SECRET_SCAN_DECODE_LAYERS + 1 && percentDecodeLayer(last) !== last;
+    const readings = [...layers, ...layers.map((layer) => boundaryReading(layer))];
+    const forms = [...new Set([...readings, ...readings.map((reading) => (reading.indexOf("+") === -1 ? reading : reading.replace(/\+/g, " ")))])];
+    return { percentLayers: layers, forms, unresolved };
+}
+/** 「URL 的 userinfo 就是凭据」的**唯一**判定(6.3.0,opus 腿 L1):username / password 任一在场即是。校验侧 `NON_SECRET_URL` 与 https
+ *  插件源据此拒写(`./types`),身份面据此否决(`./config-fns` 的 `isDisclosableIdentity` —— `https://admin:hunter2@db…` /
+ *  `postgres://svc:pw@h` 的字符全在身份白名单里)。串解析不成 URL ⇒ false:这只判定只说「一个 URL 带没带 userinfo」,
+ *  不是 URL 的串不在它的射程里(无 scheme 的 `svc:pw@host` 解析成不透明路径,同样答 false —— 如实登记的边界)。 */
+export function carriesUserinfo(u) {
+    let url;
+    if (typeof u === "string") {
+        try {
+            url = new URL(u);
+        }
+        catch {
+            return false; // 不是 URL:不在这只判定的射程里(见头注),不是回退
+        }
+    }
+    else
+        url = u;
+    return url.username !== "" || url.password !== "";
+}

package/dist/types.d.ts

@@ -18,9 +18,10 @@
 import { z } from "zod";
 /** A private-key PEM header (`-----BEGIN [RSA |EC |OPENSSH |ENCRYPTED ]PRIVATE KEY`), unanchored — the ONE definition
  *  of that shape: {@link SECRET_LITERAL_RE} is composed from it (anchored, as one of its branches), and
- *  `redactSecrets` (config-fns) tests it ANYWHERE in a string. It carries spaces, so the token-splitting detector
- *  {@link containsSecretToken} only sees it at the very start of a string; a PEM behind a newline or a `key: ` prefix
- *  slipped past (S-712 codex review [high]). Public keys / certificates never match (see above). */
+ *  `redactSecrets` (config-fns) tests it ANYWHERE in a string, on every display-side normalized form. It carries spaces,
+ *  so the token-splitting detector {@link containsSecretToken} only sees it at the very start of a string; a PEM behind
+ *  a newline or a `key: ` prefix slipped past (S-712 codex review [high]), and a `key=`-prefixed percent-encoded one
+ *  hid it behind `%20` on the raw form, a form-urlencoded one behind `+` (6.3.0). Public keys / certificates never match. */
 export declare const PRIVATE_KEY_PEM_HEADER: RegExp;
 export declare const SECRET_LITERAL_RE: RegExp;
 export declare const ENV_NAME: z.ZodEffects<z.ZodString, string, string>;
@@ -29,9 +30,15 @@ export declare const ENV_NAME: z.ZodEffects<z.ZodString, string, string>;
  *  fs path — so the worker dies at exec/boot, not at config edit. A NUL is never legitimate in a command / path
  *  / host / image, so reject it on every exec-bound string field (mcp stdio + the whole remoteExec contract). R20. */
 export declare const hasNul: (s: string) => boolean;
-/** Does `s` contain a secret-shaped token? Scans the raw string AND a percent-decoded form (a secret can hide
- *  as `%73%6B-…`) — so mcp args / dockerHost / URL components all get uniform percent-decode coverage. Tokenized
- *  + JWT-aware (see scanForSecret). Shared by NON_SECRET_URL + dockerHost + mcp stdio. Round-4/5/11. */
+/** Does `s` contain a secret-shaped token? Scans every percent layer of it — the raw string AND up to three tolerant
+ *  percent-decoded layers (a secret can hide as `%73%6B-…`; the ONE definition of those layers is `percentLayers` in the
+ *  package-private `./secret-scan`) — so mcp args / dockerHost / URL components all get uniform percent-decode coverage.
+ *  Tokenized + JWT-aware (see scanForSecret). Shared by NON_SECRET_URL + dockerHost + mcp stdio. Round-4/5/11. (6.3.0 moved
+ *  the decode loop out, unchanged in result — same layers, same bound, same verdict — and made it exception-free; the
+ *  display-side readings the redactor also judges are not this detector's.) We do NOT fail-closed on a bare `%` — that
+ *  would false-reject legit values like `100%` / `%s`. A secret glued to a malformed escape (`%ZZsk-`) is an accepted
+ *  coarse-heuristic gap (no consumer reconstructs it; the real guarantee is the env-NAME boundary on structured fields).
+ *  R11/R13/R14. */
 export declare function containsSecretToken(s: string): boolean;
 /** Scan a URL's PATH + query + fragment (KEYS and values, decoded, tokenized) for a secret-shaped literal.
  *  Userinfo is handled separately (NON_SECRET_URL bans it; dockerHost scans the ssh user). Round-4/5. */

package/dist/types.js

@@ -18,6 +18,7 @@
 import { z } from "zod";
 import { MAX_EXTRA_BODY_DEPTH } from "./hash.js"; // reconcile the extraBody depth cap with the hash cap (R18)
 import { DispatchPolicy } from "./fleet.js"; // WorkerSpec.fleet.dispatch (scheduling framework D3)
+import { carriesUserinfo, percentLayers } from "./secret-scan.js"; // package-private normalization + the userinfo judgement (not in the barrel)
 // COARSE, best-effort literal-secret SHAPE detector (NOT exhaustive — the real boundary is the env-NAME schema
 // on structured fields). Rejected in free-form value fields (worker `env`, model `extraBody`), URL components,
 // AND as an env-NAME value (an AWS key id is a valid env-NAME charset yet is a secret VALUE, not a NAME). Case-
@@ -28,9 +29,10 @@ import { DispatchPolicy } from "./fleet.js"; // WorkerSpec.fleet.dispatch (sched
 // which review flagged as a bypass (a private key misnamed `*_PUBKEY` skipped scanning entirely).
 /** A private-key PEM header (`-----BEGIN [RSA |EC |OPENSSH |ENCRYPTED ]PRIVATE KEY`), unanchored — the ONE definition
  *  of that shape: {@link SECRET_LITERAL_RE} is composed from it (anchored, as one of its branches), and
- *  `redactSecrets` (config-fns) tests it ANYWHERE in a string. It carries spaces, so the token-splitting detector
- *  {@link containsSecretToken} only sees it at the very start of a string; a PEM behind a newline or a `key: ` prefix
- *  slipped past (S-712 codex review [high]). Public keys / certificates never match (see above). */
+ *  `redactSecrets` (config-fns) tests it ANYWHERE in a string, on every display-side normalized form. It carries spaces,
+ *  so the token-splitting detector {@link containsSecretToken} only sees it at the very start of a string; a PEM behind
+ *  a newline or a `key: ` prefix slipped past (S-712 codex review [high]), and a `key=`-prefixed percent-encoded one
+ *  hid it behind `%20` on the raw form, a form-urlencoded one behind `+` (6.3.0). Public keys / certificates never match. */
 export const PRIVATE_KEY_PEM_HEADER = /-----BEGIN[A-Z0-9 ]*PRIVATE KEY/i;
 export const SECRET_LITERAL_RE = new RegExp(`^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\\s|basic\\s|eyJ[A-Za-z0-9_-]{10,}\\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|${PRIVATE_KEY_PEM_HEADER.source})`, "i");
 // 所有 *Env / *tokenEnv 字段的值是宿主机 env 变量的 NAME（不是值）。合法 env 变量名 + 拒绝 secret 形状的值（AKIA…
@@ -71,33 +73,17 @@ function scanForSecret(s) {
  *  fs path — so the worker dies at exec/boot, not at config edit. A NUL is never legitimate in a command / path
  *  / host / image, so reject it on every exec-bound string field (mcp stdio + the whole remoteExec contract). R20. */
 export const hasNul = (s) => s.includes("\0");
-/** Does `s` contain a secret-shaped token? Scans the raw string AND a percent-decoded form (a secret can hide
- *  as `%73%6B-…`) — so mcp args / dockerHost / URL components all get uniform percent-decode coverage. Tokenized
- *  + JWT-aware (see scanForSecret). Shared by NON_SECRET_URL + dockerHost + mcp stdio. Round-4/5/11. */
+/** Does `s` contain a secret-shaped token? Scans every percent layer of it — the raw string AND up to three tolerant
+ *  percent-decoded layers (a secret can hide as `%73%6B-…`; the ONE definition of those layers is `percentLayers` in the
+ *  package-private `./secret-scan`) — so mcp args / dockerHost / URL components all get uniform percent-decode coverage.
+ *  Tokenized + JWT-aware (see scanForSecret). Shared by NON_SECRET_URL + dockerHost + mcp stdio. Round-4/5/11. (6.3.0 moved
+ *  the decode loop out, unchanged in result — same layers, same bound, same verdict — and made it exception-free; the
+ *  display-side readings the redactor also judges are not this detector's.) We do NOT fail-closed on a bare `%` — that
+ *  would false-reject legit values like `100%` / `%s`. A secret glued to a malformed escape (`%ZZsk-`) is an accepted
+ *  coarse-heuristic gap (no consumer reconstructs it; the real guarantee is the env-NAME boundary on structured fields).
+ *  R11/R13/R14. */
 export function containsSecretToken(s) {
-    // scan the raw string AND up to 3 percent-decoded layers (handles a multi-encoded `%2573%256B…` → `%73%6B…`
-    // → `sk-…`). TOLERANT decode: each valid %HH is decoded, a malformed escape (`%ZZ`, `%` at end) is left as-is
-    // so one bad escape elsewhere can't abort the whole decode (R13's all-or-nothing decodeURIComponent did). We
-    // do NOT fail-closed on a bare `%` — that would false-reject legit values like `100%` / `%s`. A secret glued
-    // to a malformed escape (`%ZZsk-`) is an accepted coarse-heuristic gap (no consumer reconstructs it; the real
-    // guarantee is the env-NAME boundary on structured fields). Bounded → deterministic. R11/R13/R14. */
-    let cur = s;
-    for (let i = 0; i < 4; i++) {
-        if (scanForSecret(cur))
-            return true;
-        const next = cur.replace(/%[0-9A-Fa-f]{2}/g, (m) => {
-            try {
-                return decodeURIComponent(m);
-            }
-            catch {
-                return m;
-            }
-        });
-        if (next === cur)
-            break;
-        cur = next;
-    }
-    return false;
+    return percentLayers(s).some((form) => scanForSecret(form));
 }
 /** Scan a URL's PATH + query + fragment (KEYS and values, decoded, tokenized) for a secret-shaped literal.
  *  Userinfo is handled separately (NON_SECRET_URL bans it; dockerHost scans the ssh user). Round-4/5. */
@@ -141,7 +127,7 @@ export const NON_SECRET_URL = z
     .refine((s) => {
     try {
         const u = new URL(s);
-        if (!(u.protocol === "http:" || u.protocol === "https:") || !u.host || u.username || u.password)
+        if (!(u.protocol === "http:" || u.protocol === "https:") || !u.host || carriesUserinfo(u))
             return false;
         return !urlQueryFragmentHasSecret(u);
     }
@@ -2053,7 +2039,7 @@ export const PLUGIN_ORIGIN = z
         return true; // 已被上一条拒;避免对非 URL 再报一条噪声
     try {
         const u = new URL(s);
-        return !u.username && !u.password && !urlQueryFragmentHasSecret(u);
+        return !carriesUserinfo(u) && !urlQueryFragmentHasSecret(u);
     }
     catch {
         return false; // claims to be https but does not parse → reject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",