oasis_test 0.1.87 → 0.1.90

package/dist/index.js

@@ -2488,6 +2488,24 @@ var init_registry = __esm({
   }
 });
 
+// ../contract/src/credential-ref.ts
+function makeVarRef(key) {
+  return `${VAR_REF_PREFIX}${key}`;
+}
+function parseVarRef(s2) {
+  if (!s2.startsWith(VAR_REF_PREFIX)) return null;
+  const key = s2.slice(VAR_REF_PREFIX.length);
+  if (key.length === 0 || /[\s/]/.test(key)) return null;
+  return key;
+}
+var VAR_REF_PREFIX;
+var init_credential_ref = __esm({
+  "../contract/src/credential-ref.ts"() {
+    "use strict";
+    VAR_REF_PREFIX = "oasis://var/";
+  }
+});
+
 // ../contract/src/views.ts
 var init_views = __esm({
   "../contract/src/views.ts"() {
@@ -2565,6 +2583,7 @@ var init_src = __esm({
     init_runtime();
     init_daemon_protocol();
     init_registry();
+    init_credential_ref();
     init_views();
     init_telemetry();
     init_trace();
@@ -5982,6 +6001,13 @@ var init_dispatcher = __esm({
        * 是否相对本会话推进过**（上游产新版才动 pin，天然排除驳回/人类改单）。运行时态、不进 oplog/重放，
        * 与 inFlight 同生同灭。 */
       inFlightPins = /* @__PURE__ */ new Map();
+      /**
+       * 本次会话的凭据清理器，与 inFlight 同生同灭。
+       * **必须在「只有槽位主人才能解锁」那个守卫里调**（见 handleSessionExit）——
+       * 无差别调用 = 拿僵尸会话的死讯删掉**活会话正在用的** creds 文件，
+       * 那比不清理更糟：活着的 agent 下一次 `gh` 就炸，且现场看起来像凭据凭空消失。
+       */
+      inFlightCleanup = /* @__PURE__ */ new Map();
       /** ADR-0094：本会话已确认不支持原生 append（codex/subprocess 远端报 unsupported，或会话在收尾）——
        *  停投，回落"等会话退出 + fresh 重派"。与 inFlight 同生同灭。 */
       appendSkip = /* @__PURE__ */ new Set();
@@ -6887,7 +6913,7 @@ var init_dispatcher = __esm({
         this.assertSpawnAttemptCurrent(jobKey, attempt);
         const tokenFor = this.opts.tokenFor ?? ((a, _ctx) => `token:${a}`);
         const actorToken = tokenFor(dispatchSpec.actor, credentialCtx);
-        const provisioned = this.opts.provision ? await this.opts.provision(dispatchSpec.actor) : void 0;
+        const provisioned = this.opts.provision ? await this.opts.provision(dispatchSpec.actor, spec.artifactId) : void 0;
         this.assertSpawnAttemptCurrent(jobKey, attempt);
         const jobEnv = {
           ...provisioned?.env ?? {},
@@ -6915,6 +6941,8 @@ var init_dispatcher = __esm({
           ...Object.keys(jobEnv).length > 0 ? { env: jobEnv } : {},
           ...provisioned?.wrapperPaths && provisioned.wrapperPaths.length > 0 ? { wrapperPaths: provisioned.wrapperPaths } : {},
           ...provisioned?.requiredTools && provisioned.requiredTools.length > 0 ? { requiredTools: provisioned.requiredTools } : {},
+          // 凭据本体随 job 下发，供**节点侧本机注入**（见上方 provision 注释）。
+          ...provisioned?.connectorCreds && provisioned.connectorCreds.length > 0 ? { connectorCreds: provisioned.connectorCreds } : {},
           // ADR-0078 D1/D3：把本次派发的 id 交给 adapter 当 handle.id——于是
           // `handle.id` = `agent_runs.id` = token 的 dispatchId claim，三处同值。
           dispatchId: attempt
@@ -6946,6 +6974,7 @@ var init_dispatcher = __esm({
         }
         this.inFlight.set(jobKey, session);
         this.inFlightActor.set(jobKey, dispatchSpec.actor);
+        if (provisioned?.cleanup) this.inFlightCleanup.set(jobKey, provisioned.cleanup);
         const dispatchedAtMs = Date.now();
         this.inFlightStartedAt.set(jobKey, dispatchedAtMs);
         const seqAtDispatch = seqNow;
@@ -7040,6 +7069,12 @@ var init_dispatcher = __esm({
           this.inFlightStartedAt.delete(jobKey);
           this.inFlightPins.delete(jobKey);
           this.appendSkip.delete(jobKey);
+          const cleanup = this.inFlightCleanup.get(jobKey);
+          if (cleanup) {
+            this.inFlightCleanup.delete(jobKey);
+            void cleanup().catch(() => {
+            });
+          }
         }
         const seqAtExit = kernel.model.lastSeq.get(spec.artifactId) ?? 0;
         const exitSessionKey = this.produceSessionKeyFor(spec);
@@ -23533,8 +23568,8 @@ var require_axios = __commonJS({
     axios.toFormData = toFormData;
     axios.AxiosError = AxiosError$1;
     axios.Cancel = axios.CanceledError;
-    axios.all = function all(promises) {
-      return Promise.all(promises);
+    axios.all = function all(promises2) {
+      return Promise.all(promises2);
     };
     axios.spread = spread;
     axios.isAxiosError = isAxiosError;
@@ -124780,8 +124815,8 @@ function getElementAtPath(obj, path30) {
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
-  const promises = keys.map((key) => promisesObj[key]);
-  return Promise.all(promises).then((results) => {
+  const promises2 = keys.map((key) => promisesObj[key]);
+  return Promise.all(promises2).then((results) => {
     const resolvedObj = {};
     for (let i = 0; i < keys.length; i++) {
       resolvedObj[keys[i]] = results[i];
@@ -140760,8 +140795,8 @@ var init_install = __esm({
 function shSingleQuote(v2) {
   return `'${v2.replace(/'/g, `'\\''`)}'`;
 }
-async function writeSessionCredsFile(slug6, exports2) {
-  const dir = await (0, import_promises.mkdtemp)((0, import_node_path5.join)((0, import_node_os3.tmpdir)(), `oasis-${slug6}-`));
+async function writeSessionCredsFile(slug6, exports2, reuseDir) {
+  const dir = reuseDir ?? await (0, import_promises.mkdtemp)((0, import_node_path5.join)((0, import_node_os3.tmpdir)(), `oasis-${slug6}-`));
   const file = (0, import_node_path5.join)(dir, "creds.env");
   const body = Object.entries(exports2).map(([k2, v2]) => `export ${k2}=${shSingleQuote(v2)}`).join("\n");
   await (0, import_promises.writeFile)(file, body + "\n", { mode: 384 });
@@ -140787,7 +140822,7 @@ async function refreshCredentialsIfNeeded(connector, credentials, opts = {}) {
     return { status: "unsupported", detail: `${connector.config.slug}: \u51ED\u636E\u4E0D\u8FC7\u671F\uFF0C\u65E0\u9700\u7EED\u671F` };
   }
   const nowMs = opts.nowMs ?? Date.now();
-  const skewMs = opts.skewMs ?? CREDENTIAL_REFRESH_SKEW_MS;
+  const skewMs = opts.skewMs ?? connector.minRemainingLifetimeMs ?? CREDENTIAL_REFRESH_SKEW_MS;
   const expiresAt = readEpochMs(credentials, connector.expiresAtCredentialKey);
   if (!isExpiringSoon(expiresAt, nowMs, skewMs)) {
     return { status: "fresh" };
@@ -141072,6 +141107,8 @@ var init_feishu = __esm({
         "FEISHU_REFRESH_TOKEN_EXPIRES_AT",
         "FEISHU_USER_OPEN_ID"
       ];
+      /** 宿主机登录态隔离，理由同 github（见接口注释）：由通用装配层无条件设。 */
+      hostCredentialIsolationEnvKeys = ["LARKSUITE_CLI_CONFIG_DIR"];
       /** inject() 写进 sessionEnv 的全部键——通用 cleanup() 按它逐个删。 */
       injectedEnvKeys = [
         "LARK_BIN",
@@ -141140,7 +141177,7 @@ var init_feishu = __esm({
           LARKSUITE_CLI_APP_ID: appId,
           LARKSUITE_CLI_APP_SECRET: appSecret,
           ...userAccessToken ? { LARKSUITE_CLI_USER_ACCESS_TOKEN: userAccessToken } : {}
-        });
+        }, sessionEnv.get("FEISHU_RUN_TMPDIR"));
         const configDir = (0, import_node_path6.join)(creds.dir, "lark-config");
         await (0, import_promises3.mkdir)(configDir, { recursive: true, mode: 448 });
         sessionEnv.set("LARK_BIN", await this.resolveAbsoluteLarkBin());
@@ -141633,10 +141670,17 @@ async function exchangeManifestCode(code, deps = {}) {
   const appId = body["id"] === void 0 ? "" : String(body["id"]);
   const privateKeyPem = typeof body["pem"] === "string" ? body["pem"] : "";
   if (!appId || !privateKeyPem) throw new Error("github app: id/pem missing in conversion response");
+  const owner = body["owner"];
+  const rawPerms = body["permissions"];
+  const permissions = {};
+  for (const [k2, v2] of Object.entries(rawPerms ?? {})) if (typeof v2 === "string") permissions[k2] = v2;
   return {
     appId,
     privateKeyPem,
     slug: typeof body["slug"] === "string" ? body["slug"] : "",
+    ownerLogin: typeof owner?.["login"] === "string" ? owner["login"] : "",
+    ownerType: typeof owner?.["type"] === "string" ? owner["type"] : "",
+    permissions,
     ...typeof body["webhook_secret"] === "string" ? { webhookSecret: body["webhook_secret"] } : {}
   };
 }
@@ -141720,6 +141764,18 @@ var init_github = __esm({
         { key: "access_token", from: "GITHUB_APP_TOKEN", required: false },
         { key: "app_token_expires_at", from: "GITHUB_APP_TOKEN_EXPIRES_AT", required: false }
       ];
+      /**
+       * installation token 满寿命就是 1 小时；声明成全寿命 ⇒ **每次注入都铸新的**。
+       *
+       * 代价可接受：铸 token 是纯换取（私钥 + installation_id 推出来的），
+       * **旧 token 不会被新的作废**（GitHub 要显式 `DELETE /installation/token` 才失效），
+       * 所以多铸一次既不打断在跑的会话、也不消耗任何一次性材料。
+       *
+       * 换来的是：一场会话开头拿到的 token 一定是满 60 分钟，而不是「上一场剩下的 6 分钟」。
+       * ⚠ 仍挡不住跑超过 60 分钟的会话——会话硬顶是 120 分钟（`SESSION_WALL_CLOCK_MS`），
+       * 那半截要靠会话内续期，本字段管不到。
+       */
+      minRemainingLifetimeMs = 60 * 6e4;
       /** 过期判定只认这个键——必须与注入时消费的 token 同源（契约测试盯着）。 */
       expiresAtCredentialKey = "app_token_expires_at";
       // 私钥不会过期，故不声明 refreshMaterialExpiresAtCredentialKey，也无需 clearOnExpired。
@@ -141729,6 +141785,12 @@ var init_github = __esm({
         "GITHUB_APP_TOKEN",
         "GITHUB_APP_PRIVATE_KEY"
       ];
+      /**
+       * 宿主机登录态隔离：`gh` 只认 env 里的 GH_TOKEN 或 `~/.config/gh/hosts.yml`。
+       * 这个键**由通用装配层无条件设**（哪怕本连接器没接通），否则关掉连接器时
+       * agent 会静默用成宿主机那个真人账号——见接口里的详细说明。
+       */
+      hostCredentialIsolationEnvKeys = ["GH_CONFIG_DIR"];
       /** inject() 写进 sessionEnv 的全部键——通用 cleanup() 按它逐个删。 */
       injectedEnvKeys = [
         "GH_BIN",
@@ -141819,7 +141881,7 @@ var init_github = __esm({
         const creds = await writeSessionCredsFile(this.config.slug, {
           GH_TOKEN: token,
           GITHUB_TOKEN: token
-        });
+        }, sessionEnv.get("GH_RUN_TMPDIR"));
         const configDir = (0, import_node_path7.join)(creds.dir, "gh-config");
         await (0, import_promises4.mkdir)(configDir, { recursive: true, mode: 448 });
         sessionEnv.set("GH_BIN", await this.resolveRealBin("gh"));
@@ -141872,7 +141934,27 @@ function callbackHtml(ok, message) {
 setTimeout(function(){window.close()},${ok ? 800 : 4e3})</script>
 </body>`;
 }
-var GITHUB_APP_DEFAULT_PERMISSIONS, GITHUB_APP_PERMISSION_LABELS, PENDING_TTL_MS, PendingAppCreations;
+function checkAppOwnership(conv, want) {
+  if (want.ownerKind === "org" && want.ownerLogin) {
+    const got = conv.ownerLogin;
+    if (!got) {
+      return { message: "GitHub \u6CA1\u8FD4\u56DE App \u7684\u5F52\u5C5E\u8D26\u53F7\uFF0C\u65E0\u6CD5\u786E\u8BA4\u5EFA\u5BF9\u4E86\u5730\u65B9\u2014\u2014\u8BF7\u5220\u6389\u8FD9\u4E2A App \u91CD\u8BD5\u3002" };
+    }
+    if (got.toLowerCase() !== want.ownerLogin.toLowerCase()) {
+      return {
+        message: `\u4F60\u9009\u7684\u662F\u7EC4\u7EC7 ${want.ownerLogin}\uFF0C\u4F46\u8FD9\u4E2A App \u5EFA\u5728\u4E86 ${got}\uFF08${conv.ownerType || "\u672A\u77E5\u7C7B\u578B"}\uFF09\u540D\u4E0B\u3002\u79C1\u6709 App \u53EA\u80FD\u88C5\u5728\u62E5\u6709\u5B83\u7684\u8D26\u53F7\u4E0A\uFF0C\u6240\u4EE5\u5B83\u6C38\u8FDC\u8BBF\u95EE\u4E0D\u5230 ${want.ownerLogin} \u7684\u4ED3\u5E93\u2014\u2014\u8865\u88C5\u4E5F\u6CA1\u7528\u3002\u8BF7\u53BB GitHub \u5220\u6389 ${got} \u540D\u4E0B\u8FD9\u4E2A App\uFF0C\u7136\u540E\u91CD\u65B0\u8FDE\u63A5\uFF0C\u5728\u521B\u5EFA\u9875\u786E\u8BA4\u5730\u5740\u662F github.com/organizations/${want.ownerLogin}/settings/apps/new\u3002`
+      };
+    }
+  }
+  const missing = REQUIRED_WRITE_PERMISSIONS.filter((k2) => conv.permissions[k2] !== "write");
+  if (missing.length > 0) {
+    return {
+      message: `\u8FD9\u4E2A App \u7F3A\u5C11\u5FC5\u8981\u7684\u5199\u6743\u9650\uFF1A${missing.join(" / ")}\uFF08\u9700\u8981 write\uFF09\u3002agent \u5C06\u65E0\u6CD5\u63A8\u9001\u5206\u652F\u6216\u5F00 PR\u3002\u8BF7\u5728 App \u8BBE\u7F6E\u9875\u8865\u4E0A\u6743\u9650\u540E\u91CD\u65B0\u8FDE\u63A5\u3002`
+    };
+  }
+  return null;
+}
+var GITHUB_APP_DEFAULT_PERMISSIONS, GITHUB_APP_PERMISSION_LABELS, PENDING_TTL_MS, PendingAppCreations, REQUIRED_WRITE_PERMISSIONS;
 var init_app_manifest = __esm({
   "../connectors/src/github/app-manifest.ts"() {
     "use strict";
@@ -141915,6 +141997,7 @@ var init_app_manifest = __esm({
         return this.map.size;
       }
     };
+    REQUIRED_WRITE_PERMISSIONS = ["contents", "pull_requests"];
   }
 });
 
@@ -141971,19 +142054,27 @@ function collectCredentials(connector, ctx) {
   }
   return creds;
 }
+function collectAllConnectorCredentials(ctx) {
+  return createAllConnectors().flatMap((connector) => {
+    const credentials = collectCredentials(connector, ctx);
+    return credentials ? [{ slug: connector.config.slug, credentials }] : [];
+  });
+}
 async function buildConnectorProvision(ctx) {
   const envOverrides = {};
   const wrapperPaths = [];
   const requiredTools = /* @__PURE__ */ new Set();
-  const connectorCreds = [];
   const cleanups = [];
   const sensitiveVars = /* @__PURE__ */ new Set();
+  const isolationKeys = /* @__PURE__ */ new Set();
+  const connectorCreds = collectAllConnectorCredentials(ctx);
+  const credentialsBySlug = new Map(connectorCreds.map((c) => [c.slug, c.credentials]));
   for (const connector of createAllConnectors()) {
     for (const v2 of connector.sensitiveVars) sensitiveVars.add(v2);
-    const credentials = collectCredentials(connector, ctx);
-    if (credentials === null) continue;
+    for (const k2 of connector.hostCredentialIsolationEnvKeys ?? []) isolationKeys.add(k2);
+    const credentials = credentialsBySlug.get(connector.config.slug);
+    if (credentials === void 0) continue;
     try {
-      connectorCreds.push({ slug: connector.config.slug, credentials });
       const sessionEnv = /* @__PURE__ */ new Map();
       await connector.inject(credentials, sessionEnv);
       for (const [k2, v2] of sessionEnv) envOverrides[k2] = v2;
@@ -141999,6 +142090,19 @@ async function buildConnectorProvision(ctx) {
       log("[provision]", `${connector.config.slug}: \u88C5\u914D\u5931\u8D25\uFF08\u8BE5\u8FDE\u63A5\u5668\u672C\u8F6E\u4E0D\u53EF\u7528\uFF09: ${String(err)}`);
     }
   }
+  const isolationRoot = await (0, import_promises5.mkdtemp)((0, import_node_path8.join)((0, import_node_os4.tmpdir)(), "oasis-isolate-"));
+  let isolationUsed = false;
+  for (const key of isolationKeys) {
+    if (envOverrides[key]) continue;
+    const dir = (0, import_node_path8.join)(isolationRoot, key.toLowerCase());
+    await (0, import_promises5.mkdir)(dir, { recursive: true, mode: 448 });
+    envOverrides[key] = dir;
+    isolationUsed = true;
+  }
+  if (!isolationUsed) await (0, import_promises5.rm)(isolationRoot, { recursive: true, force: true });
+  else cleanups.push(async () => {
+    await (0, import_promises5.rm)(isolationRoot, { recursive: true, force: true });
+  });
   const cleanup = async () => {
     for (const fn of cleanups) await fn().catch(() => {
     });
@@ -142012,23 +142116,28 @@ async function buildConnectorProvision(ctx) {
     cleanup
   };
 }
+var import_promises5, import_node_os4, import_node_path8;
 var init_provision = __esm({
   "../connectors/src/provision.ts"() {
     "use strict";
     init_base();
     init_registry2();
     init_logger();
+    import_promises5 = require("node:fs/promises");
+    import_node_os4 = require("node:os");
+    import_node_path8 = require("node:path");
   }
 });
 
 // ../connectors/src/prepare-job.ts
-async function prepareConnectorsForJob(job) {
+async function prepareConnectorsForJob(job, deps) {
   const creds = job.connectorCreds ?? [];
   const remoteWrappers = job.wrapperPaths ?? [];
   const localWrappers = [];
   const cleanups = [];
   const envOverrides = {};
   const statuses = [];
+  const injected = /* @__PURE__ */ new Map();
   for (const { slug: slug6, credentials } of creds) {
     const connector = createConnectorBySlug(slug6);
     if (!connector) {
@@ -142043,6 +142152,7 @@ async function prepareConnectorsForJob(job) {
       await connector.inject(credentials, sessionEnv);
       for (const [k2, v2] of sessionEnv) envOverrides[k2] = v2;
       cleanups.push(() => connector.cleanup(sessionEnv));
+      injected.set(slug6, { connector, sessionEnv });
       status.credsReady = true;
     } catch (err) {
       status.error = String(err);
@@ -142066,30 +142176,117 @@ async function prepareConnectorsForJob(job) {
   }
   const keptLocal = localWrappers.filter((p2) => isStagedWrapperUsable(p2));
   const keptRemote = remoteWrappers.filter((p2) => (0, import_node_fs5.existsSync)(p2));
-  const dropped = remoteWrappers.length - keptRemote.length + (localWrappers.length - keptLocal.length);
-  if (dropped > 0) log("[node-connectors]", `\u4E22\u5F03 ${dropped} \u6761\u672C\u673A\u4E0D\u53EF\u7528\u7684 wrapper \u8DEF\u5F84`);
+  const droppedWrappers = remoteWrappers.length - keptRemote.length + (localWrappers.length - keptLocal.length);
+  if (droppedWrappers > 0) log("[node-connectors]", `\u4E22\u5F03 ${droppedWrappers} \u6761\u672C\u673A\u4E0D\u53EF\u7528\u7684 wrapper \u8DEF\u5F84`);
+  const staleKeys = /* @__PURE__ */ new Set();
+  const isolationKeys = /* @__PURE__ */ new Set();
+  for (const connector of createAllConnectors()) {
+    if (injected.has(connector.config.slug)) continue;
+    const isolation = new Set(connector.hostCredentialIsolationEnvKeys ?? []);
+    for (const key of connector.injectedEnvKeys) {
+      if (isolation.has(key)) isolationKeys.add(key);
+      else staleKeys.add(key);
+    }
+  }
   const basePath = job.env?.["PATH"] ?? process.env["PATH"] ?? "";
   const toolsBin = connectorToolsBinDir();
   const pathWithTools = basePath.split(":").includes(toolsBin) ? basePath : [toolsBin, basePath].filter(Boolean).join(":");
+  const jobEnv = { ...job.env ?? {}, ...envOverrides, PATH: pathWithTools };
+  let dropped = 0;
+  for (const key of staleKeys) {
+    if (jobEnv[key] === void 0) continue;
+    delete jobEnv[key];
+    dropped++;
+  }
+  if (isolationKeys.size > 0) {
+    const isolationRoot = await (0, import_promises6.mkdtemp)((0, import_node_path9.join)((0, import_node_os5.tmpdir)(), "oasis-node-isolate-"));
+    for (const key of isolationKeys) {
+      const dir = (0, import_node_path9.join)(isolationRoot, key.toLowerCase());
+      await (0, import_promises6.mkdir)(dir, { recursive: true, mode: 448 });
+      jobEnv[key] = dir;
+    }
+    cleanups.push(async () => {
+      await (0, import_promises6.rm)(isolationRoot, { recursive: true, force: true });
+    });
+  }
+  if (dropped > 0) {
+    log(
+      "[node-connectors]",
+      `\u26A0 \u6E05\u6389 ${dropped} \u4E2A\u6307\u5411\u522B\u7684\u673A\u5668\u7684\u8FDE\u63A5\u5668 env \u952E\uFF08server \u53D1\u4E86\u6307\u9488\u4F46\u6CA1\u53D1\u51ED\u636E\uFF09\u2014\u2014\u672C\u8F6E\u8FD9\u4E9B\u8FDE\u63A5\u5668**\u4E0D\u53EF\u7528**\uFF0Cagent \u5E94\u636E\u6B64\u5224\u5B9A\u300C\u6CA1\u6709\u8BE5\u80FD\u529B\u300D\uFF0C\u800C\u4E0D\u662F\u4EE5\u4E3A\u914D\u597D\u4E86\u3002`
+    );
+  }
   const preparedJob = {
     ...job,
-    env: { ...job.env ?? {}, ...envOverrides, PATH: pathWithTools },
+    env: jobEnv,
     wrapperPaths: [...keptLocal, ...keptRemote]
   };
+  if (injected.size > 0 && (job.limits?.wallClockMs ?? 0) > SESSION_CREDENTIAL_RENEW_INTERVAL_MS) {
+    const fetchCredentials = deps?.fetchCredentials ?? fetchCredentialsFromServer(job);
+    const setTimer = deps?.setTimer ?? defaultSetTimer;
+    const timer = setTimer(() => {
+      void renewInjectedCredentials(injected, fetchCredentials);
+    }, SESSION_CREDENTIAL_RENEW_INTERVAL_MS);
+    cleanups.push(async () => {
+      timer.stop();
+    });
+    log("[node-connectors]", `\u4F1A\u8BDD\u4E2D\u9014\u7EED\u671F\u5DF2\u542F\u52A8\uFF08\u6BCF ${SESSION_CREDENTIAL_RENEW_INTERVAL_MS / 6e4} \u5206\u949F\uFF0C${injected.size} \u4E2A\u8FDE\u63A5\u5668\uFF09`);
+  }
   const cleanup = async () => {
     for (const fn of cleanups) await fn().catch(() => {
     });
   };
   return { job: preparedJob, cleanup, statuses };
 }
-var import_node_fs5;
+async function renewInjectedCredentials(injected, fetchCredentials) {
+  const outcome = { renewed: [], failed: [] };
+  let fresh;
+  try {
+    fresh = await fetchCredentials();
+  } catch (err) {
+    for (const slug6 of injected.keys()) outcome.failed.push({ slug: slug6, error: String(err) });
+    log("[node-connectors]", `\u7EED\u671F\uFF1A\u5411 server \u53D6\u51ED\u636E\u5931\u8D25\uFF0C\u672C\u8F6E\u6CBF\u7528\u65E7\u51ED\u636E: ${String(err)}`);
+    return outcome;
+  }
+  for (const { slug: slug6, credentials } of fresh) {
+    const target = injected.get(slug6);
+    if (!target) continue;
+    try {
+      await target.connector.inject(credentials, target.sessionEnv);
+      outcome.renewed.push(slug6);
+    } catch (err) {
+      outcome.failed.push({ slug: slug6, error: String(err) });
+      log("[node-connectors]", `\u26A0 \u7EED\u671F\uFF1A${slug6} \u5C31\u5730\u91CD\u6CE8\u5931\u8D25\uFF0C\u6CBF\u7528\u65E7\u51ED\u636E: ${String(err)}`);
+    }
+  }
+  if (outcome.renewed.length > 0) log("[node-connectors]", `\u7EED\u671F\uFF1A\u5DF2\u5C31\u5730\u6362\u65B0 ${outcome.renewed.join(", ")}`);
+  return outcome;
+}
+function defaultSetTimer(fn, ms) {
+  const timer = setInterval(fn, ms);
+  timer.unref?.();
+  return { stop: () => clearInterval(timer) };
+}
+function fetchCredentialsFromServer(job) {
+  return async () => {
+    const url = new URL("/api/connector-credentials", job.server?.url ?? "").toString();
+    const res = await fetch(url, { headers: { authorization: `Bearer ${job.actorToken}` } });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const body = await res.json();
+    return body.connectorCreds ?? [];
+  };
+}
+var import_node_fs5, import_promises6, import_node_os5, import_node_path9, SESSION_CREDENTIAL_RENEW_INTERVAL_MS;
 var init_prepare_job = __esm({
   "../connectors/src/prepare-job.ts"() {
     "use strict";
     import_node_fs5 = require("node:fs");
+    import_promises6 = require("node:fs/promises");
+    import_node_os5 = require("node:os");
+    import_node_path9 = require("node:path");
     init_base();
     init_registry2();
     init_logger();
+    SESSION_CREDENTIAL_RENEW_INTERVAL_MS = 30 * 6e4;
   }
 });
 
@@ -142428,8 +142625,8 @@ function materializeFiles(dir, files) {
   if (!files) return;
   for (const [rel, content] of Object.entries(files)) {
     try {
-      const file = import_node_path8.default.join(dir, rel);
-      import_node_fs6.default.mkdirSync(import_node_path8.default.dirname(file), { recursive: true });
+      const file = import_node_path10.default.join(dir, rel);
+      import_node_fs6.default.mkdirSync(import_node_path10.default.dirname(file), { recursive: true });
       import_node_fs6.default.writeFileSync(file, content);
     } catch {
     }
@@ -142445,7 +142642,7 @@ function resolveLegacyWorkRoot(workRoot) {
   if (workRoot) return workRoot;
   const env = process.env["OASIS_WORK_ROOT"];
   if (env) return env;
-  return import_node_os4.default.tmpdir();
+  return import_node_os6.default.tmpdir();
 }
 function resolveWorkRoots(workRoot) {
   return { workRoot: resolveWorkRoot(workRoot), legacyRoot: resolveLegacyWorkRoot(workRoot) };
@@ -142456,7 +142653,7 @@ function slug5(workdirKey) {
   return `${safe}-${h}`;
 }
 function sessionDirFor(workRoot, runtimeKind, workdirKey) {
-  return import_node_path8.default.join(resolveWorkRoot(workRoot), "sessions", runtimeKind, slug5(workdirKey));
+  return import_node_path10.default.join(resolveWorkRoot(workRoot), "sessions", runtimeKind, slug5(workdirKey));
 }
 function sessionDirKind(runtimeKind) {
   return runtimeKind === "claude-code" ? "claude" : runtimeKind;
@@ -142469,20 +142666,20 @@ function resolveSessionDirWithLegacy(args) {
   return import_node_fs6.default.existsSync(legacy) ? legacy : fresh;
 }
 function oneShotDirFor(workRoot, runtimeKind) {
-  const base = import_node_path8.default.join(resolveWorkRoot(workRoot), "tmp");
+  const base = import_node_path10.default.join(resolveWorkRoot(workRoot), "tmp");
   import_node_fs6.default.mkdirSync(base, { recursive: true });
-  return import_node_fs6.default.mkdtempSync(import_node_path8.default.join(base, `${runtimeKind}-`));
+  return import_node_fs6.default.mkdtempSync(import_node_path10.default.join(base, `${runtimeKind}-`));
 }
 function writeMeta(dir, meta) {
   try {
-    import_node_fs6.default.writeFileSync(import_node_path8.default.join(dir, META_FILE), `${JSON.stringify(meta, null, 2)}
+    import_node_fs6.default.writeFileSync(import_node_path10.default.join(dir, META_FILE), `${JSON.stringify(meta, null, 2)}
 `);
   } catch {
   }
 }
 function readMeta(dir) {
   try {
-    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path8.default.join(dir, META_FILE), "utf8"));
+    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path10.default.join(dir, META_FILE), "utf8"));
     if (!raw || typeof raw !== "object") return null;
     const m2 = raw;
     return typeof m2.kind === "string" && typeof m2.createdAt === "string" ? m2 : null;
@@ -142511,14 +142708,14 @@ function lockWorkdir(dir, pid, holder, workdirKey) {
     ...workdirKey !== void 0 ? { workdirKey } : {}
   };
   try {
-    import_node_fs6.default.writeFileSync(import_node_path8.default.join(dir, LOCK_FILE), `${JSON.stringify(lock)}
+    import_node_fs6.default.writeFileSync(import_node_path10.default.join(dir, LOCK_FILE), `${JSON.stringify(lock)}
 `);
   } catch {
   }
 }
 function readLock(dir) {
   try {
-    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path8.default.join(dir, LOCK_FILE), "utf8"));
+    const raw = JSON.parse(import_node_fs6.default.readFileSync(import_node_path10.default.join(dir, LOCK_FILE), "utf8"));
     if (!raw || typeof raw !== "object") return null;
     const l = raw;
     return Number.isInteger(l.pid) && l.pid > 0 ? l : null;
@@ -142528,14 +142725,14 @@ function readLock(dir) {
 }
 function unlockWorkdir(dir) {
   try {
-    import_node_fs6.default.unlinkSync(import_node_path8.default.join(dir, LOCK_FILE));
+    import_node_fs6.default.unlinkSync(import_node_path10.default.join(dir, LOCK_FILE));
   } catch {
   }
 }
 function isWorkdirLive(dir) {
   let raw;
   try {
-    raw = import_node_fs6.default.readFileSync(import_node_path8.default.join(dir, LOCK_FILE), "utf8");
+    raw = import_node_fs6.default.readFileSync(import_node_path10.default.join(dir, LOCK_FILE), "utf8");
   } catch {
     return false;
   }
@@ -142552,7 +142749,7 @@ function clearWorkdir(dir) {
     );
   }
   for (const entry of import_node_fs6.default.readdirSync(dir)) {
-    import_node_fs6.default.rmSync(import_node_path8.default.join(dir, entry), { recursive: true, force: true });
+    import_node_fs6.default.rmSync(import_node_path10.default.join(dir, entry), { recursive: true, force: true });
   }
 }
 function prepareWorkdir(args) {
@@ -142582,19 +142779,19 @@ function prepareWorkdir(args) {
   return dir;
 }
 function legacyChatSessionDir(workRoot, rtId) {
-  return import_node_path8.default.join(resolveLegacyWorkRoot(workRoot), "oasis-chat-sessions", rtId.replace(/[^a-zA-Z0-9_-]+/g, "_"));
+  return import_node_path10.default.join(resolveLegacyWorkRoot(workRoot), "oasis-chat-sessions", rtId.replace(/[^a-zA-Z0-9_-]+/g, "_"));
 }
-var import_node_crypto9, import_node_fs6, import_node_os4, import_node_path8, META_FILE, LOCK_FILE, NEW_WORK_ROOT, LEGACY_ROOTS, LEGACY_ONESHOT_PREFIX;
+var import_node_crypto9, import_node_fs6, import_node_os6, import_node_path10, META_FILE, LOCK_FILE, NEW_WORK_ROOT, LEGACY_ROOTS, LEGACY_ONESHOT_PREFIX;
 var init_session_paths = __esm({
   "../adapters/src/_core/session-paths.ts"() {
     "use strict";
     import_node_crypto9 = require("node:crypto");
     import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_os4 = __toESM(require("node:os"), 1);
-    import_node_path8 = __toESM(require("node:path"), 1);
+    import_node_os6 = __toESM(require("node:os"), 1);
+    import_node_path10 = __toESM(require("node:path"), 1);
     META_FILE = ".oasis-meta.json";
     LOCK_FILE = ".oasis-lock";
-    NEW_WORK_ROOT = () => import_node_path8.default.join(import_node_os4.default.homedir(), ".oasis", "work");
+    NEW_WORK_ROOT = () => import_node_path10.default.join(import_node_os6.default.homedir(), ".oasis", "work");
     LEGACY_ROOTS = ["oasis-chat-sessions", "oasis-transcripts"];
     LEGACY_ONESHOT_PREFIX = "oasis-session-";
   }
@@ -143816,7 +144013,7 @@ async function discoverACPModels(bin, provider, args = ["acp"]) {
       clientCapabilities: {}
     });
     try {
-      tmpDir = (0, import_node_fs7.mkdtempSync)((0, import_node_path9.join)((0, import_node_os5.tmpdir)(), `oasis-acp-${provider}-`));
+      tmpDir = (0, import_node_fs7.mkdtempSync)((0, import_node_path11.join)((0, import_node_os7.tmpdir)(), `oasis-acp-${provider}-`));
     } catch {
       return fail();
     }
@@ -143872,14 +144069,14 @@ function parseACPSessionNewModels(result) {
 async function discoverOpenclawModels(bin) {
   throw new Error("discoverOpenclawModels: TODO");
 }
-var import_node_child_process9, import_node_fs7, import_node_os5, import_node_path9, modelCache, CACHE_TTL_MS;
+var import_node_child_process9, import_node_fs7, import_node_os7, import_node_path11, modelCache, CACHE_TTL_MS;
 var init_models = __esm({
   "../adapters/src/_core/models.ts"() {
     "use strict";
     import_node_child_process9 = require("node:child_process");
     import_node_fs7 = require("node:fs");
-    import_node_os5 = require("node:os");
-    import_node_path9 = require("node:path");
+    import_node_os7 = require("node:os");
+    import_node_path11 = require("node:path");
     modelCache = /* @__PURE__ */ new Map();
     CACHE_TTL_MS = 6e4;
   }
@@ -146446,7 +146643,7 @@ function dirSizeBytes(dir) {
       return;
     }
     for (const e of entries) {
-      const p2 = import_node_path10.default.join(d, e.name);
+      const p2 = import_node_path12.default.join(d, e.name);
       if (e.isSymbolicLink()) continue;
       if (e.isDirectory()) {
         walk(p2);
@@ -146463,40 +146660,40 @@ function dirSizeBytes(dir) {
 }
 function listWorkdirs(workRoot, legacyRoot) {
   const out = [];
-  const sessions = import_node_path10.default.join(workRoot, "sessions");
+  const sessions = import_node_path12.default.join(workRoot, "sessions");
   try {
     for (const kind of import_node_fs8.default.readdirSync(sessions)) {
-      const kindDir = import_node_path10.default.join(sessions, kind);
+      const kindDir = import_node_path12.default.join(sessions, kind);
       try {
-        for (const slug6 of import_node_fs8.default.readdirSync(kindDir)) out.push(import_node_path10.default.join(kindDir, slug6));
+        for (const slug6 of import_node_fs8.default.readdirSync(kindDir)) out.push(import_node_path12.default.join(kindDir, slug6));
       } catch {
       }
     }
   } catch {
   }
-  const tmp = import_node_path10.default.join(workRoot, "tmp");
+  const tmp = import_node_path12.default.join(workRoot, "tmp");
   try {
-    for (const d of import_node_fs8.default.readdirSync(tmp)) out.push(import_node_path10.default.join(tmp, d));
+    for (const d of import_node_fs8.default.readdirSync(tmp)) out.push(import_node_path12.default.join(tmp, d));
   } catch {
   }
   for (const legacy of LEGACY_ROOTS) {
-    const root = import_node_path10.default.join(legacyRoot, legacy);
+    const root = import_node_path12.default.join(legacyRoot, legacy);
     try {
-      for (const d of import_node_fs8.default.readdirSync(root)) out.push(import_node_path10.default.join(root, d));
+      for (const d of import_node_fs8.default.readdirSync(root)) out.push(import_node_path12.default.join(root, d));
     } catch {
     }
   }
   try {
     for (const d of import_node_fs8.default.readdirSync(legacyRoot)) {
-      if (d.startsWith(LEGACY_ONESHOT_PREFIX)) out.push(import_node_path10.default.join(legacyRoot, d));
+      if (d.startsWith(LEGACY_ONESHOT_PREFIX)) out.push(import_node_path12.default.join(legacyRoot, d));
     }
   } catch {
   }
   return [...new Set(out)];
 }
 function kindFromPath(workRoot, dir) {
-  const rel = import_node_path10.default.relative(workRoot, dir);
-  const parts = rel.split(import_node_path10.default.sep);
+  const rel = import_node_path12.default.relative(workRoot, dir);
+  const parts = rel.split(import_node_path12.default.sep);
   if (parts[0] === "sessions" && parts[1]) return parts[1];
   if (parts[0] === "tmp" && parts[1]) return parts[1].replace(/-[^-]*$/, "");
   return void 0;
@@ -146538,7 +146735,7 @@ async function runGcSweep(deps) {
   let deleted = 0;
   for (const d of decisions) {
     if (d.action !== "delete") continue;
-    if (import_node_fs8.default.existsSync(import_node_path10.default.join(d.dir, LOCK_FILE)) && isWorkdirLive(d.dir)) {
+    if (import_node_fs8.default.existsSync(import_node_path12.default.join(d.dir, LOCK_FILE)) && isWorkdirLive(d.dir)) {
       log3(`[gc] \u8DF3\u8FC7 ${d.dir}\uFF1A\u6267\u884C\u524D\u590D\u67E5\u53D1\u73B0\u5DF2\u88AB\u5360\u7528`);
       continue;
     }
@@ -146589,12 +146786,12 @@ function startGcLoop(deps) {
     clearInterval(timer);
   };
 }
-var import_node_fs8, import_node_path10;
+var import_node_fs8, import_node_path12;
 var init_gc_loop = __esm({
   "../adapters/src/_core/gc-loop.ts"() {
     "use strict";
     import_node_fs8 = __toESM(require("node:fs"), 1);
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
     init_session_paths();
     init_workdir_gc();
   }
@@ -146630,14 +146827,14 @@ var init_src4 = __esm({
 });
 
 // ../connectors/src/connector-adapter.ts
-var import_promises5, import_node_fs9, import_node_os6, import_node_path11, ConnectorAwareAdapter;
+var import_promises7, import_node_fs9, import_node_os8, import_node_path13, ConnectorAwareAdapter;
 var init_connector_adapter = __esm({
   "../connectors/src/connector-adapter.ts"() {
     "use strict";
-    import_promises5 = require("node:fs/promises");
+    import_promises7 = require("node:fs/promises");
     import_node_fs9 = require("node:fs");
-    import_node_os6 = require("node:os");
-    import_node_path11 = require("node:path");
+    import_node_os8 = require("node:os");
+    import_node_path13 = require("node:path");
     init_src4();
     init_base();
     init_prepare_job();
@@ -146660,11 +146857,11 @@ var init_connector_adapter = __esm({
         const wrapperPaths = [...prepared.job.wrapperPaths ?? [], ...sentinelWrappers];
         let extraEnv = { ...strippedEnv };
         if (wrapperPaths.length > 0) {
-          const wrapperBinDir = await (0, import_promises5.mkdtemp)((0, import_node_path11.join)((0, import_node_os6.tmpdir)(), "oasis-wrappers-"));
-          await (0, import_promises5.mkdir)(wrapperBinDir, { recursive: true });
+          const wrapperBinDir = await (0, import_promises7.mkdtemp)((0, import_node_path13.join)((0, import_node_os8.tmpdir)(), "oasis-wrappers-"));
+          await (0, import_promises7.mkdir)(wrapperBinDir, { recursive: true });
           for (const wp of wrapperPaths) {
-            const linkName = (0, import_node_path11.basename)(wp).replace(/\.sh$/, "");
-            await (0, import_promises5.symlink)(wp, (0, import_node_path11.join)(wrapperBinDir, linkName));
+            const linkName = (0, import_node_path13.basename)(wp).replace(/\.sh$/, "");
+            await (0, import_promises7.symlink)(wp, (0, import_node_path13.join)(wrapperBinDir, linkName));
           }
           extraEnv = { ...extraEnv, PATH: [wrapperBinDir, extraEnv["PATH"] ?? ""].filter(Boolean).join(":") };
           log("[adapter]", `  connectors injected  +${Date.now() - t0}ms  wrappers=${wrapperPaths.length}`);
@@ -149451,12 +149648,12 @@ async function startOasisServer(opts) {
               const actorCtx = await opts.resolveActorContext(body.actorId).catch(() => null);
               if (actorCtx) {
                 const { mkdtempSync: mkdtempSync5, mkdirSync: mkdirSync21, writeFileSync: writeFileSync13 } = await import("node:fs");
-                const { join: join30, dirname: dirname24 } = await import("node:path");
-                const { tmpdir: tmpdir8 } = await import("node:os");
-                const dir = mkdtempSync5(join30(tmpdir8(), "oasis-chat-"));
+                const { join: join32, dirname: dirname24 } = await import("node:path");
+                const { tmpdir: tmpdir10 } = await import("node:os");
+                const dir = mkdtempSync5(join32(tmpdir10(), "oasis-chat-"));
                 if (actorCtx.config?.prompt) {
                   for (const [rel, content] of Object.entries(splitIdentityFiles2(actorCtx.config.prompt))) {
-                    const file = join30(dir, rel);
+                    const file = join32(dir, rel);
                     mkdirSync21(dirname24(file), { recursive: true });
                     writeFileSync13(file, content);
                   }
@@ -149468,12 +149665,12 @@ async function startOasisServer(opts) {
                     const s2 = byId.get(id);
                     return s2 ? `- **${s2.name}** (\`${s2.id}\`): ${s2.description}` : `- \`${id}\`\uFF08\u672A\u5728\u6280\u80FD\u5E93\u4E2D\uFF0C\u53EF\u80FD\u5DF2\u5378\u8F7D\uFF09`;
                   });
-                  writeFileSync13(join30(dir, "SKILLS.md"), ["# \u53EF\u7528\u6280\u80FD", "", "\u4EE5\u4E0B\u6280\u80FD\u5DF2\u4E3A\u4F60\u542F\u7528\uFF0C\u53EF\u5728\u672C\u6B21\u4F1A\u8BDD\u4E2D\u76F4\u63A5\u4F7F\u7528\uFF1A", "", ...lines].join("\n"));
+                  writeFileSync13(join32(dir, "SKILLS.md"), ["# \u53EF\u7528\u6280\u80FD", "", "\u4EE5\u4E0B\u6280\u80FD\u5DF2\u4E3A\u4F60\u542F\u7528\uFF0C\u53EF\u5728\u672C\u6B21\u4F1A\u8BDD\u4E2D\u76F4\u63A5\u4F7F\u7528\uFF1A", "", ...lines].join("\n"));
                 }
                 if (opts.materializeSkills) {
                   const skillFiles = await opts.materializeSkills(body.actorId, "claude").catch(() => ({}));
                   for (const [rel, content] of Object.entries(skillFiles)) {
-                    const file = join30(dir, rel);
+                    const file = join32(dir, rel);
                     mkdirSync21(dirname24(file), { recursive: true });
                     writeFileSync13(file, content);
                   }
@@ -149487,7 +149684,7 @@ async function startOasisServer(opts) {
                     const modeNote = c.mode === "oauth" ? "OAuth \xB7 \u51ED\u8BC1\u7531\u5E73\u53F0\u7BA1\u7406\uFF0C\u901A\u8FC7\u5BF9\u5E94 CLI wrapper \u8C03\u7528" : "\u76F4\u63A5\u5199\u5165 \xB7 \u51ED\u8BC1\u5DF2\u6CE8\u5165\u73AF\u5883\u53D8\u91CF";
                     return `- **${c.name}** (\`${c.id}\`): ${statusNote} \xB7 ${modeNote}`;
                   });
-                  writeFileSync13(join30(dir, "CONNECTORS.md"), ["# \u53EF\u7528\u8FDE\u63A5\u5668", "", "\u4EE5\u4E0B\u8FDE\u63A5\u5668\u5DF2\u4E3A\u672C\u6B21\u4F1A\u8BDD\u914D\u7F6E\uFF0C\u51ED\u8BC1\u5DF2\u901A\u8FC7\u73AF\u5883\u53D8\u91CF\u6216 CLI wrapper \u6CE8\u5165\uFF0C\u65E0\u9700\u624B\u52A8\u914D\u7F6E\uFF1A", "", ...lines].join("\n"));
+                  writeFileSync13(join32(dir, "CONNECTORS.md"), ["# \u53EF\u7528\u8FDE\u63A5\u5668", "", "\u4EE5\u4E0B\u8FDE\u63A5\u5668\u5DF2\u4E3A\u672C\u6B21\u4F1A\u8BDD\u914D\u7F6E\uFF0C\u51ED\u8BC1\u5DF2\u901A\u8FC7\u73AF\u5883\u53D8\u91CF\u6216 CLI wrapper \u6CE8\u5165\uFF0C\u65E0\u9700\u624B\u52A8\u914D\u7F6E\uFF1A", "", ...lines].join("\n"));
                 }
                 spawnCwd = dir;
               }
@@ -149728,7 +149925,14 @@ async function startOasisServer(opts) {
               baseUrl: base,
               redirectPath: "/api/connectors/github/app/manifest-callback"
             });
-            githubAppPending.put(state, { ...actorId ? { actorId } : {}, employeeSlug: nameSlug, createdAtMs: Date.now() });
+            githubAppPending.put(state, {
+              ...actorId ? { actorId } : {},
+              employeeSlug: nameSlug,
+              createdAtMs: Date.now(),
+              // 存下这次选的归属——回调时要拿它跟 GitHub 返回的 owner 比对。
+              wantOwnerKind: kind,
+              ...kind === "org" && owner?.login ? { wantOwnerLogin: owner.login } : {}
+            });
             res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({
               state,
               formAction: manifestFormAction(kind === "org" ? { kind: "org", login: owner.login } : { kind: "user" }, state),
@@ -149791,6 +149995,14 @@ async function startOasisServer(opts) {
           }
           try {
             const conv = await exchangeManifestCode(code);
+            const problem = checkAppOwnership(conv, {
+              ...pending.wantOwnerLogin ? { ownerLogin: pending.wantOwnerLogin } : {},
+              ...pending.wantOwnerKind ? { ownerKind: pending.wantOwnerKind } : {}
+            });
+            if (problem) {
+              fail(problem.message);
+              return;
+            }
             const svc = opts.actors?.service;
             if (!svc) throw new Error("actors service unavailable");
             const scope = pending.actorId ? { scope: "personal", actorId: pending.actorId } : { scope: "global" };
@@ -150446,9 +150658,11 @@ var init_memory_registry_store = __esm({
       // key: ${runtimeId}::${modelId}
       connectors = /* @__PURE__ */ new Map();
       variables = /* @__PURE__ */ new Map();
-      // key = key::actorId
-      _varKey(key, actorId) {
-        return `${key}::${actorId ?? ""}`;
+      // key = key::actorId::projectId
+      // 唯一键覆盖三种作用域（ADR 0125：无 environment 维）：personal=(key,actorId)、project=(key,projectId)、global=(key)。
+      // 三段拼接后天然互不碰撞（personal 有 actorId 无 projectId，project 反之，global 全空）。
+      _varKey(key, actorId, projectId) {
+        return `${key}::${actorId ?? ""}::${projectId ?? ""}`;
       }
       skillCatalog = /* @__PURE__ */ new Map();
       installedSkills = /* @__PURE__ */ new Map();
@@ -150581,7 +150795,7 @@ var init_memory_registry_store = __esm({
         this.skillFiles.delete(skillId);
       }
       async putVariable(v2) {
-        this.variables.set(this._varKey(v2.key, v2.actorId), { ...v2 });
+        this.variables.set(this._varKey(v2.key, v2.actorId, v2.projectId), { ...v2 });
       }
       async patchVariableValue(key, actorId, valueEncrypted, updatedAt) {
         const mk = this._varKey(key, actorId);
@@ -150596,8 +150810,11 @@ var init_memory_registry_store = __esm({
         if (actorId !== void 0) return all.filter((v2) => v2.scope === "global" || v2.actorId === actorId).map((v2) => ({ ...v2 }));
         return all.map((v2) => ({ ...v2 }));
       }
-      async deleteVariable(key, actorId) {
-        this.variables.delete(this._varKey(key, actorId));
+      async resolveProjectVariables(projectId) {
+        return [...this.variables.values()].filter((v2) => v2.scope === "project" && v2.projectId === projectId).map((v2) => ({ ...v2 }));
+      }
+      async deleteVariable(key, actorId, scoping) {
+        this.variables.delete(this._varKey(key, actorId, scoping?.projectId));
       }
     };
   }
@@ -154721,6 +154938,10 @@ async function sweepSilentSessions(deps) {
       continue;
     }
     if (!live.lastEventAt) continue;
+    if (deps.isTraceHealthy && !deps.isTraceHealthy(s2.sessionId)) {
+      deps.log?.(`[liveness] \u8DF3\u8FC7 ${s2.artifactId}\uFF1Atrace \u5199\u5165\u4E0D\u5065\u5EB7\uFF08\u89C2\u6D4B\u964D\u7EA7\uFF09\uFF0C\u4FE1\u606F\u4E0D\u8DB3\u4E0D\u5224\u9759\u9ED8 \u2192 \u4EA4 wallClock \u515C\u5E95`);
+      continue;
+    }
     const runtime = { hasInFlight: true, lastSessionEventAt: live.lastEventAt, openToolCall: live.openToolCall };
     if (!isRuntimeSilent(runtime, deps.now, deps.silentThresholdMs)) continue;
     const ok = await deps.kill(s2.jobKey).catch(() => false);
@@ -155420,6 +155641,73 @@ var init_recovery_plan = __esm({
   }
 });
 
+// ../server/src/domains/trace/resilient-appender.ts
+var ResilientTraceAppender;
+var init_resilient_appender = __esm({
+  "../server/src/domains/trace/resilient-appender.ts"() {
+    "use strict";
+    ResilientTraceAppender = class {
+      constructor(opts) {
+        this.opts = opts;
+        this.seq = opts.startSeq ?? 0;
+      }
+      seq;
+      failing = false;
+      /** 当前已成功落库的最大 seq。 */
+      get currentSeq() {
+        return this.seq;
+      }
+      /** 恢复路径：把 seq 对齐到库里已有的最大值（不改健康态）。 */
+      resetSeq(seq) {
+        this.seq = seq;
+      }
+      onSuccess() {
+        this.opts.health?.markHealthy(this.opts.runId);
+        if (this.failing) {
+          this.failing = false;
+          this.opts.onRecover?.();
+        }
+      }
+      onFailure(err) {
+        this.opts.health?.markUnhealthy(this.opts.runId);
+        if (!this.failing) {
+          this.failing = true;
+          this.opts.onError?.(err);
+        }
+      }
+      /**
+       * 追加一批事件（seq 自动连续分配）；**成功才推进 seq**。返回是否落库。
+       * 幂等吸收（storage 层）保证：若失败其实是"提交成功但连接抖断"，下次同 seq 重投会被吸收、不重复。
+       */
+      async append(events) {
+        if (events.length === 0) return true;
+        const base = this.seq;
+        const withSeq = events.map((e, i) => ({ ...e, seq: base + i + 1 }));
+        try {
+          await this.opts.store.appendEvents(this.opts.runId, withSeq);
+          this.seq = base + events.length;
+          this.onSuccess();
+          return true;
+        } catch (err) {
+          this.onFailure(err);
+          return false;
+        }
+      }
+      /** 更新 run（心跳 lastProgressAt / 终态 / metadata 等）；失败不熄灭事件通道。 */
+      async update(patch) {
+        try {
+          await this.opts.store.updateRun(this.opts.runId, patch);
+          this.onSuccess();
+          return true;
+        } catch (err) {
+          this.onFailure(err);
+          return false;
+        }
+      }
+    };
+  }
+});
+
 // ../server/src/domains/trace/sink.ts
 function deriveMessage(payload) {
   if (payload && typeof payload === "object") {
@@ -155429,11 +155717,10 @@ function deriveMessage(payload) {
   }
   return void 0;
 }
-function trajectoryEventToRunEvent(e, seq) {
+function trajectoryEventToRunEvent(e) {
   const map = KIND_MAP[e.kind] ?? { eventType: "progress", stream: "runtime" };
   const message = deriveMessage(e.payload);
   return {
-    seq,
     eventType: map.eventType,
     stream: map.stream,
     ...message !== void 0 ? { message } : {},
@@ -155512,6 +155799,7 @@ var KIND_MAP, MODEL_TEXT_LIMIT, TOOL_PREVIEW_LIMIT, PROGRESS_TOUCH_THROTTLE_MS,
 var init_sink = __esm({
   "../server/src/domains/trace/sink.ts"() {
     "use strict";
+    init_resilient_appender();
     KIND_MAP = {
       message: { eventType: "model.output.completed", stream: "model" },
       thought: { eventType: "model.output.delta", stream: "model" },
@@ -155527,12 +155815,23 @@ var init_sink = __esm({
       store;
       runtimeKind;
       onError;
+      health;
       sessions = /* @__PURE__ */ new Map();
       constructor(opts) {
         this.store = opts.store;
         this.runtimeKind = opts.runtimeKind ?? "custom";
         this.onError = opts.onError ?? (() => {
         });
+        this.health = opts.health;
+      }
+      /** 为一个 run 造事件通道 appender（seq 两道防线 + 健康度上报都收在这里）。 */
+      makeAppender(runId) {
+        return new ResilientTraceAppender({
+          runId,
+          store: this.store,
+          ...this.health ? { health: this.health } : {},
+          onError: (err) => this.onError(err)
+        });
       }
       runtimeKindFor(session) {
         if (this.runtimeKind !== "auto") return this.runtimeKind;
@@ -155554,7 +155853,7 @@ var init_sink = __esm({
       begin(session, _bundleFiles) {
         const st = {
           runId: session.runId,
-          seq: 0,
+          appender: this.makeAppender(session.runId),
           chain: Promise.resolve(),
           openTools: /* @__PURE__ */ new Map(),
           // runtimeSessionId：运行时自己的会话号（= 会话工作目录名，也是 --resume 的键）。落账后
@@ -155588,8 +155887,7 @@ var init_sink = __esm({
             relation: "triggered_by",
             createdAt: session.startedAt
           });
-          await this.store.appendEvents(st.runId, [{
-            seq: ++st.seq,
+          await st.appender.append([{
             eventType: "run.started",
             stream: "runtime",
             message: `${session.action} ${session.artifactId}`
@@ -155599,7 +155897,7 @@ var init_sink = __esm({
       recover(session) {
         const st = {
           runId: session.runId,
-          seq: 0,
+          appender: this.makeAppender(session.runId),
           chain: Promise.resolve(),
           openTools: /* @__PURE__ */ new Map(),
           baseMetadata: { bundleManifest: session.bundleManifest, recovered: true },
@@ -155626,11 +155924,10 @@ var init_sink = __esm({
             st.baseMetadata = { ...asMetadata(existing.metadata) ?? st.baseMetadata, recovered: true };
           }
           const events = await this.store.listEvents(session.runId, {});
-          st.seq = events.reduce((max, event) => Math.max(max, event.seq), 0);
+          st.appender.resetSeq(events.reduce((max, event) => Math.max(max, event.seq), 0));
           const recoveredAt = session.recoveredAt ?? (/* @__PURE__ */ new Date()).toISOString();
           const interruptedAt = session.interruptedAt ?? recoveredAt;
-          await this.store.appendEvents(st.runId, [{
-            seq: ++st.seq,
+          await st.appender.append([{
             eventType: "progress",
             stream: "system",
             level: "warn",
@@ -155655,11 +155952,11 @@ var init_sink = __esm({
             const ms = Date.parse(event.ts);
             if (!Number.isNaN(ms) && ms - (st.lastProgressTouchMs ?? 0) >= PROGRESS_TOUCH_THROTTLE_MS) {
               st.lastProgressTouchMs = ms;
-              await this.store.updateRun(st.runId, { lastProgressAt: event.ts });
+              await st.appender.update({ lastProgressAt: event.ts });
             }
             return;
           }
-          await this.store.appendEvents(st.runId, [trajectoryEventToRunEvent(event, ++st.seq)]);
+          await st.appender.append([trajectoryEventToRunEvent(event)]);
           await this.materializeToolCall(st, event);
         });
       }
@@ -155710,8 +156007,7 @@ var init_sink = __esm({
         const captured = this.sessions.get(sessionId);
         this.enqueue(sessionId, async (st) => {
           for (const ref2 of update.opRefs) {
-            await this.store.appendEvents(st.runId, [{
-              seq: ++st.seq,
+            await st.appender.append([{
               eventType: "oplog.appended",
               stream: "oasis",
               message: ref2.kind,
@@ -155725,8 +156021,7 @@ var init_sink = __esm({
               createdAt: update.exit.at
             });
           }
-          await this.store.appendEvents(st.runId, [{
-            seq: ++st.seq,
+          await st.appender.append([{
             eventType: "run.finished",
             stream: "runtime",
             message: `exit code=${update.exit.code ?? "killed"} ops=${update.opRefs.length}`
@@ -155760,6 +156055,7 @@ var init_sink = __esm({
         });
         if (captured) captured.chain = captured.chain.finally(() => {
           this.sessions.delete(sessionId);
+          this.health?.forget(captured.runId);
         });
       }
     };
@@ -155821,27 +156117,26 @@ function wireRecoveredChatTurn(deps) {
     live.emit(rest);
   }
   deps.register();
-  let traceSeq = 0;
-  let traceEnabled = true;
+  const appender = new ResilientTraceAppender({
+    runId: plan.runId,
+    store: trace,
+    ...deps.traceHealth ? { health: deps.traceHealth } : {},
+    onError: (err) => log3(`[chat-recovery] run ${plan.runId} trace \u5199\u5931\u8D25\uFF08\u7EE7\u7EED\u3001\u4E0D\u7184\u706D\uFF09: ${String(err)}`)
+  });
   let traceChain = trace.listEvents(plan.runId, {}).then((events) => {
-    for (const e of events) if (e.seq > traceSeq) traceSeq = e.seq;
+    appender.resetSeq(events.reduce((n, e) => Math.max(n, e.seq), 0));
   }).catch((err) => {
-    traceEnabled = false;
-    log3(`[chat-recovery] run ${plan.runId} \u8BFB\u4E8B\u4EF6\u5931\u8D25\uFF0C\u672C\u8F6E trace \u7EED\u8D26\u5173\u95ED: ${String(err)}`);
+    deps.traceHealth?.markUnhealthy(plan.runId);
+    log3(`[chat-recovery] run ${plan.runId} \u8BFB\u4E8B\u4EF6\u5931\u8D25: ${String(err)}`);
   });
   const enqueueTrace = (step) => {
-    if (!traceEnabled) return;
-    traceChain = traceChain.then(async () => {
-      if (traceEnabled) await step();
-    }).catch((err) => {
-      traceEnabled = false;
-      log3(`[chat-recovery] run ${plan.runId} trace \u7EED\u8D26\u5931\u8D25: ${String(err)}`);
+    traceChain = traceChain.then(step).catch((err) => {
+      log3(`[chat-recovery] run ${plan.runId} trace \u7EED\u8D26\u5F02\u5E38: ${String(err)}`);
     });
   };
   const recoveredAt = (/* @__PURE__ */ new Date()).toISOString();
   enqueueTrace(async () => {
-    await trace.appendEvents(plan.runId, [{
-      seq: ++traceSeq,
+    await appender.append([{
       eventType: "progress",
       stream: "system",
       level: "warn",
@@ -155865,11 +156160,11 @@ function wireRecoveredChatTurn(deps) {
       const ms = Date.parse(event.ts);
       if (!Number.isNaN(ms) && ms - lastProgressTouchMs >= PROGRESS_TOUCH_THROTTLE_MS2) {
         lastProgressTouchMs = ms;
-        enqueueTrace(() => trace.updateRun(plan.runId, { lastProgressAt: event.ts }).then(() => void 0));
+        enqueueTrace(() => appender.update({ lastProgressAt: event.ts }).then(() => void 0));
       }
       return;
     }
-    enqueueTrace(() => trace.appendEvents(plan.runId, [trajectoryEventToRunEvent(event, ++traceSeq)]).then(() => void 0));
+    enqueueTrace(() => appender.append([trajectoryEventToRunEvent(event)]).then(() => void 0));
     if (event.kind === "message" && sawTextOutput) return;
     const part = chatPartFromTrajectoryEvent(event);
     if (part) {
@@ -155950,14 +156245,13 @@ function wireRecoveredChatTurn(deps) {
     live.finish(failed ? "error" : "done");
     deps.unregister();
     enqueueTrace(async () => {
-      await trace.appendEvents(plan.runId, [{
-        seq: ++traceSeq,
+      await appender.append([{
         eventType: "run.finished",
         stream: "runtime",
         message: `exit code=${info.code ?? "killed"}`,
         startedAt: finishedAt
       }]);
-      await trace.updateRun(plan.runId, runTerminalPatch(info, plan.startedAt, finishedAt));
+      await appender.update(runTerminalPatch(info, plan.startedAt, finishedAt));
       if (info.usage && trace.updateUsageAggregates) {
         const run = await trace.getRun(plan.runId);
         if (run) void trace.updateUsageAggregates(run).catch(() => void 0);
@@ -156054,17 +156348,17 @@ async function reconcileChatExitFrame(deps) {
     }).catch(() => void 0);
     try {
       const events = await deps.trace.listEvents(row.runId, {});
-      let traceSeq = events.reduce((n, e) => Math.max(n, e.seq), 0);
-      await deps.trace.appendEvents(row.runId, [
-        ...stash.frames.filter((frame) => frame.type === "event").map((frame) => frame.event).filter((event) => event.kind !== "system").map((event) => trajectoryEventToRunEvent(event, ++traceSeq)),
+      const baseSeq = events.reduce((n, e) => Math.max(n, e.seq), 0);
+      const seqless = [
+        ...stash.frames.filter((frame) => frame.type === "event").map((frame) => frame.event).filter((event) => event.kind !== "system").map((event) => trajectoryEventToRunEvent(event)),
         {
-          seq: ++traceSeq,
           eventType: "run.finished",
           stream: "runtime",
           message: `exit code=${info.code ?? "killed"}\uFF08serve \u505C\u673A\u7A97\u53E3\u5185\u7ED3\u675F\uFF0C\u8282\u70B9 outbox \u91CD\u53D1\u5BF9\u8D26\uFF09`,
           startedAt: finishedAt
         }
-      ]);
+      ];
+      await deps.trace.appendEvents(row.runId, seqless.map((e, i) => ({ ...e, seq: baseSeq + i + 1 })));
       await deps.trace.updateRun(row.runId, runTerminalPatch(info, run.startedAt, finishedAt));
       if (info.usage && deps.trace.updateUsageAggregates) {
         const fresh = await deps.trace.getRun(row.runId);
@@ -156085,6 +156379,7 @@ var init_chat_recovery = __esm({
     import_node_crypto20 = require("node:crypto");
     init_chat_parts();
     init_sink();
+    init_resilient_appender();
     asObj3 = (v2) => v2 && typeof v2 === "object" && !Array.isArray(v2) ? v2 : void 0;
     partsOf = (parts) => Array.isArray(parts) ? parts.filter((p2) => p2 && typeof p2 === "object" && typeof p2.type === "string") : [];
     maxPartSeq = (parts) => parts.reduce((n, p2) => Math.max(n, typeof p2.seq === "number" ? p2.seq : 0), 0);
@@ -156678,6 +156973,24 @@ var init_skill_fetcher = __esm({
 });
 
 // ../server/src/domains/actors/service.ts
+function applyRefDelivery(env, entries, warn = (m2) => console.warn(m2)) {
+  for (const e of entries) {
+    if (!(e.key in env)) continue;
+    const mode = e.deliveryMode;
+    switch (mode) {
+      case "env":
+        break;
+      // 非敏感：明文保持不动
+      case "ref":
+        env[e.key] = makeVarRef(e.key);
+        break;
+      default:
+        delete env[e.key];
+        warn(`[credential] \u672A\u77E5 deliveryMode "${mode}"\uFF08key=${e.key}\uFF09\u2014\u2014\u5DF2\u4ECE env \u5254\u9664\uFF0C\u4FDD\u5B88\u5904\u7406\u4E0D\u6CE8\u5165\u660E\u6587`);
+        break;
+    }
+  }
+}
 function computeEffectiveEntries(config2, connections, connectors) {
   const globalConnected = new Set(connectors.filter((c) => c.status === "connected").map((c) => c.id));
   const record6 = new Map(connections.map((c) => [c.connectorId, c.enabled]));
@@ -156709,6 +157022,7 @@ var init_service3 = __esm({
     init_skill_fetcher();
     init_identity();
     init_src5();
+    init_src();
     REDACTED_MARKER = "[REDACTED]";
     ActorsService = class {
       constructor(opts) {
@@ -157362,8 +157676,11 @@ ${input.description}
           key: v2.key,
           scope: v2.scope,
           ...v2.actorId !== void 0 ? { actorId: v2.actorId } : {},
+          ...v2.projectId !== void 0 ? { projectId: v2.projectId } : {},
           ...v2.connectorId !== void 0 ? { connectorId: v2.connectorId } : {},
           ...v2.overrides !== void 0 ? { overrides: v2.overrides } : {},
+          // 缺省 "env"（存量行为不变，敏感项需显式选 "ref"，ADR §4.4 / 待确认 3）
+          deliveryMode: v2.deliveryMode ?? "env",
           valueEncrypted: v2.encrypted === false ? `plain:${v2.value}` : this.encrypt(v2.value),
           updatedAt: this.now()
         });
@@ -157399,8 +157716,11 @@ ${input.description}
             key: r.key,
             scope: r.scope,
             ...r.actorId !== void 0 ? { actorId: r.actorId } : {},
+            ...r.projectId !== void 0 ? { projectId: r.projectId } : {},
             ...r.connectorId !== void 0 ? { connectorId: r.connectorId } : {},
             ...r.overrides !== void 0 ? { overrides: r.overrides } : {},
+            deliveryMode: r.deliveryMode ?? "env",
+            // 缺省视为 env（ADR §4.4；存量行读侧统一回填）
             encrypted: !isPlain,
             maskedValue: isPlain ? r.valueEncrypted.slice(6) : mask(this.decrypt(r.valueEncrypted)),
             updatedAt: r.updatedAt
@@ -157424,8 +157744,13 @@ ${input.description}
         }
         return this.revealVariable(key, void 0);
       }
-      deleteVariable(key, actorId) {
-        return this.opts.store.deleteVariable(key, actorId);
+      deleteVariable(key, actorId, scoping) {
+        return this.opts.store.deleteVariable(key, actorId, scoping);
+      }
+      /** 该 key 是否在**任一**作用域存在（reveal 判权失败时区分 not_found / no_permission，仅 server 侧审计用；§4.5.2）。 */
+      async hasVariableKey(key) {
+        const rows = await this.opts.store.listVariables();
+        return rows.some((r) => r.key === key);
       }
       async resolveActorEnv(actorId) {
         const cfg = await this.opts.store.latestConfig(actorId);
@@ -157455,6 +157780,64 @@ ${input.description}
         }
         return env;
       }
+      /** 密文 → 明文（与 resolveActorEnv 内联的 decode 同规则：plain: 前缀直读，否则 AES 解密）。 */
+      decodeCiphertext(ct) {
+        return ct.startsWith("plain:") ? ct.slice(6) : this.decrypt(ct);
+      }
+      /**
+       * ADR 凭据保险库 §4.3 / ADR 0125：按「项目」解析 project 变量为明文条目（含 deliveryMode）。
+       * store 未实现 resolveProjectVariables（旧实现）时返回空——调用方跳过 project 层。
+       */
+      async resolveProjectVariables(projectId) {
+        if (!this.opts.store.resolveProjectVariables) return [];
+        const rows = await this.opts.store.resolveProjectVariables(projectId);
+        return rows.map((r) => ({ key: r.key, value: this.decodeCiphertext(r.valueEncrypted), deliveryMode: r.deliveryMode ?? "env" }));
+      }
+      /**
+       * ADR 凭据保险库 §4.3 / ADR 0125：派单/reveal 用的**合并后**变量条目（明文 + deliveryMode）。
+       * 优先级低→高：global < project < personal（同 key 时高层覆盖低层，personal 最优先）。
+       * 连接器门禁与 resolveActorEnv 同源（未启用的连接器变量不注入）。
+       *   - `opts.projectId` 给出时才叠加 project 层；缺省 = 只有 personal+global（存量行为）。
+       */
+      async resolveActorProvisionEntries(actorId, opts) {
+        const cfg = await this.opts.store.latestConfig(actorId);
+        const enabledConnectors = await this.effectiveEnabledConnectors(actorId, cfg);
+        if (opts?.refreshConnectors !== false) {
+          await refreshEnabledConnectorCredentials(
+            this,
+            createAllConnectors(),
+            actorId,
+            (slug6) => enabledConnectors.has(slug6)
+          );
+        }
+        const rows = await this.opts.store.listVariables(actorId);
+        const projectRows = opts?.projectId && this.opts.store.resolveProjectVariables ? await this.opts.store.resolveProjectVariables(opts.projectId) : [];
+        const merged = /* @__PURE__ */ new Map();
+        const gated = (row) => !row.connectorId || enabledConnectors.has(row.connectorId);
+        const put = (row) => {
+          if (!gated(row)) return;
+          merged.set(row.key, { key: row.key, value: this.decodeCiphertext(row.valueEncrypted), deliveryMode: row.deliveryMode ?? "env" });
+        };
+        for (const row of rows) {
+          if (row.scope === "global" && !row.actorId) put(row);
+        }
+        for (const row of projectRows) {
+          if (row.scope === "project") put(row);
+        }
+        for (const row of rows) {
+          if (row.scope === "personal" && (!row.actorId || row.actorId === actorId)) put(row);
+        }
+        return [...merged.values()];
+      }
+      /**
+       * ADR 凭据保险库 §4.5.1：reveal 的判权即「能否被解析」——该 key 通过 §4.3 合并顺序对本 caller
+       * 能得出值即可读，返回明文；否则返回 null（缺 key / 无权，统一由路由映射成 403，不区分）。
+       */
+      async resolveRevealValue(actorId, key, opts) {
+        const entries = await this.resolveActorProvisionEntries(actorId, { ...opts, refreshConnectors: false });
+        const hit = entries.find((e) => e.key === key);
+        return hit ? { value: hit.value } : null;
+      }
       encrypt(plain) {
         const iv = (0, import_node_crypto22.randomBytes)(12);
         const cipher = (0, import_node_crypto22.createCipheriv)("aes-256-gcm", this.opts.variableKey, iv);
@@ -158463,7 +158846,7 @@ var init_skill_materializer = __esm({
 
 // ../server/src/governance/connector-skills.ts
 function connectorSkillsDir(dataDir, connectorId) {
-  return (0, import_node_path12.join)(dataDir, "connector-skills", connectorId);
+  return (0, import_node_path14.join)(dataDir, "connector-skills", connectorId);
 }
 function parseConnectorSkillId(id) {
   if (!id.startsWith("connector:")) return null;
@@ -158473,17 +158856,17 @@ function parseConnectorSkillId(id) {
   return { connectorId: rest.slice(0, i), slug: rest.slice(i + 1) };
 }
 async function collect(root, dir, out) {
-  for (const e of await (0, import_promises6.readdir)(dir, { withFileTypes: true })) {
-    const abs = (0, import_node_path12.join)(dir, e.name);
+  for (const e of await (0, import_promises8.readdir)(dir, { withFileTypes: true })) {
+    const abs = (0, import_node_path14.join)(dir, e.name);
     if (e.isDirectory()) await collect(root, abs, out);
-    else if (e.isFile()) out[(0, import_node_path12.relative)(root, abs).split(/[\\/]/).join("/")] = await (0, import_promises6.readFile)(abs, "utf8");
+    else if (e.isFile()) out[(0, import_node_path14.relative)(root, abs).split(/[\\/]/).join("/")] = await (0, import_promises8.readFile)(abs, "utf8");
   }
 }
 async function readLocalPack(dataDir, connectorId) {
   const root = connectorSkillsDir(dataDir, connectorId);
   let slugs;
   try {
-    slugs = (await (0, import_promises6.readdir)(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = (await (0, import_promises8.readdir)(root, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
@@ -158491,7 +158874,7 @@ async function readLocalPack(dataDir, connectorId) {
   for (const slug6 of slugs) {
     const files = {};
     try {
-      await collect((0, import_node_path12.join)(root, slug6), (0, import_node_path12.join)(root, slug6), files);
+      await collect((0, import_node_path14.join)(root, slug6), (0, import_node_path14.join)(root, slug6), files);
     } catch {
       continue;
     }
@@ -158507,17 +158890,17 @@ async function readLocalPack(dataDir, connectorId) {
 async function writePack(dataDir, connectorId, pack) {
   const root = connectorSkillsDir(dataDir, connectorId);
   const tmp = `${root}.tmp`;
-  await (0, import_promises6.rm)(tmp, { recursive: true, force: true });
+  await (0, import_promises8.rm)(tmp, { recursive: true, force: true });
   for (const s2 of pack) {
     for (const [rel, content] of Object.entries(s2.files)) {
-      const abs = (0, import_node_path12.join)(tmp, s2.slug, rel);
-      await (0, import_promises6.mkdir)((0, import_node_path12.dirname)(abs), { recursive: true });
-      await (0, import_promises6.writeFile)(abs, content, "utf8");
+      const abs = (0, import_node_path14.join)(tmp, s2.slug, rel);
+      await (0, import_promises8.mkdir)((0, import_node_path14.dirname)(abs), { recursive: true });
+      await (0, import_promises8.writeFile)(abs, content, "utf8");
     }
   }
-  await (0, import_promises6.rm)(root, { recursive: true, force: true });
-  await (0, import_promises6.mkdir)((0, import_node_path12.dirname)(root), { recursive: true });
-  await (0, import_promises6.rename)(tmp, root);
+  await (0, import_promises8.rm)(root, { recursive: true, force: true });
+  await (0, import_promises8.mkdir)((0, import_node_path14.dirname)(root), { recursive: true });
+  await (0, import_promises8.rename)(tmp, root);
 }
 function packMatches(local, remote) {
   if (local.length !== remote.length) return false;
@@ -158544,18 +158927,21 @@ async function syncConnectorSkills(args) {
   log3(`[connector-skills] ${args.connectorId}\uFF1A\u5DF2\u4ECE\u5382\u5546\u540C\u6B65 ${fresh.length} \u4E2A\u6280\u80FD`);
   return { skills: fresh, outcome: "fetched" };
 }
-var import_promises6, import_node_path12, toId;
+var import_promises8, import_node_path14, toId;
 var init_connector_skills = __esm({
   "../server/src/governance/connector-skills.ts"() {
     "use strict";
-    import_promises6 = require("node:fs/promises");
-    import_node_path12 = require("node:path");
+    import_promises8 = require("node:fs/promises");
+    import_node_path14 = require("node:path");
     init_src5();
     toId = (connectorId, slug6) => `connector:${connectorId}/${slug6}`;
   }
 });
 
 // ../server/src/domains/actors/routes.ts
+function isKnownRevealSource(source) {
+  return CREDENTIAL_REVEAL_SOURCES.has(source) || source.startsWith("agent-skill:");
+}
 function positionsFromPayload(body) {
   if (!body) return void 0;
   if (Object.prototype.hasOwnProperty.call(body, "roles")) {
@@ -158588,6 +158974,8 @@ function actorApiRecord(actor) {
 }
 function actorsDomain(opts) {
   const { resolveCtx } = opts;
+  const revealLimits = opts.credentialRevealLimits ?? { perSession: 200, perSessionPerKey: 20 };
+  const revealLimiter = new RevealRateLimiter(revealLimits.perSession, revealLimits.perSessionPerKey);
   return (router) => {
     router.get("/api/actors", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
@@ -158827,11 +159215,23 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
+      const scope = b2.scope ?? "global";
+      if (scope === "project" && !b2.projectId) {
+        throw new ApiError(400, "BAD_REQUEST", "scope=project \u5FC5\u987B\u63D0\u4F9B projectId");
+      }
+      if (scope === "project" && opts.projectExists && !await opts.projectExists(b2.projectId)) {
+        throw new ApiError(400, "BAD_REQUEST", `\u9879\u76EE\u4E0D\u5B58\u5728\uFF1A${b2.projectId}\uFF08scope=project \u53D8\u91CF\u7684 projectId \u5FC5\u987B\u662F\u771F\u5B9E\u9879\u76EE\uFF09`);
+      }
+      if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref") {
+        throw new ApiError(400, "BAD_REQUEST", "deliveryMode \u53EA\u80FD\u662F env \u6216 ref");
+      }
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       await service.putVariable({
         key: b2.key,
         value: b2.value,
-        scope: b2.scope ?? "global",
+        scope,
+        ...scope === "project" ? { projectId: b2.projectId } : {},
+        ...b2.deliveryMode !== void 0 ? { deliveryMode: b2.deliveryMode } : {},
         ...b2.connectorId !== void 0 ? { connectorId: b2.connectorId } : {},
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
@@ -158840,7 +159240,12 @@ function actorsDomain(opts) {
     });
     router.delete("/api/variables/:key", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
-      await service.deleteVariable(req.params.key);
+      const projectId = req.query.get("projectId") ?? void 0;
+      await service.deleteVariable(
+        req.params.key,
+        void 0,
+        projectId ? { projectId } : void 0
+      );
       return { status: 200, body: { ok: true } };
     });
     router.get("/api/actors/:id/variables", async (req) => {
@@ -158852,6 +159257,9 @@ function actorsDomain(opts) {
       const actorId = req.params.id;
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
+      if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref") {
+        throw new ApiError(400, "BAD_REQUEST", "deliveryMode \u53EA\u80FD\u662F env \u6216 ref");
+      }
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       if (b2.connectorId === void 0) {
         const existing = await service.listVariables(actorId);
@@ -158869,6 +159277,7 @@ function actorsDomain(opts) {
         value: b2.value,
         actorId,
         scope: "personal",
+        ...b2.deliveryMode !== void 0 ? { deliveryMode: b2.deliveryMode } : {},
         ...b2.connectorId !== void 0 ? { connectorId: b2.connectorId } : {},
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
@@ -158880,6 +159289,51 @@ function actorsDomain(opts) {
       await service.deleteVariable(req.params.key, req.params.id);
       return { status: 200, body: { ok: true } };
     });
+    router.post("/api/variables/reveal", async (req) => {
+      const { service } = await resolveCtx(req.auth.companyId);
+      const b2 = req.body;
+      const rawKey = typeof b2?.key === "string" ? b2.key.trim() : "";
+      if (!rawKey) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
+      const key = parseVarRef(rawKey) ?? rawKey;
+      const source = typeof b2?.source === "string" && b2.source.trim() || "agent-cli";
+      if (!isKnownRevealSource(source)) throw new ApiError(400, "BAD_REQUEST", `\u672A\u8BC6\u522B\u7684 source\u300C${source}\u300D\uFF08\xA74.5.4\uFF1A\u53EA\u63A5\u53D7\u8BC6\u522B\u503C\uFF09`);
+      const actor = req.auth.actor;
+      const artifactId = req.auth.dispatch?.artifactId;
+      const sessionId = req.auth.dispatch?.sessionId;
+      const now = Date.now();
+      const timestamp = new Date(now).toISOString();
+      const sessionKey = sessionId ?? `${actor}::${artifactId ?? "no-artifact"}`;
+      const dispatchFields = { ...sessionId ? { sessionId } : {}, ...artifactId ? { artifactId } : {} };
+      const throttled = revealLimiter.check(sessionKey, key, now);
+      if (throttled) {
+        await opts.credentialAudit?.({ kind: "credential_reveal_throttled", actor, variableKey: key, source, timestamp, scope: throttled, ...dispatchFields });
+        return { status: 429, body: { code: "throttled", key, scope: throttled } };
+      }
+      const scope = artifactId && opts.resolveDispatchScope ? await opts.resolveDispatchScope(artifactId) : {};
+      const resolved = await service.resolveRevealValue(actor, key, scope);
+      if (!resolved) {
+        const reason = await service.hasVariableKey(key) ? "no_permission" : "not_found";
+        await opts.credentialAudit?.({ kind: "credential_reveal_denied", actor, variableKey: key, source, timestamp, reason, ...dispatchFields });
+        return { status: 403, body: { code: "denied", key } };
+      }
+      await opts.credentialAudit?.({ kind: "credential_reveal", actor, variableKey: key, source, timestamp, ...dispatchFields });
+      return { status: 200, body: { value: resolved.value } };
+    });
+    router.get("/api/variables/reveal-audit", async (req) => {
+      if (!opts.readCredentialAudit) return { status: 501, body: { error: "credential audit reader \u672A\u914D\u7F6E" } };
+      const actor = req.query.get("actor") ?? void 0;
+      const key = req.query.get("key") ?? void 0;
+      const kind = req.query.get("kind") ?? void 0;
+      const limitRaw = req.query.get("limit");
+      const limit = limitRaw ? Math.min(Math.max(parseInt(limitRaw, 10) || 50, 1), 500) : 50;
+      const items = await opts.readCredentialAudit({
+        ...actor ? { actor } : {},
+        ...key ? { key } : {},
+        ...kind ? { kind } : {},
+        limit
+      });
+      return { status: 200, body: { items } };
+    });
     router.get("/api/skills/market", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
       const [catalog, installed] = await Promise.all([
@@ -159038,6 +159492,18 @@ function actorsDomain(opts) {
       const results = await opts.refreshConnectorSkills();
       return { status: 200, body: { results } };
     });
+    router.get("/api/connector-credentials", async (req) => {
+      const { service } = await resolveCtx(req.auth.companyId);
+      const actorId = req.auth.actor;
+      const entries = await service.resolveActorProvisionEntries(actorId);
+      const vars = {};
+      for (const e of entries) vars[e.key] = e.value;
+      const connectorCreds = collectAllConnectorCredentials({
+        vars,
+        actorName: vars["GIT_AUTHOR_NAME"] ?? actorId.split(":").pop() ?? "oasis-agent"
+      });
+      return { status: 200, body: { connectorCreds } };
+    });
     router.get("/api/skill-cache/manifest", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
       const builtins = opts.getBuiltinSkills?.() ?? [];
@@ -159316,12 +159782,15 @@ function actorsDomain(opts) {
     });
   };
 }
+var CREDENTIAL_REVEAL_SOURCES, RevealRateLimiter;
 var init_routes = __esm({
   "../server/src/domains/actors/routes.ts"() {
     "use strict";
     init_src();
     init_src2();
     init_router();
+    init_src();
+    init_src5();
     init_memory();
     init_skill_fetcher();
     init_stats();
@@ -159330,6 +159799,44 @@ var init_routes = __esm({
     init_image_upload();
     init_skill_materializer();
     init_connector_skills();
+    CREDENTIAL_REVEAL_SOURCES = /* @__PURE__ */ new Set(["agent-cli", "smoke-test", "oasis-internal"]);
+    RevealRateLimiter = class {
+      constructor(perSession, perSessionPerKey, ttlMs = 2 * 60 * 6e4) {
+        this.perSession = perSession;
+        this.perSessionPerKey = perSessionPerKey;
+        this.ttlMs = ttlMs;
+      }
+      sessionCounts = /* @__PURE__ */ new Map();
+      sessionKeyCounts = /* @__PURE__ */ new Map();
+      /** 记一次尝试；返回命中的限流档（若超限）或 null（放行）。 */
+      check(sessionKey, varKey, now) {
+        this.prune(now);
+        const sk = `${sessionKey}::${varKey}`;
+        const s2 = this.sessionCounts.get(sessionKey) ?? { count: 0, last: now };
+        const k2 = this.sessionKeyCounts.get(sk) ?? { count: 0, last: now };
+        if (k2.count >= this.perSessionPerKey) {
+          k2.last = now;
+          this.sessionKeyCounts.set(sk, k2);
+          return "session_key";
+        }
+        if (s2.count >= this.perSession) {
+          s2.last = now;
+          this.sessionCounts.set(sessionKey, s2);
+          return "session";
+        }
+        s2.count += 1;
+        s2.last = now;
+        this.sessionCounts.set(sessionKey, s2);
+        k2.count += 1;
+        k2.last = now;
+        this.sessionKeyCounts.set(sk, k2);
+        return null;
+      }
+      prune(now) {
+        for (const [key, v2] of this.sessionCounts) if (now - v2.last > this.ttlMs) this.sessionCounts.delete(key);
+        for (const [key, v2] of this.sessionKeyCounts) if (now - v2.last > this.ttlMs) this.sessionKeyCounts.delete(key);
+      }
+    };
   }
 });
 
@@ -159428,7 +159935,7 @@ function createActorsDomain(opts) {
   return {
     service: defaultCtx.service,
     resolveCtx,
-    register: actorsDomain({ resolveCtx, ...opts.trace ? { trace: opts.trace } : {}, ...opts.listBuiltinSkills ? { listBuiltinSkills: opts.listBuiltinSkills } : {}, ...opts.getBuiltinSkills ? { getBuiltinSkills: opts.getBuiltinSkills } : {}, ...opts.getConnectorSkills ? { getConnectorSkills: opts.getConnectorSkills } : {}, ...opts.refreshConnectorSkills ? { refreshConnectorSkills: opts.refreshConnectorSkills } : {}, ...opts.memory ? { memory: opts.memory } : {} })
+    register: actorsDomain({ resolveCtx, ...opts.trace ? { trace: opts.trace } : {}, ...opts.listBuiltinSkills ? { listBuiltinSkills: opts.listBuiltinSkills } : {}, ...opts.getBuiltinSkills ? { getBuiltinSkills: opts.getBuiltinSkills } : {}, ...opts.getConnectorSkills ? { getConnectorSkills: opts.getConnectorSkills } : {}, ...opts.refreshConnectorSkills ? { refreshConnectorSkills: opts.refreshConnectorSkills } : {}, ...opts.memory ? { memory: opts.memory } : {}, ...opts.resolveDispatchScope ? { resolveDispatchScope: opts.resolveDispatchScope } : {}, ...opts.projectExists ? { projectExists: opts.projectExists } : {}, ...opts.credentialAudit ? { credentialAudit: opts.credentialAudit } : {}, ...opts.readCredentialAudit ? { readCredentialAudit: opts.readCredentialAudit } : {}, ...opts.credentialRevealLimits ? { credentialRevealLimits: opts.credentialRevealLimits } : {} })
   };
 }
 var import_node_crypto24;
@@ -161857,10 +162364,10 @@ function nodesDomain(deps) {
       }
     }
     try {
-      const here = (0, import_node_path13.dirname)((0, import_node_url4.fileURLToPath)(__esm_import_meta_url));
+      const here = (0, import_node_path15.dirname)((0, import_node_url4.fileURLToPath)(__esm_import_meta_url));
       for (const rel of ["../../../../node-daemon/package.json", "../../../../../node-daemon/package.json"]) {
         try {
-          const raw = (0, import_node_fs11.readFileSync)((0, import_node_path13.resolve)(here, rel), "utf8");
+          const raw = (0, import_node_fs11.readFileSync)((0, import_node_path15.resolve)(here, rel), "utf8");
           const pkg = JSON.parse(raw);
           if (pkg.version) return { version: pkg.version, source: "monorepo" };
         } catch {
@@ -162172,14 +162679,14 @@ function nodesDomain(deps) {
     });
   };
 }
-var import_node_crypto26, import_node_fs11, import_node_url4, import_node_path13;
+var import_node_crypto26, import_node_fs11, import_node_url4, import_node_path15;
 var init_routes5 = __esm({
   "../server/src/domains/nodes/routes.ts"() {
     "use strict";
     import_node_crypto26 = require("node:crypto");
     import_node_fs11 = require("node:fs");
     import_node_url4 = require("node:url");
-    import_node_path13 = require("node:path");
+    import_node_path15 = require("node:path");
     init_src4();
     init_connect_script();
     init_node_health();
@@ -163336,6 +163843,7 @@ function buildOrganizationUsageSummary(input) {
   const runtimeEmployees = /* @__PURE__ */ new Map();
   const runtimeInstanceKind = /* @__PURE__ */ new Map();
   const runtimeHostnames = input.runtimeHostnames ?? /* @__PURE__ */ new Map();
+  const runtimeNodeNames = input.runtimeNodeNames ?? /* @__PURE__ */ new Map();
   for (const run of input.runs) {
     const usage = usageOf(run);
     if (!usage) {
@@ -163466,11 +163974,27 @@ function buildOrganizationUsageSummary(input) {
     (e) => e.share,
     (e, s2) => ({ ...e, share: s2 })
   );
+  function parseNodeId(rtKey) {
+    const parts = rtKey.split(":");
+    if (parts.length >= 3 && parts[0] === "runtime") return parts[1];
+    return "";
+  }
+  function resolveDisplayName(rtKey, kind) {
+    const nodeId = parseNodeId(rtKey);
+    if (nodeId) {
+      const name = runtimeNodeNames.get(nodeId);
+      if (name) return name;
+    }
+    const h = runtimeHostnames.get(rtKey);
+    if (h) return h;
+    if (nodeId) return nodeId;
+    return kind;
+  }
   function resolveHostname(rtKey, kind) {
     const h = runtimeHostnames.get(rtKey);
     if (h) return h;
-    const parts = rtKey.split(":");
-    if (parts.length >= 3 && parts[0] === "runtime") return parts[1];
+    const nodeId = parseNodeId(rtKey);
+    if (nodeId) return nodeId;
     return kind;
   }
   const runtimeRows = normalizeShares(
@@ -163498,6 +164022,8 @@ function buildOrganizationUsageSummary(input) {
       );
       return {
         runtimeInstanceId: rtKey,
+        nodeId: parseNodeId(rtKey),
+        displayName: resolveDisplayName(rtKey, kind),
         hostname: resolveHostname(rtKey, kind),
         runtimeKind: kind,
         usage,
@@ -163535,12 +164061,12 @@ function nameKey(name) {
 function cleanName(name) {
   return name.trim().replace(/\s+/g, " ");
 }
-var import_node_fs12, import_node_path14, import_node_crypto27, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
+var import_node_fs12, import_node_path16, import_node_crypto27, SEP, keyOf, prefixOf, MemoryWorkorderTagStore, FileWorkorderTagStore;
 var init_tags = __esm({
   "../server/src/domains/collab/tags.ts"() {
     "use strict";
     import_node_fs12 = __toESM(require("node:fs"), 1);
-    import_node_path14 = __toESM(require("node:path"), 1);
+    import_node_path16 = __toESM(require("node:path"), 1);
     import_node_crypto27 = __toESM(require("node:crypto"), 1);
     SEP = "::";
     keyOf = (companyId, id) => `${companyId}${SEP}${id}`;
@@ -163626,7 +164152,7 @@ var init_tags = __esm({
       }
       persist() {
         try {
-          import_node_fs12.default.mkdirSync(import_node_path14.default.dirname(this.file), { recursive: true });
+          import_node_fs12.default.mkdirSync(import_node_path16.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs12.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs12.default.renameSync(tmp, this.file);
@@ -163767,17 +164293,22 @@ function collabDomain(opts) {
         return { status: 400, body: { error: { code: "bad_request", message: "timeZone \u65E0\u6548" } } };
       }
       const { kernel } = await resolveCtx(req.auth.companyId);
-      const [runs, runtimeRecords] = await Promise.all([
+      const [runs, runtimeRecords, nodeRecords] = await Promise.all([
         opts.trace.listUsageRuns({ from, to }),
-        opts.listRuntimes ? opts.listRuntimes().catch(() => []) : Promise.resolve([])
+        opts.listRuntimes ? opts.listRuntimes().catch(() => []) : Promise.resolve([]),
+        opts.listNodes ? opts.listNodes().catch(() => []) : Promise.resolve([])
       ]);
       const runtimeHostnames = /* @__PURE__ */ new Map();
       for (const rt of runtimeRecords) {
         if (rt.id && rt.hostname) runtimeHostnames.set(rt.id, rt.hostname);
       }
+      const runtimeNodeNames = /* @__PURE__ */ new Map();
+      for (const n of nodeRecords) {
+        if (n.id && n.name) runtimeNodeNames.set(n.id, n.name);
+      }
       return {
         status: 200,
-        body: buildOrganizationUsageSummary({ model: kernel.model, runs, bucketKind: bucket, timeZone, runtimeHostnames })
+        body: buildOrganizationUsageSummary({ model: kernel.model, runs, bucketKind: bucket, timeZone, runtimeHostnames, runtimeNodeNames })
       };
     });
     router.get("/api/workorders", async (req) => {
@@ -164577,10 +165108,10 @@ function tokenType(p2) {
 function parseOtlpMetricsUsage(body) {
   const req = body;
   const out = [];
-  for (const rm4 of req.resourceMetrics ?? []) {
-    const runId = attrString(rm4.resource?.attributes, "oasis.run_id");
+  for (const rm6 of req.resourceMetrics ?? []) {
+    const runId = attrString(rm6.resource?.attributes, "oasis.run_id");
     if (!runId) continue;
-    const actorId = attrString(rm4.resource?.attributes, "oasis.actor_id");
+    const actorId = attrString(rm6.resource?.attributes, "oasis.actor_id");
     let input = 0;
     let output = 0;
     let cacheRead = 0;
@@ -164588,7 +165119,7 @@ function parseOtlpMetricsUsage(body) {
     let costUsd = 0;
     let sawToken = false;
     let sawCost = false;
-    for (const sm of rm4.scopeMetrics ?? []) {
+    for (const sm of rm6.scopeMetrics ?? []) {
       for (const m2 of sm.metrics ?? []) {
         const name = (m2.name ?? "").toLowerCase();
         const points = m2.sum?.dataPoints ?? m2.gauge?.dataPoints ?? [];
@@ -164964,6 +165495,30 @@ var init_routes6 = __esm({
   }
 });
 
+// ../server/src/domains/trace/trace-health.ts
+function createTraceHealth() {
+  const unhealthy = /* @__PURE__ */ new Set();
+  return {
+    markUnhealthy(runId) {
+      unhealthy.add(runId);
+    },
+    markHealthy(runId) {
+      unhealthy.delete(runId);
+    },
+    isHealthy(runId) {
+      return !unhealthy.has(runId);
+    },
+    forget(runId) {
+      unhealthy.delete(runId);
+    }
+  };
+}
+var init_trace_health = __esm({
+  "../server/src/domains/trace/trace-health.ts"() {
+    "use strict";
+  }
+});
+
 // ../server/src/domains/trace/index.ts
 function createTraceDomain(opts) {
   const service = new TraceService({ store: opts.store });
@@ -164978,6 +165533,8 @@ var init_trace2 = __esm({
     init_routes6();
     init_sink();
     init_chat_parts();
+    init_trace_health();
+    init_resilient_appender();
   }
 });
 
@@ -167049,12 +167606,12 @@ function normalize(patch) {
     ...reviewRoles !== void 0 ? { reviewRoles: [...new Set(reviewRoles.map((r) => r.trim()).filter(Boolean))] } : {}
   };
 }
-var import_node_fs13, import_node_path15, SEP2, keyOf2, prefixOf2, MemoryPlaybookOverrideStore, FilePlaybookOverrideStore;
+var import_node_fs13, import_node_path17, SEP2, keyOf2, prefixOf2, MemoryPlaybookOverrideStore, FilePlaybookOverrideStore;
 var init_overrides = __esm({
   "../server/src/domains/playbooks/overrides.ts"() {
     "use strict";
     import_node_fs13 = __toESM(require("node:fs"), 1);
-    import_node_path15 = __toESM(require("node:path"), 1);
+    import_node_path17 = __toESM(require("node:path"), 1);
     SEP2 = "::";
     keyOf2 = (companyId, ref2, nodeKey) => `${companyId}${SEP2}${ref2}${SEP2}${nodeKey}`;
     prefixOf2 = (companyId, ref2) => `${companyId}${SEP2}${ref2}${SEP2}`;
@@ -167093,7 +167650,7 @@ var init_overrides = __esm({
       }
       persist() {
         try {
-          import_node_fs13.default.mkdirSync(import_node_path15.default.dirname(this.file), { recursive: true });
+          import_node_fs13.default.mkdirSync(import_node_path17.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs13.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs13.default.renameSync(tmp, this.file);
@@ -167532,12 +168089,12 @@ var init_daemon_adapter = __esm({
 });
 
 // ../server/src/side-map.ts
-var import_node_fs14, import_node_path16, FileSideMap;
+var import_node_fs14, import_node_path18, FileSideMap;
 var init_side_map = __esm({
   "../server/src/side-map.ts"() {
     "use strict";
     import_node_fs14 = __toESM(require("node:fs"), 1);
-    import_node_path16 = __toESM(require("node:path"), 1);
+    import_node_path18 = __toESM(require("node:path"), 1);
     FileSideMap = class {
       constructor(file) {
         this.file = file;
@@ -167564,7 +168121,7 @@ var init_side_map = __esm({
       }
       persist() {
         try {
-          import_node_fs14.default.mkdirSync(import_node_path16.default.dirname(this.file), { recursive: true });
+          import_node_fs14.default.mkdirSync(import_node_path18.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs14.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs14.default.renameSync(tmp, this.file);
@@ -169020,26 +169577,26 @@ ${ctx.nodeFault}
 
 // ../server/src/governance/builtin-skills.ts
 async function collectDir(root, dir, out) {
-  const entries = await (0, import_promises7.readdir)(dir, { withFileTypes: true });
+  const entries = await (0, import_promises9.readdir)(dir, { withFileTypes: true });
   for (const e of entries) {
-    const abs = (0, import_node_path17.join)(dir, e.name);
+    const abs = (0, import_node_path19.join)(dir, e.name);
     if (e.isDirectory()) {
       await collectDir(root, abs, out);
     } else if (e.isFile()) {
-      const info = await (0, import_promises7.stat)(abs);
+      const info = await (0, import_promises9.stat)(abs);
       if (info.size > MAX_FILE_BYTES3) {
         console.warn(`[builtin-skills] skip oversized file (${info.size}B): ${abs}`);
         continue;
       }
-      const rel = (0, import_node_path17.relative)(root, abs).split(/[\\/]/).join("/");
-      out[rel] = await (0, import_promises7.readFile)(abs, "utf8");
+      const rel = (0, import_node_path19.relative)(root, abs).split(/[\\/]/).join("/");
+      out[rel] = await (0, import_promises9.readFile)(abs, "utf8");
     }
   }
 }
 async function loadBuiltinSkills(skillsDir) {
   let dirents;
   try {
-    dirents = await (0, import_promises7.readdir)(skillsDir, { withFileTypes: true });
+    dirents = await (0, import_promises9.readdir)(skillsDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -169047,7 +169604,7 @@ async function loadBuiltinSkills(skillsDir) {
   for (const d of dirents) {
     if (!d.isDirectory()) continue;
     const slug6 = d.name;
-    const skillDir = (0, import_node_path17.join)(skillsDir, slug6);
+    const skillDir = (0, import_node_path19.join)(skillsDir, slug6);
     const files = {};
     try {
       await collectDir(skillDir, skillDir, files);
@@ -169075,12 +169632,12 @@ function materializeBuiltinSkills(builtins, skillsDirPrefix) {
   }
   return out;
 }
-var import_promises7, import_node_path17, MAX_FILE_BYTES3;
+var import_promises9, import_node_path19, MAX_FILE_BYTES3;
 var init_builtin_skills = __esm({
   "../server/src/governance/builtin-skills.ts"() {
     "use strict";
-    import_promises7 = require("node:fs/promises");
-    import_node_path17 = require("node:path");
+    import_promises9 = require("node:fs/promises");
+    import_node_path19 = require("node:path");
     init_skill_fetcher();
     init_skill_materializer();
     MAX_FILE_BYTES3 = 1 << 20;
@@ -174572,6 +175129,21 @@ var init_postgres = __esm({
 });
 
 // ../storage/src/postgres-registry.ts
+function rowToVariable(row) {
+  return {
+    key: row.key,
+    scope: row.scope === "connector" ? "global" : row.scope,
+    ...row.actor_id !== null && row.actor_id !== void 0 ? { actorId: row.actor_id } : {},
+    ...row.project_id !== null && row.project_id !== void 0 ? { projectId: row.project_id } : {},
+    ...row.connector_id !== null && row.connector_id !== void 0 ? { connectorId: row.connector_id } : {},
+    ...row.overrides !== null && row.overrides !== void 0 ? { overrides: row.overrides } : {},
+    // 保留库里存的原始 delivery_mode（含未来 broker/wrapper 档，annotation d7456d5e Req3）——
+    // **不塌成 env**，否则未知档位读回来变明文；仅 null/空回填 "env"（存量行）。派单侧按未知档保守处理。
+    deliveryMode: typeof row.delivery_mode === "string" && row.delivery_mode ? row.delivery_mode : "env",
+    valueEncrypted: row.value_encrypted,
+    updatedAt: new Date(row.updated_at).toISOString()
+  };
+}
 var ident4, PostgresRegistryStore, rowToActor, rowToConfig;
 var init_postgres_registry = __esm({
   "../storage/src/postgres-registry.ts"() {
@@ -174703,9 +175275,21 @@ var init_postgres_registry = __esm({
         value_encrypted text NOT NULL,
         updated_at      timestamptz NOT NULL
       )`);
-        await pool.query(`CREATE UNIQUE INDEX IF NOT EXISTS "${s2}_variables_key_actor_uq" ON "${s2}".variables (key, COALESCE(actor_id, ''))`);
         await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS overrides text`);
         await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS actor_id text`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS project_id text`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS environment text`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS delivery_mode text`);
+        await pool.query(`DROP INDEX IF EXISTS "${s2}"."${s2}_variables_key_actor_uq"`);
+        await pool.query(`DROP INDEX IF EXISTS "${s2}"."${s2}_variables_scope_uq"`);
+        await pool.query(`
+      DELETE FROM "${s2}".variables v
+      WHERE v.ctid NOT IN (
+        SELECT DISTINCT ON (key, COALESCE(actor_id, ''), COALESCE(project_id, '')) ctid
+        FROM "${s2}".variables
+        ORDER BY key, COALESCE(actor_id, ''), COALESCE(project_id, ''), updated_at DESC, ctid DESC
+      )`);
+        await pool.query(`CREATE UNIQUE INDEX IF NOT EXISTS "${s2}_variables_scope_uq_v2" ON "${s2}".variables (key, COALESCE(actor_id, ''), COALESCE(project_id, ''))`);
         await pool.query(`
       CREATE TABLE IF NOT EXISTS "${s2}".runtime_configs (
         runtime_id  text PRIMARY KEY,
@@ -175149,27 +175733,36 @@ var init_postgres_registry = __esm({
       }
       /* ---------- 变量 ---------- */
       async putVariable(v2) {
-        const aid = v2.actorId ?? null;
         await this.pool.query(
-          `INSERT INTO ${this.s}.variables (key, scope, actor_id, connector_id, overrides, value_encrypted, updated_at)
-       VALUES ($1,$2,$3,$4,$5,$6,$7)
-       ON CONFLICT (key, COALESCE(actor_id, '')) DO UPDATE
-         SET scope=$2, actor_id=$3, connector_id=$4, overrides=$5, value_encrypted=$6, updated_at=$7`,
-          [v2.key, v2.scope, aid, v2.connectorId ?? null, v2.overrides ?? null, v2.valueEncrypted, v2.updatedAt]
+          `INSERT INTO ${this.s}.variables (key, scope, actor_id, project_id, connector_id, overrides, delivery_mode, value_encrypted, updated_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+       ON CONFLICT (key, COALESCE(actor_id, ''), COALESCE(project_id, '')) DO UPDATE
+         SET scope=$2, actor_id=$3, project_id=$4, connector_id=$5, overrides=$6, delivery_mode=$7, value_encrypted=$8, updated_at=$9`,
+          [
+            v2.key,
+            v2.scope,
+            v2.actorId ?? null,
+            v2.projectId ?? null,
+            v2.connectorId ?? null,
+            v2.overrides ?? null,
+            v2.deliveryMode ?? null,
+            v2.valueEncrypted,
+            v2.updatedAt
+          ]
         );
       }
       async patchVariableValue(key, actorId, valueEncrypted, updatedAt) {
         const aid = actorId ?? null;
         await this.pool.query(
           `UPDATE ${this.s}.variables SET value_encrypted=$3, updated_at=$4
-       WHERE key=$1 AND COALESCE(actor_id,'')=COALESCE($2::text,'')`,
+       WHERE key=$1 AND COALESCE(actor_id,'')=COALESCE($2::text,'') AND COALESCE(project_id,'')=''`,
           [key, aid, valueEncrypted, updatedAt]
         );
       }
       async getVariableCiphertext(key, actorId) {
         const aid = actorId ?? null;
         const r = await this.pool.query(
-          `SELECT value_encrypted FROM ${this.s}.variables WHERE key=$1 AND COALESCE(actor_id,'')=COALESCE($2::text,'')`,
+          `SELECT value_encrypted FROM ${this.s}.variables WHERE key=$1 AND COALESCE(actor_id,'')=COALESCE($2::text,'') AND COALESCE(project_id,'')=''`,
           [key, aid]
         );
         return r.rows[0]?.value_encrypted ?? null;
@@ -175184,21 +175777,21 @@ var init_postgres_registry = __esm({
         } else {
           r = await this.pool.query(`SELECT * FROM ${this.s}.variables ORDER BY key`);
         }
-        return r.rows.map((row) => ({
-          key: row.key,
-          scope: row.scope === "connector" ? "global" : row.scope,
-          ...row.actor_id !== null && row.actor_id !== void 0 ? { actorId: row.actor_id } : {},
-          ...row.connector_id !== null ? { connectorId: row.connector_id } : {},
-          ...row.overrides !== null ? { overrides: row.overrides } : {},
-          valueEncrypted: row.value_encrypted,
-          updatedAt: new Date(row.updated_at).toISOString()
-        }));
+        return r.rows.map((row) => rowToVariable(row));
       }
-      async deleteVariable(key, actorId) {
-        const aid = actorId ?? null;
+      async resolveProjectVariables(projectId) {
+        const r = await this.pool.query(
+          `SELECT * FROM ${this.s}.variables WHERE scope='project' AND project_id=$1 ORDER BY key`,
+          [projectId]
+        );
+        return r.rows.map((row) => rowToVariable(row));
+      }
+      async deleteVariable(key, actorId, scoping) {
         await this.pool.query(
-          `DELETE FROM ${this.s}.variables WHERE key=$1 AND COALESCE(actor_id,'')=COALESCE($2::text,'')`,
-          [key, aid]
+          `DELETE FROM ${this.s}.variables
+       WHERE key=$1 AND COALESCE(actor_id,'')=COALESCE($2::text,'')
+         AND COALESCE(project_id,'')=COALESCE($3::text,'')`,
+          [key, actorId ?? null, scoping?.projectId ?? null]
         );
       }
     };
@@ -176017,6 +176610,7 @@ var init_postgres_projects = __esm({
         work_order_id text PRIMARY KEY,
         project_id    text NOT NULL
       )`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".workspace_bindings ADD COLUMN IF NOT EXISTS environment text`);
         await pool.query(`
       CREATE TABLE IF NOT EXISTS "${s2}".workspace_dispatch_hold (
         work_order_id text PRIMARY KEY
@@ -176886,6 +177480,38 @@ var init_postgres_control_plane = __esm({
   }
 });
 
+// ../storage/src/pg-sanitize.ts
+function hasPgUnstorable(s2) {
+  return new RegExp(PG_UNSTORABLE_SOURCE).test(s2);
+}
+function scrubPgString(v2) {
+  return typeof v2 === "string" ? v2.replace(new RegExp(PG_UNSTORABLE_SOURCE, "g"), REPLACEMENT) : v2;
+}
+function scrubPgJson(v2) {
+  const re = new RegExp(PG_UNSTORABLE_SOURCE, "g");
+  const walk = (x2) => {
+    if (typeof x2 === "string") return x2.replace(re, REPLACEMENT);
+    if (Array.isArray(x2)) return x2.map(walk);
+    if (x2 && typeof x2 === "object") {
+      const out = {};
+      for (const [k2, val] of Object.entries(x2)) {
+        out[k2.replace(re, REPLACEMENT)] = walk(val);
+      }
+      return out;
+    }
+    return x2;
+  };
+  return walk(v2);
+}
+var REPLACEMENT, PG_UNSTORABLE_SOURCE;
+var init_pg_sanitize = __esm({
+  "../storage/src/pg-sanitize.ts"() {
+    "use strict";
+    REPLACEMENT = "\uFFFD";
+    PG_UNSTORABLE_SOURCE = "\\u0000|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|(?<![\\uD800-\\uDBFF])[\\uDC00-\\uDFFF]";
+  }
+});
+
 // ../storage/src/postgres-trace.ts
 var ident9, PostgresTraceStore, rowToRun, rowToEvent2, rowToToolCall, rowToArtifact2;
 var init_postgres_trace = __esm({
@@ -176893,6 +177519,7 @@ var init_postgres_trace = __esm({
     "use strict";
     init_esm2();
     init_src();
+    init_pg_sanitize();
     ident9 = (s2) => {
       if (!/^[a-z_][a-z0-9_]*$/.test(s2)) throw new Error(`invalid schema name: ${s2}`);
       return s2;
@@ -177153,12 +177780,12 @@ var init_postgres_trace = __esm({
             run.exitCode,
             run.exitReason,
             run.errorCode,
-            run.errorMessage,
+            scrubPgString(run.errorMessage),
             run.usage === null ? null : JSON.stringify(run.usage),
             run.effectiveModel,
             run.modelSource,
             run.transcriptRef,
-            JSON.stringify(run.metadata),
+            JSON.stringify(scrubPgJson(run.metadata)),
             run.createdAt,
             run.updatedAt
           ]
@@ -177201,7 +177828,7 @@ var init_postgres_trace = __esm({
         for (const [key, spec] of Object.entries(_PostgresTraceStore.RUN_COLS)) {
           if (!(key in patch)) continue;
           const v2 = patch[key];
-          args.push(spec.json ? v2 == null ? null : JSON.stringify(v2) : v2 ?? null);
+          args.push(spec.json ? v2 == null ? null : JSON.stringify(scrubPgJson(v2)) : scrubPgString(v2 ?? null));
           sets.push(spec.json ? `${spec.col}=$${args.length}::jsonb` : `${spec.col}=$${args.length}`);
         }
         args.push(this.now());
@@ -177340,8 +177967,8 @@ var init_postgres_trace = __esm({
                 stream,
                 level,
                 inp.color ?? null,
-                inp.message ?? null,
-                JSON.stringify(payload),
+                scrubPgString(inp.message ?? null),
+                JSON.stringify(scrubPgJson(payload)),
                 inp.blobRef ?? null,
                 inp.spanId ?? null,
                 inp.parentSpanId ?? null,
@@ -177416,11 +178043,11 @@ var init_postgres_trace = __esm({
             c.durationMs ?? null,
             c.inputRef ?? null,
             c.outputRef ?? null,
-            c.inputPreview ?? null,
-            c.outputPreview ?? null,
+            scrubPgString(c.inputPreview ?? null),
+            scrubPgString(c.outputPreview ?? null),
             c.errorCode ?? null,
-            c.errorMessage ?? null,
-            JSON.stringify(c.metadata ?? {})
+            scrubPgString(c.errorMessage ?? null),
+            JSON.stringify(scrubPgJson(c.metadata ?? {}))
           ]
         );
       }
@@ -177465,12 +178092,12 @@ var init_postgres_trace = __esm({
             a.id,
             a.runId,
             a.kind,
-            a.name,
+            scrubPgString(a.name),
             a.contentType ?? null,
             a.size ?? null,
             a.blobRef,
             a.createdAt,
-            JSON.stringify(a.metadata ?? {})
+            JSON.stringify(scrubPgJson(a.metadata ?? {}))
           ]
         );
       }
@@ -179182,7 +179809,10 @@ __export(src_exports, {
   PostgresTraceStore: () => PostgresTraceStore,
   PostgresTypeRegistryStore: () => PostgresTypeRegistryStore,
   backfillTypeRegistryFromFile: () => backfillTypeRegistryFromFile,
-  createPgPool: () => createPgPool
+  createPgPool: () => createPgPool,
+  hasPgUnstorable: () => hasPgUnstorable,
+  scrubPgJson: () => scrubPgJson,
+  scrubPgString: () => scrubPgString
 });
 var init_src8 = __esm({
   "../storage/src/index.ts"() {
@@ -179195,6 +179825,7 @@ var init_src8 = __esm({
     init_pool();
     init_postgres_control_plane();
     init_postgres_trace();
+    init_pg_sanitize();
     init_postgres_automations();
     init_postgres_chat_sessions();
     init_postgres_nodes();
@@ -179594,15 +180225,18 @@ function splitIdentityFiles3(prompt) {
   }
   return out;
 }
-async function buildActorProvision(service, actorId) {
-  const raw = await service.resolveActorEnv(actorId);
-  const env = { ...raw };
+async function buildActorProvision(service, actorId, scope) {
+  const entries = await service.resolveActorProvisionEntries(actorId, scope);
+  const raw = {};
+  for (const e of entries) raw[e.key] = e.value;
   const provision = await buildConnectorProvision({
     vars: raw,
     actorName: raw["GIT_AUTHOR_NAME"] ?? actorId.split(":").pop() ?? "oasis-agent"
   });
+  const env = { ...raw };
   for (const k2 of provision.sensitiveVars) delete env[k2];
   for (const [k2, v2] of Object.entries(provision.envOverrides)) env[k2] = v2;
+  applyRefDelivery(env, entries);
   return {
     env,
     wrapperPaths: [oasisWrapperScript(), ...provision.wrapperPaths],
@@ -179828,6 +180462,45 @@ async function startServe(opts) {
     });
     for (const l of registryListeners) l({ kind: record6.kind, actor: record6.actor, target: record6.target, timestamp: record6.timestamp });
   };
+  const credentialAudit = (record6) => {
+    fs29.appendFile(registryAuditFile, JSON.stringify(record6) + "\n", () => {
+    });
+    for (const l of registryListeners) l({ kind: record6.kind, actor: record6.actor, target: record6.variableKey, timestamp: record6.timestamp });
+  };
+  const readCredentialAudit = async (filter) => {
+    let raw;
+    try {
+      raw = await fs29.promises.readFile(registryAuditFile, "utf8");
+    } catch {
+      return [];
+    }
+    const out = [];
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      let rec;
+      try {
+        rec = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (typeof rec.kind !== "string" || !rec.kind.startsWith("credential_reveal")) continue;
+      if (filter.actor && rec.actor !== filter.actor) continue;
+      if (filter.key && rec.variableKey !== filter.key) continue;
+      if (filter.kind && rec.kind !== filter.kind) continue;
+      out.push(rec);
+    }
+    out.reverse();
+    return typeof filter.limit === "number" ? out.slice(0, filter.limit) : out;
+  };
+  const resolveDispatchScope = async (artifactId) => {
+    const ws = kernel.model.artifacts.get(artifactId)?.workspace;
+    if (!ws) return {};
+    const binding = await artifactStateStore.getWorkspaceBinding(ws);
+    if (!binding) return {};
+    return {
+      ...binding.projectId ? { projectId: binding.projectId } : {}
+    };
+  };
   await syncRegistryRolesToKernel(registryStore, kernel);
   let builtinSkills = [];
   let connectorSkills = [];
@@ -179844,6 +180517,13 @@ async function startServe(opts) {
     blobs: assets,
     trace: () => traceStoreForActors,
     audit: registryAudit,
+    // ADR 凭据保险库 §4.5/§4.7 / ADR 0125：reveal 判权的项目解析 + 凭据读取审计读写。
+    resolveDispatchScope,
+    credentialAudit,
+    readCredentialAudit,
+    // ADR 0125：写 scope=project 变量时校验 projectId 真实存在（getProject 直查，含临时项目）。
+    // projectStateStore 在下方 ~行 1023 才赋值——本箭头只在请求时跑，那时已就绪（同 resolveDispatchScope 惰性模式）。
+    projectExists: async (id) => await projectStateStore.getProject(id) !== null,
     // CO-302 数据面隔离（actors 域试点）：按当前公司取其引擎，用各自 registry 服务该域请求。
     // engineRouter 在下方（行 ~411）以 const 声明；此箭头只在请求时调用，那时已初始化，闭包引用合法
     // （TDZ 只在构造时访问才报错，这里不访问）。默认公司命中现有单实例（registry===registryStore），
@@ -179974,7 +180654,13 @@ async function startServe(opts) {
   traceStoreForActors = traceStore;
   const trajReader = new FsTrajectorySink(opts.dir);
   const trace = createTraceDomain({ store: traceStore, readBundleFile: (id, rel) => trajReader.readBundleFile(id, rel) });
-  const traceStoreSink = new TraceStoreSink({ store: traceStore, runtimeKind: "auto" });
+  const traceHealth = createTraceHealth();
+  const traceStoreSink = new TraceStoreSink({
+    store: traceStore,
+    runtimeKind: "auto",
+    health: traceHealth,
+    onError: (err) => console.warn(`[trace-sink] \u5199\u89C2\u6D4B\u6D41\u5931\u8D25\uFF08\u7EE7\u7EED\u3001\u4E0D\u5F71\u54CD\u6D3E\u53D1\uFF09: ${String(err)}`)
+  });
   const automationStore = pgPool ? await PostgresAutomationStore.open(pgPool, pgSchema) : new MemoryAutomationStore();
   console.log(`[serve] \u81EA\u52A8\u5316\u4F53\u7CFB\uFF1A${pgPool ? `Postgres schema=${pgSchema}` : "\u5185\u5B58 dev store"}`);
   const automations = createAutomationsDomain({ store: automationStore, kernel });
@@ -180438,6 +181124,8 @@ async function startServe(opts) {
         // 组织汇总用——从 node_runtimes 取 hostname，解析运行时实例标签（kind @ hostname）
         listRuntimes: (nodeId) => nodeStore.listRuntimes(nodeId),
         dispatchJournal: () => journalRing.slice(-200),
+        // 组织汇总用——从 nodes 取 name（用户友好名），优先于 hostname 作为展示标签
+        listNodes: () => nodeStore.listNodes(),
         // 诊断 92ac8f18-83e5fde6 §④ D-2：按**请求公司**取其 dispatcher 的 queued/backoff 信号。
         // CO-302 每家公司各有一套 dispatcher（dispatchers 以 companyId 为键）——固定读默认公司会让
         // 非默认公司请求拿到错的/空的信号（code-review 打回）。该公司未起 dispatcher（老部署无 --dispatch、
@@ -180577,10 +181265,14 @@ async function startServe(opts) {
         const traceRunId = `chat-run:${(0, import_node_crypto37.randomUUID)()}`;
         const artifactId = `artifact:chat:${(0, import_node_crypto37.randomUUID)()}`;
         const traceStartedAt = (/* @__PURE__ */ new Date()).toISOString();
-        let traceSeq = 0;
         let lastProgressTouchMs = 0;
         const PROGRESS_TOUCH_THROTTLE_MS2 = 2e4;
-        let traceEnabled = true;
+        const traceAppender = new ResilientTraceAppender({
+          runId: traceRunId,
+          store: traceStore,
+          health: traceHealth,
+          onError: (err) => console.warn(`[trace] chat run ${traceRunId} \u5199\u5931\u8D25\uFF08\u7EE7\u7EED\u3001\u4E0D\u7184\u706D\uFF09: ${String(err)}`)
+        });
         const analyzedRunId = chatSessionId ? (await chatSessionStore.getSession(chatSessionId).catch(() => null))?.analyzedRunId ?? void 0 : void 0;
         let traceChain = traceStore.createRun({
           id: traceRunId,
@@ -180601,16 +181293,14 @@ async function startServe(opts) {
             ...analyzedRunId ? { analyzedRunId } : {}
           }
         }).then(async () => {
-          await traceStore.appendEvents(traceRunId, [
+          await traceAppender.append([
             {
-              seq: ++traceSeq,
               eventType: "run.started",
               stream: "runtime",
               message: `chat ${actorId}`,
               startedAt: traceStartedAt
             },
             {
-              seq: ++traceSeq,
               eventType: "input.message",
               stream: "model",
               actorId,
@@ -180620,16 +181310,12 @@ async function startServe(opts) {
             }
           ]);
         }).catch((err) => {
-          traceEnabled = false;
-          console.warn(`[trace] chat run create failed: ${String(err)}`);
+          traceHealth.markUnhealthy(traceRunId);
+          console.warn(`[trace] chat run create failed (continuing): ${String(err)}`);
         });
         const enqueueTrace = (step) => {
-          if (!traceEnabled) return;
-          traceChain = traceChain.then(async () => {
-            if (traceEnabled) await step();
-          }).catch((err) => {
-            traceEnabled = false;
-            console.warn(`[trace] chat run ${traceRunId} failed: ${String(err)}`);
+          traceChain = traceChain.then(step).catch((err) => {
+            console.warn(`[trace] chat run ${traceRunId} \u7EED\u8D26\u5F02\u5E38: ${String(err)}`);
           });
         };
         const provision = await buildActorProvision(actorService, actorId);
@@ -180776,7 +181462,7 @@ async function startServe(opts) {
           const run = await traceStore.getRun(traceRunId);
           if (!run) return;
           const base = run.metadata && typeof run.metadata === "object" && !Array.isArray(run.metadata) ? run.metadata : {};
-          await traceStore.updateRun(traceRunId, {
+          await traceAppender.update({
             metadata: { ...base, dispatchId: handle.id },
             // 恢复路径拿不到 dispatchChat 闭包里的 fallback 解析结果，开跑时先写进账本；退出帧若上报
             // 更精确 model 仍会覆盖为 runtime 来源。
@@ -180798,23 +181484,23 @@ async function startServe(opts) {
             const ms = Date.parse(event.ts);
             if (!Number.isNaN(ms) && ms - lastProgressTouchMs >= PROGRESS_TOUCH_THROTTLE_MS2) {
               lastProgressTouchMs = ms;
-              enqueueTrace(() => traceStore.updateRun(traceRunId, { lastProgressAt: event.ts }).then(() => void 0));
+              enqueueTrace(() => traceAppender.update({ lastProgressAt: event.ts }).then(() => void 0));
             }
             return;
           }
-          enqueueTrace(() => traceStore.appendEvents(traceRunId, [trajectoryEventToRunEvent(event, ++traceSeq)]).then(() => void 0));
+          enqueueTrace(() => traceAppender.append([trajectoryEventToRunEvent(event)]).then(() => void 0));
         });
         let capturedNativeSessionId;
         const done = new Promise((resolve8, reject) => {
           handle.onExit((info) => {
             chatLiveSessions.delete(chatJobKey);
+            traceHealth.forget(traceRunId);
             void provision.cleanup();
             const endedAt = (/* @__PURE__ */ new Date()).toISOString();
             const durationMs = Date.parse(endedAt) - Date.parse(traceStartedAt);
             if (info.runtimeSessionId) capturedNativeSessionId = info.runtimeSessionId;
             enqueueTrace(async () => {
-              await traceStore.appendEvents(traceRunId, [{
-                seq: ++traceSeq,
+              await traceAppender.append([{
                 eventType: "run.finished",
                 stream: "runtime",
                 message: `exit code=${info.code ?? "killed"}`,
@@ -180823,7 +181509,7 @@ async function startServe(opts) {
               const usage = info.usage ?? null;
               const effectiveModel = info.model ?? chatModel ?? null;
               const modelSource = info.model ? "runtime" : chatModelSource;
-              await traceStore.updateRun(traceRunId, {
+              await traceAppender.update({
                 status: info.reason === "timeout" ? "timeout" : info.reason === "cancelled" ? "cancelled" : info.code === 0 ? "succeeded" : "failed",
                 endedAt,
                 durationMs,
@@ -180928,6 +181614,7 @@ async function startServe(opts) {
             unregister: () => {
               chatLiveSessions.delete(jobKey);
             },
+            traceHealth,
             log: (m2) => console.log(m2)
           });
           console.log(`[chat-recovery] \u91CD\u6302 chat \u8F6E\uFF1Asession=${plan.chatSessionId} run=${plan.runId} node=${daemonId}`);
@@ -181148,7 +181835,7 @@ async function startServe(opts) {
           console.warn(`[dispatch] artifact ${artifactId} owner ${actor} \u5DF2\u505C\u7528\uFF0C\u6309 ownerRole=${ownerRole} \u6539\u6D3E\u7ED9 ${replacement.id}${rejected.length ? `\uFF08\u8DF3\u8FC7\u4E0D\u5065\u5EB7\u7684\uFF1A${rejected.join("\u3001")}\uFF09` : ""}`);
           return { actor: replacement.id, originalActor: actor, routeReason: "disabled-owner-fallback" };
         },
-        provision: async (actorId) => buildActorProvision((await runActors()).service, actorId),
+        provision: async (actorId, artifactId) => buildActorProvision((await runActors()).service, actorId, artifactId ? await resolveDispatchScope(artifactId) : void 0),
         resolveActorContext: async (actorId) => buildActorContext((await runActors()).service, actorId),
         // 收尾评审的角色分工段（reviewer 此前彼此不知道对方存在 → 越界 / 重复劳动）。
         // 职责取自**岗位目录**（配置面），不在代码里硬编码任何岗位——加角色自动就在。
@@ -181771,7 +182458,7 @@ ${nodeFault}` : "");
       resolveManager: (id) => resolveManagerBinding(registryStore, id),
       schemaTypes: schema.map((d) => d.name),
       schemaTypeDescriptions: Object.fromEntries(schema.filter((d) => d.description).map((d) => [d.name, d.description])),
-      provision: (actorId) => buildActorProvision(actors.service, actorId),
+      provision: async (actorId, artifactId) => buildActorProvision(actors.service, actorId, artifactId ? await resolveDispatchScope(artifactId) : void 0),
       // 阻塞诊断（proposal D1/D3）：派发器运行时信号（queued/fused/backoff/hasInFlight）注入诊断，
       // 让协调者把"资源 / 运行时"病因和"图病"分开——资源排队的节点不会被误唤去砍流程。
       runtimeSignals: (id) => {
@@ -181811,6 +182498,9 @@ ${nodeFault}` : "");
             if (c) return Promise.resolve(c.kill()).then(() => true).catch(() => false);
             return dispatcherByJob.get(jobKey)?.killSession(jobKey) ?? Promise.resolve(false);
           },
+          // trace 写不进去的 run：冻结的事件钟是"观测降级"不是"真静默"，按"信息不足→不判"跳过、交 wallClock
+          // 兜底（brief §限制1 / 诊断 §6）。真卡死的 run trace 健康、isTraceHealthy=true，照常被杀。
+          isTraceHealthy: (sessionId) => traceHealth.isHealthy(sessionId),
           now: Date.now(),
           silentThresholdMs,
           log: (m2) => console.log(m2)
@@ -181973,7 +182663,7 @@ var SessionManager = class {
 
 // ../cli/src/daemon/ws-client.ts
 init_wrapper();
-var import_node_os7 = require("node:os");
+var import_node_os9 = require("node:os");
 var import_node_crypto38 = require("node:crypto");
 init_src5();
 
@@ -182029,7 +182719,7 @@ function detectRuntimes() {
 
 // ../cli/src/daemon/workdir-handler.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 init_src4();
 init_src();
 var WORKDIR_READ_MAX_BYTES2 = 2 * 1024 * 1024;
@@ -182048,10 +182738,10 @@ function isSensitiveSegment(segment) {
 }
 function relPathIsSensitive(rel) {
   if (!rel) return false;
-  return rel.split(import_node_path18.default.sep).some((seg) => seg.length > 0 && isSensitiveSegment(seg));
+  return rel.split(import_node_path20.default.sep).some((seg) => seg.length > 0 && isSensitiveSegment(seg));
 }
 function withinBase(p2, base) {
-  return p2 === base || p2.startsWith(base + import_node_path18.default.sep);
+  return p2 === base || p2.startsWith(base + import_node_path20.default.sep);
 }
 function normalizeRel(raw) {
   const trimmed = (raw ?? "").trim();
@@ -182068,7 +182758,7 @@ async function trustedCanonicalContainer(req, logicalBase, dirKind) {
   } catch {
     return null;
   }
-  return isLegacy ? import_node_path18.default.join(trustedRootReal, "oasis-chat-sessions") : import_node_path18.default.join(trustedRootReal, "sessions", dirKind);
+  return isLegacy ? import_node_path20.default.join(trustedRootReal, "oasis-chat-sessions") : import_node_path20.default.join(trustedRootReal, "sessions", dirKind);
 }
 async function resolveWithinWorkdir(req) {
   const dirKind = sessionDirKind(req.runtimeKind);
@@ -182086,11 +182776,11 @@ async function resolveWithinWorkdir(req) {
   } catch {
     return { ok: false, code: "NOT_FOUND" };
   }
-  if (import_node_path18.default.dirname(base) !== canonicalContainer) return { ok: false, code: "PATH_ESCAPE" };
+  if (import_node_path20.default.dirname(base) !== canonicalContainer) return { ok: false, code: "PATH_ESCAPE" };
   const rel = normalizeRel(req.path);
-  const requested = import_node_path18.default.resolve(base, rel);
+  const requested = import_node_path20.default.resolve(base, rel);
   if (!withinBase(requested, base)) return { ok: false, code: "PATH_ESCAPE" };
-  const cleanRel = base === requested ? "" : import_node_path18.default.relative(base, requested);
+  const cleanRel = base === requested ? "" : import_node_path20.default.relative(base, requested);
   if (relPathIsSensitive(cleanRel)) return { ok: false, code: "SENSITIVE" };
   let real;
   try {
@@ -182100,7 +182790,7 @@ async function resolveWithinWorkdir(req) {
     return { ok: false, code: "PATH_ESCAPE" };
   }
   if (!withinBase(real, base)) return { ok: false, code: "PATH_ESCAPE" };
-  const realRel = base === real ? "" : import_node_path18.default.relative(base, real);
+  const realRel = base === real ? "" : import_node_path20.default.relative(base, real);
   if (relPathIsSensitive(realRel)) return { ok: false, code: "SENSITIVE" };
   return { ok: true, base, real };
 }
@@ -182136,7 +182826,7 @@ async function handleWorkdirList(req) {
       const slice = truncated ? visible.slice(0, WORKDIR_LIST_MAX_ENTRIES) : visible;
       const entries = [];
       for (const d of slice) {
-        const abs = import_node_path18.default.join(anchor, d.name);
+        const abs = import_node_path20.default.join(anchor, d.name);
         try {
           const st = await import_node_fs16.default.promises.lstat(abs);
           if (st.isSymbolicLink()) continue;
@@ -182168,7 +182858,7 @@ async function verifyOpenedFd(fh, base, fallback) {
   const fdReal = await fdCanonicalPath(fh);
   if (fdReal === null) return { anchor: fallback };
   if (!withinBase(fdReal, base)) return { error: { ok: false, code: "PATH_ESCAPE" } };
-  const fdRel = base === fdReal ? "" : import_node_path18.default.relative(base, fdReal);
+  const fdRel = base === fdReal ? "" : import_node_path20.default.relative(base, fdReal);
   if (relPathIsSensitive(fdRel)) return { error: { ok: false, code: "SENSITIVE" } };
   return { anchor: `/proc/self/fd/${fh.fd}` };
 }
@@ -182257,7 +182947,7 @@ function looksBinary(bytes) {
 function contentTypeFor(absPath, bytes) {
   const sniffed = sniffContentType(bytes);
   if (sniffed) return sniffed;
-  const ext = import_node_path18.default.extname(absPath).toLowerCase();
+  const ext = import_node_path20.default.extname(absPath).toLowerCase();
   if (EXT_CONTENT_TYPE[ext]) return EXT_CONTENT_TYPE[ext];
   return looksBinary(bytes) ? "application/octet-stream" : "text/plain; charset=utf-8";
 }
@@ -182600,7 +183290,7 @@ var DaemonWsClient = class {
   buildMeta() {
     const activeSessions = this.sessions.activeSessions();
     return {
-      hostname: (0, import_node_os7.hostname)(),
+      hostname: (0, import_node_os9.hostname)(),
       adapters: this.adapters,
       ...this.reportRuntimes ? { runtimes: this.runtimes } : {},
       nodeVersion: process.version,
@@ -182630,18 +183320,18 @@ var RuntimeRouterAdapter = class {
 
 // ../cli/src/daemon/reap-claude-projects.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_os10 = __toESM(require("node:os"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 function claudeProjectSlug(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
 function claudeProjectsRoot() {
-  const configDir = process.env["CLAUDE_CONFIG_DIR"] || import_node_path19.default.join(import_node_os8.default.homedir(), ".claude");
-  return import_node_path19.default.join(configDir, "projects");
+  const configDir = process.env["CLAUDE_CONFIG_DIR"] || import_node_path21.default.join(import_node_os10.default.homedir(), ".claude");
+  return import_node_path21.default.join(configDir, "projects");
 }
 function reapClaudeProjects(workdir, runtimeKind) {
   if (runtimeKind !== "claude" && runtimeKind !== "claude-code") return;
-  const dir = import_node_path19.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
+  const dir = import_node_path21.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
   if (!import_node_fs17.default.existsSync(dir)) return;
   try {
     import_node_fs17.default.rmSync(dir, { recursive: true, force: true });
@@ -182651,7 +183341,7 @@ function reapClaudeProjects(workdir, runtimeKind) {
 
 // ../cli/src/node.ts
 init_src4();
-var import_node_os9 = __toESM(require("node:os"), 1);
+var import_node_os11 = __toESM(require("node:os"), 1);
 var RESILIENCE = {
   codex: { idleTimeoutMs: 6e5 }
 };
@@ -182715,7 +183405,7 @@ async function startNode(opts) {
   console.log(`[oasis node] ${opts.nodeId} \u2192 ${opts.serverUrl}`);
   client.start();
   const { workRoot, legacyRoot } = resolveWorkRoots(opts.workRoot);
-  const workRootIsEphemeral = workRoot.startsWith(import_node_os9.default.tmpdir());
+  const workRootIsEphemeral = workRoot.startsWith(import_node_os11.default.tmpdir());
   if (opts.gcEnabled === false && !workRootIsEphemeral) {
     console.warn(`[oasis node] \u26A0 \u56DE\u6536\u5668\u5DF2\u5173\u95ED\uFF0C\u800C\u5DE5\u4F5C\u533A\u5728\u6301\u4E45\u76D8\uFF08${workRoot}\uFF09\u2014\u2014\u6CA1\u6709\u4EFB\u4F55\u5783\u573E\u56DE\u6536\uFF0C\u5B9E\u6D4B\u4E24\u5468\u4F1A\u6DA8 12.4GB\u3002\u4EC5\u4F9B\u6392\u969C\uFF0C\u522B\u957F\u671F\u8FD9\u4E48\u8DD1\u3002`);
   }
@@ -182750,7 +183440,7 @@ async function startNode(opts) {
 var import_node_child_process16 = require("node:child_process");
 var import_node_fs18 = require("node:fs");
 var import_node_crypto39 = require("node:crypto");
-var import_node_os10 = require("node:os");
+var import_node_os12 = require("node:os");
 function linuxMachineId() {
   for (const p2 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
     try {
@@ -182790,13 +183480,13 @@ function windowsMachineId() {
 }
 function fallbackFingerprint() {
   const macs = [];
-  const ifaces = (0, import_node_os10.networkInterfaces)();
+  const ifaces = (0, import_node_os12.networkInterfaces)();
   for (const name of Object.keys(ifaces).sort()) {
     for (const ni of ifaces[name] ?? []) {
       if (!ni.internal && ni.mac && ni.mac !== "00:00:00:00:00:00") macs.push(ni.mac);
     }
   }
-  return `fallback:${(0, import_node_os10.hostname)()}:${macs.sort()[0] ?? "no-mac"}`;
+  return `fallback:${(0, import_node_os12.hostname)()}:${macs.sort()[0] ?? "no-mac"}`;
 }
 function machineFingerprint() {
   const byOs = process.platform === "darwin" ? macMachineId() : process.platform === "win32" ? windowsMachineId() : linuxMachineId();
@@ -182806,7 +183496,7 @@ var defaultSources = {
   machineFingerprint,
   osUser: () => {
     try {
-      return (0, import_node_os10.userInfo)().username;
+      return (0, import_node_os12.userInfo)().username;
     } catch {
       return process.env["USER"] ?? process.env["USERNAME"] ?? "unknown";
     }
@@ -183810,6 +184500,19 @@ var COMMAND_DECLS = {
     description: "\u4EA4\u4ED8\u7269\u6587\u6863\u4F53\u7CFB\u64CD\u4F5C\uFF08artifact revision \u5B50\u547D\u4EE4\u96C6\uFF09\u3002",
     subCommands: ["artifact revision register", "artifact revision approve", "artifact revision reject"],
     examples: ['oasis artifact revision register --project oasis --artifact-id artifact:dev:abc --type dev --title "v1.0" --version 1 --content-ref ref-001']
+  },
+  var: {
+    usage: "oasis var <reveal> ...",
+    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF1A\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u660E\u6587\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 \xA74.5\uFF09\u3002",
+    subCommands: ["var reveal"],
+    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD"]
+  },
+  "var reveal": {
+    usage: "oasis var reveal <key> [--source <tag>]",
+    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002\u660E\u6587\u53EA\u8F93\u51FA\u5230 stdout\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key\uFF08\u53EF\u4F20\u88F8 key \u6216 oasis://var/<key> \u5F15\u7528\uFF0C\u4E8C\u8005\u7B49\u4EF7\uFF09" }],
+    flags: [{ name: "source", desc: "\u8C03\u7528\u6765\u6E90\u6807\u8BB0\uFF08\u5BA1\u8BA1\u7528\uFF0C\u5982 smoke-test\uFF1B\u7F3A\u7701 agent-cli\uFF09", own: true }],
+    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var reveal oasis://var/GLM_API_KEY --source smoke-test"]
   }
 };
 function formatCommandHelp(decl) {
@@ -185475,6 +186178,33 @@ ${res.warning}`);
       println(`\u5DF2\u5220\u9664 ${memId}`);
       break;
     }
+    case "var": {
+      const sub = positional[0];
+      if (sub === "reveal") {
+        const rawKey = needPos(positional, 1, "oasis var reveal <key> [--source <tag>]");
+        const key = parseVarRef(rawKey) ?? rawKey;
+        const source = flags.get("source");
+        try {
+          const out = await api.request("POST", "/api/variables/reveal", {
+            key,
+            ...source ? { source } : {}
+          });
+          println(out.value);
+        } catch (e) {
+          if (e instanceof ApiRequestError && e.status === 403) {
+            throw new Error(`\u51ED\u636E\u4E0D\u53EF\u8BFB\uFF1A${key}\uFF08403 denied\uFF09\u2014\u2014\u8BE5 key \u4E0D\u5B58\u5728\uFF0C\u6216\u672C\u4F1A\u8BDD\u65E0\u6743\u8BFB\u53D6\uFF08ADR \xA74.5\uFF09\u3002\u522B\u5FAA\u73AF\u91CD\u8BD5\uFF1B\u7F3A\u51ED\u636E\u8BF7\u4E0A\u62A5\u8FD0\u7EF4\u3002`);
+          }
+          if (e instanceof ApiRequestError && e.status === 429) {
+            const scope = e.body?.scope ?? "session";
+            throw new Error(`reveal \u89E6\u53D1\u9650\u6D41\uFF1A${key}\uFF08429 throttled\uFF0C\u6863=${scope}\uFF09\u2014\u2014\u77ED\u65F6\u5185\u8BFB\u53D6\u8FC7\u591A\u3002\u522B\u518D\u5FAA\u73AF reveal \u540C\u4E00 key\u3002`);
+          }
+          throw e;
+        }
+        break;
+      }
+      throw new Error(`\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Aoasis var ${sub ?? ""}
+\u53EF\u7528\uFF1Aoasis var reveal <key> [--source <tag>]`);
+    }
     case "pin": {
       const { message } = await api.cmd("pin", {
         artifactId: needPos(positional, 0, "oasis pin <artifactId> --to u --rev r"),
@@ -186174,7 +186904,7 @@ function syncRuntimeAssets(candidateRoots, binDir) {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "0.1.87" : "dev";
+var PKG_VERSION = true ? "0.1.90" : "dev";
 var OASIS_DIR = path29.join(os9.homedir(), ".oasis");
 var CONFIG_FILE = path29.join(OASIS_DIR, "node-config.json");
 var PID_FILE = path29.join(OASIS_DIR, "node.pid");