oasis_test_v2 2.2.11 → 2.2.12

package/dist/index.js

@@ -28783,6 +28783,8 @@ var init_chat_item_ledger = __esm({
        * 也不算进本段的 assistant item 计数。
        */
       recordUserInput(text5, attachments) {
+        const payload = { role: "user", text: text5 };
+        if (attachments?.length) payload.attachments = attachments;
         this.insert({
           kind: "text",
           role: "user",
@@ -28793,6 +28795,7 @@ var init_chat_item_ledger = __esm({
           inContent: false,
           persist: true,
           forceNullMessage: true,
+          payload,
           metadata: {
             [CHAT_ITEM_META_LEGACY_CONTENT]: false,
             ...attachments?.length ? { attachments } : {}
@@ -29111,7 +29114,8 @@ var init_chat_item_ledger = __esm({
               ord: created.ord,
               version: writeVersion,
               role: input.role,
-              text: input.text
+              text: input.text,
+              payload
             });
           } catch {
           }
@@ -160522,6 +160526,7 @@ var init_live_chat = __esm({
         if (!turn || turn.status !== "running") {
           return say({ accepted: false, reason: "no-live-turn" }, { turnStatus: turn?.status ?? "<no-turn>" });
         }
+        if (turn.recovering) return say({ accepted: false, reason: "recovering" }, { recovering: true });
         const fn = turn.handle.appendInput;
         if (typeof fn !== "function") return say({ accepted: false, reason: "unsupported" });
         const pendingItemId = !opts?.system && opts?.clientMessageKey ? `oasis-user:${opts.clientMessageKey}` : void 0;
@@ -160797,7 +160802,7 @@ async function appendNowThroughQueue(chatSessionId, text5, deps, clientKey, atta
     ...displayText !== merged ? { displayText } : {},
     ...attachmentRefs.length ? { attachments: attachmentRefs } : {}
   });
-  const DEFINITELY_NOT_DELIVERED = /* @__PURE__ */ new Set(["unsupported", "no-live-turn", "session-closing", "turn-finished"]);
+  const DEFINITELY_NOT_DELIVERED = /* @__PURE__ */ new Set(["unsupported", "no-live-turn", "session-closing", "turn-finished", "recovering"]);
   const nextState = res.accepted ? "delivered" : DEFINITELY_NOT_DELIVERED.has(res.reason ?? "") ? "queued" : "unconfirmed";
   await deps.store.markPendingMessages?.(chatSessionId, ids2, nextState, res.reason).catch(() => void 0);
   return { ...res, queued: true, delivered: merged, batch, ...prepared.paths.length ? { attachmentPaths: prepared.paths } : {} };
@@ -163873,7 +163878,8 @@ async function linkChatAttachmentsToWorkOrder(input) {
       ...candidate.contentType ?? meta?.contentType ? { contentType: candidate.contentType ?? meta?.contentType } : {},
       sourceSessionId: input.chatSessionId,
       sourceMessageId: candidate.messageId,
-      linkedAt: input.linkedAt
+      linkedAt: input.linkedAt,
+      ...input.uploadedBy ? { uploadedBy: input.uploadedBy } : {}
     };
     try {
       await input.artifacts.addWorkOrderFile(file);
@@ -196760,6 +196766,7 @@ var init_continue_outcome = __esm({
     "use strict";
     REASON_TEXT = {
       "no-live-turn": "\u4E13\u5BB6\u6B64\u523B\u6CA1\u6709\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\uFF08\u591A\u534A\u662F\u521A\u6536\u5C3E\u3001\u4E0B\u4E00\u8F6E\u8FD8\u6CA1\u8D77\u6765\uFF09",
+      recovering: "\u670D\u52A1\u521A\u91CD\u542F\uFF0C\u4E13\u5BB6\u90A3\u4E00\u8F6E\u8FD8\u5728\u6062\u590D\u4E2D\uFF08\u8282\u70B9\u91CD\u8FDE\u540E\u5C31\u80FD\u63D2\uFF1B\u8FD9\u53E5\u8BDD\u5DF2\u6392\u961F\uFF09",
       unsupported: "\u8FD9\u4E2A\u4E13\u5BB6\u7528\u7684\u6A21\u578B\u4E0D\u652F\u6301\u4E2D\u9014\u63D2\u8BDD\uFF08\u8981\u7B49\u5B83\u8FD9\u4E00\u8F6E\u8DD1\u5B8C\uFF09",
       "session-closing": "\u4E13\u5BB6\u90A3\u4E00\u8F6E\u6B63\u5728\u6536\u5C3E\uFF0C\u8FD9\u53E5\u8BDD\u6765\u665A\u4E86\u4E00\u6B65",
       "turn-finished": "\u6295\u9012\u8FC7\u7A0B\u4E2D\u4E13\u5BB6\u90A3\u4E00\u8F6E\u5DF2\u7ECF\u6536\u5C3E\u4E86",
@@ -198844,9 +198851,13 @@ async function mintInstallationToken(args, deps = {}) {
   const token = typeof body2["token"] === "string" ? body2["token"] : "";
   if (!token) throw new Error("github app: token missing in response");
   const parsed = typeof body2["expires_at"] === "string" ? Date.parse(body2["expires_at"]) : NaN;
+  const rawPerms = body2["permissions"];
+  const permissions = {};
+  for (const [k2, v2] of Object.entries(rawPerms ?? {})) if (typeof v2 === "string") permissions[k2] = v2;
   return {
     token,
-    expiresAtMs: Number.isFinite(parsed) ? parsed : nowMs + 60 * 60 * 1e3
+    expiresAtMs: Number.isFinite(parsed) ? parsed : nowMs + 60 * 60 * 1e3,
+    permissions
   };
 }
 async function listAppInstallations(args, deps = {}) {
@@ -198870,7 +198881,10 @@ async function listAppInstallations(args, deps = {}) {
     const id = item["id"] === void 0 ? "" : String(item["id"]);
     if (!id) return [];
     const account = item["account"];
-    return [{ installationId: id, account: String(account?.["login"] ?? "") }];
+    const rawPerms = item["permissions"];
+    const permissions = {};
+    for (const [k2, v2] of Object.entries(rawPerms ?? {})) if (typeof v2 === "string") permissions[k2] = v2;
+    return [{ installationId: id, account: String(account?.["login"] ?? ""), permissions }];
   });
 }
 async function fetchAppSelfMetadata(args, deps = {}) {
@@ -205065,7 +205079,9 @@ async function startOasisServer(opts) {
                   blobMeta: blobMetaAcrossCabinets,
                   // 工单就是这一刻建出来的，所以「现在」就是任务创建时间。取一次、全部文件共用，
                   // 保证同一次建单带进来的文件在任务侧显示的是同一个时刻（排期序 28 原文口径）。
-                  linkedAt: (/* @__PURE__ */ new Date()).toISOString()
+                  linkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  // 建单发起人就是把这些附件带进任务的人——项目页「创建人」列与预览副标据此署名。
+                  uploadedBy: actor
                 }).catch((err) => ({
                   linked: 0,
                   warnings: [`\u672A\u80FD\u628A\u672C\u6B21\u5BF9\u8BDD\u7684\u9644\u4EF6\u5E26\u5165\u4EFB\u52A1\u6587\u4EF6\uFF1A${err instanceof Error ? err.message : String(err)}`]
@@ -206226,13 +206242,16 @@ ${composed}`;
                    只推 user：assistant 的每一条本来就走 `emitV3`。 */
                 onPersisted: (info) => {
                   if (info.role !== "user") return;
+                  const rowPayload = info.payload && typeof info.payload === "object" && !Array.isArray(info.payload) ? info.payload : void 0;
+                  const rowCsid = typeof rowPayload?.["clientSubmitId"] === "string" ? rowPayload["clientSubmitId"] : void 0;
+                  const rowAttachments = Array.isArray(rowPayload?.["attachments"]) ? rowPayload["attachments"] : void 0;
                   opts.liveChat?.publishUserItem(persistTarget?.id ?? session.id, {
                     itemId: info.itemId,
                     ord: info.ord,
                     version: info.version,
                     text: info.text,
-                    ...clientSubmitId ? { clientSubmitId } : {},
-                    ...effectiveAttachments.length ? { attachments: effectiveAttachments } : {}
+                    ...rowCsid ? { clientSubmitId: rowCsid } : {},
+                    ...rowAttachments?.length ? { attachments: rowAttachments } : {}
                   });
                 },
                 sessionId: persistTarget?.id ?? session.id,
@@ -207154,8 +207173,26 @@ ${composed}`;
               return;
             }
             const meta = await fetchAppSelfMetadata({ appId, privateKeyPem });
-            const installationId = await svc.revealResolvedVariable("GITHUB_APP_INSTALLATION_ID", actorId);
-            const effective = installationId ? await fetchInstallationPermissions({ appId, privateKeyPem, installationId }) : meta.permissions;
+            const storedInstallationId = await svc.revealResolvedVariable("GITHUB_APP_INSTALLATION_ID", actorId);
+            const installs = await listAppInstallations({ appId, privateKeyPem }).catch(() => []);
+            const chosen = installs.find((i) => i.installationId === storedInstallationId) ?? (installs.length === 1 ? installs[0] : void 0);
+            const installationStale = Boolean(storedInstallationId) && installs.length > 0 && !chosen;
+            const installationId = chosen?.installationId || storedInstallationId;
+            let grantedFrom = "app";
+            let effective = meta.permissions;
+            if (installationId) {
+              const minted = await mintInstallationToken({ appId, privateKeyPem, installationId }).catch(() => null);
+              if (minted && Object.keys(minted.permissions).length > 0) {
+                effective = minted.permissions;
+                grantedFrom = "token";
+              } else if (chosen && Object.keys(chosen.permissions).length > 0) {
+                effective = chosen.permissions;
+                grantedFrom = "installation";
+              } else {
+                effective = await fetchInstallationPermissions({ appId, privateKeyPem, installationId });
+                grantedFrom = "installation";
+              }
+            }
             const missing = missingAppPermissions(effective);
             const requestedAll = Object.entries(meta.permissions).filter(([, level]) => Boolean(level)).map(([key, level]) => ({ key, level: String(level) })).sort((a, b2) => a.key.localeCompare(b2.key));
             const grantedKeys = new Set(
@@ -207169,13 +207206,27 @@ ${composed}`;
               requested: requestedAll,
               /** true＝读的是这次安装真正被授予的权限；false＝只拿到 App 申请的，可能偏乐观。 */
               fromInstallation: Boolean(installationId),
+              /** 「已授予」这一列是从哪问出来的：token（最准）/ 安装记录 / 只有 App 申请。 */
+              grantedFrom,
+              /** 读的是哪一处安装——同一个 App 装多处时，人得看得见自己批的是不是这一处。 */
+              installationAccount: chosen?.account ?? "",
+              /** 库里存的 installation 已不在这个 App 的安装列表里（卸载重装过）。 */
+              installationStale,
+              /**
+               * 这个 App 的**其它**安装及各自的权限项数。只在装了不止一处时才有内容。
+               * 它专门回答那句「我明明已经批过了」：批在哪一处，这里一眼看得见。
+               */
+              otherInstallations: installs.filter((i) => i.installationId !== installationId).map((i) => ({ account: i.account, count: Object.keys(i.permissions).length })),
               /**
-               * App 申请了、但这次安装还没被授予——多半是权限升级还等着组织 owner 批准。
+               * App 申请了、但**这一处安装铸出来的 token 里没有**。
                * **在全集上做差**，不再只看本仓必需的那八项（否则人另外勾的永远报不出来）。
+               *
+               * ⚠ 差集只说明「这一处安装现在给不了」，不等于「人没批」——同一个 App 装多处时
+               * 批准是逐处的（见 `otherInstallations`）。界面别把这层推断说死。
                */
               awaitingApproval: requestedAll.filter((r) => !grantedKeys.has(r.key)).map((r) => r.key),
               /**
-               * 这次安装**真正被授予**的全部权限，一律用 GitHub 的英文原名 + 级别
+               * agent **真正拿得到**的全部权限（优先读 token 自己的权限位），一律用 GitHub 的英文原名 + 级别
                * （2026-09-10 发起人：「所有权限都用英文原文，不区分是不是八项权限」）。
                *
                * 此前这里是 `GITHUB_APP_PERMISSION_LABELS.filter(...)` —— 那张表只有本仓必需的
@@ -207325,7 +207376,8 @@ ${composed}`;
             return;
           }
           try {
-            const appSecret = opts.actors ? await opts.actors.service.revealVariable("FEISHU_APP_SECRET", actorId) : null;
+            const startSvc = await connectorActorsService();
+            const appSecret = startSvc ? await startSvc.revealResolvedVariable("FEISHU_APP_SECRET", actorId) : null;
             if (!appSecret) throw new Error("FEISHU_APP_SECRET not found \u2014 please complete app setup first");
             const basicAuth = Buffer.from(`${appId}:${appSecret}`).toString("base64");
             const resp = await fetch("https://accounts.feishu.cn/oauth/v1/device_authorization", {
@@ -207355,7 +207407,8 @@ ${composed}`;
             return;
           }
           try {
-            const appSecret = opts.actors ? await opts.actors.service.revealVariable("FEISHU_APP_SECRET", actorId) : null;
+            const pollSvc = await connectorActorsService();
+            const appSecret = pollSvc ? await pollSvc.revealResolvedVariable("FEISHU_APP_SECRET", actorId) : null;
             if (!appSecret) throw new Error("FEISHU_APP_SECRET not found \u2014 please complete app setup first");
             const resp = await fetch("https://open.feishu.cn/open-apis/authen/v2/oauth/token", {
               method: "POST",
@@ -207381,6 +207434,7 @@ ${composed}`;
             if (svc) {
               if (actorId) {
                 await svc.putVariable({ key: "FEISHU_APP_ID", value: appId, scope: "personal", actorId, connectorId: "feishu", encrypted: true });
+                await svc.putVariable({ key: "FEISHU_APP_SECRET", value: appSecret, scope: "personal", actorId, connectorId: "feishu", encrypted: true });
               } else {
                 await svc.putVariable({ key: "FEISHU_APP_ID", value: appId, scope: "global", connectorId: "feishu", encrypted: true });
                 await svc.upsertConnector({ id: "feishu", name: "\u98DE\u4E66", mode: "oauth", status: "connected", account: appId });
@@ -208243,10 +208297,15 @@ var init_memory_registry_store = __esm({
         const mk = this._varKey(v2.key, v2.actorId, v2.projectId);
         const ex = this.variables.get(mk);
         const keptName = v2.name ?? ex?.name;
+        const keptCreatedBy = ex?.createdBy ?? v2.createdBy;
+        const keptCreatedAt = ex?.createdAt ?? v2.createdAt;
         this.variables.set(mk, {
           ...v2,
           ...ex?.lastUsedAt !== void 0 ? { lastUsedAt: ex.lastUsedAt } : {},
-          ...keptName ? { name: keptName } : {}
+          ...keptName ? { name: keptName } : {},
+          ...keptCreatedBy ? { createdBy: keptCreatedBy } : {},
+          ...keptCreatedAt ? { createdAt: keptCreatedAt } : {},
+          ...v2.updatedBy ? { updatedBy: v2.updatedBy } : {}
         });
       }
       async touchVariableUsage(key, actorId, projectId2, when) {
@@ -210763,8 +210822,14 @@ function foldSingleNodeTasks(items) {
     paths.add(item.path);
     nodeFoldersByTask.set(item.taskId, paths);
   }
+  const tasksWithRootFiles = /* @__PURE__ */ new Set();
+  for (const item of items) {
+    if (item.kind === "file" && item.taskId && item.path?.startsWith(`wo:${item.taskId}/file:`)) {
+      tasksWithRootFiles.add(item.taskId);
+    }
+  }
   const folded = new Set(
-    [...nodeFoldersByTask].filter(([, paths]) => paths.size === 1).map(([taskId]) => taskId)
+    [...nodeFoldersByTask].filter(([taskId, paths]) => paths.size === 1 && !tasksWithRootFiles.has(taskId)).map(([taskId]) => taskId)
   );
   if (folded.size === 0) return folded;
   for (const item of items) {
@@ -211705,6 +211770,33 @@ var init_service4 = __esm({
             });
           }
         }
+        if (this.artifacts.listWorkOrderFiles) {
+          for (const workOrderId of workorderSummaries.map((w2) => w2.id)) {
+            const workOrderFiles = await this.artifacts.listWorkOrderFiles(workOrderId).catch(() => []);
+            const taskTitle = workorderTitleById.get(workOrderId) ?? null;
+            for (const file of workOrderFiles) {
+              const creatorId = file.uploadedBy ?? null;
+              items.push({
+                kind: "file",
+                id: file.fileId,
+                name: file.name,
+                path: `wo:${workOrderId}/file:${file.fileId}`,
+                filePath: null,
+                depth: 1,
+                type: file.contentType ?? inferTypeFromName(file.name),
+                blobRef: file.blobId,
+                contentType: file.contentType ?? null,
+                size: file.size,
+                taskId: workOrderId,
+                taskTitle,
+                creatorKind: creatorId ? creatorId.startsWith("actor:human:") ? "human" : "agent" : null,
+                creatorId,
+                creatorName: creatorId ? this.resolveActorName(creatorId) : null,
+                updatedAt: file.linkedAt
+              });
+            }
+          }
+        }
         const foldedTasks = foldSingleNodeTasks(items);
         const taskFolders = /* @__PURE__ */ new Set();
         for (const item of [...items]) {
@@ -211743,6 +211835,8 @@ var init_service4 = __esm({
             filePath: null,
             depth: path41 ? path41.replace(/^\/+/, "").split("/").length - 1 : 0,
             type: file.contentType ?? inferTypeFromName(file.name),
+            blobRef: file.blobId,
+            contentType: file.contentType ?? null,
             size: file.size,
             taskId: null,
             taskTitle: null,
@@ -217065,6 +217159,11 @@ function wireRecoveredChatTurn(deps) {
       ...nextRuntimeSessionId ? { runtimeSessionId: nextRuntimeSessionId } : {},
       touchedAt: finishedAt
     }).catch(() => void 0);
+    if (deps.onTurnSettled) {
+      await deps.onTurnSettled(failed ? "failed" : "succeeded", finishedAt).catch((err) => {
+        log3(`[chat-recovery] \u4F1A\u8BDD ${plan.chatSessionId} \u6536\u53E3\u8BB0\u8D26\u5931\u8D25\uFF08\u9000\u56DE\u6E05\u626B\u62CD\u515C\u5E95\uFF09: ${String(err)}`);
+      });
+    }
     if (!liveTerminalEmitted) {
       live.emitLive({
         protocolVersion: 2,
@@ -217388,6 +217487,22 @@ async function recoverChatTurnsAcrossCompanies(deps) {
           continue;
         }
         const handle = deps.recover(plan);
+        const settleTurnId = turn?.id;
+        const onTurnSettled = settleTurnId && stores.settleTurn ? async (status, completedAt) => {
+          await stores.settleTurn(settleTurnId, {
+            status,
+            completedAt,
+            ...status === "failed" ? { lastError: `\u91CD\u6302\u7684\u8F6E\u4EE5 ${status} \u6536\u5C3E\uFF08run ${plan.runId}\uFF09` } : {}
+          });
+          log3(`[chat-recovery] \u8F6E\u6B21 ${settleTurnId}\uFF08\u4F1A\u8BDD ${plan.chatSessionId}\uFF09\u968F\u91CD\u6302\u6536\u53E3\u4E3A ${status}\uFF0C\u4F1A\u8BDD\u69FD\u5DF2\u91CA\u653E`);
+          await deps.onTurnSettled?.({
+            chatSessionId: plan.chatSessionId,
+            turnId: settleTurnId,
+            status,
+            reason: `\u91CD\u6302\u7684\u8F6E\u4EE5 ${status} \u6536\u5C3E`,
+            ...companyId ? { companyId } : {}
+          });
+        } : void 0;
         const { done } = wireRecoveredChatTurn({
           plan,
           handle,
@@ -217397,6 +217512,7 @@ async function recoverChatTurnsAcrossCompanies(deps) {
           register: () => deps.register(plan, handle),
           unregister: () => deps.unregister(plan),
           ...deps.traceHealth ? { traceHealth: deps.traceHealth } : {},
+          ...onTurnSettled ? { onTurnSettled } : {},
           ...stores.items ? { items: stores.items, itemsTurnId } : {},
           log: log3
         });
@@ -219464,7 +219580,14 @@ ${input.description}
           vars.filter((v2) => v2.scope === "personal" && v2.actorId === actorId && v2.connectorId).map((v2) => v2.connectorId)
         )];
         const effective = await this.effectiveConnectorEntries(actorId, config2, connectors);
-        return { connections, globalConnected, actorConnected, effective };
+        const flat = {};
+        for (const v2 of vars) if (v2.scope === "global" && !v2.actorId) flat[v2.key] = this.decodeCiphertext(v2.valueEncrypted);
+        for (const v2 of vars) if (v2.scope === "personal" && (!v2.actorId || v2.actorId === actorId)) flat[v2.key] = this.decodeCiphertext(v2.valueEncrypted);
+        const credentialReady = collectAllConnectorCredentials({
+          vars: flat,
+          actorName: flat["GIT_AUTHOR_NAME"] ?? actorId.split(":").pop() ?? "oasis-agent"
+        }).map((c) => c.slug);
+        return { connections, globalConnected, actorConnected, effective, credentialReady };
       }
       /**
        * 该员工每个连接器的「有效启用」集合（变量/技能注入闸门）：
@@ -219577,6 +219700,11 @@ ${input.description}
           deliveryMode: v2.deliveryMode ?? "env",
           valueEncrypted: v2.encrypted === false ? `plain:${v2.value}` : this.encrypt(v2.value),
           updatedAt: this.now(),
+          /* 创建者 / 创建时间 / 更新者：**由服务端落，不接受调用方自报**。
+             createdBy/createdAt 两格存储层按「第一次落行才写」处理（COALESCE 旧值），所以这里每次都传，
+             写不写得进去由存储层决定；updatedBy 每次覆盖。
+             `by` 缺省（连接器授权流程等系统写入）时三格都不传——**不拿一个假身份填上去**。 */
+          ...v2.by ? { createdBy: v2.by, createdAt: this.now(), updatedBy: v2.by } : {},
           // ADR 凭据保险库补章 §D2.2：expiresAt 写侧穿透——**显式带 key**（含 undefined），使清空（传空→undefined）
           // 也落到底（store 两实现都按此覆盖）。lastUsedAt 从不由写侧传，取用时另刷（§D2.3）。
           expiresAt: v2.expiresAt
@@ -219649,7 +219777,12 @@ ${input.description}
             updatedAt: r.updatedAt,
             // ADR 凭据保险库补章 §D2.1：到期/取用时间戳透传（展示层据此染色；补章 §D2.4）。
             ...r.expiresAt !== void 0 ? { expiresAt: r.expiresAt } : {},
-            ...r.lastUsedAt !== void 0 ? { lastUsedAt: r.lastUsedAt } : {}
+            ...r.lastUsedAt !== void 0 ? { lastUsedAt: r.lastUsedAt } : {},
+            // 创建者 / 创建时间 / 更新者（子 PRD《密钥管理》§2 + 2026-09-10 追加）。
+            // 存量行没有这三格，原样不带出去——展示侧出「—」，不拿 updatedAt 冒充 createdAt。
+            ...r.createdBy !== void 0 ? { createdBy: r.createdBy } : {},
+            ...r.createdAt !== void 0 ? { createdAt: r.createdAt } : {},
+            ...r.updatedBy !== void 0 ? { updatedBy: r.updatedBy } : {}
           };
         });
       }
@@ -221503,6 +221636,8 @@ function actorsDomain(opts) {
         ...b2.connectorId !== void 0 ? { connectorId: b2.connectorId } : {},
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {},
+        // 创建者/更新者取**当前登录人**，不接受 body 传入——自报的「谁建的」等于没有这一格。
+        by: req.auth.actor,
         expiresAt: expiresAt2
       });
       await auditVariableChange(
@@ -221575,6 +221710,7 @@ function actorsDomain(opts) {
         ...b2.connectorId !== void 0 ? { connectorId: b2.connectorId } : {},
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {},
+        by: req.auth.actor,
         expiresAt: expiresAt2
       });
       await auditVariableChange(req, "credential_write", b2.key, `personal:${actorId}`);
@@ -223377,6 +223513,9 @@ function toApiProjectFilesView(view) {
       // 其它外部引用→链接）。交付物整份产物行才有，上传文件与文件夹为 null。
       content_kind: item.contentKind ?? null,
       content_ref: item.contentRef ?? null,
+      // 上传文件行（项目级上传 / 工单级文件）的 blob 引用 + MIME：前端据此直读 blob 预览。交付物与文件夹为 null。
+      blob_ref: item.blobRef ?? null,
+      content_type: item.contentType ?? null,
       size: item.size,
       task_id: item.taskId,
       task_title: item.taskTitle,
@@ -228694,6 +228833,9 @@ function toAuditEntry(op) {
     actor: op.actor,
     op: op.kind,
     artifactId: op.artifactId,
+    /* 动作名单独发一份（见契约 `AuditEntry.actionLabel`）：`summary` 拼着裸 artifactId，
+       不能直接给人看，而「已处理」那一行需要「干了什么 + 在哪个节点」两截并排。 */
+    actionLabel: KIND_LABEL2[op.kind] ?? op.kind,
     summary: `${KIND_LABEL2[op.kind] ?? op.kind} \xB7 ${op.artifactId}`
   };
 }
@@ -228730,6 +228872,7 @@ function eventToAuditEntry(rec) {
     actor: rec.actorId,
     op: ev.kind,
     artifactId,
+    actionLabel: KIND_LABEL2[ev.kind] ?? ev.kind,
     summary: `${KIND_LABEL2[ev.kind] ?? ev.kind}${artifactId ? ` \xB7 ${artifactId}` : ""}`
   };
 }
@@ -229680,13 +229823,32 @@ async function buildLeadResolver(registry2) {
     return null;
   };
 }
-async function buildResolver(registry2) {
+async function memberNameResolver(listMembers, companyId) {
+  if (!listMembers) return void 0;
+  let members;
+  try {
+    members = await listMembers(companyId);
+  } catch (err) {
+    console.warn(`[collab] \u6210\u5458\u6635\u79F0\u8BFB\u53D6\u5931\u8D25\uFF0C\u672C\u6B21\u56DE\u843D\u5458\u5DE5\u6863\u6848\u59D3\u540D: ${String(err)}`);
+    return void 0;
+  }
+  const byActor2 = /* @__PURE__ */ new Map();
+  for (const m2 of members) {
+    const name = m2.displayName?.trim();
+    if (name) byActor2.set(m2.actorId, name);
+  }
+  return (id) => byActor2.get(id);
+}
+async function buildResolver(registry2, memberName) {
   if (!registry2) return void 0;
   const actors = await registry2.listActors();
   const byId = new Map(actors.map((a) => [a.id, a]));
   return (id) => {
     const a = byId.get(id);
-    return a ? actorRefFieldsOf(a) : actorRefFallbackOf(id);
+    if (!a) return actorRefFallbackOf(id);
+    const fields = actorRefFieldsOf(a);
+    const nickname = memberName?.(id);
+    return nickname ? { ...fields, name: nickname } : fields;
   };
 }
 async function buildProjectResolver(artifacts) {
@@ -229808,6 +229970,7 @@ function collabDomain(opts) {
     cache.set(companyId, ctx);
     return ctx;
   }
+  const resolverFor = async (companyId, registry2) => buildResolver(registry2, await memberNameResolver(opts.listMembers, companyId));
   return (router) => {
     router.get("/api/organization/usage-summary", async (req) => {
       if (!opts.trace) {
@@ -229852,7 +230015,7 @@ function collabDomain(opts) {
     });
     router.get("/api/workorders", async (req) => {
       const { kernel, registry: registry2, artifacts } = await resolveCtx(req.auth.companyId);
-      const resolve10 = await buildResolver(registry2);
+      const resolve10 = await resolverFor(req.auth.companyId, registry2);
       const resolveProject = await buildProjectResolver(artifacts);
       const dispatchPausedOf = await buildDispatchPausedResolver(kernel.model, artifacts);
       const ref2 = (id) => {
@@ -229883,7 +230046,7 @@ function collabDomain(opts) {
     });
     router.get("/api/workorder-metrics", async (req) => {
       const { kernel, registry: registry2, artifacts, engineStore } = await resolveCtx(req.auth.companyId);
-      const resolve10 = await buildResolver(registry2);
+      const resolve10 = await resolverFor(req.auth.companyId, registry2);
       const resolveProject = await buildProjectResolver(artifacts);
       const dispatchPausedOf = await buildDispatchPausedResolver(kernel.model, artifacts);
       const workorders = buildWorkorderSummaries(kernel.model, resolve10, resolveProject, dispatchPausedOf);
@@ -229930,7 +230093,7 @@ function collabDomain(opts) {
     });
     router.get("/api/workorders/:id", async (req) => {
       const { kernel, oplog, blobs, registry: registry2, artifacts, engineStore } = await resolveCtx(req.auth.companyId);
-      const resolve10 = await buildResolver(registry2);
+      const resolve10 = await resolverFor(req.auth.companyId, registry2);
       const resolveProject = await buildProjectResolver(artifacts);
       const dispatchPausedOf = await buildDispatchPausedResolver(kernel.model, artifacts);
       const wsArts = [...kernel.model.artifacts.values()].filter((a) => a.workspace === req.params.id);
@@ -230005,7 +230168,7 @@ function collabDomain(opts) {
       if (![...kernel.model.artifacts.values()].some((a) => a.workspace === workorderId)) {
         return { status: 404, body: { error: { code: "not_found", message: `\u5DE5\u5355\u4E0D\u5B58\u5728: ${workorderId}` } } };
       }
-      const resolve10 = await buildResolver(registry2);
+      const resolve10 = await resolverFor(req.auth.companyId, registry2);
       const ref2 = (id) => {
         const extra = resolve10?.(id);
         return {
@@ -230048,7 +230211,7 @@ function collabDomain(opts) {
       if (!cardId) {
         return { status: 400, body: { error: { code: "bad_request", message: "\u7F3A\u5C11 card \u53C2\u6570\uFF08\u52A8\u6001\u5361 id\uFF09" } } };
       }
-      const resolve10 = await buildResolver(registry2);
+      const resolve10 = await resolverFor(req.auth.companyId, registry2);
       const ref2 = (id) => {
         const extra = resolve10?.(id);
         return {
@@ -230088,7 +230251,7 @@ function collabDomain(opts) {
       if (!ledger) {
         return { status: 404, body: { error: { code: "not_found", message: `\u5DE5\u5355\u4E0D\u5B58\u5728: ${req.params.id}` } } };
       }
-      const resolve10 = await buildResolver(registry2);
+      const resolve10 = await resolverFor(req.auth.companyId, registry2);
       const ids2 = /* @__PURE__ */ new Set();
       if (ledger.owner) ids2.add(ledger.owner);
       if (ledger.manager) ids2.add(ledger.manager);
@@ -230107,13 +230270,14 @@ function collabDomain(opts) {
       return { status: 200, body: { ...ledger, actors } };
     });
     router.get("/api/workorders/:id/files", async (req) => {
-      const { kernel, artifacts } = await resolveCtx(req.auth.companyId);
+      const { kernel, registry: registry2, artifacts } = await resolveCtx(req.auth.companyId);
       const ws = req.params.id;
       const exists = [...kernel.model.artifacts.values()].some((a) => a.workspace === ws);
       if (!exists) {
         return { status: 404, body: { error: { code: "not_found", message: `\u5DE5\u5355\u4E0D\u5B58\u5728: ${ws}` } } };
       }
       const files = artifacts?.listWorkOrderFiles ? await artifacts.listWorkOrderFiles(ws) : [];
+      const resolve10 = await buildResolver(registry2);
       const items = files.map((f2) => ({
         id: f2.fileId,
         name: f2.name,
@@ -230123,12 +230287,14 @@ function collabDomain(opts) {
         updated_at: f2.linkedAt,
         blob_ref: f2.blobId,
         source_session_id: f2.sourceSessionId ?? null,
-        source_message_id: f2.sourceMessageId ?? null
+        source_message_id: f2.sourceMessageId ?? null,
+        uploaded_by: f2.uploadedBy ?? null,
+        uploader_name: f2.uploadedBy ? resolve10?.(f2.uploadedBy)?.name ?? null : null
       }));
       return { status: 200, body: { total: items.length, items } };
     });
     router.post("/api/workorders/:id/files", async (req) => {
-      const { kernel, artifacts } = await resolveCtx(req.auth.companyId);
+      const { kernel, registry: registry2, artifacts } = await resolveCtx(req.auth.companyId);
       const ws = req.params.id;
       const exists = [...kernel.model.artifacts.values()].some((a) => a.workspace === ws);
       if (!exists) {
@@ -230162,7 +230328,9 @@ function collabDomain(opts) {
         blobId,
         size: bytes2.byteLength,
         ...contentType ? { contentType } : {},
-        linkedAt
+        linkedAt,
+        // 上传者：项目页「创建人」列与预览副标据此署名（建单带入的那条路记的是建单发起人）。
+        uploadedBy: req.auth.actor
       };
       try {
         await artifacts.addWorkOrderFile(file);
@@ -230172,6 +230340,7 @@ function collabDomain(opts) {
           body: { error: { code: "write_failed", message: `\u5199 work_order_files \u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}` } }
         };
       }
+      const resolve10 = await buildResolver(registry2);
       const item = {
         id: fileId,
         name,
@@ -230181,7 +230350,9 @@ function collabDomain(opts) {
         updated_at: linkedAt,
         blob_ref: blobId,
         source_session_id: null,
-        source_message_id: null
+        source_message_id: null,
+        uploaded_by: req.auth.actor,
+        uploader_name: resolve10?.(req.auth.actor)?.name ?? null
       };
       return { status: 201, body: { item } };
     });
@@ -230255,7 +230426,7 @@ function collabDomain(opts) {
       const [leadOf, resolveActor, initialMarkers] = await Promise.all([
         buildLeadResolver(registry2),
         // 决策 0026 (c)：gap 升级也发卡住节点 owner 的人类上级
-        buildResolver(registry2),
+        resolverFor(req.auth.companyId, registry2),
         // 决策 0042：gap reporter 名册 join
         myReadMarkers ? myReadMarkers.listMarkers(me) : Promise.resolve([])
         // ADR-0086：知会型条目的已读水位
@@ -230528,7 +230699,7 @@ function collabDomain(opts) {
       let teamMembers;
       let lead;
       if (registry2) {
-        const resolve10 = await buildResolver(registry2);
+        const resolve10 = await resolverFor(req.auth.companyId, registry2);
         const meRec = await registry2.getActor(me);
         if (meRec?.teamId) {
           teamMembers = new Set((await registry2.listActors({ teamId: meRec.teamId })).map((m2) => m2.id));
@@ -233780,7 +233951,10 @@ function createChatSessionsDomain(opts) {
     const kernel = await kernelFor(req);
     const engineStore = kernel?.getStore?.();
     const snap = engineStore ? await engineStore.transaction((tx) => tx.loadWorkorder(workorderId)) : null;
-    const resolve10 = await buildResolver(await registryFor(req));
+    const resolve10 = await buildResolver(
+      await registryFor(req),
+      await memberNameResolver(opts.listMembers, req.auth.companyId)
+    );
     const ref2 = (id) => {
       const extra = resolve10?.(id);
       return { id, ...extra?.name ? { name: extra.name } : {}, ...extra?.role ? { role: extra.role } : {}, ...extra?.avatar ? { avatar: extra.avatar } : {} };
@@ -240391,7 +240565,11 @@ function rowToVariable(row) {
     ...row.expires_at ? { expiresAt: row.expires_at } : {},
     ...row.last_used_at ? { lastUsedAt: row.last_used_at } : {},
     // 展示名（存量行没有 → 不带这一格，展示侧回落成 key）。
-    ...row.name ? { name: row.name } : {}
+    ...row.name ? { name: row.name } : {},
+    // 创建者 / 创建时间 / 更新者：2026-09-10 之前的行没有 → 不带这一格，展示侧出「—」。
+    ...row.created_by ? { createdBy: row.created_by } : {},
+    ...row.created_at ? { createdAt: row.created_at } : {},
+    ...row.updated_by ? { updatedBy: row.updated_by } : {}
   };
 }
 var ident4, PostgresRegistryStore, rowToActor, rowToConfig, rowToAgentPrefs;
@@ -240562,6 +240740,9 @@ var init_postgres_registry = __esm({
         await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS name text`);
         await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS expires_at text`);
         await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS last_used_at text`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS created_by text`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS created_at text`);
+        await pool.query(`ALTER TABLE IF EXISTS "${s2}".variables ADD COLUMN IF NOT EXISTS updated_by text`);
         await pool.query(`DROP INDEX IF EXISTS "${s2}"."${s2}_variables_key_actor_uq"`);
         await pool.query(`DROP INDEX IF EXISTS "${s2}"."${s2}_variables_scope_uq"`);
         await pool.query(`
@@ -241063,11 +241244,17 @@ var init_postgres_registry = __esm({
         await this.pool.query(
           /* `name` 走 COALESCE：**没传 = 不动**。连接器授权流程写变量时手上没有「名称」，
              普通赋值会把人在密钥表单里填的名字抹掉——同 connectors.connected_by 那条。 */
-          `INSERT INTO ${this.s}.variables (key, scope, actor_id, project_id, connector_id, overrides, delivery_mode, value_encrypted, updated_at, expires_at, name)
-       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)
+          /* created_by / created_at 走 COALESCE(**旧值**, 新值)：**第一次落行才写**，之后每次 upsert
+             都保留原值——否则「谁建的」会被最后一次改的人顶掉，这一格就没有意义了。
+             updated_by 反过来：每次都覆盖。三者与 name 的 COALESCE 方向相反，别照抄。 */
+          `INSERT INTO ${this.s}.variables (key, scope, actor_id, project_id, connector_id, overrides, delivery_mode, value_encrypted, updated_at, expires_at, name, created_by, created_at, updated_by)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)
        ON CONFLICT (key, COALESCE(actor_id, ''), COALESCE(project_id, '')) DO UPDATE
          SET scope=$2, actor_id=$3, project_id=$4, connector_id=$5, overrides=$6, delivery_mode=$7, value_encrypted=$8, updated_at=$9, expires_at=$10,
-             name=COALESCE($11, ${this.s}.variables.name)`,
+             name=COALESCE($11, ${this.s}.variables.name),
+             created_by=COALESCE(${this.s}.variables.created_by, $12),
+             created_at=COALESCE(${this.s}.variables.created_at, $13),
+             updated_by=$14`,
           [
             v2.key,
             v2.scope,
@@ -241079,7 +241266,10 @@ var init_postgres_registry = __esm({
             v2.valueEncrypted,
             v2.updatedAt,
             v2.expiresAt ?? null,
-            v2.name ?? null
+            v2.name ?? null,
+            v2.createdBy ?? null,
+            v2.createdAt ?? null,
+            v2.updatedBy ?? null
           ]
         );
       }
@@ -242050,8 +242240,10 @@ var init_postgres_projects = __esm({
         content_type      text,
         source_session_id text,
         source_message_id text,
-        linked_at         timestamptz NOT NULL
+        linked_at         timestamptz NOT NULL,
+        uploaded_by       text
       )`);
+        await pool.query(`ALTER TABLE "${s2}".work_order_files ADD COLUMN IF NOT EXISTS uploaded_by text`);
         await pool.query(`CREATE INDEX IF NOT EXISTS work_order_files_wo_idx ON "${s2}".work_order_files (work_order_id)`);
         return new _PostgresArtifactStateStore(pool, schema);
       }
@@ -242334,11 +242526,12 @@ var init_postgres_projects = __esm({
       async addWorkOrderFile(file) {
         await this.pool.query(
           `INSERT INTO ${this.s}.work_order_files
-         (file_id, work_order_id, name, blob_id, size, content_type, source_session_id, source_message_id, linked_at)
-       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+         (file_id, work_order_id, name, blob_id, size, content_type, source_session_id, source_message_id, linked_at, uploaded_by)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
        ON CONFLICT (file_id) DO UPDATE SET
          work_order_id=$2, name=$3, blob_id=$4, size=$5, content_type=$6,
-         source_session_id=$7, source_message_id=$8, linked_at=$9`,
+         source_session_id=$7, source_message_id=$8, linked_at=$9,
+         uploaded_by=COALESCE($10, ${this.s}.work_order_files.uploaded_by)`,
           [
             file.fileId,
             file.workOrderId,
@@ -242348,7 +242541,8 @@ var init_postgres_projects = __esm({
             file.contentType ?? null,
             file.sourceSessionId ?? null,
             file.sourceMessageId ?? null,
-            file.linkedAt
+            file.linkedAt,
+            file.uploadedBy ?? null
           ]
         );
       }
@@ -242540,6 +242734,7 @@ var init_postgres_projects = __esm({
       ...row.content_type !== null ? { contentType: row.content_type } : {},
       ...row.source_session_id !== null ? { sourceSessionId: row.source_session_id } : {},
       ...row.source_message_id !== null ? { sourceMessageId: row.source_message_id } : {},
+      ...row.uploaded_by !== null && row.uploaded_by !== void 0 ? { uploadedBy: row.uploaded_by } : {},
       linkedAt: iso2(row.linked_at)
     });
   }
@@ -259891,6 +260086,7 @@ async function startServe(opts) {
     }
     return resolved;
   };
+  const listCompanyMembers = (companyId) => controlPlaneStore.listMembers(companyId ?? defaultCompanyId);
   const server = await startOasisServer({
     deployTargets,
     kernel: engine.kernel,
@@ -260138,6 +260334,8 @@ async function startServe(opts) {
         // 草案图算「类型默认审核人」用（与 /api/cmd 同源类型目录）
         roles: roleStore,
         // 诊断 f1641dd3-abdaa869：概览角色桶补「默认承接人」（读 RoleDef.defaultOwner）
+        // 真人展示名的第一顺位：本公司成员昵称压过员工档案 name（档案上那份缺省是邮箱）。
+        listMembers: listCompanyMembers,
         chatSession: chatSessionStore,
         // ADR-0086：chat 知会条目（与 readMarkers 成对）
         // ADR「多租户数据面收口」§D2：知会条目按**当前公司**取。装了路由才给（dev 文件模式沿用单实例）。
@@ -260176,6 +260374,8 @@ async function startServe(opts) {
         // 装了路由（有 PG）就只走路由，解析不出公司一律 403，不回落默认公司。
         ...chatStoreRouter ? { resolveStore: chatStoreFor } : {},
         registry: registryStore,
+        // 缺口线署名的真人名字与 collab 读面同一口径：本公司成员昵称压过员工档案 name。
+        listMembers: listCompanyMembers,
         // ★ wo:acfee725 评审 blocker ①：两个 `/workdir/*` 读口与 files-view 段按**当前公司**解 binding，
         // 与派发、与委派回流搬产物同一处（`resolveCompanyBinding`）。上面那个 `registry` 是全局
         // store（`public.actor_bindings`），org-registry cutover 之后它是冻结旧镜像——只留给
@@ -261321,6 +261521,14 @@ async function startServe(opts) {
       requestId: `project-created:${project.id}`
     }, project.id);
   });
+  const notifyChatTurnSettled = async (info) => {
+    await server.settleDelegationFromSweep(
+      info.chatSessionId,
+      `\u5B50\u4F1A\u8BDD\u8FD9\u4E00\u8F6E\u88AB\u6062\u590D\u5668\u6536\u53E3\u4E3A ${info.status}\uFF08${info.reason}\uFF09`,
+      info.companyId,
+      { outcome: info.status === "succeeded" ? "succeeded" : "failed" }
+    );
+  };
   const handshakeThrottleOpts = {};
   {
     const num3 = (name) => {
@@ -261383,10 +261591,12 @@ async function startServe(opts) {
         if (hit) return hit;
         const sessions = id === defaultCompanyId ? platformChatRecovery : PlatformChatRecoveryStore.open(pgPool, engineSchemaFor(id));
         const items = await chatItemsFor(id);
+        const turnsForRecovery = await chatTurnsFor(id).catch(() => void 0);
         const plane = {
           listRunningAssistantMessages: () => sessions.listRunningAssistantMessages(),
           chatStore: sessions,
           getTurnForRun: (sid, rid) => sessions.getTurnForRun(sid, rid),
+          ...turnsForRecovery ? { settleTurn: (turnId, patch) => turnsForRecovery.settleTurn(turnId, patch) } : {},
           ...items ? { items } : {}
         };
         chatRecoveryPlanes.set(id, plane);
@@ -261412,6 +261622,8 @@ async function startServe(opts) {
         isWired: (artifactId) => chatLiveSessions.has(`chat::${artifactId}`),
         ...opts2.stopOnFirstHit ? { stopOnFirstHit: true } : {},
         onCompanyError: chatRecoveryCompanyWarn(opts2.label),
+        // 重挂的那一轮收口时当场外报，与清扫拍同一个接收方（见 `notifyChatTurnSettled`）。
+        onTurnSettled: (info) => notifyChatTurnSettled(info),
         liveChat,
         trace: runRoutedTrace,
         traceHealth,
@@ -261682,14 +261894,12 @@ async function startServe(opts) {
          本拍是从轮次账本走的（`assistant_run_id` 一直有值），是"这一轮死没死"的权威来源。
          `companyId` 由扇出那层填好 —— 台账按公司分 store，少了它会查到默认公司的库。
          非委派会话调进去是空转：`settleFromSweep` 按 childSessionId 查不到记录就原样返回。 */
-      onTurnSettled: async ({ chatSessionId, status, reason, companyId }) => {
-        await server.settleDelegationFromSweep(
-          chatSessionId,
-          `\u5B50\u4F1A\u8BDD\u8FD9\u4E00\u8F6E\u88AB\u6062\u590D\u5668\u6536\u53E3\u4E3A ${status}\uFF08${reason}\uFF09`,
-          companyId,
-          { outcome: status === "succeeded" ? "succeeded" : "failed" }
-        );
-      },
+      /* `status` 必须带下去分流。跨重启完成的那一轮走的正是 `succeeded`：
+         `settleRound` 是派发那一刻建的闭包，serve 一重启就随老进程没了。
+         不分流的话，一条**干完活**的委派会被按时钟闭合拍成 failed。
+         接收方与重挂路**同一个**（`notifyChatTurnSettled`）——两条路一处收敛，
+         不会出现「清扫拍收的能通知、重挂收的不能」这种只在重启后显形的差异。 */
+      onTurnSettled: (info) => notifyChatTurnSettled(info),
       log: (m2) => console.log(m2),
       onCompanyError: (companyId, err) => {
         const key = companyId ?? "<default>";
@@ -271034,7 +271244,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.11" : "dev";
+var PKG_VERSION = true ? "2.2.12" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.11",
+  "version": "2.2.12",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "99635443b071b822e6a7e8b4ee1e4940cd488202"
+    "sourceHead": "ae18ecf5995f37b7a3f14b601e3a87c21d91ab03"
   }
 }