oasis_test_v2 2.2.36 → 2.2.38

package/dist/index.js

@@ -5645,7 +5645,6 @@ CREATE TABLE IF NOT EXISTS ${q2}.workorders (
   paused_reason       text,
   done_at             timestamptz,
   structural_version  integer NOT NULL DEFAULT 0,
-  row_version         integer NOT NULL DEFAULT 0,
   created_at          timestamptz NOT NULL,
   created_by          text NOT NULL,
   updated_at          timestamptz NOT NULL
@@ -5660,7 +5659,6 @@ CREATE TABLE IF NOT EXISTS ${q2}.workflow_nodes (
   spec                  text,
   version               integer NOT NULL DEFAULT 0,
   assignee_actor_id     text,
-  assignee_role         text,
   latest_work_id        text,
   latest_proposed_work_id text,
   latest_accept_id      text,
@@ -5670,7 +5668,6 @@ CREATE TABLE IF NOT EXISTS ${q2}.workflow_nodes (
   cancelled_at          timestamptz,
   -- \u5C01\u5B58\u539F\u56E0\uFF08accepted/cancelled/frozen\uFF09\u3002NULL = \u5B58\u91CF\u884C\uFF0C\u8BFB\u6A21\u578B\u6309 cancelled \u515C\u5E95\u3002
   seal_reason           text,
-  row_version           integer NOT NULL DEFAULT 0,
   created_at            timestamptz NOT NULL,
   updated_at            timestamptz NOT NULL
 );
@@ -5684,7 +5681,6 @@ CREATE TABLE IF NOT EXISTS ${q2}.workflow_edges (
   kind             text NOT NULL CHECK (kind IN ('data','order')),
   required         boolean NOT NULL DEFAULT true,
   pinned_work_id   text,
-  consumed_work_id text,
   PRIMARY KEY (from_node_id, to_node_id)
 );
 CREATE INDEX IF NOT EXISTS edges_to_idx ON ${q2}.workflow_edges (to_node_id);
@@ -5886,7 +5882,6 @@ CREATE TABLE IF NOT EXISTS ${q2}.events (
   origin             text NOT NULL CHECK (origin IN ('command','apply','effect')),
   dedup_key          text,
   status             text NOT NULL CHECK (status IN ('pending','applied','done','failed')),
-  attempts           integer NOT NULL DEFAULT 0,
   available_at       timestamptz,
   failed_reason      text,
   created_at         timestamptz NOT NULL,
@@ -6077,6 +6072,31 @@ BEGIN
   END;
 END $$;
 
+-- ADR 0564\uFF1A\u9000\u5F79\u672A\u6D88\u8D39\u7684\u8BA1\u6570\u5668\u548C\u5355\u5411\u526F\u672C\uFF1B\u5386\u53F2 events.payload \u539F\u6587\u4E0D\u6539\u3002
+-- \u90E8\u7F72\u524D\u5907\u4EFD\u5B58\u91CF\u5E93\uFF08\u542B\u975E\u7A7A consumed_work_id / assignee_role\uFF09\u3002\u6309\u5217\u9694\u79BB\u6E05\u7406\uFF0C
+-- \u5916\u90E8\u4F9D\u8D56\u53EA\u63A8\u8FDF\u8BE5\u5217\uFF0C\u4E0D CASCADE\u3001\u4E0D\u963B\u65AD\u542F\u52A8\uFF08\u6CBF\u7528 ADR 0512 \u7684\u53EF\u7528\u6027\u7EA6\u675F\uFF09\u3002
+-- \u81EA\u6709 node_view \u5DF2\u5728\u4E0A\u65B9\u5220\u9664\uFF0C\u540E\u7EED ENGINE_VIEWS \u6309\u65B0\u5217\u96C6\u91CD\u5EFA\uFF1B\u4ECD\u88AB\u4FDD\u7559\u7684\u65E7
+-- workorder_view \u6309\u5916\u90E8\u4F9D\u8D56\u5904\u7406\uFF0C\u4E0D\u80FD\u4E3A\u672C\u6B21\u9000\u5F79\u7834\u574F ADR 0512 \u7684\u5386\u53F2\u503C\u4FDD\u7559\u3002
+DO $$
+DECLARE obsolete record;
+BEGIN
+  FOR obsolete IN SELECT * FROM (VALUES
+    ('workorders', 'row_version'),
+    ('workflow_nodes', 'row_version'),
+    ('workflow_nodes', 'assignee_role'),
+    ('workflow_edges', 'consumed_work_id'),
+    ('events', 'attempts')
+  ) AS retired(table_name, column_name) LOOP
+    BEGIN
+      EXECUTE format('ALTER TABLE %I.%I DROP COLUMN IF EXISTS %I',
+        ${lit}, obsolete.table_name, obsolete.column_name);
+    EXCEPTION WHEN dependent_objects_still_exist THEN
+      RAISE WARNING 'Retaining retired engine field %.%.%: external dependencies require reconciliation (ADR 0564)',
+        ${lit}, obsolete.table_name, obsolete.column_name;
+    END;
+  END LOOP;
+END $$;
+
 -- \u8C03\u5EA6\u5668\u5B8C\u7ED3\u6807\u8BB0\uFF08mark_done/unmark_done \u843D\u70B9\uFF0C2026-08-12\uFF09\u3002
 ALTER TABLE ${q2}.workorders ADD COLUMN IF NOT EXISTS done_at timestamptz;
 -- \u2605 \u5DE5\u5355\u7EA7\u5C01\u5B58\u6574\u4F53\u79FB\u9664\uFF08ADR 0137\uFF09\uFF1Alifecycle \u53EA\u5269 draft/active\uFF0Cseal_reason \u5217\u5220\u9664\u3002
@@ -11329,7 +11349,6 @@ function toRecord(r) {
     origin: r.origin,
     dedupKey: r.dedup_key ?? null,
     status: r.status,
-    attempts: Number(r.attempts ?? 0),
     availableAt: iso(r.available_at),
     failedReason: r.failed_reason ?? null,
     createdAt: iso(r.created_at),
@@ -11558,7 +11577,6 @@ var init_store_postgres = __esm({
             pausedReason: r.paused_reason,
             doneAt: iso(r.done_at),
             structuralVersion: r.structural_version,
-            rowVersion: r.row_version,
             createdAt: iso(r.created_at),
             createdBy: r.created_by,
             updatedAt: iso(r.updated_at)
@@ -11571,7 +11589,6 @@ var init_store_postgres = __esm({
             spec: n.spec,
             version: n.version ?? 0,
             assigneeActorId: n.assignee_actor_id,
-            assigneeRole: n.assignee_role,
             latestWorkId: n.latest_work_id,
             latestProposedWorkId: n.latest_proposed_work_id ?? null,
             latestAcceptId: n.latest_accept_id,
@@ -11581,7 +11598,6 @@ var init_store_postgres = __esm({
             sealReason: n.seal_reason ?? null,
             fields: n.fields ?? void 0,
             continuationBudget: n.continuation_budget ?? null,
-            rowVersion: n.row_version,
             createdAt: iso(n.created_at),
             updatedAt: iso(n.updated_at)
           })),
@@ -11591,8 +11607,7 @@ var init_store_postgres = __esm({
             toNodeId: e.to_node_id,
             kind: e.kind,
             required: e.required,
-            pinnedWorkId: e.pinned_work_id,
-            consumedWorkId: e.consumed_work_id
+            pinnedWorkId: e.pinned_work_id
           })),
           requirements: reqs.rows.map((q2) => ({
             nodeId: q2.node_id,
@@ -11731,8 +11746,8 @@ var init_store_postgres = __esm({
               await this.c.query(
                 `INSERT INTO ${this.s}.workorders
              (id,company_id,title,owner_actor_id,lifecycle,dispatch_paused,paused_by,paused_reason,
-              done_at,structural_version,row_version,created_at,created_by,updated_at)
-             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)
+              done_at,structural_version,created_at,created_by,updated_at)
+             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13)
              ON CONFLICT (id) DO NOTHING`,
                 [
                   r.id,
@@ -11745,7 +11760,6 @@ var init_store_postgres = __esm({
                   r.pausedReason,
                   r.doneAt,
                   r.structuralVersion,
-                  r.rowVersion,
                   r.createdAt,
                   r.createdBy,
                   r.updatedAt
@@ -11760,10 +11774,10 @@ var init_store_postgres = __esm({
               const n = m2.row;
               await this.c.query(
                 `INSERT INTO ${this.s}.workflow_nodes
-             (id,workorder_id,type,title,spec,version,assignee_actor_id,assignee_role,
+             (id,workorder_id,type,title,spec,version,assignee_actor_id,
               latest_work_id,latest_proposed_work_id,latest_accept_id,is_final_output,
-              fields,cancelled_at,seal_reason,row_version,created_at,updated_at,continuation_budget)
-             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19)
+              fields,cancelled_at,seal_reason,created_at,updated_at,continuation_budget)
+             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17)
              ON CONFLICT (id) DO NOTHING`,
                 [
                   n.id,
@@ -11773,7 +11787,6 @@ var init_store_postgres = __esm({
                   n.spec,
                   n.version,
                   n.assigneeActorId,
-                  n.assigneeRole,
                   n.latestWorkId,
                   n.latestProposedWorkId,
                   n.latestAcceptId,
@@ -11781,7 +11794,6 @@ var init_store_postgres = __esm({
                   n.fields ? JSON.stringify(n.fields) : null,
                   n.cancelledAt,
                   n.sealReason ?? null,
-                  n.rowVersion,
                   n.createdAt,
                   n.updatedAt,
                   n.continuationBudget ? JSON.stringify(n.continuationBudget) : null
@@ -11796,9 +11808,9 @@ var init_store_postgres = __esm({
               const e = m2.row;
               await this.c.query(
                 `INSERT INTO ${this.s}.workflow_edges
-             (workorder_id,from_node_id,to_node_id,kind,required,pinned_work_id,consumed_work_id)
-             VALUES ($1,$2,$3,$4,$5,$6,$7) ON CONFLICT (from_node_id,to_node_id) DO NOTHING`,
-                [e.workorderId, e.fromNodeId, e.toNodeId, e.kind, e.required, e.pinnedWorkId, e.consumedWorkId]
+             (workorder_id,from_node_id,to_node_id,kind,required,pinned_work_id)
+             VALUES ($1,$2,$3,$4,$5,$6) ON CONFLICT (from_node_id,to_node_id) DO NOTHING`,
+                [e.workorderId, e.fromNodeId, e.toNodeId, e.kind, e.required, e.pinnedWorkId]
               );
               break;
             }
@@ -12017,8 +12029,8 @@ var init_store_postgres = __esm({
           const res = await this.c.query(
             `INSERT INTO ${this.s}.events
          (company_id,workorder_id,node_id,work_id,actor_id,hand_actor_id,kind,payload,caused_by_seq,
-          origin,dedup_key,status,attempts,created_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,'pending',0,$12)
+          origin,dedup_key,status,created_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,'pending',$12)
          ON CONFLICT (workorder_id, dedup_key) WHERE dedup_key IS NOT NULL DO NOTHING
          RETURNING seq`,
             [
@@ -12203,13 +12215,11 @@ function newNode(id, workorderId, at, version2) {
     spec: null,
     version: version2,
     assigneeActorId: null,
-    assigneeRole: null,
     latestWorkId: null,
     latestProposedWorkId: null,
     latestAcceptId: null,
     isFinalOutput: false,
     cancelledAt: null,
-    rowVersion: 0,
     createdAt: at,
     updatedAt: at
   };
@@ -12280,7 +12290,6 @@ var init_plan = __esm({
           title: e.title,
           spec: e.spec,
           assigneeActorId: e.assigneeActorId,
-          assigneeRole: e.assigneeRole,
           isFinalOutput: e.isFinalOutput,
           ...e.fields ? { fields: e.fields } : {}
         });
@@ -12332,8 +12341,7 @@ var init_plan = __esm({
           toNodeId: e.toNodeId,
           kind: e.edgeKind,
           required: e.required,
-          pinnedWorkId: upstream?.latestAcceptId ?? null,
-          consumedWorkId: null
+          pinnedWorkId: upstream?.latestAcceptId ?? null
         });
         const dn = state.node(e.toNodeId);
         if (dn) state.updateNode(e.toNodeId, { version: dn.version + 1 });
@@ -12362,7 +12370,6 @@ var init_plan = __esm({
         }
         state.updateNode(e.nodeId, {
           assigneeActorId: e.assigneeActorId,
-          assigneeRole: e.assigneeRole,
           ...changed && !settled ? { version: node2.version + 1 } : {},
           updatedAt: ctx.at
         });
@@ -12458,7 +12465,6 @@ var init_plan = __esm({
             title: spec.title,
             spec: spec.spec,
             assigneeActorId: spec.assigneeActorId,
-            assigneeRole: spec.assigneeRole,
             isFinalOutput: spec.isFinalOutput,
             reviewers: spec.reviewers,
             ...spec.fields ? { fields: spec.fields } : {}
@@ -12528,7 +12534,6 @@ var init_workorder = __esm({
           pausedReason: null,
           doneAt: null,
           structuralVersion: 0,
-          rowVersion: 0,
           createdAt: ctx.at,
           createdBy: ctx.actorId,
           updatedAt: ctx.at
@@ -12543,7 +12548,7 @@ var init_workorder = __esm({
           ([key]) => Object.hasOwn(state.workorder, key)
         ));
         if (Object.keys(patch).length === 0) return;
-        state.updateWorkorder({ ...patch, updatedAt: ctx.at, rowVersion: state.workorder.rowVersion + 1 });
+        state.updateWorkorder({ ...patch, updatedAt: ctx.at });
       }
     };
     workorderPause = {
@@ -13347,11 +13352,6 @@ var init_review = __esm({
         for (const r of state.openReviewsOf(e.workId)) {
           state.updateReview(r.id, { cancelledAt: ctx.at, status: "dead" });
         }
-        const inputs = state.workInputsOf(e.workId);
-        for (const edge of state.edgesInto(w2.nodeId)) {
-          const real = inputs.find((i) => i.upstreamNodeId === edge.fromNodeId);
-          state.updateEdge(edge.fromNodeId, edge.toNodeId, { consumedWorkId: real?.upstreamWorkId ?? edge.pinnedWorkId });
-        }
         for (const edge of state.edgesFrom(w2.nodeId)) {
           state.updateEdge(edge.fromNodeId, edge.toNodeId, { pinnedWorkId: e.workId });
         }
@@ -13614,7 +13614,6 @@ function emptySnapshotPlaceholder(record8) {
       pausedReason: null,
       doneAt: null,
       structuralVersion: 0,
-      rowVersion: 0,
       createdAt: "",
       createdBy: "",
       updatedAt: ""
@@ -19657,7 +19656,7 @@ function groupRequirementsForPreview(rows) {
   const out = [];
   for (const [key, b2] of groups) {
     if (b2.source === "type") {
-      out.push({ source: "type", eligible: [], quorum: 1, roles: [key] });
+      out.push({ source: "type", eligible: b2.eligible, quorum: 1, roles: [key] });
     } else {
       out.push({ source: b2.source, eligible: b2.eligible, quorum: 1 });
     }
@@ -20140,9 +20139,14 @@ var init_kernel_bridge = __esm({
         const nodeReqs = a.reviewers ?? [];
         if (nodeReqs.length > 0) {
           const requirements2 = groupRequirementsForPreview(nodeReqs);
-          const namedActors2 = nodeReqs.filter((r) => r.source !== "type").map((r) => ({ actor: r.actor, source: r.source }));
+          const listed = nodeReqs.filter((r) => r.source !== "type").map((r) => ({ actor: r.actor, source: r.source }));
+          for (const r of nodeReqs) {
+            if (r.source === "type" && !listed.some((n) => n.actor === r.actor)) {
+              listed.push({ actor: r.actor, source: "type" });
+            }
+          }
           return {
-            reviewers: namedActors2,
+            reviewers: listed,
             quorum: requirements2.length,
             requirements: requirements2,
             typeName: a.type
@@ -20236,7 +20240,6 @@ var init_kernel_bridge = __esm({
               title: args.title ?? args.description ?? args.type,
               spec: args.description ?? null,
               assigneeActorId: owner,
-              assigneeRole: null,
               isFinalOutput: args.isFinalOutput ?? false,
               // ★ docType（projects 域的具体文档类型）随节点 fields 落库（同 reviewRoles 的做法，jsonb 免加列）；
               // bridge 投影时从 fields 剥出成 artifact.docType、不混进用户自定义字段。
@@ -21101,8 +21104,7 @@ var init_kernel_bridge = __esm({
             kind: "plan.assign_actor",
             workorderId: wid,
             nodeId: args.artifactId,
-            assigneeActorId: args.owner,
-            assigneeRole: null
+            assigneeActorId: args.owner
           }
         });
       }
@@ -21628,7 +21630,6 @@ var init_kernel_bridge = __esm({
                     title: op.title ?? op.type,
                     spec: op.description ?? null,
                     assigneeActorId: spawnOwner,
-                    assigneeRole: null,
                     isFinalOutput: op.isFinalOutput ?? false,
                     ...allReviewers.length > 0 ? { reviewers: allReviewers } : {},
                     ...mergedFields ? { fields: mergedFields } : {}
@@ -21675,7 +21676,7 @@ var init_kernel_bridge = __esm({
               break;
             }
             case "assign":
-              await enqueue({ kind: "plan.assign_actor", workorderId: woFor(op.artifactId), nodeId: op.artifactId, assigneeActorId: op.owner, assigneeRole: null });
+              await enqueue({ kind: "plan.assign_actor", workorderId: woFor(op.artifactId), nodeId: op.artifactId, assigneeActorId: op.owner });
               applied++;
               break;
             case "seal":
@@ -31180,6 +31181,9 @@ var init_chat_turn_gate = __esm({
 function isDeletedActor(actor) {
   return actor?.status === "disabled";
 }
+function hideDeleted(rows) {
+  return rows.filter((row) => row.status !== "disabled");
+}
 var ACTOR_DELETED_CHAT_MESSAGE, ACTOR_DELETED_ERROR_CODE, ActorAlreadyDeletedError;
 var init_deletion = __esm({
   "../server/src/domains/actors/deletion.ts"() {
@@ -203936,6 +203940,19 @@ function resolveCallbackBase(supplied, requestHost) {
   }
   return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
 }
+function companyAmbiguousError(actor, companies) {
+  return new ApiError(
+    400,
+    "COMPANY_AMBIGUOUS",
+    `\u65E0\u6CD5\u786E\u5B9A\u5F53\u524D\u516C\u53F8\uFF1A${actor} \u5C5E\u4E8E\u591A\u5BB6\u516C\u53F8\uFF08${companies.join("\u3001")}\uFF09\uFF0C\u672C\u6B21\u8BF7\u6C42\u6CA1\u6709\u6307\u5B9A\u3002\u8BF7\u7528 x-oasis-company \u5934\u6307\u5B9A\u516C\u53F8 id \u6216 slug\uFF08CLI\uFF1A--company <\u516C\u53F8> \u6216 $OASIS_COMPANY\uFF09\u3002`,
+    { companies: [...companies] }
+  );
+}
+function writeApiError(res, err) {
+  res.writeHead(err.status, { "content-type": "application/json" }).end(JSON.stringify({
+    error: { code: err.code, message: err.message, ...err.details ?? {} }
+  }));
+}
 function toApiError(err) {
   if (err instanceof ApiError) return err;
   const message = err instanceof Error ? err.message : String(err);
@@ -206281,6 +206298,10 @@ async function startOasisServer(opts) {
         }
         if (url.pathname.startsWith("/api/files/")) {
           const company = opts.resolveCompanyContext ? await opts.resolveCompanyContext(actor, req.headers, url.pathname) : void 0;
+          if (company?.kind === "ambiguous") {
+            writeApiError(res, companyAmbiguousError(actor, company.companies));
+            return;
+          }
           if (company && company.kind !== "ok") {
             res.writeHead(403, { "content-type": "application/json" }).end(JSON.stringify({
               error: { code: "FORBIDDEN", message: "\u65E0\u6743\u8BFB\u53D6\u8BE5\u516C\u53F8\u7684\u6587\u4EF6" }
@@ -206321,6 +206342,10 @@ async function startOasisServer(opts) {
         const rawBody = Buffer.concat(chunks).toString("utf8");
         const companyCtx = opts.resolveCompanyContext ? await opts.resolveCompanyContext(actor, req.headers, url.pathname) : void 0;
         const currentCompanyId = companyCtx?.kind === "ok" ? companyCtx.companyId : void 0;
+        if (companyCtx?.kind === "ambiguous") {
+          writeApiError(res, companyAmbiguousError(actor, companyCtx.companies));
+          return;
+        }
         const connectorActorsService = async (companyId) => opts.actors ? (await opts.actors.resolveCtx(companyId ?? currentCompanyId)).service : void 0;
         const wodrafts = opts.resolveWorkorderDrafts ? await opts.resolveWorkorderDrafts(currentCompanyId) : opts.workorderDrafts;
         const wodraftPlannerIssues = (opts.resolveWorkorderDraftPlannerIssues && await opts.resolveWorkorderDraftPlannerIssues(currentCompanyId)) ?? opts.workorderDraftPlannerIssues ?? defaultDraftPlannerIssuesStore;
@@ -210253,6 +210278,11 @@ var init_memory_registry_store = __esm({
           ...v2.updatedBy ? { updatedBy: v2.updatedBy } : {}
         });
       }
+      async insertVariable(v2) {
+        if (this.variables.has(this._varKey(v2.key, v2.actorId, v2.projectId))) return false;
+        await this.putVariable(v2);
+        return true;
+      }
       async touchVariableUsage(key, actorId, projectId2, when) {
         const mk = this._varKey(key, actorId, projectId2);
         const ex = this.variables.get(mk);
@@ -216681,6 +216711,9 @@ var init_company_scoped_registry = __esm({
       async putVariable(...args) {
         return this.base.putVariable(...args);
       }
+      async insertVariable(...args) {
+        return this.base.insertVariable(...args);
+      }
       async patchVariableValue(...args) {
         return this.base.patchVariableValue(...args);
       }
@@ -221846,6 +221879,9 @@ function computeEffectiveEntries(config2, connections, connectors) {
   }
   return out;
 }
+function personalConnectionPairs(vars) {
+  return vars.flatMap((v2) => v2.scope === "personal" && v2.actorId && v2.connectorId ? [{ actorId: v2.actorId, connectorId: v2.connectorId }] : []);
+}
 function variableKeyFromEnv(env = process.env) {
   const hex = env.OASIS_VAR_KEY;
   if (hex) {
@@ -222587,35 +222623,43 @@ ${input.description}
         }
       }
       /**
-       * 连接器 + 分配派生：按每个 AI 员工的**有效启用**口径聚合「此连接器对谁生效」（决策 0080：
-       * 连接记录 > 旧 connectorIds > 组织默认，与运行时注入同一判定）。此前只扫旧 connectorIds，
-       * 组织页显示的员工集合与真正生效的注入口径脱节。
+       * 管理页连接器列表的「N 个 Agent 已连接」：每个连接器上**建立过 Agent 层连接**的 Agent
+       * （判据见 {@link personalConnectionPairs}，与类型详情页的行、组织页 tab 同一份）。
+       *
+       * 口径与原型帧 `1496:5390` / `1551:767` 对齐：卡片上的数 = 点进去那一页的行数——
+       * 开关关着的、凭据不全或解不开的都是一行，也都算一个；从没连过的不算。
+       *
+       * 两处刻意的范围：
+       *   · 人群 = 花名册（`GET /api/actors?kind=agent`）那一群：**已删除的 Agent 不算**——详情页压根列不出他们，
+       *     算进来就是「卡片 5、点进去 4」。
+       *   · 不以连接器表为界：2026-09-09 起连接器类型对所有组织默认可用、个人授权又不碰组织行，
+       *     连接器表**天然是空的**（二期生产 09-15 实测 `items: []`）。此前只对表里有行的连接器聚合，
+       *     卡片恒为「暂无连接的 Agent」、点进去却有好几位。没有组织行的连接器单列在
+       *     `connectedActorIdsByConnector` 里，**不**编一条 Connector 记录塞进 `items`（没有的 name/mode 不造）。
+       *
+       * 这里**不再**按 `effective` 数（此前的「对谁生效」口径）：那是注入闸，含组织默认与旧 connectorIds 两档，
+       * 数出来的人与详情行、组织页 tab 都对不上。注入闸本身（`computeEffectiveEntries`）不动。
        */
       async listConnectorsWithAssignments() {
-        const [connectors, agents] = await Promise.all([
+        const [connectors, agents, vars] = await Promise.all([
           this.opts.store.listConnectors(),
-          this.opts.store.listActors({ kind: "agent" })
+          this.opts.store.listActors({ kind: "agent" }),
+          this.opts.store.listVariables()
         ]);
-        const agentIds = agents.map((a) => a.id);
-        const configs = this.opts.store.latestConfigs ? await this.opts.store.latestConfigs(agentIds) : new Map(await Promise.all(agentIds.map(async (id) => [id, await this.opts.store.latestConfig(id)])));
-        const allConns = this.opts.store.listAllActorConnectorConnections ? await this.opts.store.listAllActorConnectorConnections() : (await Promise.all(agentIds.map((id) => this.opts.store.listActorConnectorConnections(id)))).flat();
-        const connsByActor = /* @__PURE__ */ new Map();
-        for (const c of allConns) {
-          const arr = connsByActor.get(c.actorId) ?? [];
-          arr.push(c);
-          connsByActor.set(c.actorId, arr);
-        }
+        const roster = new Set(hideDeleted(agents).map((a) => a.id));
         const byConn = /* @__PURE__ */ new Map();
-        for (const a of agents) {
-          const entries = computeEffectiveEntries(configs.get(a.id) ?? null, connsByActor.get(a.id) ?? [], connectors);
-          for (const e of entries) {
-            if (!e.enabled) continue;
-            const list2 = byConn.get(e.connectorId) ?? [];
-            list2.push(a.id);
-            byConn.set(e.connectorId, list2);
-          }
-        }
-        return connectors.map((c) => ({ ...c, connectedActorIds: [...new Set(byConn.get(c.id) ?? [])] }));
+        for (const { actorId, connectorId } of personalConnectionPairs(vars)) {
+          if (!roster.has(actorId)) continue;
+          const set = byConn.get(connectorId) ?? /* @__PURE__ */ new Set();
+          set.add(actorId);
+          byConn.set(connectorId, set);
+        }
+        const connectedActorIdsByConnector = {};
+        for (const [connectorId, set] of byConn) connectedActorIdsByConnector[connectorId] = [...set];
+        return {
+          items: connectors.map((c) => ({ ...c, connectedActorIds: connectedActorIdsByConnector[c.id] ?? [] })),
+          connectedActorIdsByConnector
+        };
       }
       /** 该员工最新配置里启用的 connector id 集合——与 resolveActorEnv 同一闸门（connectorIds 成员资格）。 */
       async activeConnectorIdsForActor(actorId, cfg) {
@@ -222712,17 +222756,94 @@ ${input.description}
         ]);
         const globalConnected = connectors.filter((c) => c.status === "connected").map((c) => c.id);
         const actorConnected = [...new Set(
-          vars.filter((v2) => v2.scope === "personal" && v2.actorId === actorId && v2.connectorId).map((v2) => v2.connectorId)
+          personalConnectionPairs(vars).filter((p2) => p2.actorId === actorId).map((p2) => p2.connectorId)
         )];
         const effective = await this.effectiveConnectorEntries(actorId, config2, connectors);
+        const { ready, assessed, undecryptable } = this.connectorCredentialReadiness(actorId, vars);
+        const credentialReady = [...ready];
+        const credentialUndecryptable = [...undecryptable];
+        const credentialMissing = actorConnected.filter(
+          (id) => undecryptable.has(id) || assessed.has(id) && !ready.has(id)
+        );
+        return { connections, globalConnected, actorConnected, effective, credentialReady, credentialMissing, credentialUndecryptable };
+      }
+      /**
+       * 这名员工每个连接器的凭据齐不齐——**派单那条路的等价判定**：
+       *   ① `collectAllConnectorCredentials`（派单与会话中途续期共用的那个函数）现在就收得齐；或
+       *   ② 连接器声明了续期能力，且续期材料里 required 的几项都在（`orgDefault` 的可回落组织级，
+       *      与 `readRefreshMaterials` 同口径）——`resolveActorEnv` 注入前会先跑
+       *      `refreshEnabledConnectorCredentials`，把短命凭据铸出来再收。
+       *      GitHub App 就是这一类：组织级连接只存 App 材料、token 每次派单现铸（server.ts 的 manifest
+       *      回调刻意不存组织级 token）。只看 ① 会把它一刀切报成「凭据不全」。
+       *
+       * 续期**会不会成功**（私钥被吊销、App 被卸载、飞书 refresh_token 过期、平台不可达 / 限流）这里判不了——
+       * 要真打一次平台才知道，PRD「不能获取时不伪造」，所以不算异常。
+       * `assessed` = 本服务判得了的连接器（注册表里有的）。
+       *
+       * **解不开的密文**（变量密钥换过、坏行）不能当「没有」处理，要记成那个连接器的异常证据（`undecryptable`）。
+       * 派单那条路（serve.ts `buildActorProvision` → `resolveActorProvisionEntries`；`resolveActorEnv` 同规则）
+       * 对「无 connectorId 的行 + 启用中连接器的行」**逐行**解密，任何一行解不开就抛，dispatcher 记 spawn-failed
+       * ——整单派不出去，不是只少一个连接器：
+       *   · 不回落同 key 的组织值（个人行存在就解个人行，解不开就抛；续期读材料的 `revealResolvedVariable` 同理）；
+       *   · 不跳过可选项（用户 token、只在服务端用的 refresh_token 也逐行解）；
+       *   · 续期读材料撞上坏行 → 该连接器本轮不续（best-effort catch），坏行原样留着，下一步解密照样抛。
+       * 所以这里若把坏行当「没有」再回落组织值、或因为它可选就放过，界面会说凭据齐全而派单整单失败
+       * （2026-09-15 验收时补的回归：connector-connection-consistency.test.ts「解不开的密文」一组）。
+       * 反过来**不改运行时**：派单遇坏行就失败是既有的身份策略，不为了显示去动它。
+       *
+       * 归属：行上有 `connectorId` 就归它；没有（密钥页手录的那种）就归「声明了这个变量名的连接器」——
+       * 与这里收凭据时不看 `connectorId`、只按变量名取值是同一口径。归属不到任何连接器的坏行（如组织级
+       * OPENAI_API_KEY）一样会让派单失败，但它不是哪条连接的事，不拿它把无关连接器标坏。
+       * 此前（更早）这里直接抛，整个 `GET /api/actors/:id/connectors` 500；现在接口照样可读。
+       */
+      connectorCredentialReadiness(actorId, vars) {
+        const connectors = createAllConnectors();
+        const declaredBy = /* @__PURE__ */ new Map();
+        for (const connector of connectors) {
+          for (const s2 of [...connector.credentialSources, ...connector.refreshCredentialSources ?? []]) {
+            for (const key of [s2.from, ...s2.fromAny ?? []]) {
+              const slugs = declaredBy.get(key) ?? [];
+              if (!slugs.includes(connector.config.slug)) declaredBy.set(key, [...slugs, connector.config.slug]);
+            }
+          }
+        }
+        const undecryptable = /* @__PURE__ */ new Set();
+        const decode2 = (v2) => {
+          try {
+            return this.decodeCiphertext(v2.valueEncrypted);
+          } catch {
+            for (const slug6 of v2.connectorId ? [v2.connectorId] : declaredBy.get(v2.key) ?? []) undecryptable.add(slug6);
+            return void 0;
+          }
+        };
         const flat = {};
-        for (const v2 of vars) if (v2.scope === "global" && !v2.actorId) flat[v2.key] = this.decodeCiphertext(v2.valueEncrypted);
-        for (const v2 of vars) if (v2.scope === "personal" && (!v2.actorId || v2.actorId === actorId)) flat[v2.key] = this.decodeCiphertext(v2.valueEncrypted);
-        const credentialReady = collectAllConnectorCredentials({
+        const own3 = {};
+        for (const v2 of vars) {
+          if (v2.scope !== "global" || v2.actorId) continue;
+          const value2 = decode2(v2);
+          if (value2 !== void 0) flat[v2.key] = value2;
+        }
+        for (const v2 of vars) {
+          if (v2.scope !== "personal" || v2.actorId && v2.actorId !== actorId) continue;
+          const value2 = decode2(v2);
+          if (value2 === void 0) continue;
+          flat[v2.key] = value2;
+          if (v2.actorId === actorId) own3[v2.key] = value2;
+        }
+        const ready = new Set(collectAllConnectorCredentials({
           vars: flat,
           actorName: flat["GIT_AUTHOR_NAME"] ?? actorId.split(":").pop() ?? "oasis-agent"
-        }).map((c) => c.slug);
-        return { connections, globalConnected, actorConnected, effective, credentialReady };
+        }).map((c) => c.slug));
+        const assessed = /* @__PURE__ */ new Set();
+        for (const connector of connectors) {
+          const slug6 = connector.config.slug;
+          assessed.add(slug6);
+          if (ready.has(slug6) || !connector.refreshCredentials) continue;
+          const materials = (connector.refreshCredentialSources ?? []).filter((s2) => s2.required);
+          if (materials.length > 0 && materials.every((s2) => Boolean((s2.orgDefault ? flat : own3)[s2.from]))) ready.add(slug6);
+        }
+        for (const slug6 of undecryptable) ready.delete(slug6);
+        return { ready, assessed, undecryptable };
       }
       /**
        * 该员工每个连接器的「有效启用」集合（变量/技能注入闸门）：
@@ -222815,6 +222936,23 @@ ${input.description}
         if (v2.value === void 0 || v2.value === "") {
           return;
         }
+        await this.opts.store.putVariable(this.toStoredVariableRow(v2, v2.value));
+      }
+      /**
+       * **新建**一条变量（决策 0565）：这一行（组织变量按 key、个人变量按 key + actorId、项目变量按 key + projectId）
+       * 已经存在就返回 `"exists"`、什么都不写——不像 `putVariable` 那样悄悄覆盖。
+       *
+       * 「管理页新建组织变量」「Agent 详情新建个人变量」都走这里：同一组织第二条同名组织变量、同一 Agent
+       * 第二条同名个人变量在存储层当场被挡下；不同 Agent 的同名个人变量、以及个人变量与同名组织变量
+       * 是不同的唯一键，照常共存。值必填（新建出一条没有值的空壳没有意义）。
+       */
+      async createVariable(v2) {
+        if (!v2.value) throw new ApiError(400, "BAD_REQUEST", "\u65B0\u5EFA\u53D8\u91CF\u5FC5\u987B\u63D0\u4F9B\u53D8\u91CF\u503C");
+        const inserted = await this.opts.store.insertVariable(this.toStoredVariableRow(v2, v2.value));
+        return inserted ? "created" : "exists";
+      }
+      /** `putVariable` / `createVariable` 共用：校验 + 加密 + 摊成存储行。两条写路径的落行口径必须逐字一致。 */
+      toStoredVariableRow(v2, value2) {
         if (v2.deliveryMode === void 0 && v2.connectorId === void 0) {
           throw new ApiError(
             400,
@@ -222822,7 +222960,7 @@ ${input.description}
             "\u5199\u53D8\u91CF\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B deliveryMode\uFF08env | ref | broker\uFF09\u2014\u2014\u6295\u9012\u6863\u51B3\u5B9A\u660E\u6587\u662F\u5426\u8FDB agent env\uFF0C\u4E0D\u8BBE\u7F3A\u7701"
           );
         }
-        await this.opts.store.putVariable({
+        return {
           key: v2.key,
           // 展示名（子 PRD《密钥管理》§2）。没传就不传下去——存储层按「不动」处理，不抹既有名字。
           ...v2.name !== void 0 && v2.name !== "" ? { name: v2.name } : {},
@@ -222833,7 +222971,7 @@ ${input.description}
           ...v2.overrides !== void 0 ? { overrides: v2.overrides } : {},
           // 非连接器写入到此 deliveryMode 必非空（上面已拦）；连接器写入沿用 env（其值经 sensitiveVars 剔除，不进 env）。
           deliveryMode: v2.deliveryMode ?? "env",
-          valueEncrypted: v2.encrypted === false ? `plain:${v2.value}` : this.encrypt(v2.value),
+          valueEncrypted: v2.encrypted === false ? `plain:${value2}` : this.encrypt(value2),
           updatedAt: this.now(),
           /* 创建者 / 创建时间 / 更新者：**由服务端落，不接受调用方自报**。
              createdBy/createdAt 两格存储层按「第一次落行才写」处理（COALESCE 旧值），所以这里每次都传，
@@ -222846,7 +222984,7 @@ ${input.description}
           // 决策 0556：发给谁只对全局行有意义；个人档 / 项目档一律不带（存储层 COALESCE：不带 = 不动）。
           ...v2.scope === "global" && v2.audience !== void 0 ? { audience: v2.audience } : {},
           ...v2.scope === "global" && v2.enabledActorIds !== void 0 ? { enabledActorIds: dedupe(v2.enabledActorIds) } : {}
-        });
+        };
       }
       /**
        * 只改一行变量的元数据、不碰值（决策 0556）。
@@ -222906,15 +223044,18 @@ ${input.description}
       /** 前端/接口可见的列表。
        * - actorId 指定时：返回全局 + 该员工个人变量，按 key 去重（个人覆盖全局）；
        *   个人变量如覆盖同名全局则 overrides 字段填 key 名，告知前端。
+       *   `opts.includeShadowed`（决策 0565）：**不去重**——被同名个人变量覆盖的那条组织变量也带上，
+       *   Agent 详情要把「组织变量」与「个人变量」分开摆，覆盖关系由调用方按同名个人行判。
+       *   发给谁（audience）的过滤仍由存储层那一条查询做，这里不另判。
        * - 不指定时：返回全部（管理员视图，不去重）。
        */
-      async listVariables(actorId) {
+      async listVariables(actorId, opts) {
         const rows = await this.opts.store.listVariables(actorId);
         let source = rows;
         if (actorId) {
           const personalKeys = new Set(rows.filter((r) => r.actorId).map((r) => r.key));
           const globalKeys = new Set(rows.filter((r) => !r.actorId).map((r) => r.key));
-          source = rows.filter((r) => r.actorId !== void 0 || !personalKeys.has(r.key));
+          if (!opts?.includeShadowed) source = rows.filter((r) => r.actorId !== void 0 || !personalKeys.has(r.key));
           source = source.map(
             (r) => r.actorId && globalKeys.has(r.key) && !r.overrides ? { ...r, overrides: r.key } : r
           );
@@ -222956,11 +223097,19 @@ ${input.description}
        * 或行是 2026-09-10 之前落的（那时还没有 created_by 这一格）。
        */
       async variableCreatedBy(key, selector = {}) {
+        return (await this.variableRowMeta(key, selector))?.createdBy;
+      }
+      /** 按存储唯一键 (key, actorId?, projectId?) 找那一行的元数据（**不解密**）。没有这一行返回 undefined。 */
+      async variableRowMeta(key, selector = {}) {
         const rows = await this.opts.store.listVariables();
         const hit = rows.find(
           (r) => r.key === key && (r.actorId ?? "") === (selector.actorId ?? "") && (r.projectId ?? "") === (selector.projectId ?? "")
         );
-        return hit?.createdBy;
+        if (!hit) return void 0;
+        return {
+          ...hit.createdBy !== void 0 ? { createdBy: hit.createdBy } : {},
+          ...hit.connectorId !== void 0 ? { connectorId: hit.connectorId } : {}
+        };
       }
       async revealVariable(key, actorId) {
         const ct = await this.opts.store.getVariableCiphertext(key, actorId);
@@ -224316,7 +224465,8 @@ function actorsDomain(opts) {
     });
     router.get("/api/connectors", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
-      return { status: 200, body: { items: await service.listConnectorsWithAssignments() } };
+      const { items, connectedActorIdsByConnector } = await service.listConnectorsWithAssignments();
+      return { status: 200, body: { items, connectedActorIdsByConnector } };
     });
     router.post("/api/connectors", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
@@ -224367,9 +224517,39 @@ function actorsDomain(opts) {
       throw new ApiError(
         403,
         "SECRET_NOT_OWNED",
-        "\u8FD9\u4EFD\u5BC6\u94A5\u7531\u522B\u4EBA\u521B\u5EFA\uFF0C\u53EA\u6709\u521B\u5EFA\u8005\u672C\u4EBA\u6216\u7EC4\u7EC7\u7BA1\u7406\u8005\u53EF\u4EE5\u4FEE\u6539 / \u5220\u9664"
+        "\u8FD9\u6761\u53D8\u91CF\u7531\u522B\u4EBA\u521B\u5EFA\uFF0C\u53EA\u6709\u521B\u5EFA\u8005\u672C\u4EBA\u6216\u7EC4\u7EC7\u7BA1\u7406\u8005\u53EF\u4EE5\u4FEE\u6539 / \u5220\u9664"
+      );
+    };
+    const variableExistsError = async (service, key, selector) => {
+      const meta = await service.variableRowMeta(key, selector).catch(() => void 0);
+      if (meta?.connectorId) {
+        return new ApiError(
+          409,
+          "VARIABLE_ALREADY_EXISTS",
+          `\u53D8\u91CF\u540D ${key} \u5DF2\u88AB\u8FDE\u63A5\u5668\u300C${meta.connectorId}\u300D\u7684\u51ED\u636E\u5360\u7528\uFF1B\u8FDE\u63A5\u5668\u51ED\u636E\u8BF7\u901A\u8FC7\u8FDE\u63A5\u5668\u6388\u6743\u6D41\u7A0B\u7EF4\u62A4`
+        );
+      }
+      if (selector.actorId) {
+        return new ApiError(
+          409,
+          "VARIABLE_ALREADY_EXISTS",
+          `\u8FD9\u4F4D Agent \u5DF2\u7ECF\u6709\u53EB ${key} \u7684\u4E2A\u4EBA\u53D8\u91CF\u4E86\u2014\u2014\u540C\u4E00 Agent \u540C\u4E00\u4E2A\u53D8\u91CF\u540D\u53EA\u80FD\u6709\u4E00\u6761\u4E2A\u4EBA\u53D8\u91CF\uFF0C\u8981\u6539\u8BF7\u7F16\u8F91\u90A3\u4E00\u6761`
+        );
+      }
+      if (selector.projectId) {
+        return new ApiError(409, "VARIABLE_ALREADY_EXISTS", `\u9879\u76EE ${selector.projectId} \u5DF2\u7ECF\u6709\u53EB ${key} \u7684\u9879\u76EE\u53D8\u91CF\u4E86`);
+      }
+      return new ApiError(
+        409,
+        "VARIABLE_ALREADY_EXISTS",
+        `\u7EC4\u7EC7\u91CC\u5DF2\u7ECF\u6709\u53EB ${key} \u7684\u7EC4\u7EC7\u53D8\u91CF\u4E86\u2014\u2014\u540C\u4E00\u4E2A\u53D8\u91CF\u540D\u5728\u7EC4\u7EC7\u91CC\u53EA\u80FD\u6709\u4E00\u6761\u7EC4\u7EC7\u53D8\u91CF\uFF0C\u8981\u6539\u8BF7\u7F16\u8F91\u90A3\u4E00\u6761`
       );
     };
+    const parseCreateFlag = (raw) => {
+      if (raw === void 0 || raw === false) return false;
+      if (raw === true) return true;
+      throw new ApiError(400, "BAD_REQUEST", "create \u53EA\u80FD\u662F\u5E03\u5C14\u503C true / false");
+    };
     const auditVariableChange = async (req, kind, variableKey, targetScope) => {
       await opts.credentialAudit?.({
         kind,
@@ -224391,6 +224571,7 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
+      const create = parseCreateFlag(b2.create);
       const expiresAt2 = normalizeExpiresAt(b2.expiresAt);
       const audienceMeta = parseAudienceMeta(b2);
       if ((audienceMeta.audience !== void 0 || audienceMeta.enabledActorIds !== void 0) && b2.scope !== "global") {
@@ -224407,7 +224588,7 @@ function actorsDomain(opts) {
       if (scope === "project" && !b2.projectId) {
         throw new ApiError(400, "BAD_REQUEST", "scope=project \u5FC5\u987B\u63D0\u4F9B projectId");
       }
-      if (scope === "project" && opts.projectExists && !await opts.projectExists(b2.projectId)) {
+      if (scope === "project" && opts.projectExists && !await opts.projectExists(b2.projectId, req.auth.companyId)) {
         throw new ApiError(400, "BAD_REQUEST", `\u9879\u76EE\u4E0D\u5B58\u5728\uFF1A${b2.projectId}\uFF08scope=project \u53D8\u91CF\u7684 projectId \u5FC5\u987B\u662F\u771F\u5B9E\u9879\u76EE\uFF09`);
       }
       if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref" && b2.deliveryMode !== "broker") {
@@ -224427,11 +224608,9 @@ function actorsDomain(opts) {
           "personal \u53D8\u91CF\u8BF7\u8D70 POST /api/actors/:id/variables\uFF08\u672C\u7AEF\u70B9\u65E0 actorId\uFF0C\u5199\u5165\u4F1A\u843D\u4E0B\u65E0\u5F52\u5C5E\u7684\u7578\u5F62\u884C\uFF09"
         );
       }
-      if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
-      await requireSecretOwner(req, service, b2.key, scope === "project" ? { projectId: b2.projectId } : {});
-      await service.putVariable({
+      const selector = scope === "project" ? { projectId: b2.projectId } : {};
+      const input = {
         key: b2.key,
-        value: b2.value,
         scope,
         // 展示名（子 PRD《密钥管理》§2「名称」）；不传 = 不改既有名字。
         ...typeof b2.name === "string" && b2.name.trim() ? { name: b2.name.trim() } : {},
@@ -224444,7 +224623,16 @@ function actorsDomain(opts) {
         // 创建者/更新者取**当前登录人**，不接受 body 传入——自报的「谁建的」等于没有这一格。
         by: req.auth.actor,
         expiresAt: expiresAt2
-      });
+      };
+      if (create) {
+        if (b2.value === void 0 || b2.value === "") throw new ApiError(400, "BAD_REQUEST", "\u65B0\u5EFA\u53D8\u91CF\u5FC5\u987B\u63D0\u4F9B\u53D8\u91CF\u503C");
+        const outcome = await service.createVariable({ ...input, value: b2.value });
+        if (outcome === "exists") throw await variableExistsError(service, b2.key, selector);
+      } else {
+        if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
+        await requireSecretOwner(req, service, b2.key, selector);
+        await service.putVariable({ ...input, value: b2.value });
+      }
       await auditVariableChange(
         req,
         "credential_write",
@@ -224486,7 +224674,8 @@ function actorsDomain(opts) {
     router.get("/api/actors/:id/variables", async (req) => {
       requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
-      return { status: 200, body: { items: await service.listVariables(req.params.id) } };
+      const includeShadowed = ["1", "true"].includes(req.query.get("includeShadowed") ?? "");
+      return { status: 200, body: { items: await service.listVariables(req.params.id, includeShadowed ? { includeShadowed } : void 0) } };
     });
     router.post("/api/actors/:id/variables", async (req) => {
       requireVariableManager(req);
@@ -224494,6 +224683,12 @@ function actorsDomain(opts) {
       const actorId = req.params.id;
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
+      const create = parseCreateFlag(b2.create);
+      if (create) {
+        const owner = await service.getActor(actorId);
+        if (!owner) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A Agent\uFF1A${actorId}`);
+        if (owner.kind !== "agent") throw new ApiError(400, "BAD_REQUEST", "\u4E2A\u4EBA\u53D8\u91CF\u53EA\u80FD\u5EFA\u5728 Agent \u4E0A");
+      }
       const expiresAt2 = normalizeExpiresAt(b2.expiresAt);
       if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref" && b2.deliveryMode !== "broker") {
         throw new ApiError(400, "BAD_REQUEST", "deliveryMode \u53EA\u80FD\u662F env\u3001ref \u6216 broker");
@@ -224505,6 +224700,7 @@ function actorsDomain(opts) {
           "\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B deliveryMode\uFF08env | ref | broker\uFF09\u2014\u2014\u6295\u9012\u6863\u51B3\u5B9A\u660E\u6587\u662F\u5426\u8FDB agent env\uFF0C\u4E0D\u8BBE\u7F3A\u7701"
         );
       }
+      if (create && (b2.value === void 0 || b2.value === "")) throw new ApiError(400, "BAD_REQUEST", "\u65B0\u5EFA\u53D8\u91CF\u5FC5\u987B\u63D0\u4F9B\u53D8\u91CF\u503C");
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       if (b2.connectorId === void 0) {
         const existing = await service.listVariables(actorId);
@@ -224517,13 +224713,12 @@ function actorsDomain(opts) {
           );
         }
       }
-      await requireSecretOwner(req, service, b2.key, { actorId });
-      await service.putVariable({
+      const input = {
         key: b2.key,
         value: b2.value,
         actorId,
         scope: "personal",
-        // 展示名（同上）。组织页「添加密钥 → 新建」走的就是这条端点。
+        // 展示名（同上）。组织页「新建变量」走的就是这条端点。
         ...typeof b2.name === "string" && b2.name.trim() ? { name: b2.name.trim() } : {},
         ...b2.deliveryMode !== void 0 ? { deliveryMode: b2.deliveryMode } : {},
         ...b2.connectorId !== void 0 ? { connectorId: b2.connectorId } : {},
@@ -224531,7 +224726,14 @@ function actorsDomain(opts) {
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {},
         by: req.auth.actor,
         expiresAt: expiresAt2
-      });
+      };
+      if (create) {
+        const outcome = await service.createVariable(input);
+        if (outcome === "exists") throw await variableExistsError(service, b2.key, { actorId });
+      } else {
+        await requireSecretOwner(req, service, b2.key, { actorId });
+        await service.putVariable(input);
+      }
       await auditVariableChange(req, "credential_write", b2.key, `personal:${actorId}`);
       return { status: 201, body: { ok: true } };
     });
@@ -244949,6 +245151,26 @@ var init_postgres = __esm({
 });
 
 // ../storage/src/postgres-registry.ts
+function variableInsertParams(v2) {
+  return [
+    v2.key,
+    v2.scope,
+    v2.actorId ?? null,
+    v2.projectId ?? null,
+    v2.connectorId ?? null,
+    v2.overrides ?? null,
+    v2.deliveryMode ?? null,
+    v2.valueEncrypted,
+    v2.updatedAt,
+    v2.expiresAt ?? null,
+    v2.name ?? null,
+    v2.createdBy ?? null,
+    v2.createdAt ?? null,
+    v2.updatedBy ?? null,
+    v2.audience ?? null,
+    v2.enabledActorIds ?? null
+  ];
+}
 function rowToVariable(row) {
   return {
     key: row.key,
@@ -244976,7 +245198,7 @@ function rowToVariable(row) {
     ...Array.isArray(row.enabled_actor_ids) ? { enabledActorIds: row.enabled_actor_ids } : {}
   };
 }
-var ident5, PostgresRegistryStore, rowToActor, rowToConfig, rowToAgentPrefs;
+var ident5, PostgresRegistryStore, VARIABLE_INSERT_COLUMNS, rowToActor, rowToConfig, rowToAgentPrefs;
 var init_postgres_registry = __esm({
   "../storage/src/postgres-registry.ts"() {
     "use strict";
@@ -245657,7 +245879,7 @@ var init_postgres_registry = __esm({
              updated_by 反过来：每次都覆盖。三者与 name 的 COALESCE 方向相反，别照抄。 */
           /* audience / enabled_actor_ids（决策 0556）走 COALESCE(**新值**, 旧值)：不传 = 不动——
              改默认值时手上不带「发给谁」，普通赋值会把「仅指定 Agent」悄悄打回全员生效。 */
-          `INSERT INTO ${this.s}.variables (key, scope, actor_id, project_id, connector_id, overrides, delivery_mode, value_encrypted, updated_at, expires_at, name, created_by, created_at, updated_by, audience, enabled_actor_ids)
+          `INSERT INTO ${this.s}.variables (${VARIABLE_INSERT_COLUMNS})
        VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
        ON CONFLICT (key, COALESCE(actor_id, ''), COALESCE(project_id, '')) DO UPDATE
          SET scope=$2, actor_id=$3, project_id=$4, connector_id=$5, overrides=$6, delivery_mode=$7, value_encrypted=$8, updated_at=$9, expires_at=$10,
@@ -245667,25 +245889,17 @@ var init_postgres_registry = __esm({
              updated_by=$14,
              audience=COALESCE($15, ${this.s}.variables.audience),
              enabled_actor_ids=COALESCE($16, ${this.s}.variables.enabled_actor_ids)`,
-          [
-            v2.key,
-            v2.scope,
-            v2.actorId ?? null,
-            v2.projectId ?? null,
-            v2.connectorId ?? null,
-            v2.overrides ?? null,
-            v2.deliveryMode ?? null,
-            v2.valueEncrypted,
-            v2.updatedAt,
-            v2.expiresAt ?? null,
-            v2.name ?? null,
-            v2.createdBy ?? null,
-            v2.createdAt ?? null,
-            v2.updatedBy ?? null,
-            v2.audience ?? null,
-            v2.enabledActorIds ?? null
-          ]
+          variableInsertParams(v2)
+        );
+      }
+      async insertVariable(v2) {
+        const r = await this.pool.query(
+          `INSERT INTO ${this.s}.variables (${VARIABLE_INSERT_COLUMNS})
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
+       ON CONFLICT (key, COALESCE(actor_id, ''), COALESCE(project_id, '')) DO NOTHING`,
+          variableInsertParams(v2)
         );
+        return (r.rowCount ?? 0) > 0;
       }
       async touchVariableUsage(key, actorId, projectId2, when) {
         await this.pool.query(
@@ -245773,6 +245987,7 @@ var init_postgres_registry = __esm({
         );
       }
     };
+    VARIABLE_INSERT_COLUMNS = "key, scope, actor_id, project_id, connector_id, overrides, delivery_mode, value_encrypted, updated_at, expires_at, name, created_by, created_at, updated_by, audience, enabled_actor_ids";
     rowToActor = (row) => ({
       id: row.id,
       kind: row.kind,
@@ -257049,6 +257264,9 @@ var init_cutover_aware_registry = __esm({
       async putVariable(...args) {
         return (await this.orgStoreForWrite()).putVariable(...args);
       }
+      async insertVariable(...args) {
+        return (await this.orgStoreForWrite()).insertVariable(...args);
+      }
       async patchVariableValue(...args) {
         return (await this.orgStoreForWrite()).patchVariableValue(...args);
       }
@@ -263398,8 +263616,10 @@ async function startServe(opts) {
     credentialAudit,
     readCredentialAudit,
     // ADR 0125：写 scope=project 变量时校验 projectId 真实存在（getProject 直查，含临时项目）。
-    // projectStateStore 在下方 ~行 1023 才赋值——本箭头只在请求时跑，那时已就绪（同 resolveDispatchScope 惰性模式）。
-    projectExists: async (id) => await projectStateStore.getProject(id) !== null,
+    // 按请求所属公司查（同 PR #870 的剧本/自动化）：此前固定查 projectStateStore（默认公司那一份），
+    // 非默认公司的项目一律报「项目不存在」。未解析出公司 = 默认公司，与 experiments 同一口径。
+    // projectExistsIn 在下方才声明——本箭头只在请求时跑，那时已就绪（同 resolveDispatchScope 惰性模式）。
+    projectExists: async (id, companyId) => projectExistsIn(id, companyId ?? defaultCompanyId),
     /* 子 PRD《密钥管理》§1 的权限判据：密钥的写 / 删要认「创建者本人或组织管理者」。
        owner 与 admin 都算组织管理者（与组织页 `orgIdentityOf` 同一口径）。
        `controlPlaneStore` 在下方才赋值——本箭头只在请求时跑，那时已就绪（同 projectExists 的惰性模式）。
@@ -264308,6 +264528,10 @@ async function startServe(opts) {
     const raw = headers["x-oasis-company"];
     const selector = typeof raw === "string" && raw ? raw : void 0;
     const me = await companies.currentUser({ actor }, headers);
+    if (!selector && authz.startsWith("Bearer ")) {
+      const active = (await companies.service.listForUser(me.accountId)).filter((c) => c.status === "active");
+      if (active.length > 1) return { kind: "ambiguous", companies: active.map((c) => c.id) };
+    }
     const ctx = await companies.service.resolveCurrentCompany(me.accountId, selector);
     if (!ctx) return { kind: "not-found", ...selector !== void 0 ? { selector } : {} };
     return ctx.isMember ? { kind: "ok", companyId: ctx.company.id } : { kind: "forbidden" };
@@ -270950,7 +271174,7 @@ function declaredBooleanFlags() {
   }
   return out;
 }
-var GLOBAL_FLAGS = Object.freeze(/* @__PURE__ */ new Set(["server", "token", "dir", "workspace"]));
+var GLOBAL_FLAGS = Object.freeze(/* @__PURE__ */ new Set(["server", "token", "dir", "workspace", "company"]));
 var BEHAVIORAL_FLAGS = Object.freeze(/* @__PURE__ */ new Set(["set-json", "clear"]));
 var COMMAND_DECLS = {
   // —— 基础设施 ——
@@ -272724,8 +272948,9 @@ async function runConnectorEffectCli(argv) {
 var USAGE_HEADER = `oasis \u2014\u2014 artifact-centric \u534F\u4F5C\u5185\u6838 CLI\uFF08\u670D\u52A1\u7AEF\u7626\u5BA2\u6237\u7AEF\uFF09
 
 \u547D\u4EE4\u603B\u89C8\uFF08\u6309\u5206\u7EC4\u5217\u51FA\uFF1B\u5355\u6761\u8BE6\u60C5\u4E0E\u53C2\u6570\u7528 \`oasis help <\u547D\u4EE4>\` \u6216 \`oasis <\u547D\u4EE4> --help\`\uFF09\uFF1A`;
-var USAGE_FOOTER = `\u901A\u7528\u53C2\u6570\uFF08\u6240\u6709\u547D\u4EE4\u901A\u7528\uFF09: [--server http://127.0.0.1:7320] [--token <t>] [--dir .oasis]
-      token \u89E3\u6790\u987A\u5E8F: --token > $OASIS_TOKEN > <dir>/operator-token\uFF08serve \u542F\u52A8\u65F6\u5199\u5230 <dir>/operator-token\uFF0C\u672C\u673A CLI \u81EA\u52A8\u8BFB\u53D6\uFF09`;
+var USAGE_FOOTER = `\u901A\u7528\u53C2\u6570\uFF08\u6240\u6709\u547D\u4EE4\u901A\u7528\uFF09: [--server http://127.0.0.1:7320] [--token <t>] [--dir .oasis] [--company <\u516C\u53F8 id \u6216 slug>]
+      token \u89E3\u6790\u987A\u5E8F: --token > $OASIS_TOKEN > <dir>/operator-token\uFF08serve \u542F\u52A8\u65F6\u5199\u5230 <dir>/operator-token\uFF0C\u672C\u673A CLI \u81EA\u52A8\u8BFB\u53D6\uFF09
+      \u516C\u53F8\u89E3\u6790\u987A\u5E8F: --company > $OASIS_COMPANY > \u670D\u52A1\u7AEF\u63A8\u65AD\uFF08token \u81EA\u5E26\u516C\u53F8\u7684\u6309 token\uFF1B\u8FD0\u7EF4/\u4EBA\u7C7B token \u6309\u8D26\u53F7\u6240\u5C5E\u516C\u53F8\uFF09`;
 var USAGE = `${USAGE_HEADER}
 
 ${buildCommandIndex()}
@@ -272966,8 +273191,13 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-function makeClient(base, token) {
-  const baseHeaders = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+function apiHeaders(token, company) {
+  const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  if (company) headers["x-oasis-company"] = company;
+  return headers;
+}
+function makeClient(base, token, opts = {}) {
+  const baseHeaders = apiHeaders(token, opts.company);
   const chatSessionId = process.env["OASIS_CHAT_SESSION_ID"];
   if (chatSessionId) baseHeaders["x-chat-session-id"] = chatSessionId;
   const headers = baseHeaders;
@@ -273428,7 +273658,8 @@ async function runCli(argv, println = console.log, progressln = console.error) {
   if (!token) {
     throw new Error(`\u65E0 token\uFF1A\u5148 oasis serve\uFF08\u4F1A\u751F\u6210 ${tokenFile}\uFF09\uFF0C\u6216\u663E\u5F0F --token / $OASIS_TOKEN`);
   }
-  const api = makeClient(base, token);
+  const companySelector = (flags.get("company") ?? process.env["OASIS_COMPANY"])?.trim() || void 0;
+  const api = makeClient(base, token, companySelector ? { company: companySelector } : {});
   if (command === "reconcile-terminal-runs") {
     const runIds = flags.get("run-ids")?.split(",").map((x2) => x2.trim()).filter(Boolean);
     const rows = await api.post("/api/admin/reconcile-terminal-runs", { execute: flags.get("execute") === "true", ...runIds ? { runIds } : {} });
@@ -273550,8 +273781,9 @@ async function runCli(argv, println = console.log, progressln = console.error) {
   switch (command) {
     // 委派一位专家（提案 §7）。四个子形态共用一条命令，靠给了哪个 flag 分流。
     //
-    // ⚠️ **没有 `--company`**：公司与父会话身份一律从签名 claims 取（不变量 3 / §6.1.2）。
-    //   加一个 `--company` 就是把这份保证亲手拆掉——那等于允许 agent 写到别人名下。
+    // ⚠️ **没有自己的 `--company`**：公司与父会话身份一律从签名 claims 取（不变量 3 / §6.1.2）。
+    //   往请求体里加一个公司参数就是把这份保证亲手拆掉——那等于允许 agent 写到别人名下。
+    //   全局 `--company` 只发 `x-oasis-company` 头，服务端对带公司 claims 的 token 不看这个头（见 apiHeaders）。
     // ⚠️ **没有 `--wait-ms`**：一期只做异步。理由不是墙钟不够（chat 墙钟 120 分钟），是三条：
     //   阻塞期间主会话那一轮一直挂着（用户看着「正在输入」十几分钟、他这期间说的话只能排队）、
     //   一个进程挂着空等不产出任何东西、这十几分钟里 serve 重启或节点掉线那一轮就白丢了
@@ -275005,7 +275237,7 @@ ${res.warning}`);
           throw forbidden(e) ?? e;
         }
         const where = scope === "project" ? `\u9879\u76EE ${projectId2}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7";
-        println(`\u5DF2\u5199\u5165 ${key}\uFF08${where}\uFF0C\u6295\u9012=${delivery}\uFF09`);
+        println(`\u5DF2\u5199\u5165 ${key}\uFF08${companySelector ? `\u516C\u53F8 ${companySelector} \xB7 ` : ""}${where}\uFF0C\u6295\u9012=${delivery}\uFF09`);
         break;
       }
       if (sub === "rm") {
@@ -275021,7 +275253,7 @@ ${res.warning}`);
         } catch (e) {
           throw forbidden(e) ?? e;
         }
-        println(`\u5DF2\u5220\u9664 ${key}\uFF08${scope === "project" ? `\u9879\u76EE ${projectId2}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7"}\uFF09`);
+        println(`\u5DF2\u5220\u9664 ${key}\uFF08${companySelector ? `\u516C\u53F8 ${companySelector} \xB7 ` : ""}${scope === "project" ? `\u9879\u76EE ${projectId2}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7"}\uFF09`);
         break;
       }
       throw new Error(`\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Aoasis var ${sub ?? ""}
@@ -275409,7 +275641,7 @@ ${res.warning}`);
     // A3：成图事务（与 intervene 同管线、分语义命名——铺图不是手术）
     case "intervene": {
       const plan = JSON.parse(readFileArg(need(flags, "file")));
-      const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+      const headers = apiHeaders(token, companySelector);
       const previewRes = await fetch(`${base}/api/intervention/preview`, {
         method: "POST",
         headers,
@@ -276452,7 +276684,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.36" : "dev";
+var PKG_VERSION = true ? "2.2.38" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.36",
+  "version": "2.2.38",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "696858b581661883b2eb278fb40c793f3ecf70da"
+    "sourceHead": "55454aeb4d2b4d5b0b530b8777cd1b62d86803c5"
   }
 }