oasis_test_v2 2.2.67 → 2.2.69

package/dist/index.js

@@ -444,13 +444,14 @@ function isUnread(eventAt, marker) {
 function isChatSessionUnread(session, marker) {
   return session.lastTurnQuality !== void 0 && isUnread(session.touchedAt, marker);
 }
-var chatScope, letterScope, INBOX_BASELINE_SCOPE;
+var chatScope, letterScope, INBOX_BASELINE_SCOPE, INBOX_READ_ALL_SCOPE;
 var init_inbox_read = __esm({
   "../contract/src/inbox-read.ts"() {
     "use strict";
     chatScope = (sessionId) => `chat:${sessionId}`;
     letterScope = (annotationId) => `letter:${annotationId}`;
     INBOX_BASELINE_SCOPE = "inbox-baseline";
+    INBOX_READ_ALL_SCOPE = "inbox-read-all";
   }
 });
 
@@ -1303,6 +1304,15 @@ var init_telemetry = __esm({
 });
 
 // ../contract/src/trace.ts
+function legacyScopeIsEmpty(scope2) {
+  return scope2.artifactIds.length === 0 && scope2.chatSessionIds.length === 0 && (scope2.runtimeInstanceIds?.length ?? 0) === 0;
+}
+function legacyScopeMatcher(scope2) {
+  const artifacts = new Set(scope2.artifactIds);
+  const sessions = new Set(scope2.chatSessionIds);
+  const runtimes = new Set(scope2.runtimeInstanceIds ?? []);
+  return (run) => run.artifactId != null && artifacts.has(run.artifactId) || run.chatSessionId != null && sessions.has(run.chatSessionId) || run.runtimeInstanceId != null && runtimes.has(run.runtimeInstanceId);
+}
 var DISPLAY_CNY_PER_USD, USAGE_POINT_FINAL_SEQ;
 var init_trace = __esm({
   "../contract/src/trace.ts"() {
@@ -125849,7 +125859,7 @@ function isReplyWork(w2) {
 function replyIssueIdOf(w2) {
   return w2.lane === "reply" ? w2.replyToIssueId ?? null : null;
 }
-var BUSINESS_HANDOFF_POLICY_FIELD, BUSINESS_HANDOFF_POLICY_EXEMPT, DEFAULT_CONFIG, deriveWorkId, deriveReviewId, deriveReplyId;
+var BUSINESS_HANDOFF_POLICY_FIELD, BUSINESS_HANDOFF_POLICY_EXEMPT, DEFAULT_CONFIG, deriveWorkId, deriveReviewId, ENGINE_SYSTEM_ACTOR, REVIEW_EXHAUSTED_ESC_PREFIX, deriveReplyId;
 var init_model = __esm({
   "../engine/src/model.ts"() {
     "use strict";
@@ -125862,6 +125872,8 @@ var init_model = __esm({
     };
     deriveWorkId = (nodeId, version2) => `wk:${nodeId}:${version2}`;
     deriveReviewId = (workId, reviewer, group) => `rv:${workId}:${reviewer}:${group}`;
+    ENGINE_SYSTEM_ACTOR = "actor:system:engine";
+    REVIEW_EXHAUSTED_ESC_PREFIX = "esc:review-exhausted:";
     deriveReplyId = (issueId, salt) => `ir:${issueId}:${salt}`;
   }
 });
@@ -126405,6 +126417,7 @@ var init_kill = __esm({
 function scan(state, ctx) {
   if (state.workorder.dispatchPaused) return { events: [], terminated: false };
   const events = [];
+  closeSettledReviewEscalations(state, events);
   for (const node2 of state.liveNodes()) {
     const lw = node2.latestWorkId ? state.work(node2.latestWorkId) : null;
     const continuationPolicy = node2.assigneeActorId ? ctx.continuationPolicies?.get(node2.assigneeActorId) : null;
@@ -126933,6 +126946,55 @@ function reviewMaxRetriesOf(policy) {
   const act = policy.resolve({ executor: "agent", scenario: "review" }).timeoutAction;
   return act.kind === "kill-rebuild" ? act.maxRetries : AGENT_REVIEW_MAX_RETRIES;
 }
+function pushReviewExhaustedEscalation(state, nodeId, workId, reviewId, reviewerActorId, rounds, events) {
+  const node2 = state.node(nodeId);
+  if (!node2) return;
+  if (node2.latestAcceptId === workId) return;
+  const escId = `${REVIEW_EXHAUSTED_ESC_PREFIX}${reviewId}`;
+  if (state.allIssues().some((i) => i.id === escId)) return;
+  events.push({
+    kind: "issue.create",
+    workorderId: state.workorder.id,
+    issueId: escId,
+    issueKind: "escalation",
+    body: `\u300A${node2.title}\u300B\u7684\u8BC4\u5BA1\u8FDE\u7EED ${rounds} \u6B21\u5931\u8D25\uFF0C\u8FD9\u4E00\u8F6E\u8BC4\u5BA1\u6536\u4E0D\u9F50\u2014\u2014\u9700\u8981\u6709\u4EBA\u91CD\u5F00\u3002
+
+\u672B\u6B21\u8BC4\u5BA1\u4F1A\u8BDD\u7ED3\u675F\u65F6\u6CA1\u6709\u6295\u7968\uFF1B\u62A5\u9519\u539F\u8BDD\u89C1\u8FD9\u4E2A\u8282\u70B9\u7684\u6267\u884C\u8F68\u8FF9\u3002`,
+    aboutNodeId: nodeId,
+    aboutWorkId: workId,
+    raisedByNodeId: null,
+    authorActorId: reviewerActorId,
+    handActorId: null,
+    recipients: [state.workorder.ownerActorId],
+    attachments: [],
+    intent: "advisory"
+  });
+}
+function closeSettledReviewEscalations(state, events) {
+  for (const issue2 of state.allIssues()) {
+    if (issue2.resolvedAt !== null || issue2.kind !== "escalation") continue;
+    const id = issue2.id;
+    if (!id.startsWith(REVIEW_EXHAUSTED_ESC_PREFIX)) continue;
+    const node2 = issue2.aboutNodeId ? state.node(issue2.aboutNodeId) : void 0;
+    if (!node2 || node2.cancelledAt) continue;
+    const lw = node2.latestWorkId ? state.work(node2.latestWorkId) : null;
+    if (lw && workState(lw, hasOutput(lw, state.artifactsOf(lw.id).length)) === "dead") continue;
+    const review = state.review(id.slice(REVIEW_EXHAUSTED_ESC_PREFIX.length));
+    if (!review) continue;
+    const head = state.requirementsOf(node2.id).find((r) => r.reviewGroup === review.reviewGroup)?.latestReviewId ?? null;
+    const note = head !== review.id ? "\u8BC4\u5BA1\u5DF2\u91CD\u65B0\u5B89\u6392" : node2.latestAcceptId === review.targetWorkId ? "\u8FD9\u4E00\u7248\u5DF2\u9A8C\u6536" : null;
+    if (note === null) continue;
+    events.push({
+      kind: "issue.resolve",
+      workorderId: state.workorder.id,
+      issueId: issue2.id,
+      state: "resolved",
+      by: SYSTEM_ENGINE_ACTOR,
+      note,
+      viaWorkId: null
+    });
+  }
+}
 function processReviews(state, nodeId, workId, ctx, events) {
   const policy = ctx.policy ?? CODE_DEFAULT_POLICY;
   const reqs = state.requirementsOf(nodeId);
@@ -126994,15 +127056,19 @@ function processReviews(state, nodeId, workId, ctx, events) {
       }
     } else if (info.status === "failed") {
       const req = reqs.find((r) => r.reviewGroup === g2);
-      const overLimit = reviewRetriesExhausted(g2, reviews, { policy }) !== null;
+      const exhausted = reviewRetriesExhausted(g2, reviews, { policy });
+      const overLimit = exhausted !== null;
       if (overLimit && classify(req.reviewerActorId) === "agent") {
         const lrId = req.latestReviewId;
-        if (lrId) events.push({
-          kind: "review.kill",
-          workorderId: state.workorder.id,
-          reviewId: lrId,
-          reason: "exhausted"
-        });
+        if (lrId) {
+          events.push({
+            kind: "review.kill",
+            workorderId: state.workorder.id,
+            reviewId: lrId,
+            reason: "exhausted"
+          });
+          pushReviewExhaustedEscalation(state, nodeId, workId, lrId, req.reviewerActorId, exhausted.rounds, events);
+        }
       } else if (!overLimit) {
         events.push({
           kind: "review.create",
@@ -127193,6 +127259,7 @@ function assessConvergence(state, ctx) {
   const anyUnfinished = state.liveNodes().some((n) => !n.latestAcceptId);
   return { stuck: !anyRunning && !anyBlockingIssue && allIdle && anyUnfinished, codes };
 }
+var SYSTEM_ENGINE_ACTOR;
 var init_activate = __esm({
   "../engine/src/activate.ts"() {
     "use strict";
@@ -127207,6 +127274,7 @@ var init_activate = __esm({
     init_model();
     init_views2();
     init_kill();
+    SYSTEM_ENGINE_ACTOR = ENGINE_SYSTEM_ACTOR;
   }
 });
 
@@ -135081,6 +135149,7 @@ var init_issue = __esm({
   "../engine/src/handlers/issue.ts"() {
     "use strict";
     init_plan();
+    init_model();
     init_letters();
     issueCreate = {
       name: "issue/create",
@@ -135172,7 +135241,8 @@ var init_issue = __esm({
         }
         if (issue2.resolvedAt !== null) return;
         const humanResolution = e.by.startsWith("actor:human:") && e.by === ctx.actorId;
-        if (e.semanticsVersion === 2 && issue2.kind === "escalation" && !humanResolution) {
+        const engineSelfClosure = e.by === ENGINE_SYSTEM_ACTOR && ctx.actorId === ENGINE_SYSTEM_ACTOR && issue2.id.startsWith(REVIEW_EXHAUSTED_ESC_PREFIX);
+        if (e.semanticsVersion === 2 && issue2.kind === "escalation" && !humanResolution && !engineSelfClosure) {
           throw new Error("\u5173\u95ED\u5347\u7EA7\u9700\u8981\u4EBA\u660E\u786E\u786E\u8BA4\uFF1Bagent \u8BF7\u63D0\u4EA4\u5173\u95ED\u6388\u6743\u7533\u8BF7");
         }
         state.updateIssue(e.issueId, {
@@ -213891,7 +213961,10 @@ ${composed}`;
                 auth: {
                   actor,
                   ...companyId !== void 0 ? { companyId } : {},
-                  ...dispatch && Object.keys(dispatch).length > 0 ? { dispatch } : {}
+                  ...dispatch && Object.keys(dispatch).length > 0 ? { dispatch } : {},
+                  // 签名 scopes 原样透出（ADR 0609 D1）：部署级 operator-token 靠它被认出来。
+                  // 只来自签名 token；cookie / 简单 token 没有这一项。
+                  ...domainClaims?.scopes ? { scopes: domainClaims.scopes } : {}
                 },
                 raw: req
               });
@@ -214342,6 +214415,18 @@ var init_tokens = __esm({
   }
 });
 
+// ../server/src/auth/operator.ts
+function isOperatorRequest(auth) {
+  return auth.scopes?.includes(OPERATOR_SCOPE) === true;
+}
+var OPERATOR_SCOPE;
+var init_operator = __esm({
+  "../server/src/auth/operator.ts"() {
+    "use strict";
+    OPERATOR_SCOPE = "oasis:operator";
+  }
+});
+
 // ../server/src/session-dataplane-token.ts
 function createDataplaneTokenIssuer(opts = {}) {
   const secret = readOrCreateSecret2(opts.secretFile);
@@ -215505,6 +215590,7 @@ var init_memory_trace_store = __esm({
         return run ? this.decorate(structuredClone(run)) : null;
       }
       async listRuns(filter) {
+        const inScope2 = filter.legacyScope ? legacyScopeMatcher(filter.legacyScope) : null;
         let items = [...this.runs.values()].filter((r) => {
           if (filter.actorId && r.actorId !== filter.actorId) return false;
           if (filter.artifactId && r.artifactId !== filter.artifactId) return false;
@@ -215512,6 +215598,7 @@ var init_memory_trace_store = __esm({
           if (filter.runtimeKind && r.runtimeKind !== filter.runtimeKind) return false;
           if (filter.status && r.status !== filter.status) return false;
           if (filter.rootRunId && r.rootRunId !== filter.rootRunId) return false;
+          if (inScope2 && !inScope2(r)) return false;
           if (filter.from && r.startedAt < filter.from) return false;
           if (filter.to && r.startedAt > filter.to) return false;
           if (filter.excludeAnalysis) {
@@ -216223,6 +216310,7 @@ var init_memory_trace_store = __esm({
       }
       /** 按维度查聚合用量。 */
       async queryUsageStats(filter) {
+        if (filter.legacyScope) return this.queryUsageStatsScoped(filter, filter.legacyScope);
         const gran = filter.granularity ?? "hour";
         const out = [];
         for (const row of this.usageAggregates.values()) {
@@ -216250,6 +216338,59 @@ var init_memory_trace_store = __esm({
         }
         return out.sort((a, b2) => a.bucket < b2.bucket ? 1 : a.bucket > b2.bucket ? -1 : a.actorId.localeCompare(b2.actorId));
       }
+      /**
+       * legacy 共享账本上的按维度用量：绕开聚合行、按租户谓词从 runs 现算
+       * （与 PostgresTraceStore.queryUsageStatsScoped 同口径——聚合行里没有 artifact / chat_session，
+       *  表达不了归属；共用同一份 run 才能对上数）。
+       */
+      async queryUsageStatsScoped(filter, scope2) {
+        if (legacyScopeIsEmpty(scope2)) return [];
+        const inScope2 = legacyScopeMatcher(scope2);
+        const gran = filter.granularity ?? "hour";
+        const acc = /* @__PURE__ */ new Map();
+        for (const run of this.runs.values()) {
+          if (run.usage == null) continue;
+          if (!inScope2(run)) continue;
+          if (filter.actorIds?.length && !filter.actorIds.includes(run.actorId)) continue;
+          if (filter.runtimeInstanceIds?.length && !filter.runtimeInstanceIds.includes(run.runtimeInstanceId ?? "")) continue;
+          if (filter.runtimeKinds?.length && !filter.runtimeKinds.includes(run.runtimeKind)) continue;
+          if (filter.effectiveModels?.length && !filter.effectiveModels.includes(run.effectiveModel ?? "")) continue;
+          const started = new Date(run.startedAt);
+          const bucket2 = gran === "day" ? this.truncDayISO(started) : this.truncHourISO(started);
+          if (filter.from && bucket2 < (gran === "day" ? this.truncDayISO(new Date(filter.from)) : this.truncHourISO(new Date(filter.from)))) continue;
+          if (filter.to && bucket2 > filter.to) continue;
+          const u = run.usage;
+          const input = u.inputTokens ?? 0;
+          const output = u.outputTokens ?? 0;
+          const key2 = `${run.actorId}|${run.runtimeInstanceId ?? ""}|${run.effectiveModel ?? ""}|${bucket2}`;
+          const row = acc.get(key2);
+          if (row) {
+            row.runCount += 1;
+            row.inputTokens += input;
+            row.outputTokens += output;
+            row.totalTokens += u.totalTokens ?? input + output;
+            row.cacheReadTokens += u.cacheReadTokens ?? 0;
+            row.cacheCreationTokens += u.cacheCreationTokens ?? 0;
+            row.costUsdMicros += u.costUsdMicros ?? 0;
+          } else {
+            acc.set(key2, {
+              actorId: run.actorId,
+              runtimeInstanceId: run.runtimeInstanceId ?? null,
+              runtimeKind: run.runtimeKind,
+              effectiveModel: run.effectiveModel ?? null,
+              bucket: bucket2,
+              runCount: 1,
+              inputTokens: input,
+              outputTokens: output,
+              totalTokens: u.totalTokens ?? input + output,
+              cacheReadTokens: u.cacheReadTokens ?? 0,
+              cacheCreationTokens: u.cacheCreationTokens ?? 0,
+              costUsdMicros: u.costUsdMicros ?? 0
+            });
+          }
+        }
+        return [...acc.values()].sort((a, b2) => a.bucket < b2.bucket ? 1 : a.bucket > b2.bucket ? -1 : a.actorId.localeCompare(b2.actorId));
+      }
     };
   }
 });
@@ -233138,6 +233279,7 @@ var init_review_requirement_activity = __esm({
 // ../server/src/domains/collab/activity.ts
 function escalationKindOf(issueId, authorActorId) {
   if (issueId.startsWith(RETRY_EXHAUSTED_ESC_PREFIX)) return "retry_exhausted";
+  if (issueId.startsWith(REVIEW_EXHAUSTED_ESC_PREFIX2)) return "review_exhausted";
   return isSystemActorId(authorActorId) ? "output_stall" : "manual";
 }
 function parseStopLossFacts(kind, body2) {
@@ -234046,8 +234188,12 @@ function buildWorkorderActivity(input) {
         const gapId = issueById.get(id)?.gapId;
         return typeof gapId === "string" && !!issueById.get(gapId);
       };
-      const head = kind === "retry_exhausted" ? ACTIVITY_COPY.escalationHeadRetryExhausted(nodeName(latest.nodeId)) : kind === "output_stall" ? ACTIVITY_COPY.escalationHeadOutputStall(nodeName(latest.nodeId)) : gapBehind(latest.id) ? ACTIVITY_COPY.escalationHeadGapEscalated(nameOf(latest.authorId), nodeName(latest.nodeId)) : ACTIVITY_COPY.escalationHeadManual(nameOf(stuckActor));
-      const howTo = kind === "retry_exhausted" ? ACTIVITY_COPY.escalationHowToRetryExhausted : kind === "output_stall" ? ACTIVITY_COPY.escalationHowToOutputStall : void 0;
+      const lastReviewFailure = kind === "review_exhausted" ? (input.runFailures ?? []).filter((f2) => f2.nodeId === latest.nodeId && f2.actorId === latest.authorId && f2.startedAt <= latest.at && f2.message.trim()).sort((a, b2) => a.startedAt.localeCompare(b2.startedAt)).at(-1)?.message : void 0;
+      const head = kind === "retry_exhausted" ? ACTIVITY_COPY.escalationHeadRetryExhausted(nodeName(latest.nodeId)) : kind === "review_exhausted" ? ACTIVITY_COPY.escalationHeadReviewExhausted(
+        nodeName(latest.nodeId),
+        lastReviewFailure ? firstSentence(lastReviewFailure) : void 0
+      ) : kind === "output_stall" ? ACTIVITY_COPY.escalationHeadOutputStall(nodeName(latest.nodeId)) : gapBehind(latest.id) ? ACTIVITY_COPY.escalationHeadGapEscalated(nameOf(latest.authorId), nodeName(latest.nodeId)) : ACTIVITY_COPY.escalationHeadManual(nameOf(stuckActor));
+      const howTo = kind === "retry_exhausted" ? ACTIVITY_COPY.escalationHowToRetryExhausted : kind === "review_exhausted" ? ACTIVITY_COPY.escalationHowToReviewExhausted : kind === "output_stall" ? ACTIVITY_COPY.escalationHowToOutputStall : void 0;
       const closing = issueById.get(latest.id);
       const closeEvent = plainResolveEvents.get(latest.id);
       const closedBy = text5(closing?.resolvedBy) ?? closeEvent?.by ?? target;
@@ -234369,7 +234515,7 @@ function buildWorkorderActivity(input) {
   cards.sort((a, b2) => a.at.localeCompare(b2.at) || a.seq - b2.seq || a.id.localeCompare(b2.id));
   return { workorderId, cards, truncated };
 }
-var ACTIVITY_EVENT_KINDS, LEGACY_PAUSE_REASON, ACTIVITY_EVENT_LIMIT, UPSTREAM_ACK_NOTE_CAP, ACTIVITY_COPY, REWORK_ANNOTATION_PREFIX, RECOVERY_ANNOTATION_PREFIX, ENGINE_RETRY_EXHAUSTED, BUTTON, PHASE_LABEL, COORDINATOR_CARD_PREFIX, RETRY_EXHAUSTED_ESC_PREFIX, isStopLoss;
+var ACTIVITY_EVENT_KINDS, LEGACY_PAUSE_REASON, ACTIVITY_EVENT_LIMIT, UPSTREAM_ACK_NOTE_CAP, ACTIVITY_COPY, REWORK_ANNOTATION_PREFIX, RECOVERY_ANNOTATION_PREFIX, ENGINE_RETRY_EXHAUSTED, BUTTON, PHASE_LABEL, COORDINATOR_CARD_PREFIX, RETRY_EXHAUSTED_ESC_PREFIX, REVIEW_EXHAUSTED_ESC_PREFIX2, isStopLoss;
 var init_activity2 = __esm({
   "../server/src/domains/collab/activity.ts"() {
     "use strict";
@@ -234513,6 +234659,8 @@ var init_activity2 = __esm({
          同一件事，只换后半句（「等 @X 处理」→「X 已处理：…」）。 */
       escalationHeadRetryExhausted: (node2) => `\u300A${node2}\u300B\u91CD\u8BD5\u5DF2\u7528\u5C3D\uFF0C`,
       escalationHeadOutputStall: (node2) => `\u7CFB\u7EDF\u6B62\u635F\uFF1A\u300A${node2}\u300B\u505C\u4F4F\u4E86\uFF0C`,
+      /** 评审连败熔断（Bug 0212）：卡住的是**这一轮评审**，不是那一版活——话不能写成「执行异常」。 */
+      escalationHeadReviewExhausted: (node2, lastReason) => `\u300A${node2}\u300B\u7684\u8BC4\u5BA1\u8FDE\u7740\u6CA1\u8DD1\u6210\uFF0C\u8FD9\u4E00\u8F6E\u6536\u4E0D\u9F50${lastReason ? `\uFF08\u672B\u6B21\uFF1A${lastReason}\uFF09` : ""}\uFF0C`,
       /** 人工上报里**关联着缺口**的那一档：协调者接了缺口、补不了，于是升级给人（四种停法的第二种）。 */
       escalationHeadGapEscalated: (coordinator, node2) => `${coordinator} \u8865\u4E0D\u4E86\u300A${node2}\u300B\u7684\u7F3A\u53E3\uFF0C`,
       /** 其余人工上报：主语是卡住的那个执行人（异常是它的，不是上报作者的）。 */
@@ -234528,6 +234676,8 @@ var init_activity2 = __esm({
       /** 「你要做什么」那半句——两种系统止损各一份（F6 的立论就在这里：执行者一样，只有话不一样）。 */
       escalationHowToRetryExhausted: "\u5904\u7406\u5E76\u5173\u6389\u8FD9\u6761\u4E0A\u62A5\u540E\uFF0C\u8FD9\u4E00\u6B65\u4F1A\u81EA\u52A8\u91CD\u8BD5\uFF1B\u591A\u534A\u662F\u989D\u5EA6 / \u767B\u5F55\u8FC7\u671F / \u9650\u6D41\u8FD9\u7C7B\u73AF\u5883\u95EE\u9898\uFF0C\u5148\u770B\u8F68\u8FF9\u518D\u51B3\u5B9A\u91CD\u8BD5\u3002",
       escalationHowToOutputStall: "\u5904\u7406\u5E76\u5173\u6389\u8FD9\u6761\u4E0A\u62A5\u540E\uFF0C\u8FD9\u4E00\u6B65\u4F1A\u81EA\u52A8\u91CD\u8BD5\uFF1B\u4E0D\u67E5\u6E05\u539F\u56E0\u5C31\u91CD\u8BD5\u4F1A\u7EE7\u7EED\u7A7A\u70E7\uFF0C\u5148\u8FDB\u8BA8\u8BBA\u623F\u3002",
+      /** 评审熔断那一份：关掉之后重开的是**评审**，不是这一步的活（活已经交了，等的是审）。 */
+      escalationHowToReviewExhausted: "\u5904\u7406\u5E76\u5173\u6389\u8FD9\u6761\u4E0A\u62A5\u540E\uFF0C\u8FD9\u4E00\u8F6E\u8BC4\u5BA1\u4F1A\u81EA\u52A8\u91CD\u5F00\uFF1B\u591A\u534A\u662F\u8BC4\u5BA1\u5458\u7684\u8FD0\u884C\u73AF\u5883\u51FA\u4E86\u95EE\u9898\uFF08\u989D\u5EA6 / \u767B\u5F55\u8FC7\u671F / \u9650\u6D41\uFF09\uFF0C\u5148\u770B\u8F68\u8FF9\u518D\u51B3\u5B9A\u3002",
       /** 关掉了：接着开头那半句说「谁处理的、怎么处理的」。没写处置说明就只说「已处理」。
        *  处置说明常常是人自己写的一整段、末尾自带句号——**别再补一个**，否则卡面收在「。。」上。 */
       escalationHandled: (head, by, note) => `${head}${by} \u5DF2\u5904\u7406${note ? `\uFF1A${note}` : ""}${note && /[。！？.!?]$/.test(note) ? "" : "\u3002"}`,
@@ -234717,7 +234867,8 @@ var init_activity2 = __esm({
     };
     COORDINATOR_CARD_PREFIX = "coordinator:";
     RETRY_EXHAUSTED_ESC_PREFIX = "esc:retry-exhausted:";
-    isStopLoss = (kind) => kind !== "manual";
+    REVIEW_EXHAUSTED_ESC_PREFIX2 = "esc:review-exhausted:";
+    isStopLoss = (kind) => kind === "retry_exhausted" || kind === "output_stall";
   }
 });
 
@@ -235417,6 +235568,15 @@ function backfillInboxUnread(items, markers) {
     item.unread = !Number.isFinite(effective) ? true : sinceMs > effective;
   }
 }
+function applyReadAllWatermark(items, markers) {
+  const at = markers.find((m2) => m2.scope === INBOX_READ_ALL_SCOPE)?.readAt;
+  const atMs = at ? Date.parse(at) : Number.NaN;
+  if (!Number.isFinite(atMs)) return;
+  for (const item of items) {
+    const sinceMs = Date.parse(item.since);
+    if (Number.isFinite(sinceMs) && sinceMs <= atMs) item.unread = false;
+  }
+}
 var C_ACTION_LABEL;
 var init_inbox = __esm({
   "../server/src/domains/collab/inbox.ts"() {
@@ -235995,6 +236155,16 @@ var init_notification_store = __esm({
         }
         if (changed) this.save();
       }
+      async markAllRead(recipient, at) {
+        let n = 0;
+        for (const [id, r] of this.rows) {
+          if (r.recipient !== recipient || r.readAt) continue;
+          this.rows.set(id, { ...r, readAt: at });
+          n++;
+        }
+        if (n > 0) this.save();
+        return n;
+      }
       async countUnread(recipient) {
         let pending = 0;
         let all2 = 0;
@@ -236185,6 +236355,13 @@ var init_notification_store = __esm({
           [recipient, [...ids2], at]
         );
       }
+      async markAllRead(recipient, at) {
+        const r = await this.sql.query(
+          `UPDATE ${this.t} SET read_at = $2::timestamptz WHERE recipient = $1 AND read_at IS NULL`,
+          [recipient, at]
+        );
+        return r.rowCount ?? 0;
+      }
       async countUnread(recipient) {
         const r = await this.sql.query(
           `SELECT count(*) FILTER (WHERE status = 'pending')::int AS pending, count(*)::int AS "all"
@@ -236715,7 +236892,7 @@ var init_workorder_metrics = __esm({
 });
 
 // ../server/src/domains/usage/statistics-model.ts
-var UsageQueryError;
+var UsageQueryError, ZERO_USAGE_AMOUNT;
 var init_statistics_model = __esm({
   "../server/src/domains/usage/statistics-model.ts"() {
     "use strict";
@@ -236726,6 +236903,13 @@ var init_statistics_model = __esm({
         this.name = "UsageQueryError";
       }
     };
+    ZERO_USAGE_AMOUNT = {
+      tokens: { input: 0, cache: 0, cacheRead: 0, cacheCreation: 0, output: 0, total: 0 },
+      costUsdMicros: 0,
+      costParts: { input: 0, cacheRead: 0, cacheCreation: 0, output: 0, unsplit: 0 },
+      costKnown: "full",
+      costUnknownTokens: 0
+    };
   }
 });
 
@@ -237101,6 +237285,11 @@ function bucketIndex(starts, ms) {
   }
   return ans;
 }
+function pushView(map, key2, v2) {
+  const list2 = map.get(key2);
+  if (list2) list2.push(v2);
+  else map.set(key2, [v2]);
+}
 function getCell(map, key2) {
   let c = map.get(key2);
   if (!c) {
@@ -237338,12 +237527,15 @@ function attributed(facts, relations) {
   const taskCells = /* @__PURE__ */ new Map();
   const taskActorCells = /* @__PURE__ */ new Map();
   const convSessionCells = /* @__PURE__ */ new Map();
+  const convViews = /* @__PURE__ */ new Map();
+  const taskViews = /* @__PURE__ */ new Map();
   const unlinked = new Cell();
   for (const v2 of facts.views) {
     if (!v2.relevant) continue;
     const attr = runAttribution(relations, v2.run, memo);
     if (attr.kind === "task") {
       getCell(taskCells, attr.workorderId).addView(v2);
+      pushView(taskViews, attr.workorderId, v2);
       let byActor2 = taskActorCells.get(attr.workorderId);
       if (!byActor2) {
         byActor2 = /* @__PURE__ */ new Map();
@@ -237357,6 +237549,7 @@ function attributed(facts, relations) {
         convSessionCells.set(attr.rootSessionId, bySession);
       }
       getCell(bySession, attr.sessionId).addView(v2);
+      pushView(convViews, attr.rootSessionId, v2);
     } else unlinked.addView(v2);
   }
   const taskAmount = /* @__PURE__ */ new Map();
@@ -237388,8 +237581,13 @@ function attributed(facts, relations) {
   }
   const conversations = [];
   const convGroupAcc = /* @__PURE__ */ new Map();
+  const treeViews = /* @__PURE__ */ new Map();
   for (const rootId of /* @__PURE__ */ new Set([...convSessionCells.keys(), ...tasksByRoot.keys()])) {
     const root = relations.sessions.get(rootId);
+    treeViews.set(rootId, [
+      ...convViews.get(rootId) ?? [],
+      ...(tasksByRoot.get(rootId) ?? []).flatMap((workorderId) => taskViews.get(workorderId) ?? [])
+    ]);
     const group = new Cell();
     const rows = [];
     const sessionRows = [];
@@ -237511,9 +237709,83 @@ function attributed(facts, relations) {
     { amount: a.amount, name: a.name, id: a.projectId ?? "" },
     { amount: b2.amount, name: b2.name, id: b2.projectId ?? "" }
   ));
-  return { conversations, tasks, projects };
+  return { conversations, tasks, projects, treeViews };
+}
+function deriveTreeDuration(views, now) {
+  const nowMs = now.getTime();
+  const spans = [];
+  let countedRuns = 0;
+  let unstartedRuns = 0;
+  let inProgress = false;
+  let firstMs = Infinity;
+  let lastMs = -Infinity;
+  let runtimeMs = 0;
+  for (const v2 of views) {
+    const startMs = v2.run.runtimeStartedAt ? Date.parse(v2.run.runtimeStartedAt) : NaN;
+    if (!Number.isFinite(startMs)) {
+      unstartedRuns += 1;
+      continue;
+    }
+    const endedMs = v2.run.endedAt ? Date.parse(v2.run.endedAt) : NaN;
+    const running = !Number.isFinite(endedMs) && !isRunEnded(v2.run);
+    if (running) inProgress = true;
+    const rawEnd = Number.isFinite(endedMs) ? endedMs : running ? nowMs : startMs;
+    const end = Math.max(rawEnd, startMs);
+    countedRuns += 1;
+    runtimeMs += end - startMs;
+    spans.push({ start: startMs, end });
+    if (startMs < firstMs) firstMs = startMs;
+    if (end > lastMs) lastMs = end;
+  }
+  if (countedRuns === 0) return { ...ZERO_DURATION, unstartedRuns };
+  spans.sort((a, b2) => a.start - b2.start || a.end - b2.end);
+  let activeMs = 0;
+  let curStart = spans[0].start;
+  let curEnd = spans[0].end;
+  for (const span of spans.slice(1)) {
+    if (span.start > curEnd) {
+      activeMs += curEnd - curStart;
+      curStart = span.start;
+      curEnd = span.end;
+    } else if (span.end > curEnd) curEnd = span.end;
+  }
+  activeMs += curEnd - curStart;
+  return {
+    firstStartedAt: new Date(firstMs).toISOString(),
+    lastEndedAt: new Date(lastMs).toISOString(),
+    inProgress,
+    wallClockMs: lastMs - firstMs,
+    runtimeMs,
+    activeMs,
+    countedRuns,
+    unstartedRuns
+  };
 }
-var UNKNOWN_AGENT_NAME, UNREGISTERED_RUNTIME_NAME, UNSPECIFIED_PROJECT_NAME, UNLINKED_ROW_TITLE, UNTITLED_CONVERSATION, BUCKET_KEYS, AmountAcc, FlagAcc, Cell, collator, ModelCells;
+function buildChatSessionUsage(sessionId, input) {
+  const facts = computeFacts(input);
+  const lists = attributed(facts, input.relations);
+  const attr = sessionAttribution(input.relations, sessionId, /* @__PURE__ */ new Map());
+  const rootId = attr.kind === "conversation" ? attr.rootSessionId : sessionId;
+  const session = input.relations.sessions.get(rootId);
+  const group = lists.conversations.find((g2) => g2.sessionId === rootId) ?? {
+    sessionId: rootId,
+    title: session?.title || UNTITLED_CONVERSATION,
+    projectId: session?.projectId ?? null,
+    createdAt: session?.createdAt ?? null,
+    amount: ZERO_USAGE_AMOUNT,
+    flags: { inProgress: false, usagePending: false, costUnknownRuns: 0 },
+    rows: []
+  };
+  return {
+    companyId: input.companyId,
+    sessionId,
+    window: input.resolved.window,
+    generatedAt: input.now.toISOString(),
+    group,
+    duration: deriveTreeDuration(lists.treeViews.get(rootId) ?? [], input.now)
+  };
+}
+var UNKNOWN_AGENT_NAME, UNREGISTERED_RUNTIME_NAME, UNSPECIFIED_PROJECT_NAME, UNLINKED_ROW_TITLE, UNTITLED_CONVERSATION, BUCKET_KEYS, AmountAcc, FlagAcc, Cell, collator, ModelCells, ZERO_DURATION;
 var init_statistics = __esm({
   "../server/src/domains/usage/statistics.ts"() {
     "use strict";
@@ -237521,6 +237793,7 @@ var init_statistics = __esm({
     init_uncategorized_project();
     init_model_pricing();
     init_accounting();
+    init_statistics_model();
     UNKNOWN_AGENT_NAME = "\u672A\u77E5 Agent";
     UNREGISTERED_RUNTIME_NAME = "\u672A\u767B\u8BB0\u8FD0\u884C\u65F6";
     UNSPECIFIED_PROJECT_NAME = UNCATEGORIZED_PROJECT_NAME;
@@ -237639,6 +237912,16 @@ var init_statistics = __esm({
         return [...this.cells].map(([model, c]) => ({ model, runCount: c.runCount, amount: c.amount.toAmount(), flags: c.flags.toFlags() })).filter((r) => r.runCount > 0 || r.amount.tokens.total > 0 || r.amount.costUsdMicros > 0 || r.amount.costKnown !== "full").sort((a, b2) => b2.amount.tokens.total - a.amount.tokens.total || b2.runCount - a.runCount || (a.model === null ? 1 : b2.model === null ? -1 : collator.compare(a.model, b2.model)));
       }
     };
+    ZERO_DURATION = {
+      firstStartedAt: null,
+      lastEndedAt: null,
+      inProgress: false,
+      wallClockMs: null,
+      runtimeMs: 0,
+      activeMs: 0,
+      countedRuns: 0,
+      unstartedRuns: 0
+    };
   }
 });
 
@@ -237894,6 +238177,22 @@ function createUsageReadService(deps) {
       logRequest({ companyId, op: "breakdown", range: r.query.range, dimension, runs: r.runs.length, companyScoped: r.target.companyScoped, startedMs });
       return body2;
     },
+    async conversationUsage(companyId, sessionId, raw) {
+      const startedMs = Date.now();
+      const loads = requestLoads(companyId);
+      const r = await readLedger(companyId, { ...raw, range: raw.range ?? "all" }, loads);
+      const relations = await loadRelations(companyId, loads);
+      const body2 = buildChatSessionUsage(sessionId, {
+        companyId,
+        resolved: r.resolved,
+        runs: r.runs,
+        coverage: r.coverage,
+        now: r.now,
+        relations
+      });
+      logRequest({ companyId, op: "conversation", range: r.query.range, runs: r.runs.length, companyScoped: r.target.companyScoped, startedMs });
+      return body2;
+    },
     async runtimeLedger(companyId, runtimeInstanceId, raw) {
       const startedMs = Date.now();
       const loads = requestLoads(companyId);
@@ -238871,6 +239170,7 @@ function collabDomain(opts) {
         backfillInboxUnread(waitingItems, markers);
       }
       const items = mergeInbox(kernelItems, [...chatItems, ...waitingItems]);
+      if (myReadMarkers) applyReadAllWatermark(items, markers);
       return { status: 200, body: { items: myReadMarkers ? withEscalationAttention(items, req.auth.companyId ?? opts.defaultCompanyId ?? "", markers, Date.now(), opts.escalationReminders) : items } };
     });
     router.post("/api/inbox/escalations/:id/acknowledge", async (req) => {
@@ -239140,6 +239440,28 @@ function collabDomain(opts) {
       await marks.markRead(me, scope2, (/* @__PURE__ */ new Date()).toISOString());
       return { status: 200, body: { ok: true } };
     });
+    router.post("/api/inbox/read-all", async (req) => {
+      const me = req.auth.actor;
+      if (!isHumanActor(me)) {
+        return { status: 403, body: { error: { code: "human_only", message: "\u53EA\u6709\u4EBA\u7C7B\u8EAB\u4EFD\u53EF\u4EE5\u6807\u8BB0\u5DF2\u8BFB" } } };
+      }
+      const marks = opts.resolveReadMarkers ? await opts.resolveReadMarkers(req.auth.companyId).catch(() => void 0) : opts.readMarkers;
+      let ledger;
+      if (opts.resolveNotificationLedger) {
+        try {
+          ledger = await opts.resolveNotificationLedger(req.auth.companyId);
+        } catch (err) {
+          console.warn(`[notifications] \u65E0\u53EF\u4FE1\u516C\u53F8\u4E0A\u4E0B\u6587\uFF0C\u4E0D\u6807\u5DF2\u8BFB\uFF08\u4E0D\u56DE\u843D\u9ED8\u8BA4\u516C\u53F8\uFF09: ${String(err)}`);
+        }
+      }
+      if (!marks && !ledger) {
+        return { status: 503, body: { error: { code: "unavailable", message: "\u5DF2\u8BFB\u6C34\u4F4D\u4E0E\u901A\u77E5\u53F0\u8D26\u90FD\u4E0D\u53EF\u7528" } } };
+      }
+      const readAt = (/* @__PURE__ */ new Date()).toISOString();
+      const notifications = ledger ? await ledger.markAllRead(me, readAt) : 0;
+      if (marks) await marks.markRead(me, INBOX_READ_ALL_SCOPE, readAt);
+      return { status: 200, body: { ok: true, readAt, notifications } };
+    });
     router.get("/api/audit", async (req) => {
       const { engineStore, oplog, kernel } = await resolveCtx(req.auth.companyId);
       const q2 = req.query;
@@ -244209,8 +244531,14 @@ var init_service7 = __esm({
       listRunLinks(runId) {
         return this.store.listRunLinks(runId);
       }
-      /** run 详情聚合（§4.3）：run + links + toolCalls + children + 派生 stats。 */
-      async getRunDetail(id) {
+      /**
+       * run 详情聚合（§4.3）：run + links + toolCalls + children + 派生 stats。
+       *
+       * `scopeFilters` 由调用方给（HTTP 读面传租户闸门，内部调用不给）：子 run 是用
+       * `listRuns({ rootRunId })` 捞的，共享 legacy 账本上这一步必须带同一条归属谓词，
+       * 否则详情页的「子运行」会成为列表谓词之外的第二个出口。
+       */
+      async getRunDetail(id, scopeFilters = (f2) => f2) {
         const run = await this.store.getRun(id);
         if (!run) return null;
         const [links, toolCalls, events] = await Promise.all([
@@ -244218,7 +244546,7 @@ var init_service7 = __esm({
           this.store.listToolCalls(id),
           this.store.listEvents(id, {})
         ]);
-        const sameRoot = await this.store.listRuns({ rootRunId: run.rootRunId, limit: 1e3 });
+        const sameRoot = await this.store.listRuns(scopeFilters({ rootRunId: run.rootRunId, limit: 1e3 }));
         const children = sameRoot.items.filter((r) => r.parentRunId === id).map((r) => this.withDisplayCost(r));
         const stats = {
           eventCount: events.length,
@@ -244229,9 +244557,14 @@ var init_service7 = __esm({
         };
         return { run: this.withDisplayCost(run), links, toolCalls, children, stats };
       }
-      /** 聚合统计（§4.1 /api/traces/summary）。v1 全量扫描，量大后改投影表。 */
-      async summary() {
-        const { items } = await this.store.listRuns({ limit: 1e3 });
+      /**
+       * 聚合统计（§4.1 /api/traces/summary）。v1 全量扫描，量大后改投影表。
+       *
+       * `filter` 由调用方给：这几个计数是 `listRuns` 扫出来的，共享 legacy 账本上必须带同一条
+       * 归属谓词——轨迹页页头的「共 N 条运行」就是它，不带谓词就是把别家的运行数报给本公司。
+       */
+      async summary(filter = {}) {
+        const { items } = await this.store.listRuns({ ...filter, limit: 1e3 });
         const byStatus = /* @__PURE__ */ new Map();
         const byKind = /* @__PURE__ */ new Map();
         for (const r of items) {
@@ -244499,12 +244832,33 @@ var init_map2 = __esm({
   }
 });
 
+// ../server/src/domains/trace/read-scope.ts
+function scopedTraceFilters(filter, scope2) {
+  return scope2.companyScoped ? filter : { ...filter, legacyScope: scope2.legacyScope };
+}
+function traceReadAllows(scope2) {
+  return scope2.companyScoped ? () => true : legacyScopeMatcher(scope2.legacyScope);
+}
+var COMPANY_SCOPED_TRACE_READ, DENY_ALL_TRACE_READ;
+var init_read_scope = __esm({
+  "../server/src/domains/trace/read-scope.ts"() {
+    "use strict";
+    init_src();
+    COMPANY_SCOPED_TRACE_READ = { companyScoped: true };
+    DENY_ALL_TRACE_READ = {
+      companyScoped: false,
+      legacyScope: { artifactIds: [], chatSessionIds: [], runtimeInstanceIds: [] }
+    };
+  }
+});
+
 // ../server/src/domains/trace/routes.ts
 function parseFilters(q2) {
   const f2 = {};
   const actorId = q2.get("actorId");
   const artifactId = q2.get("artifactId");
   const projectId2 = q2.get("projectId");
+  const chatSessionId = q2.get("chatSessionId");
   const runtimeKind = q2.get("runtimeKind");
   const status = q2.get("status");
   const rootRunId = q2.get("rootRunId");
@@ -244515,6 +244869,7 @@ function parseFilters(q2) {
   if (actorId) f2.actorId = actorId;
   if (artifactId) f2.artifactId = artifactId;
   if (projectId2) f2.projectId = projectId2;
+  if (chatSessionId) f2.chatSessionId = chatSessionId;
   if (runtimeKind) f2.runtimeKind = runtimeKind;
   if (status) f2.status = status;
   if (rootRunId) f2.rootRunId = rootRunId;
@@ -244527,36 +244882,53 @@ function parseFilters(q2) {
 }
 function traceDomain(opts) {
   const svc = async (req) => opts.resolveService ? await opts.resolveService(req.auth?.companyId) : opts.service;
+  const scopeOf = async (req) => opts.resolveReadScope ? await opts.resolveReadScope(req.auth?.companyId) : COMPANY_SCOPED_TRACE_READ;
+  const requireRun = async (req) => {
+    const id = req.params.id;
+    const service = await svc(req);
+    const run = await service.getRun(id);
+    if (!run || !traceReadAllows(await scopeOf(req))(run)) {
+      throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A run\uFF1A${id}`);
+    }
+    return { service, id };
+  };
   return (router) => {
     router.get("/api/traces/runs", async (req) => {
-      return { status: 200, body: await (await svc(req)).listRuns(parseFilters(req.query)) };
+      const filter = scopedTraceFilters(parseFilters(req.query), await scopeOf(req));
+      return { status: 200, body: await (await svc(req)).listRuns(filter) };
     });
     router.get("/api/traces/summary", async (req) => {
-      return { status: 200, body: await (await svc(req)).summary() };
+      return { status: 200, body: await (await svc(req)).summary(scopedTraceFilters({}, await scopeOf(req))) };
     });
     router.get("/api/traces/runs/:id", async (req) => {
-      const detail = await (await svc(req)).getRunDetail(req.params.id);
-      if (!detail) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A run\uFF1A${req.params.id}`);
+      const scope2 = await scopeOf(req);
+      const detail = await (await svc(req)).getRunDetail(req.params.id, (f2) => scopedTraceFilters(f2, scope2));
+      if (!detail || !traceReadAllows(scope2)(detail.run)) {
+        throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A run\uFF1A${req.params.id}`);
+      }
       return { status: 200, body: detail };
     });
     router.get("/api/traces/runs/:id/events", async (req) => {
+      const { service, id } = await requireRun(req);
       const afterSeq = req.query.get("afterSeq") ?? req.query.get("cursor");
       const limit = req.query.get("limit");
       return {
         status: 200,
-        body: await (await svc(req)).listEvents(req.params.id, {
+        body: await service.listEvents(id, {
           ...afterSeq !== null && Number.isFinite(Number(afterSeq)) ? { afterSeq: Number(afterSeq) } : {},
           ...limit !== null && Number.isFinite(Number(limit)) ? { limit: Number(limit) } : {}
         })
       };
     });
     router.get("/api/traces/runs/:id/tool-calls", async (req) => {
-      return { status: 200, body: { items: await (await svc(req)).listToolCalls(req.params.id) } };
+      const { service, id } = await requireRun(req);
+      return { status: 200, body: { items: await service.listToolCalls(id) } };
     });
     router.get("/api/traces/runs/:id/bundle", async (req) => {
       if (!opts.readBundleFile) return { status: 404, body: { error: "bundle not available" } };
       const rel = req.query.get("path");
       if (!rel) return { status: 400, body: { error: "path query required" } };
+      await requireRun(req);
       const content3 = opts.readBundleFile(req.params.id, rel);
       if (content3 == null) return { status: 404, body: { error: "not found" } };
       return { status: 200, body: { path: rel, content: content3 } };
@@ -244568,7 +244940,9 @@ function traceDomain(opts) {
       const runtimeKinds = q2.get("runtimeKind")?.split(",").filter(Boolean);
       const effectiveModels = q2.get("model")?.split(",").filter(Boolean);
       const granularity = q2.get("granularity") ?? "hour";
+      const scope2 = await scopeOf(req);
       const items = await (await svc(req)).queryUsageStats({
+        ...scope2.companyScoped ? {} : { legacyScope: scope2.legacyScope },
         ...actorIds?.length ? { actorIds } : {},
         ...runtimeInstanceIds?.length ? { runtimeInstanceIds } : {},
         ...runtimeKinds?.length ? { runtimeKinds } : {},
@@ -244693,6 +245067,7 @@ var init_routes9 = __esm({
     init_src();
     init_router();
     init_map2();
+    init_read_scope();
   }
 });
 
@@ -244768,6 +245143,7 @@ function createTraceDomain(opts) {
     register: traceDomain({
       service,
       ...resolveService ? { resolveService } : {},
+      ...opts.resolveReadScope ? { resolveReadScope: opts.resolveReadScope } : {},
       readBundleFile: opts.readBundleFile
     })
   };
@@ -244779,6 +245155,7 @@ var init_trace2 = __esm({
     init_routes9();
     init_service7();
     init_routes9();
+    init_read_scope();
     init_sink();
     init_chat_parts();
     init_trace_health();
@@ -246463,9 +246840,12 @@ function createChatSessionsDomain(opts) {
     }
     return manager ? manager : null;
   }
-  function ensureSessionReadable(session, actor, kernel) {
+  function ownsSessionOrOperator(session, auth) {
+    return session.humanActorId === auth.actor || isOperatorRequest(auth);
+  }
+  function ensureSessionReadable(session, auth, kernel) {
     if (!session) throw new ApiError(404, "NOT_FOUND", "session not found");
-    if (session.humanActorId === actor) return session;
+    if (ownsSessionOrOperator(session, auth)) return session;
     if (session.workspace) {
       const coordinator = coordinatorOfWorkspace(kernel, session.workspace);
       if (coordinator && session.aiActorId === coordinator) return session;
@@ -246630,7 +247010,7 @@ function createChatSessionsDomain(opts) {
     router.get("/api/chat-sessions/:id", async (req) => {
       const store2 = await storeFor(req);
       const [raw, kernel] = await Promise.all([store2.getSession(req.params.id), kernelFor(req)]);
-      const session = ensureSessionReadable(raw, req.auth.actor, kernel);
+      const session = ensureSessionReadable(raw, req.auth, kernel);
       const [window3, curRuntimeId] = await Promise.all([
         listRecentTurns(store2, session.id, parseTurns(req.query?.get("turns"))),
         currentRuntimeId(req.auth.companyId, session.aiActorId)
@@ -246771,7 +247151,7 @@ function createChatSessionsDomain(opts) {
       if (!items) throw new ApiError(404, "NOT_FOUND", "\u672C\u5B9E\u4F8B\u672A\u63A5 chat_items \u5FEB\u7167\u8BFB\u53E3");
       const store2 = await storeFor(req);
       const [session, kernel] = await Promise.all([store2.getSession(req.params.id), kernelFor(req)]);
-      ensureSessionReadable(session, req.auth.actor, kernel);
+      ensureSessionReadable(session, req.auth, kernel);
       const chatSessionId = req.params.id;
       const sinceVersion = Math.max(0, Number(req.query?.get("sinceVersion") ?? "0") || 0);
       const beforeOrdRaw = Number(req.query?.get("beforeOrd") ?? "0") || 0;
@@ -246942,7 +247322,7 @@ function createChatSessionsDomain(opts) {
     router.get("/api/chat-sessions/:id/delegations", async (req) => {
       const store2 = await storeFor(req);
       const session = await store2.getSession(req.params.id);
-      if (!session || session.humanActorId !== req.auth.actor) throw new ApiError(404, "NOT_FOUND", "session not found");
+      if (!session || !ownsSessionOrOperator(session, req.auth)) throw new ApiError(404, "NOT_FOUND", "session not found");
       const wiring = opts.delegations;
       if (!wiring || !wiring.enabled()) return { status: 200, body: { items: [] } };
       const companyId = session.companyId ?? req.auth.companyId ?? void 0;
@@ -247008,7 +247388,7 @@ function createChatSessionsDomain(opts) {
     router.get("/api/chat-sessions/:id/work-orders", async (req) => {
       const store2 = await storeFor(req);
       const session = await store2.getSession(req.params.id);
-      if (!session || session.humanActorId !== req.auth.actor) throw new ApiError(404, "NOT_FOUND", "session not found");
+      if (!session || !ownsSessionOrOperator(session, req.auth)) throw new ApiError(404, "NOT_FOUND", "session not found");
       const workOrderIds = await store2.listWorkOrdersForSession(req.params.id);
       const wkKernel = await kernelFor(req);
       if (!wkKernel || workOrderIds.length === 0) return { status: 200, body: { items: [] } };
@@ -247031,6 +247411,29 @@ function createChatSessionsDomain(opts) {
       });
       return { status: 200, body: { items } };
     });
+    router.get("/api/chat-sessions/:id/usage", async (req) => {
+      const store2 = await storeFor(req);
+      const session = await store2.getSession(req.params.id);
+      if (!session || !ownsSessionOrOperator(session, req.auth)) throw new ApiError(404, "NOT_FOUND", "session not found");
+      const companyId = req.auth.companyId ?? session.companyId ?? opts.defaultCompanyId;
+      if (!opts.usageRead || !companyId) {
+        return { status: 503, body: { error: { code: "usage_ledger_unavailable", message: "\u4F7F\u7528\u4E0E\u7EDF\u8BA1\u6570\u636E\u6E90\u672A\u63A5\u5165" } } };
+      }
+      try {
+        return {
+          status: 200,
+          body: await opts.usageRead.conversationUsage(companyId, session.id, {
+            range: req.query.get("range") ?? void 0,
+            asOf: req.query.get("asOf") ?? void 0,
+            timeZone: req.query.get("timeZone") ?? void 0
+          })
+        };
+      } catch (err) {
+        const mapped = usageErrorResponse(err);
+        if (mapped) return mapped;
+        throw err;
+      }
+    });
     router.get("/api/chat-broadcasts/pending", async (req) => {
       if (!opts.broadcastOps) throw new ApiError(404, "NOT_FOUND", "\u672C\u5B9E\u4F8B\u672A\u542F\u7528\u5DE5\u5355\u7EC8\u6001\u64AD\u62A5");
       const store2 = await storeFor(req);
@@ -247487,6 +247890,8 @@ var init_chat_sessions2 = __esm({
     init_persistent_files();
     init_files_view();
     init_router();
+    init_operator();
+    init_usage_read();
     init_collab();
     init_gap_thread();
     init_escalation_opening();
@@ -257454,6 +257859,18 @@ function companyIdFromMetadata(metadata) {
   const cid = metadata.companyId;
   return typeof cid === "string" && cid.trim() ? cid : void 0;
 }
+function legacyScopeSql(scope2, args, prefix = "") {
+  const parts = [];
+  args.push(scope2.artifactIds);
+  parts.push(`${prefix}artifact_id = ANY($${args.length}::text[])`);
+  args.push(scope2.chatSessionIds);
+  parts.push(`${prefix}chat_session_id = ANY($${args.length}::text[])`);
+  if (scope2.runtimeInstanceIds?.length) {
+    args.push(scope2.runtimeInstanceIds);
+    parts.push(`${prefix}runtime_instance_id = ANY($${args.length}::text[])`);
+  }
+  return `(${parts.join(" OR ")})`;
+}
 function normalizeUsagePoint2(input, now) {
   let seq;
   if (input.kind === "checkpoint") {
@@ -258245,16 +258662,23 @@ var init_postgres_trace = __esm({
         if (filter.actorId) push2((n) => `r.actor_id = $${n}`, filter.actorId);
         if (filter.artifactId) push2((n) => `r.artifact_id = $${n}`, filter.artifactId);
         if (filter.projectId) push2((n) => `r.project_id = $${n}`, filter.projectId);
+        if (filter.chatSessionId) push2((n) => `r.chat_session_id = $${n}`, filter.chatSessionId);
         if (filter.runtimeKind) push2((n) => `r.runtime_kind = $${n}`, filter.runtimeKind);
         if (filter.status) push2((n) => `r.status = $${n}`, filter.status);
         if (filter.rootRunId) push2((n) => `r.root_run_id = $${n}`, filter.rootRunId);
+        if (filter.legacyScope) {
+          if (legacyScopeIsEmpty(filter.legacyScope)) return { items: [], nextCursor: null };
+          conds.push(legacyScopeSql(filter.legacyScope, args, "r."));
+        }
         if (filter.from) push2((n) => `r.started_at >= $${n}`, filter.from);
         if (filter.to) push2((n) => `r.started_at <= $${n}`, filter.to);
         if (filter.excludeAnalysis) conds.push(`(r.metadata->>'analyzedRunId') IS NULL`);
         if (filter.cursor) {
+          const cursorArgs = [filter.cursor];
+          const cursorScope = filter.legacyScope ? ` AND ${legacyScopeSql(filter.legacyScope, cursorArgs)}` : "";
           const c = await this.pool.query(
-            `SELECT started_at, id FROM ${this.s}.agent_runs WHERE id = $1`,
-            [filter.cursor]
+            `SELECT started_at, id FROM ${this.s}.agent_runs WHERE id = $1${cursorScope}`,
+            cursorArgs
           );
           if (c.rows[0]) {
             args.push(c.rows[0].started_at);
@@ -258357,7 +258781,7 @@ var init_postgres_trace = __esm({
        */
       async listRunFailures(workOrderId) {
         const r = await this.pool.query(
-          `SELECT node_id, error_message, COALESCE(started_at, created_at) AS at
+          `SELECT node_id, actor_id, error_message, COALESCE(started_at, created_at) AS at
          FROM ${this.s}.agent_runs
         WHERE work_order_id = $1 AND node_id IS NOT NULL
           AND error_message IS NOT NULL AND error_message <> ''
@@ -258366,6 +258790,7 @@ var init_postgres_trace = __esm({
         );
         return r.rows.map((row) => ({
           nodeId: row.node_id,
+          actorId: row.actor_id ?? null,
           startedAt: new Date(row.at).toISOString(),
           message: row.error_message
         }));
@@ -259387,6 +259812,7 @@ var init_postgres_trace = __esm({
       }
       /** 按维度查聚合用量。granularity=day 查 daily 表，否则 hourly。 */
       async queryUsageStats(filter) {
+        if (filter.legacyScope) return this.queryUsageStatsScoped(filter, filter.legacyScope);
         const gran = filter.granularity ?? "hour";
         const table = gran === "day" ? "agent_usage_daily" : "agent_usage_hourly";
         const timeCol = gran === "day" ? "day" : "hour";
@@ -259427,6 +259853,67 @@ var init_postgres_trace = __esm({
           costUsdMicros: Number(row.cost_usd_micros)
         }));
       }
+      /**
+       * legacy 共享账本上的按维度用量：**绕开聚合表，按租户谓词从 `agent_runs` 现算**。
+       *
+       * 为什么不能用 `agent_usage_hourly/daily`：那两张表的仲裁键里没有 artifact / chat_session，
+       * 表达不了 {@link LegacyTenantScope}；而且 legacy 落点写入时 `companyIdForWrite` 拿不到
+       * `billingCompanyId`、run.metadata 又不带 companyId，所有未切公司的行都落在同一个
+       * `company_id='default'` 桶里——读它就是所有未切公司互相看见（2026-09-22 泄漏的 usage 面）。
+       *
+       * 口径与 {@link backfillUsageAggregates} 完全一致（只算 `usage` 是对象的 run、按 `started_at`
+       * 落桶、同一组 GROUP BY 键），所以 company-primary 公司读聚合表、legacy 公司现算，两条路
+       * 对同一批 run 给出同一组数字。
+       */
+      async queryUsageStatsScoped(filter, scope2) {
+        if (legacyScopeIsEmpty(scope2)) return [];
+        const gran = filter.granularity ?? "hour";
+        const args = [];
+        const conds = [`jsonb_typeof(usage) = 'object'`, legacyScopeSql(scope2, args)];
+        const push2 = (sql, val) => {
+          args.push(val);
+          conds.push(sql.replace("$$", `$${args.length}`));
+        };
+        if (filter.actorIds?.length) push2(`actor_id = ANY($$)`, filter.actorIds);
+        if (filter.runtimeInstanceIds?.length) push2(`runtime_instance_id = ANY($$)`, filter.runtimeInstanceIds);
+        if (filter.runtimeKinds?.length) push2(`runtime_kind = ANY($$)`, filter.runtimeKinds);
+        if (filter.effectiveModels?.length) push2(`effective_model = ANY($$)`, filter.effectiveModels);
+        const bucket2 = gran === "day" ? `date_trunc('day', started_at::timestamptz)` : `date_trunc('hour', started_at::timestamptz)`;
+        if (filter.from) {
+          push2(`${bucket2} >= $$`, gran === "day" ? this.truncDayISO(new Date(filter.from)) : this.truncHourISO(new Date(filter.from)));
+        }
+        if (filter.to) push2(`${bucket2} <= $$`, filter.to);
+        const r = await this.pool.query(
+          `SELECT actor_id, runtime_instance_id, runtime_kind, effective_model,
+              ${gran === "day" ? `${bucket2}::date::text` : bucket2} AS bucket,
+              COUNT(*)::bigint AS run_count,
+              COALESCE(SUM(COALESCE((usage->>'inputTokens')::bigint, 0)), 0) AS input_tokens,
+              COALESCE(SUM(COALESCE((usage->>'outputTokens')::bigint, 0)), 0) AS output_tokens,
+              COALESCE(SUM(COALESCE((usage->>'totalTokens')::bigint, 0)), 0) AS total_tokens,
+              COALESCE(SUM(COALESCE((usage->>'cacheReadTokens')::bigint, 0)), 0) AS cache_read_tokens,
+              COALESCE(SUM(COALESCE((usage->>'cacheCreationTokens')::bigint, 0)), 0) AS cache_creation_tokens,
+              COALESCE(SUM(COALESCE((usage->>'costUsdMicros')::bigint, 0)), 0) AS cost_usd_micros
+         FROM ${this.s}.agent_runs
+        WHERE ${conds.join(" AND ")}
+        GROUP BY actor_id, runtime_instance_id, runtime_kind, effective_model, ${bucket2}
+        ORDER BY ${bucket2} DESC, runtime_instance_id, actor_id, effective_model`,
+          args
+        );
+        return r.rows.map((row) => ({
+          actorId: row.actor_id,
+          runtimeInstanceId: row.runtime_instance_id ?? null,
+          runtimeKind: row.runtime_kind,
+          effectiveModel: row.effective_model ?? null,
+          bucket: this.formatUsageBucket(row.bucket, gran),
+          runCount: Number(row.run_count),
+          inputTokens: Number(row.input_tokens),
+          outputTokens: Number(row.output_tokens),
+          totalTokens: Number(row.total_tokens),
+          cacheReadTokens: Number(row.cache_read_tokens),
+          cacheCreationTokens: Number(row.cache_creation_tokens),
+          costUsdMicros: Number(row.cost_usd_micros)
+        }));
+      }
       /** hour → 整点 ISO；day → YYYY-MM-DD（优先吃 SQL ::text，Date 兜底用本地日历日）。 */
       formatUsageBucket(raw, gran) {
         if (gran === "day") {
@@ -272317,6 +272804,7 @@ __export(src_exports2, {
   CHAT_TURN_ORPHAN_GRACE_MS: () => CHAT_TURN_ORPHAN_GRACE_MS,
   CLEAR_SESSION_RUNTIME_HINT: () => CLEAR_SESSION_RUNTIME_HINT,
   COMPANY_CROSS_TENANT_PREFIXES: () => COMPANY_CROSS_TENANT_PREFIXES,
+  COMPANY_SCOPED_TRACE_READ: () => COMPANY_SCOPED_TRACE_READ,
   CONSOLE_ROUTE_TABLES: () => CONSOLE_ROUTE_TABLES,
   CONVERSATIONAL_ESCALATION_TOOLS: () => CONVERSATIONAL_ESCALATION_TOOLS,
   CONVERSATIONAL_ETHOS: () => CONVERSATIONAL_ETHOS,
@@ -272345,6 +272833,7 @@ __export(src_exports2, {
   DEFAULT_SIMPLE_QUERY_MAX_CHARS: () => DEFAULT_SIMPLE_QUERY_MAX_CHARS,
   DEFAULT_TERMINAL_MAX_AGE_MS: () => DEFAULT_TERMINAL_MAX_AGE_MS,
   DELIVERY_REPAIR_BATCH: () => DELIVERY_REPAIR_BATCH,
+  DENY_ALL_TRACE_READ: () => DENY_ALL_TRACE_READ,
   DISPATCH_DROP_BACKOFF_MS: () => DISPATCH_DROP_BACKOFF_MS,
   DISPATCH_DROP_GRACE_MS: () => DISPATCH_DROP_GRACE_MS,
   DISPATCH_DROP_MAX_PER_TICK: () => DISPATCH_DROP_MAX_PER_TICK,
@@ -272432,6 +272921,7 @@ __export(src_exports2, {
   NdjsonOplogStore: () => NdjsonOplogStore,
   NodeHealthTracker: () => NodeHealthTracker,
   NotificationLedgerWorker: () => NotificationLedgerWorker,
+  OPERATOR_SCOPE: () => OPERATOR_SCOPE,
   ORPHANED_TURN_ASSISTANT_NOTICE: () => ORPHANED_TURN_ASSISTANT_NOTICE,
   OUTPUT_COPY_LIMITS: () => OUTPUT_COPY_LIMITS,
   PARENT_CONVERSATION_PATH: () => PARENT_CONVERSATION_PATH,
@@ -272668,6 +273158,7 @@ __export(src_exports2, {
   isKnowledgeQueryPlanV2: () => isKnowledgeQueryPlanV2,
   isLocationFailureCode: () => isLocationFailureCode,
   isNodeHealthy: () => isNodeHealthy,
+  isOperatorRequest: () => isOperatorRequest,
   isRunTerminalStatus: () => isRunTerminalStatus,
   isRuntimeDrifted: () => isRuntimeDrifted,
   isRuntimeRunReader: () => isRuntimeRunReader,
@@ -272830,6 +273321,7 @@ __export(src_exports2, {
   scanFrontmatterEntries: () => scanFrontmatterEntries,
   scanSessionOutputs: () => scanSessionOutputs,
   scanZeroOutputBreaker: () => scanZeroOutputBreaker,
+  scopedTraceFilters: () => scopedTraceFilters,
   scoreKnowledgeChunk: () => scoreKnowledgeChunk,
   sealKnowledgeSnapshot: () => sealKnowledgeSnapshot,
   seedRoleCatalog: () => seedRoleCatalog,
@@ -272872,6 +273364,7 @@ __export(src_exports2, {
   toYamlDoubleQuoted: () => toYamlDoubleQuoted,
   touchKey: () => touchKey,
   traceDomain: () => traceDomain,
+  traceReadAllows: () => traceReadAllows,
   trajectoryEventToRunEvent: () => trajectoryEventToRunEvent,
   trustedDelegationInvocationId: () => trustedDelegationInvocationId,
   trustedKnowledgeInvocationId: () => trustedKnowledgeInvocationId,
@@ -272895,6 +273388,7 @@ var init_src11 = __esm({
     "use strict";
     init_server3();
     init_tokens();
+    init_operator();
     init_session_dataplane_token();
     init_dev_store();
     init_control_plane_file_store();
@@ -276566,7 +277060,7 @@ async function startServe(opts) {
   const issuer = createTokenIssuer({ secretFile: path28.join(opts.dir, "session-token-secret") });
   const apiActivity = createApiActivityLedger();
   const operatorActor = `actor:human:${os8.userInfo().username}`;
-  const operatorToken = issuer.issue(operatorActor);
+  const operatorToken = issuer.issue(operatorActor, { scopes: [OPERATOR_SCOPE] });
   fs34.writeFileSync(path28.join(opts.dir, "operator-token"), operatorToken, { mode: 384 });
   let nodeTokens = createNodeTokenStore(path28.join(opts.dir, "node-tokens.json"));
   const enrollTokens = createEnrollTokenStore(30 * 60 * 1e3, path28.join(opts.dir, "enroll-tokens.json"));
@@ -277050,6 +277544,8 @@ async function startServe(opts) {
   const trace = createTraceDomain({
     store: traceStore,
     ...pgDsn ? { resolveStore: (cid) => traceStoreFor(cid) } : {},
+    // 轨迹读面的租户闸门。PG 部署必给——不给就是未切 `company-primary` 的公司在共享账本上互相可见。
+    resolveReadScope: (cid) => traceReadScopeFor(cid),
     readBundleFile: (id, rel) => trajReader.readBundleFile(id, rel)
   });
   const traceHealth = createTraceHealth();
@@ -278068,6 +278564,33 @@ async function startServe(opts) {
   const chatTurnsFor = async (companyId) => chatStoreRouter ? (await chatStoreRouter.open(companyId, "chatTurns")).chatTurns ?? chatTurnStore : chatTurnStore;
   const chatItemsFor = async (companyId) => chatStoreRouter ? (await chatStoreRouter.open(companyId, "chatItems")).chatItems : void 0;
   const chatStoreFor = async (companyId) => chatStoreRouter ? (await chatStoreRouter.open(companyId)).chatSessions : chatSessionStore;
+  const traceReadScopeFor = async (companyId) => {
+    if (!pgPool) return COMPANY_SCOPED_TRACE_READ;
+    if (!companyId) return DENY_ALL_TRACE_READ;
+    try {
+      const store = await traceStoreFor(companyId);
+      if (store instanceof CutoverAwareTraceStore && (await store.resolveUsageReadTarget()).companyScoped) {
+        return COMPANY_SCOPED_TRACE_READ;
+      }
+      const [model, sessions, runtimes] = await Promise.all([
+        getEngine(companyId).then((e) => e.kernel.model),
+        chatStoreFor(companyId).then((s2) => s2.listUsageSessionMeta ? s2.listUsageSessionMeta() : []),
+        // 与 usageRead.sources.listRuntimes 同一条读：按公司过滤，归属未定（company_id IS NULL）的存量行不算本公司。
+        nodeStore.listRuntimes(void 0, { companyId })
+      ]);
+      return {
+        companyScoped: false,
+        legacyScope: {
+          artifactIds: [...model.artifacts.keys()],
+          chatSessionIds: sessions.map((s2) => s2.id),
+          runtimeInstanceIds: runtimes.map((r) => r.id)
+        }
+      };
+    } catch (err) {
+      console.warn(`[trace] \u89E3\u6790 ${companyId} \u7684\u8F68\u8FF9\u8BFB\u95F8\u95E8\u5931\u8D25\uFF0C\u672C\u6B21\u6309\u300C\u65E0\u53EF\u89C1\u8BB0\u5F55\u300D\u5904\u7406\uFF1A${String(err)}`);
+      return DENY_ALL_TRACE_READ;
+    }
+  };
   const artifactStateFor = async (companyId) => {
     if (!chatStoreRouter) return artifactStateStore;
     const stores = await chatStoreRouter.open(companyId, "work-order-files");
@@ -278969,7 +279492,11 @@ async function startServe(opts) {
         resolveChatItems: (companyId) => chatItemsFor(companyId),
         liveChat,
         // ADR-0587：列表行派生 `unread`，与 collab 域收件箱读同一份按公司的水位（无 PG 时闭包自己回落单实例）。
-        resolveReadMarkers: readMarkerStoreFor
+        resolveReadMarkers: readMarkerStoreFor,
+        // ADR 0609 D4：`GET /api/chat-sessions/:id/usage` 的取数口——**与 collab 域是同一个实例**，
+        // 按会话取数与组织统计因此永远同一份账本、同一套归属，不会出现两条路各算各的。
+        usageRead,
+        defaultCompanyId
       })] : []
     ],
     workorderDrafts,
@@ -279516,7 +280043,9 @@ async function startServe(opts) {
         ...c.dispatchId !== void 0 ? { dispatchId: c.dispatchId } : {},
         // ADR-0078 D3：写入围栏的钥匙
         ...c.artifactId !== void 0 ? { artifactId: c.artifactId } : {},
-        ...c.sessionId !== void 0 ? { sessionId: c.sessionId } : {}
+        ...c.sessionId !== void 0 ? { sessionId: c.sessionId } : {},
+        // ADR 0609 D1：签名 scopes 透给域路由，`isOperatorRequest` 据此认出部署级 operator-token。
+        ...c.scopes !== void 0 ? { scopes: c.scopes } : {}
       } : null;
     },
     /**
@@ -287843,7 +288372,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.67" ? "2.2.67" : "dev";
+var CLI_VERSION = "2.2.69" ? "2.2.69" : "dev";
 function apiHeaders(token, company) {
   const headers = {
     authorization: `Bearer ${token}`,
@@ -291649,7 +292178,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.67" : "dev";
+var PKG_VERSION = true ? "2.2.69" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.67",
+  "version": "2.2.69",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "4e649f6aa7bc6633070aefaf241972ac1c42f269"
+    "sourceHead": "ac031d8ccbeea2dca6ecc80ad012b61de5ca2888"
   }
 }