@sema-agent/server 7.100.0 → 7.101.0

package/dist/http/memory-store-refusal-reply.d.ts

@@ -0,0 +1,24 @@
+/**
+ * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
+ * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * `routes/memory-compliance.ts`(出处 / 抹除)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
+ * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(`routes/sessions.ts`:同码、固定文案,见那里的注)。
+ * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
+ * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
+ *
+ * ## 为什么 409
+ * core 的读法:operator 要处置的拒(去掉 store 里那只通到外面的目录链),不是可重试的 IO 故障,也不是对调用方的裁决。与
+ * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
+ * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在
+ * `test/memory-compliance-http.test.ts`);链在提交点之后才换上 ⇒ 已删的几条算数、journal 留盘 —— core 原句会带
+ * `after the commit point; the journal is kept`,本层原样转发、不嗅它分类(codex 一审 C1)。
+ *
+ * ## 文案原样
+ * core 的诊断句点名动作、路径与解析到哪 —— 那是运维找到那只链的唯一材料,与本族其它 core 码同一条「码与文案都不改写」纪律。
+ * 只对 operator 面这么做:这几口都过了 operator 门,宿主路径对这个受众不是泄露。
+ */
+import type { ServerResponse } from "node:http";
+/** `err` 是 `memory.target_outside_store` ⇒ 409 带码 + core 原句,返回 true(已应答);否则 false,一个字节都不写。 */
+export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown): boolean;
+//# sourceMappingURL=memory-store-refusal-reply.d.ts.map

package/dist/http/memory-store-refusal-reply.js

@@ -0,0 +1,10 @@
+import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { sendError } from "./send.js";
+export function sentMemoryStoreRefusal(res, err) {
+    const refusal = targetOutsideStoreOf(err);
+    if (refusal === undefined)
+        return false;
+    sendError(res, 409, "memory.target_outside_store", refusal.message);
+    return true;
+}
+//# sourceMappingURL=memory-store-refusal-reply.js.map

package/dist/http/routes/approvals-assistant.js

@@ -288,6 +288,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.deadline !== undefined ? { deadline: s.deadline } : {}),
                     ...(s.hasBidiControls === true ? { hasBidiControls: true } : {}),
                     ...(s.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...(s.mandated === true ? { mandated: true } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
                     ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { isModelAllowlisted } from "../../model-select.js";
+import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -228,7 +228,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             return;
         }
         case "models": {
-            const atCatalog = expandTiers(deps.config.models, deps.config.tiers ?? {}) ?? deps.config.models;
+            const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
             const atAllowlist = deps.config.atModelAllowlist ?? [];
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
@@ -242,7 +242,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
+                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist, deps.config.modelRefusals) } : {}),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");

package/dist/http/routes/memory-bundle.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +36,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
+    if (sentMemoryStoreRefusal(res, err))
+        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-compliance.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
-import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -36,13 +36,11 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (face === "erase" && err instanceof MemoryLayerUnwritableError) {
-        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
-        return true;
-    }
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
         return true;
+    if (sentMemoryStoreRefusal(res, err))
+        return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
         return true;

package/dist/http/routes/memory-origin.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
-import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
@@ -48,15 +48,13 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (face === "clear" && err instanceof MemoryLayerUnwritableError) {
-        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
-        return true;
-    }
     if (face === "clear") {
         const coreCode = codeOf(err);
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))
             return true;
     }
+    if (face !== "clearances" && sentMemoryStoreRefusal(res, err))
+        return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
         return true;

package/dist/http/routes/sessions.js

@@ -4,12 +4,12 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
@@ -500,16 +500,17 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
-                if (err instanceof MemoryLayerUnwritableError) {
-                    deps.logger?.warn?.("session_memory_erase_layer_unwritable", { sessionId, dirs: err.dirs });
-                    sendError(res, 409, "memory.layer_unwritable", "memory erasure refused: a memory layer directory on this server is not writable on disk, so the erase was stopped before anything was written (nothing was deleted, no journal was left). Ask whoever operates this deployment to restore the owner write bit on the memory layer directories (a known issue of the memory engine's mount), then retry with the same requestId");
-                    return;
-                }
                 const code = err.code;
                 if (code === "config.memory_erasure_request") {
                     sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
                     return;
                 }
+                const outside = targetOutsideStoreOf(err);
+                if (outside !== undefined) {
+                    deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: outside.message });
+                    sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                    return;
+                }
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
             }

package/dist/http/routes/side-query.js

@@ -1,6 +1,7 @@
 import { expandTiers, isThinkingLevel } from "@sema-agent/core";
 import { HttpError } from "../../security.js";
-import { isModelAllowlisted } from "../../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
+import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
@@ -68,9 +69,14 @@ export async function handleSideQuery(req, res, match, ctx) {
                     return;
                 }
                 if (typeof body.model === "string" && body.model.length > 0) {
-                    const bare = deps.config.models ?? {};
-                    const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-                    if (!isModelAllowlisted(body.model, catalog, deps.config.atModelAllowlist)) {
+                    const catalog = selectableCatalog(deps.config.models ?? {}, deps.config.tiers, deps.config.modelRefusals);
+                    const unavailable = matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined ? refusedCatalogEntry(body.model, deps.config.modelRefusals) : undefined;
+                    if (unavailable !== undefined) {
+                        const message = modelUnavailableMessage("model", body.model.slice(0, 120), unavailable.name, unavailable.refusal);
+                        sendError(res, 400, "request.model_unavailable", message);
+                        return;
+                    }
+                    if (!isModelAllowlisted(body.model, catalog, deps.config.atModelAllowlist, deps.config.modelRefusals)) {
                         sendError(res, 400, "request.model_not_allowed", `model is not in this deployment's @-mention allowlist: "${body.model.slice(0, 120)}" — the allowlist is configured by the operator (config-center models.atModelAllowlist)`);
                         return;
                     }

package/dist/instruction-source-notice.d.ts

@@ -0,0 +1,97 @@
+/**
+ * S-690 —— 项目指令文件**换源**通告(`engine_notice` 码 `instructions.source_changed`)的唯一铸点与基线属主口。
+ *
+ * ## 这件事为什么归本仓
+ * 选哪一份指令文件是**部署的内容半场**(`project-memory.ts` 的 `INSTRUCTION_FILE_CHAIN`;core 的 `loadProjectMemory`
+ * 契约逐字「core … NEVER hardcodes a filename」),所以「这一 run 读的是哪一份、上一 run 读的是哪一份」也只有本仓
+ * 答得出。core 的 run 内变更车道(`steering_injected`,`source: "instructions_change"`)只跟**本 run 自己声明的**
+ * 来源比,进程重启(= 升级)后没有任何东西记得上一 run 注入的是哪一份 —— 于是两文件并存的仓升级后静默换源
+ * (车MN 收车档 §1.5,判据 G6)。
+ *
+ * ## 基线 = 会话的服务端元数据
+ * 基线是「同一 session 上一次 run 选中的链成员相对路径」(不是指纹:指纹密钥每进程随机,跨进程不可比)。它住在会话店的
+ * 服务端元数据面 —— SQL 两孪生是 `session_meta.instruction_source` 一列,local 文件店是一只 sidecar —— 所以重启 /
+ * 跨副本都读得到、随会话删除一起消失,且不进模型上下文、不进 wire 会话面。不接这张面的店(core 的内存 dev 店、
+ * `run-local` 的 core 文件店)⇒ 席缺席 ⇒ 一帧不发(诚实缺席:那两形的会话本来就活不过进程,或没有会话流可投)。
+ *
+ * ## 铸点(唯一)
+ * {@link announceInstructionSource} 是本码**唯一**的铸点(`@contract instructions.source_changed.single_mint`)。
+ * 调用点只有一处:`makeLoadProjectMemory` 在每次**走了指令链**的 prepare 载入完成之后(core 每个 run 恰调一次 `loadProjectMemory`)
+ * ⇒ 一 run 至多一帧。走链之前就判「这次没有项目可读」的 prepare(无手场景、cwd 不是本机绝对目录)是**不适用**,不是
+ * 「来源 = 无」—— 不进本铸点,基线保持上一次真读的那份(O6,7.101.0 合并复审:无手孪生 Runner 与主 Runner 共用同一只
+ * loader 与会话店,把不适用折成 `null` 会让「默认 → 无手 → 默认」同 session 两跳无端发两帧)。分工照 `task-mcp.ts` `mintInjectionDropNotices` 的先例:本模块铸通告,`emit` 由装配方给
+ * (部署的 `onNotice` 转发体 —— 先日志后分流,白名单 / 归属 / 消毒 / 隔离四件判据一个不绕)。
+ *
+ * ## 不做的事
+ * 不区分「升级换源」与「用户改了文件」(跨进程指纹不可比;载荷只说前后两个来源)。detail 没有 `runId`:铸点在 core 的
+ * `loadProjectMemory` 席内,该席的 ctx 不带 runId(core 7.30.1 键集 = cwd / handsEnabled / isSubagent / agentName /
+ * sessionId / phase)—— 与 `mcp.injection_dropped`「装配期铸、无 runId」同形,run 归属由投递腿承载(这条 run 的 SSE /
+ * 这条 run 的账本)。向 core 要 ctx 加 runId 已登记为未闭环项。
+ */
+import type { EngineNotice } from "@sema-agent/core";
+import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
+export declare const INSTRUCTION_SOURCE_CHANGED: ServerNoticeCode;
+/** 基线读数。`recorded: false` = 这个会话还没有任何 run 记过基线(首 run ⇒ 只写不发);`source: null` = 记过,且那一次
+ *  没有项目指令文件被选中。两态必须可判别:把「没记过」读成「记过没有」会让新会话首 run 发一帧 `null → CLAUDE.md`。 */
+export type InstructionSourceBaseline = {
+    readonly recorded: false;
+} | {
+    readonly recorded: true;
+    readonly source: string | null;
+};
+/** 基线属主口(会话店的服务端元数据面)。 */
+export interface InstructionSourceStore {
+    readInstructionSource(sessionId: string): Promise<InstructionSourceBaseline>;
+    /**
+     * 覆写基线 —— **CAS**:只在店里此刻的基线仍等于 `expected`(调用方读到的那一份)时写,否则什么都不做(不抛)。
+     * 为什么是 CAS(codex che-NM r1 [high]):铸点对基线读写有期限,超期的写会**晚到**;不带期望值的覆写会让一个
+     * 基于过期读数的旧 run 盖掉更新的 run 写下的基线,下一 run 于是比错。会话行不存在 ⇒ 同样不写。
+     * 写**没有提交**必须抛(SQL 的写本来就如此;local sidecar 回滚内存再抛)—— 「内存已前进而盘没跟上」会让同来源的
+     * 后续 run 在相等比较上短路、再也不重写,重启后比的是一份过期的盘(codex che-NM r1 [medium])。
+     */
+    recordInstructionSource(sessionId: string, expected: InstructionSourceBaseline, source: string | null): Promise<void>;
+}
+/** 一只装配好的席:基线店 + 通告出口。 */
+export interface InstructionSourceSeat {
+    readonly store: InstructionSourceStore;
+    readonly emit: (notice: EngineNotice) => void;
+}
+/**
+ * 基线的**存储编码**(SQL 列与 local sidecar 同一只):「没有项目指令文件」存成空串,链成员存它的相对路径;
+ * 「没记过」是 SQL `NULL` / sidecar 里缺键。空串不会与任何文件名撞(没有叫空名的文件),所以不需要保留词。
+ */
+export declare function encodeInstructionSource(source: string | null): string;
+/** 两份基线读数是否同一(CAS 的判等;三店与测试夹具同用这一只)。 */
+export declare function sameInstructionSourceBaseline(a: InstructionSourceBaseline, b: InstructionSourceBaseline): boolean;
+/** {@link encodeInstructionSource} 的逆。非串非空的值 = 这一格被本仓以外的东西写坏了 ⇒ 抛(调用方按基线读不出处置)。 */
+export declare function decodeInstructionSource(raw: unknown): InstructionSourceBaseline;
+/**
+ * 会话店是否提供基线面 —— **两个方法都在**才算(只有一半的店让读写不同源,比整张缺席更坏)。结构判而不是按类名判
+ * (包装店 `CachingSessionStore` 逐方法转发,判据看的是能力不是名字)。
+ */
+export declare function instructionSourceStoreOf(sessionStore: unknown): InstructionSourceStore | undefined;
+/** 装配点的唯一口(server boot 与 run-local 两处同走):店没有基线面或没有通告出口 ⇒ 席缺席(一帧不发)。 */
+export declare function createInstructionSourceSeat(sessionStore: unknown, emit: ((notice: EngineNotice) => void) | undefined): InstructionSourceSeat | undefined;
+/**
+ * 基线每一次读 / 写的期限(codex che-NM r1 [high])。铸点跑在 prepare 里、loader 等它交出答案才返回,而两支 SQL 孪生的
+ * 查询默认没有超时(MySQL 无、PG `statement_timeout` 缺省关)—— 一次卡住的行锁 / 连接就会把整个 prepare 挂住,而修前
+ * loader 根本不碰库。两层同一个数:① 这里放手(超期 ⇒ 按读 / 写失败处置,留痕放行);② 两支 SQL 孪生的基线查询带**每查询
+ * 超时**(codex che-NM r2 [high];S-9 `write-behind-counter.ts` 先例:mysql2 `{sql, timeout}` / pg `query_timeout`,pg-pool
+ * 超时即销毁那条连接)—— 只放手不截断,卡住的查询会一直占着池里的连接。超期后仍在飞的写由 CAS 挡住,不会盖掉更新的基线。
+ * 数值与 core 给 `probeInstructionSources` 的 2s 天花板同量级:一行 PK 读写在健康库上是毫秒级。
+ */
+export declare const BASELINE_IO_DEADLINE_MS = 2000;
+/**
+ * **唯一铸点**:本次 prepare 选中的来源 `current`(链成员相对路径;没有 = `null`)与基线比。
+ *  · 没有基线 ⇒ 只写不发(新会话首 run);
+ *  · 相同 ⇒ 什么都不做(不写);
+ *  · 不同 ⇒ 铸一帧、再以读到的基线为期望值 CAS 覆写。
+ * 基线读 / 写各有 {@link BASELINE_IO_DEADLINE_MS} 的期限。
+ *
+ * 失败方向(F 类,`server.instruction-source.announce-degraded`,detail 带 `op=read|write|emit`):通告是**披露**面
+ * 不是执法面,所以基线读 / 写 / 出口失败一律留痕后放行,**绝不**抛回调用方 —— 抛回去会让 core 把这次 prepare 的项目记忆整块丢掉(loader 抛 ⇒ 不注入),
+ * 为一条通告赔上模型要读的指令本身。读失败 ⇒ 本 run 不比也不写;写失败 ⇒ 本 run 的帧照发(它对本 run 为真),代价是
+ * 下一 run 可能再说一遍同一次换源;出口抛(转发体今天结构上不抛,守的是「本函数不抛」这条契约)⇒ 本 run 缺这一帧。
+ */
+export declare function announceInstructionSource(seat: InstructionSourceSeat, sessionId: string, current: string | null): Promise<void>;
+//# sourceMappingURL=instruction-source-notice.d.ts.map

package/dist/instruction-source-notice.js

@@ -0,0 +1,78 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+export const INSTRUCTION_SOURCE_CHANGED = "instructions.source_changed";
+export function encodeInstructionSource(source) {
+    return source ?? "";
+}
+export function sameInstructionSourceBaseline(a, b) {
+    if (!a.recorded || !b.recorded)
+        return a.recorded === b.recorded;
+    return a.source === b.source;
+}
+export function decodeInstructionSource(raw) {
+    if (raw === null || raw === undefined)
+        return { recorded: false };
+    if (typeof raw !== "string")
+        throw new TypeError(`instruction_source holds a ${typeof raw}, not a string`);
+    return { recorded: true, source: raw === "" ? null : raw };
+}
+export function instructionSourceStoreOf(sessionStore) {
+    const s = sessionStore;
+    if (typeof s?.readInstructionSource !== "function" || typeof s.recordInstructionSource !== "function")
+        return undefined;
+    return { readInstructionSource: s.readInstructionSource.bind(s), recordInstructionSource: s.recordInstructionSource.bind(s) };
+}
+export function createInstructionSourceSeat(sessionStore, emit) {
+    const store = instructionSourceStoreOf(sessionStore);
+    return store && emit ? { store, emit } : undefined;
+}
+const describeSource = (source) => source ?? "no project instruction file";
+export const BASELINE_IO_DEADLINE_MS = 2_000;
+class BaselineDeadlineExceeded extends Error {
+}
+function withinDeadline(op) {
+    const running = Promise.resolve().then(op);
+    running.catch(() => undefined);
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new BaselineDeadlineExceeded(`no answer within ${BASELINE_IO_DEADLINE_MS}ms`)), BASELINE_IO_DEADLINE_MS);
+        timer.unref?.();
+    });
+    return Promise.race([running, deadline]).finally(() => clearTimeout(timer));
+}
+export async function announceInstructionSource(seat, sessionId, current) {
+    let baseline;
+    try {
+        baseline = await withinDeadline(() => seat.store.readInstructionSource(sessionId));
+    }
+    catch (e) {
+        degraded("read", sessionId, e);
+        return;
+    }
+    if (baseline.recorded && baseline.source === current)
+        return;
+    if (baseline.recorded) {
+        const previous = baseline.source;
+        try {
+            seat.emit({
+                code: INSTRUCTION_SOURCE_CHANGED,
+                message: `Project instructions for this run come from ${describeSource(current)}; the previous run of this session read ${describeSource(previous)}.`,
+                detail: { previous, current, sessionId },
+                sessionId,
+            });
+        }
+        catch (e) {
+            degraded("emit", sessionId, e);
+        }
+    }
+    try {
+        await withinDeadline(() => seat.store.recordInstructionSource(sessionId, baseline, current));
+    }
+    catch (e) {
+        degraded("write", sessionId, e);
+    }
+}
+function degraded(op, sessionId, e) {
+    const why = e instanceof BaselineDeadlineExceeded ? `timeout=${BASELINE_IO_DEADLINE_MS}ms` : `err=${e instanceof Error ? e.message : String(e)}`;
+    recordFailOpen("server.instruction-source.announce-degraded", `op=${op} session=${sessionId} ${why}`);
+}
+//# sourceMappingURL=instruction-source-notice.js.map

package/dist/memory-layer-legacy-lock.d.ts

@@ -0,0 +1,14 @@
+import type { EngineNotice } from "@sema-agent/core";
+import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
+export declare const MEMORY_LAYER_LOCKED_LEGACY: ServerNoticeCode;
+/** 探测读数:锁住的层名(排序)+ 看不全的目录条数。挂载面不存在(新数据根)⇒ 两者皆空。 */
+export interface LockedLegacyLayerProbe {
+    readonly layers: readonly string[];
+    readonly unreadable: number;
+}
+export declare function probeLockedLegacyMemoryLayers(memoryDir: string): LockedLegacyLayerProbe;
+/** 锁住的层 ⇒ 一条通告(纯数据);没有 ⇒ `undefined`。detail 两键:`layers`(层名)与 `remedy`(同一句 `chmod -R u+w <memoryDir>`)。 */
+export declare function buildMemoryLayerLockedLegacyNotice(memoryDir: string, layers: readonly string[]): EngineNotice | undefined;
+/** boot 期的唯一调用口:探测一次、有锁住的层就经 `emit` 发一条;看不全的子树走 F 类留痕。不抛(不拒启)。 */
+export declare function announceLockedLegacyMemoryLayers(memoryDir: string, emit: (notice: EngineNotice) => void): void;
+//# sourceMappingURL=memory-layer-legacy-lock.d.ts.map

package/dist/memory-layer-legacy-lock.js

@@ -0,0 +1,74 @@
+import { lstatSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { recordFailOpen } from "./observability/fail-open.js";
+export const MEMORY_LAYER_LOCKED_LEGACY = "memory.layer_locked_legacy";
+const OWNER_WRITE = 0o200;
+function shellQuoted(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+const isMissing = (err) => err?.code === "ENOENT";
+function treeHasLockedDir(dir, gaps) {
+    let st;
+    try {
+        st = lstatSync(dir);
+    }
+    catch (err) {
+        if (!isMissing(err))
+            gaps.n += 1;
+        return false;
+    }
+    if (!st.isDirectory())
+        return false;
+    if ((st.mode & OWNER_WRITE) === 0)
+        return true;
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch (err) {
+        if (!isMissing(err))
+            gaps.n += 1;
+        return false;
+    }
+    for (const e of entries) {
+        if (e.isDirectory() && treeHasLockedDir(join(dir, e.name), gaps))
+            return true;
+    }
+    return false;
+}
+export function probeLockedLegacyMemoryLayers(memoryDir) {
+    const gaps = { n: 0 };
+    let top;
+    try {
+        top = readdirSync(memoryDir, { withFileTypes: true });
+    }
+    catch (err) {
+        return { layers: [], unreadable: isMissing(err) ? 0 : 1 };
+    }
+    const layers = top.filter((e) => e.isDirectory() && treeHasLockedDir(join(memoryDir, e.name), gaps)).map((e) => e.name);
+    return { layers: layers.sort(), unreadable: gaps.n };
+}
+export function buildMemoryLayerLockedLegacyNotice(memoryDir, layers) {
+    if (layers.length === 0)
+        return undefined;
+    const remedy = `chmod -R u+w ${shellQuoted(memoryDir)}`;
+    const one = layers.length === 1;
+    return {
+        code: MEMORY_LAYER_LOCKED_LEGACY,
+        message: `memory layer${one ? "" : "s"} ${layers.map((l) => JSON.stringify(l)).join(", ")} ${one ? "still carries" : "still carry"} the read-only permission bits ` +
+            "an engine from 7.30.x or earlier (a server replica at 7.100.0 or earlier) sets on every layer it mounts read-only — deleting an " +
+            "entry there (memory erase / origin clear) fails for a server that does not run as root: the request answers 500, its journal " +
+            `stays on disk and this replica's next start fails. Run \`${remedy}\` once no such engine still runs on this store (an older ` +
+            "replica sets the bits again whenever it mounts a layer read-only). Starting anyway.",
+        detail: { layers: [...layers], remedy },
+    };
+}
+export function announceLockedLegacyMemoryLayers(memoryDir, emit) {
+    const probe = probeLockedLegacyMemoryLayers(memoryDir);
+    if (probe.unreadable > 0)
+        recordFailOpen("server.memory.locked-layer-probe-partial", `unreadable=${probe.unreadable}`);
+    const notice = buildMemoryLayerLockedLegacyNotice(memoryDir, probe.layers);
+    if (notice !== undefined)
+        emit(notice);
+}
+//# sourceMappingURL=memory-layer-legacy-lock.js.map

package/dist/memory-operator-faces.js

@@ -1,6 +1,5 @@
 import { MemoryEngine, } from "@sema-agent/core";
 import { memoryMountRootOf } from "./memory-scope.js";
-import { memoryLayerWriteRefusal } from "./memory-layer-preflight.js";
 export function backendOwnsControlPlane(backend) {
     const b = backend;
     return typeof b?.controlPlaneRoot === "string" && b.controlPlaneRoot !== "";
@@ -41,7 +40,6 @@ function erasureEnvelopeRefusal(input, allowedScopes) {
 export function createMemoryComplianceFaces(store, opts) {
     if (!backendOwnsControlPlane(store.backend))
         return undefined;
-    const mountRoot = memoryMountRootOf(store.backend, store.root);
     const engine = new MemoryEngine({
         backend: store.backend,
         memoryDir: memoryMountRootOf(store.backend, store.root),
@@ -59,14 +57,6 @@ export function createMemoryComplianceFaces(store, opts) {
             const refusal = erasureEnvelopeRefusal(input, opts?.allowedScopes);
             if (refusal !== undefined)
                 return Promise.reject(refusal);
-            try {
-                const locked = memoryLayerWriteRefusal(mountRoot);
-                if (locked !== undefined)
-                    return Promise.reject(locked);
-            }
-            catch (err) {
-                return Promise.reject(err);
-            }
             return engine.eraseMemoryEntries(input);
         },
     };
@@ -74,7 +64,6 @@ export function createMemoryComplianceFaces(store, opts) {
 export function createMemoryOriginFaces(store, opts) {
     if (!backendOwnsControlPlane(store.backend))
         return undefined;
-    const mountRoot = memoryMountRootOf(store.backend, store.root);
     const engine = new MemoryEngine({
         backend: store.backend,
         memoryDir: memoryMountRootOf(store.backend, store.root),
@@ -84,12 +73,7 @@ export function createMemoryOriginFaces(store, opts) {
     return {
         listExternal: (scopes) => engine.listExternalOriginEntries(scopes),
         listClearances: () => engine.listOriginClearances(),
-        clear: async (entryId, input) => {
-            const locked = memoryLayerWriteRefusal(mountRoot);
-            if (locked !== undefined)
-                throw locked;
-            return engine.clearEntryOrigin(entryId, input);
-        },
+        clear: (entryId, input) => engine.clearEntryOrigin(entryId, input),
     };
 }
 export function createSessionMemoryStatusFace(store, opts) {

package/dist/memory-store-refusal.d.ts

@@ -0,0 +1,37 @@
+/**
+ * core 7.31.1 #1094 —— **`memory.target_outside_store`** 在本仓的唯一读法属主(纯叶:零 http / 零 boot 依赖)。
+ *
+ * ## 这个码说的是什么(core `docs/wire-consumption/7.31.1.md` 逐 face 表,tag v7.31.1 亲读)
+ * 记忆 store 里的一个目录经软链通到了 store **外**(或 store 根在 backend 打开 / 引擎首次挂载之后被改指)⇒ 引擎对落点在外的
+ * 删 / 写 / 重放 / 自身写一律**不做**,抛普通 `Error` + `.code`(文案以码领头,点名动作、路径、解析到哪)。core 的读法原话:
+ * operator 要处置的拒(去掉那只目录链),**不是**可重试的 IO 故障,也**不是**对调用方的裁决;链去掉之前重发恒拒。
+ *
+ * ## 两条到达车道,两个读者(本模块各给一只,别处不许再写第二份判据)
+ *  ① **抛出面**(抹除 / 出处 / 外源列表 / 清标 / bundle 导出导入 —— 凡触 store 树的 backend 面):`.code` 就是码
+ *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,一处字面量)。
+ *  ② **报告面**(harvest `incident`):core 契约写明 report 车道上码**只在文本里** —— `sidecar_corrupt` 的 detail 恰两种形
+ *     `memory commit refused: memory.target_outside_store: …` / `memory control plane refused: memory.target_outside_store: …`
+ *     (core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字)⇒ {@link targetOutsideStoreInIncident} 只认**这两个 lead 紧跟码**
+ *     的位置:lead 与码都是 core 铸的字面,路径与引用数据全在码之后。🔴 不做全文子串找(codex 一审 C2:一条真控制面损坏若在
+ *     它引用的坏数据里恰好带着这串字,子串找会把它标成目录链 —— 两者运维动作相反)。不读散文、不猜语义;结构化码位
+ *     (`HarvestReport.incident` / `.warnings` 带码)是向 core 索取的欠账。
+ *     ⚠️ 同一拒的**还原类**(缺失文件还原 / 只读层还原 / `MEMORY.md` 写)只进 `HarvestReport.warnings`(可以 `ok:true`、无 incident),
+ *     那几行的前缀是**条目路径**(模型可写)—— 本仓今天不读 warnings 车道(既有面,不是本批回归),也不在模型可写的文本上
+ *     找码;这一半候 core 的结构化码位(登记在案,codex 一审 C3)。
+ *
+ * ## 不是这个码的三形(core 同表「different surface」,本仓**不**自拼码,如实走各自既有臂)
+ *  · journal 重放目标目录成链 ⇒ `ControlPlaneCorruptError`(无 `.code`,KL-1094-b)⇒ 路由 typed 500 `internal.memory_control_plane_corrupt`;
+ *  · 引擎原地写撞硬链(nlink>1)⇒ 文本 `has N names (a hard link)`、无码(KL-1094-g / #1105)⇒ 走该写点既有的失败车道(harvest
+ *    warnings / 挂载失败),抛出面够不着;
+ *  · 解析故障(`EACCES` / `ELOOP` / `ENOTDIR`)⇒ 以 errno 本身抛 ⇒ 路由未分类 500 + 运维 warn(`String(err)` 带 core 补救句)。
+ */
+/** core 的码(`src/core/memory-engine/layout.ts` `TARGET_OUTSIDE_STORE`;core 不在包根导出它,本常量是它在本仓的唯一写点)。 */
+export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+/** 抛出面:`err` 是这一拒 ⇒ 原样交回(已窄化成 `Error`,调用方要它的 `message`);否则 `undefined`。形 = core 的 `Error` + `.code`。 */
+export declare function targetOutsideStoreOf(err: unknown): Error | undefined;
+/** 报告面:harvest `incident` 是这一拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成链)。 */
+export declare function targetOutsideStoreInIncident(incident: {
+    readonly kind: string;
+    readonly detail: string;
+}): typeof TARGET_OUTSIDE_STORE | undefined;
+//# sourceMappingURL=memory-store-refusal.d.ts.map

package/dist/memory-store-refusal.js

@@ -0,0 +1,14 @@
+export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+export function targetOutsideStoreOf(err) {
+    if (!(err instanceof Error))
+        return undefined;
+    const { code } = err;
+    return code === TARGET_OUTSIDE_STORE ? err : undefined;
+}
+const INCIDENT_PREFIXES = [`memory commit refused: ${TARGET_OUTSIDE_STORE}: `, `memory control plane refused: ${TARGET_OUTSIDE_STORE}: `];
+export function targetOutsideStoreInIncident(incident) {
+    if (incident.kind !== "sidecar_corrupt")
+        return undefined;
+    return INCIDENT_PREFIXES.some((p) => incident.detail.startsWith(p)) ? TARGET_OUTSIDE_STORE : undefined;
+}
+//# sourceMappingURL=memory-store-refusal.js.map