@sema-agent/server 7.100.0 → 7.101.1

package/dist/fleet/fleet-reconciler.js

@@ -11,7 +11,7 @@ export const FLEET_RECONCILE_COOLDOWN_MS = 60_000;
 export const FLEET_RECONCILE_WATCH_MAX = 200;
 export const FLEET_RECONCILE_WATCH_TTL_MS = 30 * 60_000;
 const emptyTally = () => ({
-    scanned: 0, skippedLive: 0, skippedParked: 0, retired: 0, orphaned: 0, childrenSwept: 0, workflowsRetired: 0, reads: 0, cooling: false, failOpen: false,
+    scanned: 0, skippedLive: 0, skippedParked: 0, retired: 0, orphaned: 0, childrenSwept: 0, childrenKeptAlive: 0, workflowsRetired: 0, reads: 0, cooling: false, failOpen: false,
 });
 function rotate(rows, cursor) {
     if (cursor === undefined || rows.length === 0)
@@ -22,6 +22,22 @@ function rotate(rows, cursor) {
     return [...rows.slice(at), ...rows.slice(0, at)];
 }
 const SILENT_FOR_A_CYCLE = FLEET_RECONCILE_INTERVAL_MS;
+function bgAgentVouches(status) {
+    switch (status) {
+        case "running":
+        case "parked":
+            return true;
+        case "completed":
+        case "failed":
+        case "killed":
+            return false;
+        default: {
+            const unhandled = status;
+            recordFailOpen("server.fleet.agent-status-unmapped", String(unhandled));
+            return true;
+        }
+    }
+}
 export function createFleetReconciler(deps) {
     const now = deps.now ?? (() => Date.now());
     const lastFrameAt = new Map();
@@ -86,11 +102,11 @@ export function createFleetReconciler(deps) {
         coolingUntil = undefined;
         const deadline = now() + FLEET_RECONCILE_READ_BUDGET_MS;
         const budgetLeft = () => tally.reads < FLEET_RECONCILE_MAX_ROWS && now() < deadline;
-        const readRun = async (id) => {
+        const budgetedRead = async (read) => {
             tally.reads++;
             let t;
-            const rec = await Promise.race([
-                deps.runs.getRun(id),
+            return await Promise.race([
+                read(),
                 new Promise((_r, reject) => {
                     t = setTimeout(() => reject(new ReadAborted(`fleet reconcile read exceeded ${FLEET_RECONCILE_READ_BUDGET_MS}ms`)), Math.max(0, deadline - now()));
                     if (typeof t.unref === "function")
@@ -100,30 +116,43 @@ export function createFleetReconciler(deps) {
                 if (t !== undefined)
                     clearTimeout(t);
             });
-            return rec;
         };
+        const readRun = (id) => budgetedRead(() => deps.runs.getRun(id));
         const snap = deps.bus.snapshot();
         for (const r of snap.tasks)
             if (!lastFrameAt.has(r.id))
                 lastFrameAt.set(r.id, nowMs);
         const idle = (id) => nowMs - (lastFrameAt.get(id) ?? nowMs) >= SILENT_FOR_A_CYCLE;
         const present = new Set(snap.tasks.map((r) => r.id));
-        const kids = new Map();
-        for (const r of snap.tasks) {
-            if (r.parentId === undefined)
-                continue;
-            const bucket = kids.get(r.parentId);
-            if (bucket)
-                bucket.push(r);
-            else
-                kids.set(r.parentId, [r]);
-        }
-        const sweepChildren = (parentId) => {
-            for (const c of kids.get(parentId) ?? []) {
-                deps.bus.removeTask(c.id, { removeReason: "orphaned", ...(c.cycleSeq !== undefined ? { cycleSeq: c.cycleSeq } : {}) });
-                lastFrameAt.delete(c.id);
-                tally.childrenSwept++;
+        const parentsOnBus = new Set(present);
+        const stillSilent = (row) => {
+            const cur = deps.bus.taskRow(row.id);
+            return cur !== undefined && cur.cycleSeq === row.cycleSeq && idle(row.id);
+        };
+        const keptAlive = (row, why) => {
+            tally.childrenKeptAlive++;
+            deps.logger?.info("fleet_row_reconciled", { taskId: row.id, disposition: "child_kept_alive", why, instanceId: deps.instanceId ?? null });
+        };
+        const judgeSilentRow = async (row, exit) => {
+            const handle = deps.bus.childOwnerKeys(row).handle;
+            if (handle !== undefined && deps.agents !== undefined && row.scope !== undefined) {
+                if (!budgetLeft())
+                    return "over_budget";
+                const scope = row.scope;
+                const rec = await budgetedRead(() => deps.agents.get(handle, scope));
+                if (rec !== null && bgAgentVouches(rec.status)) {
+                    keptAlive(row, "bg_registry");
+                    return "settled";
+                }
+            }
+            const hasPendingAsk = deps.hasPendingAsk;
+            if (hasPendingAsk !== undefined && deps.bus.childOwnerKeys(row).sessionIds.some((id) => hasPendingAsk(id))) {
+                keptAlive(row, "pending_ask");
+                return "settled";
             }
+            if (stillSilent(row))
+                exit();
+            return "settled";
         };
         const retire = (row, rec) => {
             deps.bus.publishTask({
@@ -132,14 +161,14 @@ export function createFleetReconciler(deps) {
                 retiredBy: "reconcile",
                 ...fleetRunResiduals(rec.result),
             });
-            sweepChildren(row.id);
+            parentsOnBus.delete(row.id);
             deps.bus.removeTask(row.id, { ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
             lastFrameAt.delete(row.id);
             tally.retired++;
             deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "retired" });
         };
         const orphanExit = (row, why) => {
-            sweepChildren(row.id);
+            parentsOnBus.delete(row.id);
             deps.bus.removeTask(row.id, { removeReason: "orphaned", ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
             lastFrameAt.delete(row.id);
             if (deps.runs && watch.size < FLEET_RECONCILE_WATCH_MAX)
@@ -148,6 +177,61 @@ export function createFleetReconciler(deps) {
             deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "orphaned" });
             deps.logger?.info("fleet_row_reconciled", { taskId: row.id, disposition: "orphaned", why, instanceId: deps.instanceId ?? null });
         };
+        const childExit = (row, parentId) => {
+            deps.bus.removeTask(row.id, { removeReason: "orphaned", ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
+            lastFrameAt.delete(row.id);
+            parentsOnBus.delete(row.id);
+            if (present.has(parentId)) {
+                tally.childrenSwept++;
+            }
+            else {
+                tally.orphaned++;
+                deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "orphaned_child" });
+            }
+        };
+        const judgeTopLevel = async (row) => {
+            tally.scanned++;
+            if (deps.isLiveOnThisReplica(row.id)) {
+                tally.skippedLive++;
+                return "settled";
+            }
+            if (!deps.runs)
+                return "settled";
+            if (!budgetLeft())
+                return "over_budget";
+            const rec = await readRun(row.id);
+            if (deps.isLiveOnThisReplica(row.id)) {
+                tally.skippedLive++;
+                return "settled";
+            }
+            const nowRow = deps.bus.taskRow(row.id);
+            if (nowRow === undefined)
+                return "settled";
+            if (nowRow.cycleSeq !== row.cycleSeq)
+                return "settled";
+            if (rec === undefined) {
+                if (!idle(row.id))
+                    return "settled";
+                return judgeSilentRow(row, () => orphanExit(row, "durable_row_absent"));
+            }
+            if (isTerminalRunStatus(rec.status)) {
+                retire(row, rec);
+                return "settled";
+            }
+            if (isParkedRunStatus(rec.status)) {
+                tally.skippedParked++;
+                return "settled";
+            }
+            orphanExit(row, runProvenElsewhere(rec, deps.instanceId) ? "durable_running_other_replica" : "durable_running_no_local_leg");
+            return "settled";
+        };
+        const judgeChild = async (row, parentId) => {
+            if (parentsOnBus.has(parentId))
+                return "settled";
+            if (!idle(row.id))
+                return "settled";
+            return judgeSilentRow(row, () => childExit(row, parentId));
+        };
         try {
             for (const [id, w] of [...watch]) {
                 if (nowMs - w.at > FLEET_RECONCILE_WATCH_TTL_MS) {
@@ -171,53 +255,11 @@ export function createFleetReconciler(deps) {
                     tally.retired++;
             }
             for (const row of rotate(snap.tasks, taskCursor)) {
-                if (row.parentId !== undefined)
-                    continue;
-                tally.scanned++;
-                if (deps.isLiveOnThisReplica(row.id)) {
-                    tally.skippedLive++;
-                    continue;
-                }
-                if (!deps.runs)
-                    continue;
-                if (!budgetLeft()) {
+                const step = row.parentId === undefined ? await judgeTopLevel(row) : await judgeChild(row, row.parentId);
+                if (step === "over_budget") {
                     taskCursor = row.id;
                     break;
                 }
-                const rec = await readRun(row.id);
-                if (deps.isLiveOnThisReplica(row.id)) {
-                    tally.skippedLive++;
-                    continue;
-                }
-                const nowRow = deps.bus.taskRow(row.id);
-                if (nowRow === undefined)
-                    continue;
-                if (nowRow.cycleSeq !== row.cycleSeq)
-                    continue;
-                if (rec === undefined) {
-                    if (idle(row.id))
-                        orphanExit(row, "durable_row_absent");
-                    continue;
-                }
-                if (isTerminalRunStatus(rec.status)) {
-                    retire(row, rec);
-                    continue;
-                }
-                if (isParkedRunStatus(rec.status)) {
-                    tally.skippedParked++;
-                    continue;
-                }
-                orphanExit(row, runProvenElsewhere(rec, deps.instanceId) ? "durable_running_other_replica" : "durable_running_no_local_leg");
-            }
-            for (const row of snap.tasks) {
-                if (row.parentId === undefined || present.has(row.parentId))
-                    continue;
-                if (!idle(row.id))
-                    continue;
-                deps.bus.removeTask(row.id, { removeReason: "orphaned", ...(row.cycleSeq !== undefined ? { cycleSeq: row.cycleSeq } : {}) });
-                lastFrameAt.delete(row.id);
-                tally.orphaned++;
-                deps.metrics?.inc("fleet_rows_reconciled_total", { disposition: "orphaned_child" });
             }
             if (wfGet) {
                 for (const wf of rotate(snap.workflows, wfCursor)) {
@@ -227,19 +269,7 @@ export function createFleetReconciler(deps) {
                         wfCursor = wf.id;
                         break;
                     }
-                    tally.reads++;
-                    let wfTimer;
-                    const run = await Promise.race([
-                        wfGet(wf.id),
-                        new Promise((_r, reject) => {
-                            wfTimer = setTimeout(() => reject(new ReadAborted("fleet reconcile workflow read over budget")), Math.max(0, deadline - now()));
-                            if (typeof wfTimer.unref === "function")
-                                wfTimer.unref();
-                        }),
-                    ]).finally(() => {
-                        if (wfTimer !== undefined)
-                            clearTimeout(wfTimer);
-                    });
+                    const run = await budgetedRead(() => wfGet(wf.id));
                     if (!run || !isTerminalWorkflowStatus(run.status))
                         continue;
                     if (wf.scope !== undefined && run.scope !== wf.scope)

package/dist/fleet-client.d.ts

@@ -4,7 +4,8 @@
  *  - **可选分层(D3)**:仅当 center 已配置(sema-registry lane 的 baseUrl+token+worker)∧ `FLEET_ADVERTISE_ADDRESS`
  *    显式声明时才启动 —— 不配 center 的部署零行为变化。address 不自猜(k8s pod IP / docker alias / 127.0.0.1:port
  *    只有部署环境自己知道,故用显式 env)。
- *  - **announce=注册=心跳同形状幂等 upsert**:boot 后 POST 一次 + 每 heartbeatMs 续;`ready = bootDone ∧ !draining`。
+ *  - **announce=注册=心跳同形状幂等 upsert**:boot 后 POST 一次 + 每 heartbeatMs 续;`ready` 今 = `!draining`(实现只读
+ *    `isDraining()`,announce 本身在 boot 之后才起;S-740 起与 /health 就绪同一只谓词 —— 车OC 6b 注释改真,实现归 S-740)。
  *  - **draining 翻转即刻再 announce**(第一时间自摘流,比任何观测都快);退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键

package/dist/hooks/hook-llm.js

@@ -1,5 +1,6 @@
 import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
-import { matchCatalogModel } from "../model-select.js";
+import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
@@ -32,21 +33,29 @@ export function createHookLlm(deps) {
     };
     const hookModelFor = (requested) => {
         const shape = (ref) => shapeFrom(ref, config.models[ref], config.models[ref]?.id ?? ref);
+        const unavailable = (field, ref) => {
+            if (config.models[ref] !== undefined)
+                return undefined;
+            const hit = refusedCatalogEntry(ref, config.modelRefusals);
+            return hit === undefined ? undefined : { ok: false, error: modelUnavailableMessage(field, ref, hit.name, hit.refusal) };
+        };
         if (requested === undefined) {
             const sum = config.roles.summarize;
             const roleModel = typeof sum === "string" ? sum : sum && typeof sum === "object" && "model" in sum && typeof sum.model === "string" ? sum.model : undefined;
             if (roleModel !== undefined)
-                return config.models[roleModel] ? shape(roleModel) : shapeFrom(config.model.id, config.model, roleModel);
+                return unavailable("summarize role model", roleModel) ?? (config.models[roleModel] ? shape(roleModel) : shapeFrom(config.model.id, config.model, roleModel));
             return shapeFrom(config.model.id, config.model, config.model.id);
         }
         if (config.models[requested])
             return shape(requested);
-        const byId = matchCatalogModel(requested, config.models);
+        if (Object.hasOwn(config.modelRefusals ?? {}, requested))
+            return unavailable("hook model", requested);
+        const byId = matchCatalogModel(requested, config.models, config.modelRefusals);
         if (byId !== undefined)
             return shape(byId);
         if (requested === config.model.id)
             return shapeFrom(requested, config.model, requested);
-        return { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };
+        return unavailable("hook model", requested) ?? { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };
     };
     const judgeRoute = (pick, perModelKey, deploymentKey, declaredRoot) => {
         const credential = resolveRouteCredential({

package/dist/host-lsp-manager.d.ts

@@ -9,7 +9,8 @@
  * `scrubServerSecrets` 的结果)。
  *
  * ## 规则(一句)
- * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) —— 与模型可驱动的 host shell(`inheritEnv:"scrub"`)
+ * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) ∪ 部署方点名放回的键(S-699,见下节;缺省空名单)——
+ * 剥除与模型可驱动的 host shell(`inheritEnv:"scrub"`)
  * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
  * 会漏掉形状规则认不出的本仓凭据键(今天是 `OTEL_EXPORTER_OTLP_HEADERS`),那正是 S-684 当初的病形。
  * 剥掉了什么经既有观测面留痕(site = `server.lsp.spawn-env`,每 site×key 一次披露 + 逐次计数)—— core 那侧
@@ -19,11 +20,22 @@
  * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
  * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
  *
+ * ## 点名放行(S-699,`LSP_ENV_ALLOW`)
+ * 剥除会连语言服务器自己的真实依赖一起剥掉(`.npmrc` 的 `${NPM_TOKEN}` 插值、rust-analyzer `cargo metadata` 私有 registry 的
+ * `CARGO_REGISTRIES_<名>_TOKEN` —— 形状规则按名判,分不出「给语言服务器用的令牌」与「编排器的令牌」)。出路 = 部署方点名:
+ * env = {@link scrubServerSecrets}(process.env) 之上把 `config.lspEnvAllow` 点到的键经 {@link allowlistedEnv}(与 host shell
+ * `inheritEnv:[names]` 同一只谓词)从原 env 原样放回;没点到的照旧剥。名单由 `config.ts` 解析(形错拒启;
+ * `REQUIRE_PRINCIPAL=true` 下落空名单并 warn 一次),本函数只读 `config.lspEnvAllow`,不在这里再判一次姿态。
+ * 放回的键不是剥除 ⇒ 不进 `secret_env_scrubbed` 的键表与计数;剥掉的键经既有现场 `server.lsp.spawn-env` 一行 warn
+ * (带当前放行名单与出路句),这一行就是「剥了什么」的用户可见面 —— 语言服务器侧从不报。
+ *
  * ## 两个调用点
  * `boot/execution-env.ts`(服务的 host 车道)与 `run-local.ts`(纯本地 CLI)此前各写一遍 `new NodeLspManager({ log })`;
  * 现在都经本函数 —— 构造形只有一份,剥除规则也就只能有一份(源码对账钉在 `test/secret-env-scrub-disclosure.test.ts`)。
+ * 两处都交整份 `config`(类型只要 `lspEnvAllow` 一格),放行名单因此只有一个读点。
  */
 import { NodeLspManager } from "@sema-agent/core";
+import type { ServiceConfig } from "./config-types.js";
 /** 构造宿主车道的本地语言服务器管理器(`create*`:返回活对象)。`log` = 管理器的观测钩(open/heal/degrade/evict 事件)。 */
-export declare function createHostLspManager(log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
+export declare function createHostLspManager(config: Pick<ServiceConfig, "lspEnvAllow">, log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
 //# sourceMappingURL=host-lsp-manager.d.ts.map

package/dist/host-lsp-manager.js

@@ -1,12 +1,13 @@
 import { NodeLspManager } from "@sema-agent/core";
 import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
-import { scrubServerSecrets } from "./server-secret-env.js";
-export function createHostLspManager(log) {
-    const findings = [];
-    const scrubbed = scrubServerSecrets(process.env, findings);
-    recordSecretEnvScrub("server.lsp.spawn-env", findings);
+import { allowlistedEnv, scrubServerSecrets } from "./server-secret-env.js";
+export function createHostLspManager(config, log) {
+    const scrubFindings = [];
+    const composed = { ...scrubServerSecrets(process.env, scrubFindings), ...allowlistedEnv(config.lspEnvAllow, process.env) };
+    const findings = scrubFindings.filter((f) => composed[f.key] === undefined);
+    recordSecretEnvScrub("server.lsp.spawn-env", findings, config.lspEnvAllow);
     const env = {};
-    for (const [k, v] of Object.entries(scrubbed))
+    for (const [k, v] of Object.entries(composed))
         if (v !== undefined)
             env[k] = v;
     return new NodeLspManager({ log, env });

package/dist/http/admission.js

@@ -1,5 +1,6 @@
 import { isThinkingLevel, expandTiers } from "@sema-agent/core";
-import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
@@ -39,7 +40,15 @@ const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
+    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
+}
+function refuseUnavailableModel(res, config, field, ref) {
+    const hit = refusedCatalogEntry(ref, config.modelRefusals);
+    if (hit === undefined)
+        return false;
+    const message = modelUnavailableMessage(field, ref.slice(0, 120), hit.name, hit.refusal);
+    sendError(res, 400, "request.model_unavailable", message);
+    return true;
 }
 export function createAdmission(ctx) {
     const { deps, readJson, runnerFor } = ctx;
@@ -419,8 +428,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const agentsBare = deps.config.models ?? {};
-            const agentsCatalog = expandTiers(agentsBare, deps.config.tiers ?? {}) ?? agentsBare;
+            const agentsCatalog = selectableCatalog(agentsBare, deps.config.tiers, deps.config.modelRefusals);
             const um = unknownTaskAgentModelRef(body.agents, agentsCatalog);
+            if (um !== undefined && refuseUnavailableModel(res, deps.config, `agents[${um.index}].model`, um.ref))
+                return null;
             if (um !== undefined) {
                 sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
                 return null;
@@ -494,8 +505,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.model, catalog) === undefined) {
+            const catalog = selectableCatalog(bare, deps.config.tiers, deps.config.modelRefusals);
+            if (matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined) {
+                if (refuseUnavailableModel(res, deps.config, "model", body.model))
+                    return null;
                 sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }
@@ -506,8 +519,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.compactionModel, catalog) === undefined) {
+            const catalog = selectableCatalog(bare, deps.config.tiers, deps.config.modelRefusals);
+            if (matchCatalogModel(body.compactionModel, catalog, deps.config.modelRefusals) === undefined) {
+                if (refuseUnavailableModel(res, deps.config, "compactionModel", body.compactionModel))
+                    return null;
                 sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }

package/dist/http/memory-store-refusal-reply.d.ts

@@ -0,0 +1,24 @@
+/**
+ * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
+ * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * `routes/memory-compliance.ts`(出处 / 抹除)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
+ * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(`routes/sessions.ts`:同码、固定文案,见那里的注)。
+ * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
+ * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
+ *
+ * ## 为什么 409
+ * core 的读法:operator 要处置的拒(去掉 store 里那只通到外面的目录链),不是可重试的 IO 故障,也不是对调用方的裁决。与
+ * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
+ * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在
+ * `test/memory-compliance-http.test.ts`);链在提交点之后才换上 ⇒ 已删的几条算数、journal 留盘 —— core 原句会带
+ * `after the commit point; the journal is kept`,本层原样转发、不嗅它分类(codex 一审 C1)。
+ *
+ * ## 文案原样
+ * core 的诊断句点名动作、路径与解析到哪 —— 那是运维找到那只链的唯一材料,与本族其它 core 码同一条「码与文案都不改写」纪律。
+ * 只对 operator 面这么做:这几口都过了 operator 门,宿主路径对这个受众不是泄露。
+ */
+import type { ServerResponse } from "node:http";
+/** `err` 是 `memory.target_outside_store` ⇒ 409 带码 + core 原句,返回 true(已应答);否则 false,一个字节都不写。 */
+export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown): boolean;
+//# sourceMappingURL=memory-store-refusal-reply.d.ts.map

package/dist/http/memory-store-refusal-reply.js

@@ -0,0 +1,10 @@
+import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { sendError } from "./send.js";
+export function sentMemoryStoreRefusal(res, err) {
+    const refusal = targetOutsideStoreOf(err);
+    if (refusal === undefined)
+        return false;
+    sendError(res, 409, "memory.target_outside_store", refusal.message);
+    return true;
+}
+//# sourceMappingURL=memory-store-refusal-reply.js.map

package/dist/http/routes/approvals-assistant.js

@@ -288,6 +288,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.deadline !== undefined ? { deadline: s.deadline } : {}),
                     ...(s.hasBidiControls === true ? { hasBidiControls: true } : {}),
                     ...(s.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...(s.mandated === true ? { mandated: true } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
                     ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { isModelAllowlisted } from "../../model-select.js";
+import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -228,7 +228,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             return;
         }
         case "models": {
-            const atCatalog = expandTiers(deps.config.models, deps.config.tiers ?? {}) ?? deps.config.models;
+            const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
             const atAllowlist = deps.config.atModelAllowlist ?? [];
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
@@ -242,7 +242,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
+                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist, deps.config.modelRefusals) } : {}),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");

package/dist/http/routes/memory-bundle.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +36,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
+    if (sentMemoryStoreRefusal(res, err))
+        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-compliance.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
-import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -36,13 +36,11 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (face === "erase" && err instanceof MemoryLayerUnwritableError) {
-        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
-        return true;
-    }
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
         return true;
+    if (sentMemoryStoreRefusal(res, err))
+        return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
         return true;

package/dist/http/routes/memory-origin.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
-import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
@@ -48,15 +48,13 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (face === "clear" && err instanceof MemoryLayerUnwritableError) {
-        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
-        return true;
-    }
     if (face === "clear") {
         const coreCode = codeOf(err);
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))
             return true;
     }
+    if (face !== "clearances" && sentMemoryStoreRefusal(res, err))
+        return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
         return true;

package/dist/http/routes/sessions.js

@@ -4,12 +4,12 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
@@ -500,16 +500,17 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
-                if (err instanceof MemoryLayerUnwritableError) {
-                    deps.logger?.warn?.("session_memory_erase_layer_unwritable", { sessionId, dirs: err.dirs });
-                    sendError(res, 409, "memory.layer_unwritable", "memory erasure refused: a memory layer directory on this server is not writable on disk, so the erase was stopped before anything was written (nothing was deleted, no journal was left). Ask whoever operates this deployment to restore the owner write bit on the memory layer directories (a known issue of the memory engine's mount), then retry with the same requestId");
-                    return;
-                }
                 const code = err.code;
                 if (code === "config.memory_erasure_request") {
                     sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
                     return;
                 }
+                const outside = targetOutsideStoreOf(err);
+                if (outside !== undefined) {
+                    deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: outside.message });
+                    sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                    return;
+                }
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
             }