@sema-agent/server 7.106.0 → 7.108.0

package/dist/boot/shutdown.d.ts

@@ -29,6 +29,8 @@ import type { RateLimiter } from "../observability/rate-limit.js";
 import type { startFleetClientFromEnv } from "../fleet-client.js";
 import type { BreakerStateStore, CostQuotaStore, RateLimiterStore, StoreBackend } from "../plugins/store-backend.js";
 import type { WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
+import type { ToolApprovalCoordinator } from "../tool-approval.js";
+import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
 export interface ShutdownCtx {
     config: ServiceConfig;
     /** [ref]①:崩溃遗言的 version 键(与 /v1/capabilities.version 同源=main 的 serviceVersion())。 */
@@ -87,6 +89,12 @@ export interface ShutdownCtx {
     configCenter: {
         stopRefreshLoop(): void;
     } | undefined;
+    /** S-929:活体审批协调器(`TOOL_APPROVAL_ENABLED` 关 ⇒ 缺席)。hardShutdown 起点调它的 `drainForShutdown`:本进程握着的活卡
+     *  按断连同路收场、审计留有序关停记号 —— 否则下一次 boot 把有序重启读成崩溃(`crashed_before_park`)。 */
+    toolApproval: ToolApprovalCoordinator | undefined;
+    /** S-929 F1:checkpoint 店的 park 提交观察层(`plugins/park-commit-watch.ts`;在场 ⇔ 本部署有 checkpoint 店)。hardShutdown 在
+     *  `backend.close()` 之前等它 quiesce —— 在飞的 `put`(审批 park / 资源挂起…,与审批协调器在不在场无关)不许被抽掉连接池。 */
+    parkCommits: ParkCommitWatch | undefined;
 }
 /**
  * `installShutdownHandlers` 的**摘除把手**([ref] 二轮重扫件4)。

package/dist/boot/shutdown.js

@@ -6,8 +6,9 @@ import { installProcessExitBoundary } from "./exit-boundary.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
+const HARD_STOP_GRACE_MS = 10_000;
 export function installShutdownHandlers(ctx) {
-    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, } = ctx;
+    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, configCenter, version, deviceHub, toolApproval, parkCommits, } = ctx;
     const dataRoot = config.localDataRoot;
     if (dataRoot) {
         const prior = readCrashLast(dataRoot);
@@ -69,6 +70,16 @@ export function installShutdownHandlers(ctx) {
         closing = true;
         if (dataRoot)
             clearCrashLast(dataRoot);
+        const graceDeadlineMs = Date.now() + HARD_STOP_GRACE_MS;
+        const approvalDrain = toolApproval === undefined
+            ? Promise.resolve()
+            : toolApproval
+                .drainForShutdown(graceDeadlineMs)
+                .then(({ uncommittedParks }) => {
+                for (const p of uncommittedParks)
+                    logger.warn("approval_park_uncommitted_at_shutdown", { approvalId: p.approvalId, taskId: p.taskId });
+            })
+                .catch((err) => logger.warn("approval_drain_for_shutdown_failed", { err: String(err) }));
         clearInterval(reaper);
         clearInterval(fleetReconcile.timer);
         const retentionTeardown = retentionLane === undefined
@@ -79,6 +90,7 @@ export function installShutdownHandlers(ctx) {
                 .then(() => undefined)
                 .catch(() => undefined);
         fleetReconcile.reconciler.stop();
+        const routingStopped = fleetClient?.stopRouting() ?? Promise.resolve();
         parentWatch?.stop();
         engineLease?.stop();
         storeLiveProbe?.stop();
@@ -86,23 +98,34 @@ export function installShutdownHandlers(ctx) {
         configCenter?.stopRefreshLoop();
         otelExporter?.stop();
         breakerState?.stop();
-        if (costQuota && "stop" in costQuota)
-            costQuota.stop();
-        if (rateLimiter && "stop" in rateLimiter)
-            rateLimiter.stop();
         runner.sessions.dispose();
         subRunner.sessions.dispose();
         void lspManager?.dispose?.();
         void workflowNotifyJournal?.close?.();
         exitBoundary.reapChildProcessesEarly();
-        void fleetClient?.stop();
+        const drained = approvalDrain
+            .then(() => parkCommits?.quiesce(graceDeadlineMs))
+            .then((q) => {
+            if (q !== undefined && q.inFlight > 0)
+                logger.warn("checkpoint_puts_inflight_at_backend_close", { inFlight: q.inFlight });
+        });
+        const ledgerStopped = drained.then(async () => {
+            if (costQuota && "stop" in costQuota)
+                costQuota.stop();
+            if (rateLimiter && "stop" in rateLimiter)
+                rateLimiter.stop();
+            await fleetClient?.flushFinalUsage();
+        });
         server.close(() => {
-            void retentionTeardown.then(() => (backend ? backend.close() : Promise.resolve())).finally(() => process.exit(0));
+            void Promise.all([retentionTeardown, ledgerStopped])
+                .then(() => (backend ? backend.close() : Promise.resolve()))
+                .then(() => routingStopped)
+                .finally(() => process.exit(0));
         });
         const finalExit = setTimeout(() => { logger.warn("hard_shutdown_final_deadline", { afterMs: 15_000 }); process.exit(0); }, 15_000);
         finalExit.unref?.();
         server.closeIdleConnections?.();
-        const forceClose = setTimeout(() => server.closeAllConnections?.(), 10_000);
+        const forceClose = setTimeout(() => server.closeAllConnections?.(), HARD_STOP_GRACE_MS);
         forceClose.unref?.();
     };
     let draining = false;

package/dist/boot/stage-06-runners.d.ts

@@ -14,6 +14,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-06-runners.js

@@ -13,6 +13,7 @@ import { buildConsolidationValveAudit, createMemoryConsolidationFaces, resolveCo
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
+import { createParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
 import { createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
@@ -22,8 +23,11 @@ import { parkedAskRedeem, runStore } from "./late-binds.js";
 export function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, sessionIncarnationOf, config, configCenter, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
+    const checkpointStore = parkCommitted?.store;
+    const parkCommits = parkCommitted?.watch;
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, approvalAskAudit, approvalExemptionStore, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
-        config, logger, backend, sendUserFileTaskEnvs, ruleConsent,
+        config, logger, backend, sendUserFileTaskEnvs, ruleConsent, parkCommits,
         getParkedRedeem: () => parkedAskRedeem,
         ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
     });
@@ -40,7 +44,6 @@ export function runStage06(ctx) {
         logger.info("shared_memory_stores_enabled", { backend: backend?.kind });
     const runnerOffloadStore = toolResultStore ?? new InMemoryToolResultStore({ maxTotalChars: 64_000_000 });
     const commitHands = config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined;
-    const checkpointStore = backend?.checkpoint && config.durableApproval ? backend.checkpoint(logger) : undefined;
     const retentionExecutor = backend?.retention?.({ taskAttachmentTable: taskAttachmentStore !== undefined, taskListTables: taskListLane.backend !== "memory", logger });
     const retentionLaneStore = backend?.retentionLane?.();
     assertRetentionLaneWirable({
@@ -202,6 +205,6 @@ export function runStage06(ctx) {
     };
     const subRunner = new Runner(subRunnerDeps);
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -27,6 +27,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-08-reapers.d.ts

@@ -40,6 +40,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-09-leader.d.ts

@@ -76,6 +76,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-10-http-server.d.ts

@@ -76,6 +76,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-10-http-server.js

@@ -26,7 +26,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, configCenter, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -303,6 +303,8 @@ export async function runStage10(ctx) {
         version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
         storeLiveProbe, configCenter,
+        toolApproval,
+        parkCommits,
         deviceHub: deviceLane?.hub,
         retentionLane: retentionLaneStarted,
         releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,

package/dist/brain.js

@@ -8,6 +8,7 @@ import { dispatchBrainLane } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { catalogEntryFingerprint } from "./config-center/restart-signal.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
+import { createModelReachBrain } from "./model-unreachable-notice.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -138,7 +139,7 @@ export function createBrain(config, deps = {}) {
             });
         }
     }
-    return brain;
+    return createModelReachBrain(brain);
 }
 export function degradeTargetOf(config) {
     return config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;

package/dist/capabilities/composite-members.d.ts

@@ -46,7 +46,7 @@ export declare const COMPOSITE_CAPABILITY_MEMBERS: {
     readonly webSearch: readonly ["backend"];
     readonly background: readonly ["listFace", "exitFaces"];
     readonly taskSettings: readonly ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"];
-    readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "intentArming", "armed", "reason", "model"];
+    readonly permissionModeAuto: readonly ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"];
     readonly writeProtection: readonly ["armed", "rows", "replaced"];
     readonly executionLane: readonly ["provider", "toolsOnThisHost", "isolated"];
     readonly retention: readonly ["mode", "maxAgeDays"];

package/dist/capabilities/composite-members.js

@@ -7,7 +7,7 @@ export const COMPOSITE_CAPABILITY_MEMBERS = {
     webSearch: ["backend"],
     background: ["listFace", "exitFaces"],
     taskSettings: ["permissions", "permissionMode", "model", "outputStyle", "env", "hooks"],
-    permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "intentArming", "armed", "reason", "model"],
+    permissionModeAuto: ["accepted", "classifierSeat", "entitlementSource", "armed", "reason", "model"],
     writeProtection: ["armed", "rows", "replaced"],
     executionLane: ["provider", "toolsOnThisHost", "isolated"],
     retention: ["mode", "maxAgeDays"],

package/dist/config-catalog.d.ts

@@ -181,8 +181,13 @@ export declare const CONFIG_CATALOG: readonly ConfigCatalogSpec[];
  * 进程起不来、每个 import 本模块的测试当场红)—— 不是 warn、不是标一个 `false` 位上 wire(7.105.0 及以前那只 `domainExists`
  * 位就是后一种:它只看域不看路径,而 `models` 是真域,于是 `models.degrade` 这个不存在的成员被报成「中心可写」)。
  *
- * 解析只认 zod 的结构外衣(optional / nullable / default / effects / lazy)与对象 / 数组两种容器;认不出的节点 = 解析不出
+ * 解析只认 zod 的结构外衣(optional / nullable / default / catch / readonly / effects·管道 / lazy)与对象 / 数组两种容器;认不出的节点 = 解析不出
  * (fail-closed:宁可多拒一个座位,也不放过一个假座位)。
+ *
+ * 🔴 S-909(7.106.0 合并复审 opus 腿 L-1):**只走 zod 公开面**。契约包今天是 zod 3.25、本仓是 zod 4 —— 读 zod 私有定义字段(类型判别名 /
+ * 内层 schema / lazy getter)的旧写法在契约包升 zod 4 那天会让 `models[].…` 整族座位解析不出,模块 import 期整只抛。两大版没有一个能同时
+ * 公开读到的「这是什么节点」判别位(v4 的 `.def.type` 在 v3 上不存在),`instanceof` 也跨不了两份 zod 的类身份 ⇒ 按两大版**同名的公开访问器**
+ * 认形,规则三条(见 {@link zodObjectShapeOf} / {@link isZodArrayFace} / {@link ZOD_WRAPPER_FACES})。钉:`test/config-catalog-zod-public-face.test.ts`。
  */
 export declare function assertCenterSeatsResolvable(specs: readonly {
     readonly name: string;

package/dist/config-catalog.js

@@ -498,24 +498,42 @@ export function assertCenterSeatsResolvable(specs) {
         throw new Error(`config catalog claims center seats the settings-schema contract does not have — the center cannot publish them, so the catalog must not advertise a center write lane for them (delete the seat, or add the member to the contract first): ${bad.join("; ")}`);
     }
 }
-function zodMember(node, key) {
+function zodPublicMember(node, key) {
     return typeof node === "object" && node !== null && key in node ? Reflect.get(node, key) : undefined;
 }
+function callZodPublic(node, key) {
+    const f = zodPublicMember(node, key);
+    return typeof f === "function" ? Reflect.apply(f, node, []) : undefined;
+}
+function zodObjectShapeOf(node) {
+    const shape = zodPublicMember(node, "shape");
+    return typeof shape === "object" && shape !== null ? shape : undefined;
+}
+function isZodArrayFace(node) {
+    return zodPublicMember(node, "element") !== undefined && typeof zodPublicMember(node, "length") === "function";
+}
+const ZOD_WRAPPER_FACES = [
+    (n) => callZodPublic(n, "unwrap"),
+    (n) => callZodPublic(n, "removeDefault"),
+    (n) => callZodPublic(n, "removeCatch"),
+    (n) => callZodPublic(n, "innerType"),
+    (n) => zodPublicMember(n, "schema"),
+    (n) => zodPublicMember(n, "in"),
+];
 function unwrapZodNode(node) {
     let cur = node;
     for (let depth = 0; depth < 32; depth++) {
-        const def = zodMember(cur, "_def");
-        const inner = zodMember(def, "innerType") ?? zodMember(def, "schema");
-        if (inner !== undefined) {
-            cur = inner;
-            continue;
-        }
-        const getter = zodMember(def, "getter");
-        if (typeof getter === "function") {
-            cur = Reflect.apply(getter, def, []);
-            continue;
+        if (zodObjectShapeOf(cur) !== undefined || isZodArrayFace(cur))
+            return cur;
+        let inner;
+        for (const face of ZOD_WRAPPER_FACES) {
+            inner = face(cur);
+            if (inner !== undefined)
+                break;
         }
-        return cur;
+        if (inner === undefined)
+            return cur;
+        cur = inner;
     }
     return cur;
 }
@@ -524,15 +542,14 @@ function zodPathResolves(schema, path) {
     for (const segment of path.split(".")) {
         const intoArray = segment.endsWith("[]");
         const name = intoArray ? segment.slice(0, -2) : segment;
-        const shape = zodMember(cur, "shape");
-        if (typeof shape !== "object" || shape === null || !Object.hasOwn(shape, name))
+        const shape = zodObjectShapeOf(cur);
+        if (shape === undefined || !Object.hasOwn(shape, name))
             return false;
         cur = unwrapZodNode(Reflect.get(shape, name));
         if (intoArray) {
-            const def = zodMember(cur, "_def");
-            if (zodMember(def, "typeName") !== "ZodArray")
+            if (!isZodArrayFace(cur))
                 return false;
-            cur = unwrapZodNode(zodMember(def, "type"));
+            cur = unwrapZodNode(zodPublicMember(cur, "element"));
         }
     }
     return true;

package/dist/config-center/apply-effective.js

@@ -2,6 +2,7 @@ import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
 import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
+import { buildModelHeadersKey } from "../model-entry-headers.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { stageLimits } from "./stage-limits.js";
@@ -50,6 +51,7 @@ function toModel(m, envDefaults = {}, logger) {
         ...(compat ? { compat } : {}),
         ...(m.extraBody ? { extraBody: m.extraBody } : {}),
         ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
+        ...buildModelHeadersKey(m.name, m.headers, m.api),
     };
     const explicitAct = m.autoCompactTokens;
     applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);

package/dist/config-center/types.d.ts

@@ -82,6 +82,13 @@ export interface CenterModel {
      *  configured sentences parse fine in registry-core but never reach the assembly face ([ref]① 排雷:
      *  the missing leg made every promptGuidance pilot a false control). */
     promptGuidance?: string[];
+    /**
+     * S-931(7.108.0)—— 这条条目发给供应商的**附加请求头**(部署 ↔ 供应商的契约;今天只有 `anthropic-beta`),上 core 的 per-model
+     * 头座 `Model.headers`。类型是 `unknown` 而不是那个结构,理由与 {@link CenterModel.compat} 逐字同:本类型是承载形,判据(闭集白名单 +
+     * 线路 + 值形)与坏形处置的单一属主是 `model-entry-headers.ts`(执法点 = S-704 逐条判据,判不过 ⇒ 条目不可用)。
+     * ⚠️ 两条读腿今天**剥掉**它(settings-schema 6.3.0 `ModelEntry` 无此键;候裁加字段):今天到得了这里的只有绕过读腿的输入。
+     */
+    headers?: unknown;
     enabled?: boolean;
 }
 export type CenterRoleTarget = {

package/dist/deployment-governance.js

@@ -2,12 +2,13 @@ import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
+import { heldRuleName } from "./tool-rule-names.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
         return createDurableQuestionPolicy();
     return {
         check(req) {
-            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME)
+            if (heldRuleName(req, (n) => n === ASK_USER_QUESTION_TOOL_NAME) === undefined)
                 return { action: "allow" };
             return live.hasLiveContext()
                 ? { action: "allow" }

package/dist/fleet-client.d.ts

@@ -102,8 +102,16 @@ export interface FleetClient {
     /** Immediate out-of-cycle announce — call when a self-reported input flips (draining: self-remove from routing FIRST;
      *  roster landed: become routable without waiting a heartbeat; restart signal changed: S-741). */
     announceNow: () => Promise<void>;
-    /** Stop timers + best-effort DELETE deregistration (bounded; never throws). */
-    stop: () => Promise<void>;
+    /**
+     * **路由面**停:停心跳、等在飞公告排空、best-effort DELETE 注销(各请求有界;从不抛)。之后的 `announceNow` 是空操作。
+     * 收尾链在 hardShutdown **起点**调(与 7.107.0 同序 —— 退出中的副本第一时间离开中心的路由表)。
+     */
+    stopRouting: () => Promise<void>;
+    /**
+     * **记账面**停:停用量窗定时器、上报最后一个(可能不满的)用量窗(有界;从不抛;空窗不发)。与路由面无关(不公告的引擎也报用量)。
+     * 收尾链排在**排空等待之后**调(S-929 F12:宽限窗里跑完的腿记下的用量必须进这一窗)。
+     */
+    flushFinalUsage: () => Promise<void>;
 }
 /**
  * Start the worker-side fleet loops. Caller has already gated on the center lane (startFleetClientFromEnv below).

package/dist/fleet-client.js

@@ -161,19 +161,16 @@ export function startFleetClient(opts) {
     hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
     uw?.unref?.();
-    let stopping = false;
-    const stop = async () => {
-        if (stopping)
+    let routingStopping = false;
+    const stopRouting = async () => {
+        if (routingStopping)
             return;
-        stopping = true;
+        routingStopping = true;
         if (hb)
             clearInterval(hb);
-        if (uw)
-            clearInterval(uw);
         while (inFlight !== undefined)
             await inFlight;
         stopped = true;
-        await flushUsage();
         if (!announcing)
             return;
         try {
@@ -182,7 +179,16 @@ export function startFleetClient(opts) {
         catch {
         }
     };
-    return { announceNow, stop };
+    let usageStopping = false;
+    const flushFinalUsage = async () => {
+        if (usageStopping)
+            return;
+        usageStopping = true;
+        if (uw)
+            clearInterval(uw);
+        await flushUsage();
+    };
+    return { announceNow, stopRouting, flushFinalUsage };
 }
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -0,0 +1,41 @@
+/**
+ * S-930 —— 记忆合规面(抹除 / 出处)上 core **已分类拒**的**唯一** HTTP 映射。两面同调:
+ *  · operator 面 `routes/memory-compliance.ts`(`POST /v1/memory/erase` · `GET /v1/memory/entries/:entryId/provenance`);
+ *  · 会话所有者自助抹除面 `routes/sessions.ts`(`POST /v1/sessions/:id/memory/erase`)。
+ *
+ * ## 病(sdk 车 SH 黑盒实证,S-930)
+ * 修前自助面在路由里自写了一份更窄的分类:只认 `config.memory_erasure_request`(400)与 `memory.target_outside_store`(409),
+ * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
+ * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
+ *
+ * ## 规则(三层,与 operator 面既有层序逐字同序)
+ *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
+ *  ② `memory.target_outside_store`(core 7.31.1 #1094 跨面 store 状态码)—— 409;
+ *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
+ *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
+ *
+ * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)
+ * core 原句是写给运维的诊断材料:② ③ 点名**宿主路径**(store 根、链解析到哪 / 控制面账本文件),① 的 `selector_mismatch` 带**首个请求的
+ * 选择子哈希**(`pinned set <selectHash>`,无盐 sha256 —— operator 选择子可字典还原,首个请求未必是这位会话所有者发的):
+ *  · operator 受众 ⇒ 原句上 wire(过了 operator 门,这些材料对这个受众不是泄露);
+ *  · 会话所有者受众 ⇒ **一律**一句固定指路(每码一句,只说「怎么办」),原句整句交 `withheld` 落运维 warn —— 不逐码判断哪句安全
+ *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② ③ 的固定句**两形都真**:
+ *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);
+ *    ③ 一码两义 —— 操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
+ *    都指路「运维修好后用同一个 requestId 重发」(两义下这句都对)。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
+ */
+import type { ServerResponse } from "node:http";
+/**
+ * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
+ * 清单跟着列)。两面同读(S-930:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
+ */
+/** 读这张映射的受众(闭集)。会话所有者受众必须交一只 `withheld` —— 被换成固定句的 core 原句落到那里(运维材料不许丢)。 */
+export type MemoryComplianceAudience = {
+    readonly kind: "operator";
+} | {
+    readonly kind: "session_owner";
+    readonly withheld: (coreMessage: string) => void;
+};
+/** 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。 */
+export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+//# sourceMappingURL=memory-compliance-failure-reply.d.ts.map

package/dist/http/memory-compliance-failure-reply.js

@@ -0,0 +1,73 @@
+import { ControlPlaneCorruptError } from "@sema-agent/core";
+import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
+import { sendError } from "./send.js";
+import { assertNever } from "./route-ctx.js";
+function sentCoreCode(res, coreCode, coreMessage, audience) {
+    switch (coreCode) {
+        case "config.memory_erasure_request":
+            sendError(res, 400, "config.memory_erasure_request", textFor(audience, coreMessage, "session memory erasure refused — the erasure request is not valid; correct it and resend"));
+            return true;
+        case "memory.erasure_evidence_unavailable":
+            sendError(res, 409, "memory.erasure_evidence_unavailable", textFor(audience, coreMessage, "session memory erasure refused — this deployment's memory store cannot produce erasure evidence; resend with allowUnevidenced: true to erase without evidence, or ask the operator"));
+            return true;
+        case "memory.erasure_selector_mismatch":
+            sendError(res, 409, "memory.erasure_selector_mismatch", textFor(audience, coreMessage, "session memory erasure refused — this requestId already names a different erasure; resend with a new requestId"));
+            return true;
+        case "memory.erasure_census_incomplete":
+            sendError(res, 409, "memory.erasure_census_incomplete", textFor(audience, coreMessage, "session memory erasure refused — the memory store could not be read completely, so nothing was erased and nothing was recorded; ask the operator to repair it, then resend with the same requestId"));
+            return true;
+        default:
+            return false;
+    }
+}
+function textFor(audience, coreMessage, ownerSentence) {
+    switch (audience.kind) {
+        case "operator":
+            return coreMessage;
+        case "session_owner":
+            audience.withheld(coreMessage);
+            return ownerSentence;
+        default:
+            return assertNever(audience);
+    }
+}
+function codeOf(err) {
+    if (!(err instanceof Error))
+        return undefined;
+    const { code } = err;
+    return typeof code === "string" ? code : undefined;
+}
+export function sentMemoryComplianceFailure(res, err, audience) {
+    const coreCode = codeOf(err);
+    if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
+        return true;
+    const outside = targetOutsideStoreOf(err);
+    if (outside !== undefined) {
+        switch (audience.kind) {
+            case "operator":
+                return sentMemoryStoreRefusal(res, err);
+            case "session_owner":
+                audience.withheld(outside.message);
+                sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                return true;
+            default:
+                return assertNever(audience);
+        }
+    }
+    if (err instanceof ControlPlaneCorruptError) {
+        switch (audience.kind) {
+            case "operator":
+                sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+                return true;
+            case "session_owner":
+                audience.withheld(err.message);
+                sendError(res, 500, "internal.memory_control_plane_corrupt", "session memory erasure could not be completed — this deployment's memory control plane could not be read cleanly (depending on where it stopped, either nothing was changed or the deletions were already committed and a replay finishes them); ask the operator to repair it, then resend with the same requestId");
+                return true;
+            default:
+                return assertNever(audience);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=memory-compliance-failure-reply.js.map

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,9 +1,9 @@
 /**
  * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
  * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
- * `routes/memory-compliance.ts`(出处 / 抹除)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
+ * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
- * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(`routes/sessions.ts`:同码、固定文案,见那里的注)。
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(S-930 起经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案)。
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
  * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
  *

package/dist/http/resume-legs.js

@@ -19,6 +19,7 @@ import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, par
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
+import { withModelReachScope } from "../model-reach-scope.js";
 import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
@@ -502,7 +503,7 @@ export function createResumeLegs(ctx) {
             await args.onResumeCommitted();
         let unregisterEngineNotice;
         try {
-            result = await withPrincipal(principal, async () => {
+            result = await withModelReachScope(sessionId, () => withPrincipal(principal, async () => {
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
                     const rs0 = deps.runStore;
@@ -871,7 +872,7 @@ export function createResumeLegs(ctx) {
                 return await (deps.sendUserFile && taskId
                     ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
                     : withElicitation());
-            });
+            }));
         }
         catch (e) {
             if (e instanceof CheckpointError) {