@sema-agent/server 7.106.0 → 7.108.0

package/dist/http/routes/capabilities.js

@@ -122,12 +122,10 @@ export async function handleCapabilities(req, res, match, ctx) {
                 subagentSteer: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
                 subagentResume: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
                 taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: deps.config.requirePrincipal !== true },
-                modeShellGateTranslation: true,
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
                     entitlementSource,
-                    intentArming: true,
                     ...autoMode,
                 },
                 readFace: deps.config.readFace ?? null,

package/dist/http/routes/diagnostics.js

@@ -1,6 +1,7 @@
 import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
@@ -106,6 +107,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
+                outbound: readOutboundWiring(),
                 configApply: deps.configApplyState?.() ?? null,
                 mcpRevocations: deps.mcpRevocationState?.() ?? null,
                 serverGates: buildServerWiringGates({

package/dist/http/routes/memory-compliance.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
-import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -11,40 +10,9 @@ const EraseRequestSchema = z.object({
     select: z.record(z.string(), z.unknown()),
     allowUnevidenced: z.boolean().optional(),
 });
-function sentCoreCode(res, coreCode, message) {
-    switch (coreCode) {
-        case "config.memory_erasure_request":
-            sendError(res, 400, "config.memory_erasure_request", message);
-            return true;
-        case "memory.erasure_evidence_unavailable":
-            sendError(res, 409, "memory.erasure_evidence_unavailable", message);
-            return true;
-        case "memory.erasure_selector_mismatch":
-            sendError(res, 409, "memory.erasure_selector_mismatch", message);
-            return true;
-        case "memory.erasure_census_incomplete":
-            sendError(res, 409, "memory.erasure_census_incomplete", message);
-            return true;
-        default:
-            return false;
-    }
-}
-function codeOf(err) {
-    if (!(err instanceof Error))
-        return undefined;
-    const { code } = err;
-    return typeof code === "string" ? code : undefined;
-}
 function sentClassifiedFailure(res, ctx, face, err) {
-    const coreCode = codeOf(err);
-    if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
+    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }))
         return true;
-    if (sentMemoryStoreRefusal(res, err))
-        return true;
-    if (err instanceof ControlPlaneCorruptError) {
-        sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
-        return true;
-    }
     ctx.deps.logger?.warn?.(`memory_compliance_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/sessions.js

@@ -4,7 +4,7 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
-import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
+import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
@@ -526,17 +526,9 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
-                const code = err.code;
-                if (code === "config.memory_erasure_request") {
-                    sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
+                const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
+                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }))
                     return;
-                }
-                const outside = targetOutsideStoreOf(err);
-                if (outside !== undefined) {
-                    deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: outside.message });
-                    sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
-                    return;
-                }
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
             }

package/dist/http/routes/side-query.js

@@ -3,7 +3,7 @@ import { HttpError } from "../../security.js";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
 import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { admitProviderEcho } from "../../observability/run-terminal.js";
+import { admitProviderEcho, redactErrorMessage } from "../../observability/run-terminal.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +35,11 @@ function shapeSideQueryEcho(result) {
     const { responseModel: _outOfShape, ...admitted } = result;
     return admitted;
 }
+function projectSideQueryResult(result) {
+    const shaped = shapeSideQueryEcho(result);
+    const redacted = redactErrorMessage(shaped.errorMessage);
+    return redacted === undefined || redacted === shaped.errorMessage ? shaped : { ...shaped, errorMessage: redacted };
+}
 export async function handleSideQuery(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
@@ -107,7 +112,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     deps.sideQueryAccounting?.(principal, { model: modelId, usage: rr.usage });
                     deps.metrics?.inc?.("side_query_total", { result: "ok" });
                     if (!res.writableEnded)
-                        sendJson(res, 200, shapeSideQueryEcho(result));
+                        sendJson(res, 200, projectSideQueryResult(result));
                 }
                 catch (e) {
                     deps.metrics?.inc?.("side_query_total", { result: "error" });

package/dist/http/routes/tasks.js

@@ -27,6 +27,7 @@ import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
+import { withModelReachScope } from "../../model-reach-scope.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -644,7 +645,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await (deps.sendUserFile
+                    await withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {

package/dist/memory-store-refusal.d.ts

@@ -8,7 +8,8 @@
  *
  * ## 两条到达车道,两个读者(本模块各给一只,别处不许再写第二份判据)
  *  ① **抛出面**(抹除 / 出处 / 外源列表 / 清标 / bundle 导出导入 —— 凡触 store 树的 backend 面):`.code` 就是码
- *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,一处字面量)。
+ *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
+ *     `http/memory-compliance-failure-reply.ts`(合规面两受众的那一只;会话所有者受众换固定句,S-930)。
  *  ② **报告面**(harvest `incident`):core 契约写明 report 车道上码**只在文本里** —— `sidecar_corrupt` 的 detail 恰两种形
  *     `memory commit refused: memory.target_outside_store: …` / `memory control plane refused: memory.target_outside_store: …`
  *     (core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字)⇒ {@link targetOutsideStoreInIncident} 只认**这两个 lead 紧跟码**

package/dist/model-entry-headers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * 白名单 = 名字 → 读它的线路(闭集;**加一个名字 = 加一行并写明哪条线路读它、为什么是部署的事**)。
+ * `anthropic-beta`:Anthropic Messages 的 beta 开关(逗号分隔的 beta 名;core anthropic 腿会把自己的 beta 并进同一个头)。
+ */
+export declare const CATALOG_ENTRY_HEADER_LANES: {
+    readonly "anthropic-beta": readonly ["anthropic-messages"];
+};
+export type CatalogEntryHeaderName = keyof typeof CATALOG_ENTRY_HEADER_LANES;
+export declare const CATALOG_ENTRY_HEADER_NAMES: readonly CatalogEntryHeaderName[];
+/** 判过的袋(只含白名单里的名字,值逐字)。 */
+export type CatalogEntryHeaders = Readonly<Partial<Record<CatalogEntryHeaderName, string>>>;
+/** 值的长度上界(字符)。`anthropic-beta` 的真实值是几枚逗号分隔的 beta 名,远在此下;上界只挡「把别的东西塞进来」。 */
+export declare const MAX_HEADER_VALUE_CHARS = 1024;
+/**
+ * 拒因 / warn 里名字的回显尺:token 形、≤64、且脱敏器不改它 ⇒ 照写;否则固定占位(名字位也可能被塞进秘密,值更是从不回显)。
+ */
+export declare function displayHeaderName(name: string): string;
+/** 判决:`ok` ⇒ 判过的袋(`undefined` = 条目没声明任何头:缺席与 `{}` 同一个读法,都不铸键);否则 ⇒ 坏字段坐标 + 一句不带值的理由。 */
+export type CatalogEntryHeadersVerdict = {
+    readonly ok: true;
+    readonly headers: CatalogEntryHeaders | undefined;
+} | {
+    readonly ok: false;
+    readonly fields: readonly string[];
+    readonly issue: string;
+};
+/**
+ * **唯一判据**:条目的 `headers` 原值(`unknown`:承载形,不信类型)+ 条目的线路词原值(`api`;两条读腿恒补齐它,
+ * 绕过读腿的输入缺它 ⇒ 按「没有线路读它」拒 —— 判据与铸点读同一个原值,不另补一份 schema 缺省)。
+ * 整只判:任一名字 / 值不合 ⇒ 整只不收(留下好的那几个 = 让运维以为整袋生效了)。坏字段逐个列出(`headers.<名>`)。
+ */
+export declare function readCatalogEntryHeaders(raw: unknown, api: unknown): CatalogEntryHeadersVerdict;
+/**
+ * **唯一铸点**(`toModel` 调):判过的袋 → `Model.headers` 的键。缺席 ⇒ 不铸键(一个 `undefined` 值的键也不铸:
+ * 缺席只有一种拼法)。判不过 ⇒ **抛**:到这里的条目已经过 S-704 逐条判据(判不过的进 `modelRefusals`、到不了 `toModel`),
+ * 抛 = 两处判据分叉了,stage 整候选拒、响亮,不静默丢头。
+ */
+export declare function buildModelHeadersKey(entryName: string, raw: unknown, api: unknown): {
+    headers?: Record<string, string>;
+};
+//# sourceMappingURL=model-entry-headers.d.ts.map

package/dist/model-entry-headers.js

@@ -0,0 +1,61 @@
+import { redactSecrets } from "./trace/redact.js";
+export const CATALOG_ENTRY_HEADER_LANES = {
+    "anthropic-beta": ["anthropic-messages"],
+};
+export const CATALOG_ENTRY_HEADER_NAMES = Object.keys(CATALOG_ENTRY_HEADER_LANES);
+export const MAX_HEADER_VALUE_CHARS = 1024;
+const HEADER_VALUE_SHAPE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
+const HEADER_NAME_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
+export function displayHeaderName(name) {
+    return HEADER_NAME_TOKEN.test(name) && redactSecrets(name) === name ? name : "(unprintable header name)";
+}
+function isCatalogEntryHeaderName(name) {
+    return Object.hasOwn(CATALOG_ENTRY_HEADER_LANES, name);
+}
+export function readCatalogEntryHeaders(raw, api) {
+    if (raw === undefined)
+        return { ok: true, headers: undefined };
+    const proto = typeof raw === "object" && raw !== null ? Object.getPrototypeOf(raw) : undefined;
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw) || (proto !== Object.prototype && proto !== null)) {
+        return { ok: false, fields: ["headers"], issue: `headers: expected a plain object of { <header name>: <value> } (allowed names: ${CATALOG_ENTRY_HEADER_NAMES.join(", ")})` };
+    }
+    const fields = [];
+    const issues = [];
+    const bag = {};
+    for (const name of Object.keys(raw)) {
+        const shown = displayHeaderName(name);
+        const field = `headers.${shown}`;
+        const value = Reflect.get(raw, name);
+        if (!isCatalogEntryHeaderName(name)) {
+            const canonical = CATALOG_ENTRY_HEADER_NAMES.find((n) => n === name.toLowerCase());
+            fields.push(field);
+            issues.push(canonical !== undefined
+                ? `${field}: write the header name in its canonical spelling "${canonical}" (one spelling per header)`
+                : `${field}: not in the closed allowlist of catalog request headers (${CATALOG_ENTRY_HEADER_NAMES.join(", ")}); credentials ride sealedApiKey / apiKeyEnv, never a header`);
+            continue;
+        }
+        const lanes = CATALOG_ENTRY_HEADER_LANES[name];
+        if (typeof api !== "string" || !lanes.includes(api)) {
+            fields.push(field);
+            issues.push(`${field}: only read on the ${lanes.join(" / ")} lane — this entry ${typeof api === "string" ? `is api "${api}"` : "declares no api"}, where the header would be sent and do nothing`);
+            continue;
+        }
+        if (typeof value !== "string" || value.length > MAX_HEADER_VALUE_CHARS || !HEADER_VALUE_SHAPE.test(value)) {
+            fields.push(field);
+            issues.push(`${field}: the value must be a non-empty string of visible ASCII (spaces only between words, at most ${MAX_HEADER_VALUE_CHARS} characters)`);
+            continue;
+        }
+        bag[name] = value;
+    }
+    if (fields.length > 0)
+        return { ok: false, fields: [...new Set(fields)], issue: issues.join("; ") };
+    return { ok: true, headers: Object.keys(bag).length > 0 ? bag : undefined };
+}
+export function buildModelHeadersKey(entryName, raw, api) {
+    const verdict = readCatalogEntryHeaders(raw, api);
+    if (!verdict.ok) {
+        throw new Error(`catalog entry "${entryName}" reached the Model mint with unjudged headers (${verdict.fields.join(", ")}) — judgeCatalogEntry must refuse it first; this is a server defect, not a config error`);
+    }
+    return verdict.headers === undefined ? {} : { headers: { ...verdict.headers } };
+}
+//# sourceMappingURL=model-entry-headers.js.map

package/dist/model-entry-refusal.d.ts

@@ -43,9 +43,15 @@ export interface CatalogEntryLike {
     readonly name: string;
     readonly id: string;
     readonly provider: string;
+    /** S-931:线路词(`headers` 的线路判据读它;原值,不信这张型)。 */
+    readonly api?: unknown;
+    /** S-931:供应商附加头的承载形(`unknown`:判据在 `model-entry-headers.ts`,不信这张型)。 */
+    readonly headers?: unknown;
 }
 /**
  * **逐条判据**:`undefined` = 本部署能完整服务它。判序即语义:先形(不合形的条目谈不上走哪条腿),再腿。
+ * 形分两段、同一个码(`config.model_entry_invalid`):settings-schema 的 `ModelEntry`,再是 S-931 的 `headers`(白名单 + 线路 + 值形,
+ * 判据单属主 `model-entry-headers.ts`;settings-schema 6.3.0 的 `ModelEntry` 还没有这个键 —— 候裁加字段,届时词表不另抄)。
  *
  * 形判的属主是 settings-schema 的 `ModelEntry`(两条读腿用的就是它)—— 本仓不手抄任何一条字段规则;这里只是
  * 在第二道边界(绕过读腿的输入)上**再问一次同一个属主**,并把答案变成一条带码的拒因。只取 `success` 与 issue

package/dist/model-entry-refusal.js

@@ -1,6 +1,7 @@
 import { CC_MODEL_TIER_ALIASES, DEFAULT_TIER_ORDER, expandTiers } from "@sema-agent/core";
 import { ModelEntry, isReportableRefusalName } from "@sema-agent/settings-schema";
 import { catalogBrainLane } from "./model-provider.js";
+import { readCatalogEntryHeaders } from "./model-entry-headers.js";
 import { describeSchemaIssueFields, describeSchemaIssues } from "./config-center/read-warnings.js";
 import { DEFAULT_MODEL_REF } from "./model-select.js";
 export const ENTRY_REFUSAL_REASON_OF = {
@@ -26,6 +27,9 @@ export function judgeCatalogEntry(m, ctx) {
         const fields = describeSchemaIssueFields(shape.error);
         return entryInvalidRefusal(typeof m.id === "string" ? m.id : "", typeof m.provider === "string" ? m.provider : "", fields, describeSchemaIssues(shape.error) ?? fields.join(", "));
     }
+    const headers = readCatalogEntryHeaders(m.headers, m.api);
+    if (!headers.ok)
+        return entryInvalidRefusal(m.id, m.provider, headers.fields, headers.issue);
     const lane = catalogBrainLane(m.provider);
     const mount = laneMount(lane, ctx);
     if (!mount.mounted) {

package/dist/model-reach-scope.d.ts

@@ -0,0 +1,55 @@
+/**
+ * S-925(7.108.0)—— 「这次模型调用的每一次出网尝试落在哪」的**异步作用域**(叶:只引 node 与类型)。
+ *
+ * 两层,一只 `AsyncLocalStorage`:
+ *  · **腿层**(`withModelReachScope`,三条带用户面投递口的 run 腿各包一次:流式 `POST /v1/tasks/stream`、后台 `POST /v1/runs`、续跑):
+ *    带着这条腿的 `sessionId`(通告归属键)与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);
+ *  · **调用层**(`createModelReachBrain` 每次模型调用包一次):一只可变的 {@link ModelCallReach},出网观察者
+ *    (`outbound-dispatcher.ts` 的 undici 诊断通道订阅)把这次调用发出的每一条请求的**结局**记在上面 —— 最后一条是
+ *    「连上了、有了回答」还是「建连就失败了」。
+ *
+ * 为什么是 ALS 而不是参数:模型调用的出网发生在 core 的 brain 里(`fetch` → 全局 dispatcher → undici),本仓在那条链上没有任何
+ * 参数座;undici 的 `undici:request:create` 通道在创建请求的那一拍同步发布、就在发起 `fetch` 的异步上下文里 —— 读 ALS 就知道
+ * 「这条请求属于哪一次模型调用」,不靠目标主机 + 时间去猜(那是把相关写成因果)。
+ * 作用域外(side-query、记忆整理、工具自己的出网 …)⇒ 没有腿层 ⇒ 只有运维日志,没有用户通告。
+ * 腿里的**辅助**模型调用(WebFetch 摘要器、压实、提示建议、分类器 …)与主循环**同一条规则**:通告说的是「这个模型端点够不着」,
+ * 不是「这条 run 失败了」—— 不设豁免名单(codex r1 / r2:豁免名单结构上开放,core 自己发起的辅助调用本仓包不到,列不全)。
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { OutboundConnectFailure } from "./outbound-dispatcher.js";
+/** 一条请求的结局(观察者按到达顺序覆盖写;模型调用终态时读**最后一条**)。 */
+export type ModelCallOutcome = {
+    readonly kind: "reached";
+} | {
+    readonly kind: "connect_failed";
+    readonly failure: OutboundConnectFailure;
+} | {
+    readonly kind: "other";
+};
+/** 一次模型调用的出网观察(可变:观察者写、装饰器读)。 */
+export interface ModelCallReach {
+    last?: ModelCallOutcome;
+}
+/** 一条 run 腿的作用域。 */
+export interface ModelReachLegScope {
+    readonly sessionId: string;
+    /** 本腿已经通告过的目标(`targetHost`)—— 去重单位 = 每腿每目标一次。 */
+    readonly announced: Set<string>;
+}
+export interface ModelReachStore {
+    readonly leg?: ModelReachLegScope;
+    readonly call?: ModelCallReach;
+}
+export declare const modelReachContext: AsyncLocalStorage<ModelReachStore>;
+/**
+ * 腿层入口:每条腿都开**自己的**作用域 —— `sessionId` 缺席(无会话腿)⇒ 空作用域(没有归属键就没有用户面可投;也不继承外层腿的
+ * 归属键 —— codex r1 旁注:修前缺席即原样执行、会沿用外层腿)。嵌套时内层覆盖外层 —— 归属跟着「这一轮是谁的腿」走。
+ */
+export declare function withModelReachScope<T>(sessionId: string | undefined, fn: () => T): T;
+/** 调用层入口(`createModelReachBrain` 用):在当前腿作用域(可能缺席)之上开一只新的调用观察。 */
+export declare function withModelCallReach<T>(call: ModelCallReach, fn: () => T): T;
+/** 观察者读口:当前异步上下文里的模型调用观察(作用域外 ⇒ `undefined`)。 */
+export declare function currentModelCallReach(): ModelCallReach | undefined;
+/** 装饰器读口:当前腿(作用域外 ⇒ `undefined`)。 */
+export declare function currentModelReachLeg(): ModelReachLegScope | undefined;
+//# sourceMappingURL=model-reach-scope.d.ts.map

package/dist/model-reach-scope.js

@@ -0,0 +1,16 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+export const modelReachContext = new AsyncLocalStorage();
+export function withModelReachScope(sessionId, fn) {
+    return modelReachContext.run(sessionId === undefined || sessionId.length === 0 ? {} : { leg: { sessionId, announced: new Set() } }, fn);
+}
+export function withModelCallReach(call, fn) {
+    const outer = modelReachContext.getStore();
+    return modelReachContext.run({ ...(outer?.leg !== undefined ? { leg: outer.leg } : {}), call }, fn);
+}
+export function currentModelCallReach() {
+    return modelReachContext.getStore()?.call;
+}
+export function currentModelReachLeg() {
+    return modelReachContext.getStore()?.leg;
+}
+//# sourceMappingURL=model-reach-scope.js.map

package/dist/model-unreachable-notice.d.ts

@@ -0,0 +1,38 @@
+/**
+ * S-925(7.108.0;test [ref] ② 用户报案分诊,验收 `srv7108-s925-connect-timeout-diagnostic`)—— **模型调用因建连失败终态**时
+ * 给这条腿的用户铸的通告 `server.model_unreachable` 的**唯一铸点**,与把它挂到每一次模型调用上的 brain 装饰器。
+ *
+ * ## 病
+ * 运营用户看不到日志 / 诊断面:VPN 中途切换之后模型网关建连超时,用户只拿到一句 undici 原句(`fetch failed (connect …)`),
+ * 分不清是网络断了还是起服时读进的代理已经失效,也没有「查 VPN / 代理、代理变过就重启」这条出路。只落运维日志不算闭环
+ * (test 立案原话)。core 没有现成的「模型不可达」用户通告码(`ENGINE_NOTICE_CODES` 亲查零命中)⇒ 本仓自铸,走既有的
+ * `SERVER_NOTICE_AUDIENCE` 族(S-690 形:白名单 / 归属 / 消毒 / 隔离四件判据一个不绕),不开第二条通道。
+ *
+ * ## 判据(一句):**这一次模型调用的终局是 `stopReason: "error"`,且它发出的最后一条请求在建连时就失败了**
+ * 「最后一条请求落在哪」由出网观察者记在调用作用域上(`model-reach-scope.ts`,undici 诊断通道,见 `outbound-dispatcher.ts`)——
+ * 不按目标主机 + 时间去猜。于是:
+ *  · 服务商回了 5xx / 4xx(收到了响应头)⇒ 最后一条是 `reached` ⇒ 不铸(那是服务商的回答);
+ *  · 建连失败、重试之后连上了并成功 ⇒ 终局不是 error ⇒ 不铸;
+ *  · 中途断流 / TLS / 主动取消 / 首字节超时 ⇒ 最后一条是 `other` ⇒ 不铸(判不出「够不着」)。
+ *
+ * ## 投递 / 去重
+ * 归属键 = 这条 run 腿的 `sessionId`(腿层作用域,三条带用户面投递口的腿各包一次)。作用域外的模型调用(side-query、记忆整理 …)
+ * 没有归属键 ⇒ 不铸(运维日志 `outbound_connect_failed` 照有)。腿里的**辅助**调用(WebFetch 摘要器、压实、提示建议、分类器 …)与
+ * 主循环**同一条规则**:本帧说的是「这个模型端点够不着」,不是「这条 run 失败了」(措辞如此,不暗示终态);不设豁免名单 —— codex r1 / r2
+ * 两轮证明豁免名单结构上开放(core 自己发起的辅助调用本仓包不到)。按 **run 终态**归属是另一种设计,候裁(收车档 ⑤)。去重单位 = **每腿每目标一次**(同一条腿里
+ * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId }` ——
+ * `proxyInUse` 只在这一跳走了代理时在场,且只是**变量名**(代理地址是基础设施细节,不上租户 wire,与 `OutboundProxyError` 的
+ * F3 裁定同一条)。`targetHost`(模型端点的 `host:port`)对 user 受众是**新披露的部署事实**(F7 裁定:它是部署自己声明的模型端点,
+ * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下 core 终局句展开到代理根因、不含模型主机,
+ * 辅助调用形下 run 可 completed、租户面本无主机句。
+ */
+import type { Brain } from "@sema-agent/core";
+import { type EngineNoticeRouter } from "./trace/engine-notice-wire.js";
+/**
+ * `create*`:包在 `createBrain` 装好的那只 brain **最外层**(路由 / 切备 / 断路器 / 降级全在里面 ⇒「这次调用」= 调用方看到的那一次,
+ * 重试与切备都在同一个调用作用域里)。每次调用开一只新的调用观察;腿层作用域在**发起调用那一拍**读(之后的回调在别的上下文里)。
+ * 不改流、不改消息、不改错误:只在终局 promise 上挂一个观察。
+ * 形 = 同型 `Proxy`:表里 `observed` 的成员(内层有它才有)换成观察器;其余成员逐字转给内层、方法绑内层(`this` 不漂)。
+ */
+export declare function createModelReachBrain(inner: Brain, router?: EngineNoticeRouter): Brain;
+//# sourceMappingURL=model-unreachable-notice.d.ts.map

package/dist/model-unreachable-notice.js

@@ -0,0 +1,72 @@
+import { currentModelReachLeg, withModelCallReach } from "./model-reach-scope.js";
+import { defaultEngineNoticeRouter } from "./trace/engine-notice-wire.js";
+const SERVER_MODEL_UNREACHABLE = "server.model_unreachable";
+const MODEL_UNREACHABLE_REMEDY = "check VPN / proxy; restart if the proxy changed since boot";
+function announceModelUnreachable(leg, failure, router = defaultEngineNoticeRouter) {
+    if (leg.announced.has(failure.targetHost))
+        return;
+    leg.announced.add(failure.targetHost);
+    const via = failure.proxyInUse !== null ? ` through the proxy from ${failure.proxyInUse}` : "";
+    router.route({
+        code: SERVER_MODEL_UNREACHABLE,
+        message: `The model endpoint could not be reached: the connection to ${failure.targetHost}${via} failed (${failure.code}). ` +
+            "Check the VPN / proxy; if the proxy changed since the server started, restart it (proxy settings are read once at startup).",
+        detail: {
+            code: failure.code,
+            targetHost: failure.targetHost,
+            ...(failure.proxyInUse !== null ? { proxyInUse: failure.proxyInUse } : {}),
+            remedy: MODEL_UNREACHABLE_REMEDY,
+            sessionId: leg.sessionId,
+        },
+        sessionId: leg.sessionId,
+    });
+}
+const isThenable = (v) => typeof v.then === "function";
+function settle(leg, call, message, router) {
+    if (leg === undefined || message.stopReason !== "error")
+        return;
+    const last = call.last;
+    if (last?.kind === "connect_failed")
+        announceModelUnreachable(leg, last.failure, router);
+}
+const BRAIN_MEMBER_TREATMENT = {
+    stream: "observed",
+    complete: "observed",
+    adjudicateRoute: "forwarded",
+};
+export function createModelReachBrain(inner, router = defaultEngineNoticeRouter) {
+    const observe = (leg, call, final) => {
+        void final.then((message) => settle(leg, call, message, router), () => undefined);
+    };
+    const MEMBER_OBSERVERS = {
+        stream: (innerStream) => (model, context, options) => {
+            const leg = currentModelReachLeg();
+            const call = {};
+            const s = withModelCallReach(call, () => innerStream.call(inner, model, context, options));
+            if (isThenable(s))
+                observe(leg, call, Promise.resolve(s).then((st) => st.result()));
+            else
+                observe(leg, call, s.result());
+            return s;
+        },
+        complete: (innerComplete) => (model, context, options) => {
+            const leg = currentModelReachLeg();
+            const call = {};
+            const p = withModelCallReach(call, () => innerComplete.call(inner, model, context, options));
+            observe(leg, call, p);
+            return p;
+        },
+    };
+    const observedStream = MEMBER_OBSERVERS.stream(inner.stream);
+    const observedComplete = inner.complete !== undefined ? MEMBER_OBSERVERS.complete(inner.complete) : undefined;
+    const observed = { stream: observedStream, complete: observedComplete };
+    return new Proxy(inner, {
+        get(target, prop) {
+            if (typeof prop === "string" && Object.hasOwn(observed, prop))
+                return Reflect.get(observed, prop);
+            const v = Reflect.get(target, prop, target);
+            return typeof v === "function" ? v.bind(target) : v;
+        },
+    });
+}
+//# sourceMappingURL=model-unreachable-notice.js.map

package/dist/observability/fail-open.d.ts

@@ -321,6 +321,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
     };
+    readonly "server.outbound.connect-observer-threw": {
+        readonly cls: "F";
+        readonly note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -294,6 +294,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
     },
+    "server.outbound.connect-observer-threw": {
+        cls: "F",
+        note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/observability/run-terminal.d.ts

@@ -130,14 +130,17 @@ export declare function redactModelText(raw: string): string;
  *
  * **回声字段是什么**:模型服务商(上游模型 API / 中间网关)在响应里给、引擎**逐字转交**的不透明标识 ——
  * `apiFailure.requestId`(响应头 `request-id` / `x-request-id`,core `brain/errors.js` 的 `readProviderRequestId`)、
- * `responseModel`(服务商自报的模型名,与账本 `turn_end.responseModel` 是孪生)、工具调用 id(`strandedHumanAnswers[].toolCallId` /
- * `stats.humanReview.gates[].toolCallId`;core `brain/openai.js` / `brain/anthropic.js` 取 `tc.id` / `cb.id`,只在缺席时
- * `mintFallbackToolCallId` 自铸兜底)。字节由**部署方接的那个端点**决定,本栈一个都没铸 ⇒ **不可信**。
+ * `responseModel`(服务商自报的模型名,与账本 `turn_end.responseModel` 是孪生)。字节由**部署方接的那个端点**决定,本栈一个都没铸 ⇒ **不可信**。
+ * 工具调用 id(`strandedHumanAnswers[].toolCallId` / `stats.humanReview.gates[].toolCallId`)**出身**同样是服务商,但自 core 7.36.0(#1207)起
+ * 它进引擎之前已**准入一次**:三只 brain 在建调用的那一行(`brain/tool-call-id.js` 的 `admitToolCallId`)—— 缺席 ⇒ 车道兜底铸;
+ * 在形(可见 ASCII 1–128 且不含 `~`)⇒ 原样;越界 ⇒ 单射折叠成引擎 id(`<前 32 码元,越界字符记 `-`>~<sha256 前 32 hex>`),原字节只挂在
+ * 转录的 `ToolCall.wireId` 上、只回给 provider。⇒ 一方 brain 在 7.107.0 起新铸的调用,到达本仓任何一张脸的 `toolCallId` 恒在形。
+ * 残余两条(S-921,如实):① ≤7.106.0 写下的存量行(待批 park 行 `boundCallId` / 检查点 `pendingAction.toolCallId` / 转录)是服务商原串逐字 —— 新版不对存量行二次准入(e2e G4 钉);② 宿主自己的 `Brain`(不经三只一方 adapter)铸的 id 不准入(core KL-1207-a;本仓生产装配的 brain 恒是 `createBrain` 的一方 adapter 外套委托装饰,这一形只经嵌入 / 测试注入的 brain 到达)。两条残余里的 id 仍是跨面 join 键、每张脸同值,只是形状不保证(本闸照旧不动它们:动一张脸 = join 断)。
  *
  * 🔴 **本闸只施加在「这个值出现的每一张脸都被覆盖到」的回声上**(codex r1 F1,实测成立的回归后改判):工具调用 id 是
  * **跨面 join 键** —— 同一枚 id 同时逐字出现在 `tool_start` / `tool_end` / 审批卡等逐帧面上。只在结果面动它 ⇒ 结果面与逐帧面
- * join 不上。所以它的处置词是 `"provider-join-key"`:信任类仍是 provider 回声,但形状闸只能在**全部面的共同入口**一次施加
- * (独立一车,已登记为债),本面逐字。`requestId` / `responseModel` 的每一张脸(结果面四处 + 账本孪生 + 子代通告 + `POST /v1/side-query` 200 体的 `responseModel`,
+ * join 不上。所以它的处置词是 `"provider-join-key"`:出身是 provider,形状在**全部面的共同入口一次施加** —— 那个入口就是上面那条
+ * core brain 准入(S-890 v1 / v2 小稿提给 core、#1207 落地;本仓零闸,不加第二道门),本面逐字 = 每张脸同一枚引擎 id,join 成立。`requestId` / `responseModel` 的每一张脸(结果面四处 + 账本孪生 + 子代通告 + `POST /v1/side-query` 200 体的 `responseModel`,
  * 后者 7.105.0 合并复审 X1 补上 —— `http/routes/side-query.ts` 的 `shapeSideQueryEcho`)本闸都覆盖到了。
  *
  * **只做形状校验,不过脱敏器**(本车裁,与 S-270 / clay [ref] ② 的 `structuredOutput` 逐字回声面同一方向):回声值