@sema-agent/server 7.107.0 → 7.108.0

package/dist/boot/stage-06-runners.d.ts

@@ -14,6 +14,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-06-runners.js

@@ -13,6 +13,7 @@ import { buildConsolidationValveAudit, createMemoryConsolidationFaces, resolveCo
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
+import { createParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
 import { createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
@@ -22,8 +23,11 @@ import { parkedAskRedeem, runStore } from "./late-binds.js";
 export function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, sessionIncarnationOf, config, configCenter, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
+    const checkpointStore = parkCommitted?.store;
+    const parkCommits = parkCommitted?.watch;
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, approvalAskAudit, approvalExemptionStore, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
-        config, logger, backend, sendUserFileTaskEnvs, ruleConsent,
+        config, logger, backend, sendUserFileTaskEnvs, ruleConsent, parkCommits,
         getParkedRedeem: () => parkedAskRedeem,
         ruleScopeRootFor: (sessionId) => cardRuleScopeRoot(sessionId !== undefined ? perSessionCwd.get(sessionId) : undefined, config),
     });
@@ -40,7 +44,6 @@ export function runStage06(ctx) {
         logger.info("shared_memory_stores_enabled", { backend: backend?.kind });
     const runnerOffloadStore = toolResultStore ?? new InMemoryToolResultStore({ maxTotalChars: 64_000_000 });
     const commitHands = config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined;
-    const checkpointStore = backend?.checkpoint && config.durableApproval ? backend.checkpoint(logger) : undefined;
     const retentionExecutor = backend?.retention?.({ taskAttachmentTable: taskAttachmentStore !== undefined, taskListTables: taskListLane.backend !== "memory", logger });
     const retentionLaneStore = backend?.retentionLane?.();
     assertRetentionLaneWirable({
@@ -202,6 +205,6 @@ export function runStage06(ctx) {
     };
     const subRunner = new Runner(subRunnerDeps);
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -27,6 +27,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-08-reapers.d.ts

@@ -40,6 +40,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-09-leader.d.ts

@@ -76,6 +76,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-10-http-server.d.ts

@@ -76,6 +76,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    parkCommits: import("../plugins/park-commit-watch.js").ParkCommitWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;

package/dist/boot/stage-10-http-server.js

@@ -26,7 +26,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, configCenter, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -303,6 +303,8 @@ export async function runStage10(ctx) {
         version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,
         storeLiveProbe, configCenter,
+        toolApproval,
+        parkCommits,
         deviceHub: deviceLane?.hub,
         retentionLane: retentionLaneStarted,
         releaseRetentionLease: retentionLaneStore !== undefined ? () => retentionLaneStore.release(instanceId) : undefined,

package/dist/brain.js

@@ -8,6 +8,7 @@ import { dispatchBrainLane } from "./model-provider.js";
 import { openaiRouteBaseUrl } from "./model-route-endpoint.js";
 import { catalogEntryFingerprint } from "./config-center/restart-signal.js";
 import { buildDisplaySafeRefusal, buildDisplaySafeUrl } from "./trace/redact.js";
+import { createModelReachBrain } from "./model-unreachable-notice.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -138,7 +139,7 @@ export function createBrain(config, deps = {}) {
             });
         }
     }
-    return brain;
+    return createModelReachBrain(brain);
 }
 export function degradeTargetOf(config) {
     return config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;

package/dist/config-center/apply-effective.js

@@ -2,6 +2,7 @@ import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
 import { applyAutoCompactWindow, buildModelCostKey, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
+import { buildModelHeadersKey } from "../model-entry-headers.js";
 import { validateCommandRules } from "../runtime-governance.js";
 import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
 import { stageLimits } from "./stage-limits.js";
@@ -50,6 +51,7 @@ function toModel(m, envDefaults = {}, logger) {
         ...(compat ? { compat } : {}),
         ...(m.extraBody ? { extraBody: m.extraBody } : {}),
         ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
+        ...buildModelHeadersKey(m.name, m.headers, m.api),
     };
     const explicitAct = m.autoCompactTokens;
     applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);

package/dist/config-center/types.d.ts

@@ -82,6 +82,13 @@ export interface CenterModel {
      *  configured sentences parse fine in registry-core but never reach the assembly face ([ref]① 排雷:
      *  the missing leg made every promptGuidance pilot a false control). */
     promptGuidance?: string[];
+    /**
+     * S-931(7.108.0)—— 这条条目发给供应商的**附加请求头**(部署 ↔ 供应商的契约;今天只有 `anthropic-beta`),上 core 的 per-model
+     * 头座 `Model.headers`。类型是 `unknown` 而不是那个结构,理由与 {@link CenterModel.compat} 逐字同:本类型是承载形,判据(闭集白名单 +
+     * 线路 + 值形)与坏形处置的单一属主是 `model-entry-headers.ts`(执法点 = S-704 逐条判据,判不过 ⇒ 条目不可用)。
+     * ⚠️ 两条读腿今天**剥掉**它(settings-schema 6.3.0 `ModelEntry` 无此键;候裁加字段):今天到得了这里的只有绕过读腿的输入。
+     */
+    headers?: unknown;
     enabled?: boolean;
 }
 export type CenterRoleTarget = {

package/dist/deployment-governance.js

@@ -2,12 +2,13 @@ import { join, posix } from "node:path";
 import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy, hasApprovalListIntent } from "./approval.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
+import { heldRuleName } from "./tool-rule-names.js";
 export function createDurableQuestionGate(live) {
     if (live === undefined)
         return createDurableQuestionPolicy();
     return {
         check(req) {
-            if (req.toolName !== ASK_USER_QUESTION_TOOL_NAME)
+            if (heldRuleName(req, (n) => n === ASK_USER_QUESTION_TOOL_NAME) === undefined)
                 return { action: "allow" };
             return live.hasLiveContext()
                 ? { action: "allow" }

package/dist/fleet-client.d.ts

@@ -102,8 +102,16 @@ export interface FleetClient {
     /** Immediate out-of-cycle announce — call when a self-reported input flips (draining: self-remove from routing FIRST;
      *  roster landed: become routable without waiting a heartbeat; restart signal changed: S-741). */
     announceNow: () => Promise<void>;
-    /** Stop timers + best-effort DELETE deregistration (bounded; never throws). */
-    stop: () => Promise<void>;
+    /**
+     * **路由面**停:停心跳、等在飞公告排空、best-effort DELETE 注销(各请求有界;从不抛)。之后的 `announceNow` 是空操作。
+     * 收尾链在 hardShutdown **起点**调(与 7.107.0 同序 —— 退出中的副本第一时间离开中心的路由表)。
+     */
+    stopRouting: () => Promise<void>;
+    /**
+     * **记账面**停:停用量窗定时器、上报最后一个(可能不满的)用量窗(有界;从不抛;空窗不发)。与路由面无关(不公告的引擎也报用量)。
+     * 收尾链排在**排空等待之后**调(S-929 F12:宽限窗里跑完的腿记下的用量必须进这一窗)。
+     */
+    flushFinalUsage: () => Promise<void>;
 }
 /**
  * Start the worker-side fleet loops. Caller has already gated on the center lane (startFleetClientFromEnv below).

package/dist/fleet-client.js

@@ -161,19 +161,16 @@ export function startFleetClient(opts) {
     hb?.unref?.();
     const uw = opts.usage ? setInterval(() => void flushUsage(), usageWindowMs) : undefined;
     uw?.unref?.();
-    let stopping = false;
-    const stop = async () => {
-        if (stopping)
+    let routingStopping = false;
+    const stopRouting = async () => {
+        if (routingStopping)
             return;
-        stopping = true;
+        routingStopping = true;
         if (hb)
             clearInterval(hb);
-        if (uw)
-            clearInterval(uw);
         while (inFlight !== undefined)
             await inFlight;
         stopped = true;
-        await flushUsage();
         if (!announcing)
             return;
         try {
@@ -182,7 +179,16 @@ export function startFleetClient(opts) {
         catch {
         }
     };
-    return { announceNow, stop };
+    let usageStopping = false;
+    const flushFinalUsage = async () => {
+        if (usageStopping)
+            return;
+        usageStopping = true;
+        if (uw)
+            clearInterval(uw);
+        await flushUsage();
+    };
+    return { announceNow, stopRouting, flushFinalUsage };
 }
 export function startFleetClientFromEnv(cfg, opts) {
     const cc = cfg.configCenter;

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -0,0 +1,41 @@
+/**
+ * S-930 —— 记忆合规面(抹除 / 出处)上 core **已分类拒**的**唯一** HTTP 映射。两面同调:
+ *  · operator 面 `routes/memory-compliance.ts`(`POST /v1/memory/erase` · `GET /v1/memory/entries/:entryId/provenance`);
+ *  · 会话所有者自助抹除面 `routes/sessions.ts`(`POST /v1/sessions/:id/memory/erase`)。
+ *
+ * ## 病(sdk 车 SH 黑盒实证,S-930)
+ * 修前自助面在路由里自写了一份更窄的分类:只认 `config.memory_erasure_request`(400)与 `memory.target_outside_store`(409),
+ * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
+ * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
+ *
+ * ## 规则(三层,与 operator 面既有层序逐字同序)
+ *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
+ *  ② `memory.target_outside_store`(core 7.31.1 #1094 跨面 store 状态码)—— 409;
+ *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
+ *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
+ *
+ * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)
+ * core 原句是写给运维的诊断材料:② ③ 点名**宿主路径**(store 根、链解析到哪 / 控制面账本文件),① 的 `selector_mismatch` 带**首个请求的
+ * 选择子哈希**(`pinned set <selectHash>`,无盐 sha256 —— operator 选择子可字典还原,首个请求未必是这位会话所有者发的):
+ *  · operator 受众 ⇒ 原句上 wire(过了 operator 门,这些材料对这个受众不是泄露);
+ *  · 会话所有者受众 ⇒ **一律**一句固定指路(每码一句,只说「怎么办」),原句整句交 `withheld` 落运维 warn —— 不逐码判断哪句安全
+ *    (逐码挑 = core 改一句文案就可能静默漏出一样新东西)。② ③ 的固定句**两形都真**:
+ *    ② 链先于请求在场 ⇒ 提交点之前拒、什么都没做;提交点之后才换上的链 ⇒ 已删的几条算数、journal 留盘(codex 一审 C1);
+ *    ③ 一码两义 —— 操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
+ *    都指路「运维修好后用同一个 requestId 重发」(两义下这句都对)。本层**不**嗅 core 文案分辨前后(拿上游自由文本当判别式是第二真源)。
+ */
+import type { ServerResponse } from "node:http";
+/**
+ * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
+ * 清单跟着列)。两面同读(S-930:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
+ */
+/** 读这张映射的受众(闭集)。会话所有者受众必须交一只 `withheld` —— 被换成固定句的 core 原句落到那里(运维材料不许丢)。 */
+export type MemoryComplianceAudience = {
+    readonly kind: "operator";
+} | {
+    readonly kind: "session_owner";
+    readonly withheld: (coreMessage: string) => void;
+};
+/** 按上面三层应答;返回 `true` = 已应答,`false` = 未分类(一个字节都没写,调用方发它自己那句 500 并落它自己的运维 warn)。 */
+export declare function sentMemoryComplianceFailure(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+//# sourceMappingURL=memory-compliance-failure-reply.d.ts.map

package/dist/http/memory-compliance-failure-reply.js

@@ -0,0 +1,73 @@
+import { ControlPlaneCorruptError } from "@sema-agent/core";
+import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
+import { sendError } from "./send.js";
+import { assertNever } from "./route-ctx.js";
+function sentCoreCode(res, coreCode, coreMessage, audience) {
+    switch (coreCode) {
+        case "config.memory_erasure_request":
+            sendError(res, 400, "config.memory_erasure_request", textFor(audience, coreMessage, "session memory erasure refused — the erasure request is not valid; correct it and resend"));
+            return true;
+        case "memory.erasure_evidence_unavailable":
+            sendError(res, 409, "memory.erasure_evidence_unavailable", textFor(audience, coreMessage, "session memory erasure refused — this deployment's memory store cannot produce erasure evidence; resend with allowUnevidenced: true to erase without evidence, or ask the operator"));
+            return true;
+        case "memory.erasure_selector_mismatch":
+            sendError(res, 409, "memory.erasure_selector_mismatch", textFor(audience, coreMessage, "session memory erasure refused — this requestId already names a different erasure; resend with a new requestId"));
+            return true;
+        case "memory.erasure_census_incomplete":
+            sendError(res, 409, "memory.erasure_census_incomplete", textFor(audience, coreMessage, "session memory erasure refused — the memory store could not be read completely, so nothing was erased and nothing was recorded; ask the operator to repair it, then resend with the same requestId"));
+            return true;
+        default:
+            return false;
+    }
+}
+function textFor(audience, coreMessage, ownerSentence) {
+    switch (audience.kind) {
+        case "operator":
+            return coreMessage;
+        case "session_owner":
+            audience.withheld(coreMessage);
+            return ownerSentence;
+        default:
+            return assertNever(audience);
+    }
+}
+function codeOf(err) {
+    if (!(err instanceof Error))
+        return undefined;
+    const { code } = err;
+    return typeof code === "string" ? code : undefined;
+}
+export function sentMemoryComplianceFailure(res, err, audience) {
+    const coreCode = codeOf(err);
+    if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err), audience))
+        return true;
+    const outside = targetOutsideStoreOf(err);
+    if (outside !== undefined) {
+        switch (audience.kind) {
+            case "operator":
+                return sentMemoryStoreRefusal(res, err);
+            case "session_owner":
+                audience.withheld(outside.message);
+                sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                return true;
+            default:
+                return assertNever(audience);
+        }
+    }
+    if (err instanceof ControlPlaneCorruptError) {
+        switch (audience.kind) {
+            case "operator":
+                sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+                return true;
+            case "session_owner":
+                audience.withheld(err.message);
+                sendError(res, 500, "internal.memory_control_plane_corrupt", "session memory erasure could not be completed — this deployment's memory control plane could not be read cleanly (depending on where it stopped, either nothing was changed or the deletions were already committed and a replay finishes them); ask the operator to repair it, then resend with the same requestId");
+                return true;
+            default:
+                return assertNever(audience);
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=memory-compliance-failure-reply.js.map

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,9 +1,9 @@
 /**
  * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
  * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
- * `routes/memory-compliance.ts`(出处 / 抹除)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
+ * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
- * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(`routes/sessions.ts`:同码、固定文案,见那里的注)。
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(S-930 起经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案)。
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
  * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
  *

package/dist/http/resume-legs.js

@@ -19,6 +19,7 @@ import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, par
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
+import { withModelReachScope } from "../model-reach-scope.js";
 import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
@@ -502,7 +503,7 @@ export function createResumeLegs(ctx) {
             await args.onResumeCommitted();
         let unregisterEngineNotice;
         try {
-            result = await withPrincipal(principal, async () => {
+            result = await withModelReachScope(sessionId, () => withPrincipal(principal, async () => {
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
                     const rs0 = deps.runStore;
@@ -871,7 +872,7 @@ export function createResumeLegs(ctx) {
                 return await (deps.sendUserFile && taskId
                     ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
                     : withElicitation());
-            });
+            }));
         }
         catch (e) {
             if (e instanceof CheckpointError) {

package/dist/http/routes/diagnostics.js

@@ -1,6 +1,7 @@
 import { buildPostureKnobReading } from "../../posture-source.js";
 import { buildReadFaceWiring } from "../../read-face-posture.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
+import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
@@ -106,6 +107,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
+                outbound: readOutboundWiring(),
                 configApply: deps.configApplyState?.() ?? null,
                 mcpRevocations: deps.mcpRevocationState?.() ?? null,
                 serverGates: buildServerWiringGates({

package/dist/http/routes/memory-compliance.js

@@ -1,7 +1,6 @@
 import { z } from "zod";
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
-import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
+import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -11,40 +10,9 @@ const EraseRequestSchema = z.object({
     select: z.record(z.string(), z.unknown()),
     allowUnevidenced: z.boolean().optional(),
 });
-function sentCoreCode(res, coreCode, message) {
-    switch (coreCode) {
-        case "config.memory_erasure_request":
-            sendError(res, 400, "config.memory_erasure_request", message);
-            return true;
-        case "memory.erasure_evidence_unavailable":
-            sendError(res, 409, "memory.erasure_evidence_unavailable", message);
-            return true;
-        case "memory.erasure_selector_mismatch":
-            sendError(res, 409, "memory.erasure_selector_mismatch", message);
-            return true;
-        case "memory.erasure_census_incomplete":
-            sendError(res, 409, "memory.erasure_census_incomplete", message);
-            return true;
-        default:
-            return false;
-    }
-}
-function codeOf(err) {
-    if (!(err instanceof Error))
-        return undefined;
-    const { code } = err;
-    return typeof code === "string" ? code : undefined;
-}
 function sentClassifiedFailure(res, ctx, face, err) {
-    const coreCode = codeOf(err);
-    if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
+    if (sentMemoryComplianceFailure(res, err, { kind: "operator" }))
         return true;
-    if (sentMemoryStoreRefusal(res, err))
-        return true;
-    if (err instanceof ControlPlaneCorruptError) {
-        sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
-        return true;
-    }
     ctx.deps.logger?.warn?.(`memory_compliance_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/sessions.js

@@ -4,7 +4,7 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
-import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
+import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders } from "../send.js";
@@ -526,17 +526,9 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
-                const code = err.code;
-                if (code === "config.memory_erasure_request") {
-                    sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
+                const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
+                if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }))
                     return;
-                }
-                const outside = targetOutsideStoreOf(err);
-                if (outside !== undefined) {
-                    deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: outside.message });
-                    sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
-                    return;
-                }
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
             }

package/dist/http/routes/side-query.js

@@ -3,7 +3,7 @@ import { HttpError } from "../../security.js";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
 import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { admitProviderEcho } from "../../observability/run-terminal.js";
+import { admitProviderEcho, redactErrorMessage } from "../../observability/run-terminal.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +35,11 @@ function shapeSideQueryEcho(result) {
     const { responseModel: _outOfShape, ...admitted } = result;
     return admitted;
 }
+function projectSideQueryResult(result) {
+    const shaped = shapeSideQueryEcho(result);
+    const redacted = redactErrorMessage(shaped.errorMessage);
+    return redacted === undefined || redacted === shaped.errorMessage ? shaped : { ...shaped, errorMessage: redacted };
+}
 export async function handleSideQuery(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
@@ -107,7 +112,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     deps.sideQueryAccounting?.(principal, { model: modelId, usage: rr.usage });
                     deps.metrics?.inc?.("side_query_total", { result: "ok" });
                     if (!res.writableEnded)
-                        sendJson(res, 200, shapeSideQueryEcho(result));
+                        sendJson(res, 200, projectSideQueryResult(result));
                 }
                 catch (e) {
                     deps.metrics?.inc?.("side_query_total", { result: "error" });

package/dist/http/routes/tasks.js

@@ -27,6 +27,7 @@ import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
+import { withModelReachScope } from "../../model-reach-scope.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -644,7 +645,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await (deps.sendUserFile
+                    await withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {

package/dist/memory-store-refusal.d.ts

@@ -8,7 +8,8 @@
  *
  * ## 两条到达车道,两个读者(本模块各给一只,别处不许再写第二份判据)
  *  ① **抛出面**(抹除 / 出处 / 外源列表 / 清标 / bundle 导出导入 —— 凡触 store 树的 backend 面):`.code` 就是码
- *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,一处字面量)。
+ *     ⇒ {@link targetOutsideStoreOf}。HTTP 映射在 `http/memory-store-refusal-reply.ts`(409,operator 面一处字面量)与
+ *     `http/memory-compliance-failure-reply.ts`(合规面两受众的那一只;会话所有者受众换固定句,S-930)。
  *  ② **报告面**(harvest `incident`):core 契约写明 report 车道上码**只在文本里** —— `sidecar_corrupt` 的 detail 恰两种形
  *     `memory commit refused: memory.target_outside_store: …` / `memory control plane refused: memory.target_outside_store: …`
  *     (core `docs/wire-consumption/7.31.1.md` 的 harvest 行逐字)⇒ {@link targetOutsideStoreInIncident} 只认**这两个 lead 紧跟码**

package/dist/model-entry-headers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * 白名单 = 名字 → 读它的线路(闭集;**加一个名字 = 加一行并写明哪条线路读它、为什么是部署的事**)。
+ * `anthropic-beta`:Anthropic Messages 的 beta 开关(逗号分隔的 beta 名;core anthropic 腿会把自己的 beta 并进同一个头)。
+ */
+export declare const CATALOG_ENTRY_HEADER_LANES: {
+    readonly "anthropic-beta": readonly ["anthropic-messages"];
+};
+export type CatalogEntryHeaderName = keyof typeof CATALOG_ENTRY_HEADER_LANES;
+export declare const CATALOG_ENTRY_HEADER_NAMES: readonly CatalogEntryHeaderName[];
+/** 判过的袋(只含白名单里的名字,值逐字)。 */
+export type CatalogEntryHeaders = Readonly<Partial<Record<CatalogEntryHeaderName, string>>>;
+/** 值的长度上界(字符)。`anthropic-beta` 的真实值是几枚逗号分隔的 beta 名,远在此下;上界只挡「把别的东西塞进来」。 */
+export declare const MAX_HEADER_VALUE_CHARS = 1024;
+/**
+ * 拒因 / warn 里名字的回显尺:token 形、≤64、且脱敏器不改它 ⇒ 照写;否则固定占位(名字位也可能被塞进秘密,值更是从不回显)。
+ */
+export declare function displayHeaderName(name: string): string;
+/** 判决:`ok` ⇒ 判过的袋(`undefined` = 条目没声明任何头:缺席与 `{}` 同一个读法,都不铸键);否则 ⇒ 坏字段坐标 + 一句不带值的理由。 */
+export type CatalogEntryHeadersVerdict = {
+    readonly ok: true;
+    readonly headers: CatalogEntryHeaders | undefined;
+} | {
+    readonly ok: false;
+    readonly fields: readonly string[];
+    readonly issue: string;
+};
+/**
+ * **唯一判据**:条目的 `headers` 原值(`unknown`:承载形,不信类型)+ 条目的线路词原值(`api`;两条读腿恒补齐它,
+ * 绕过读腿的输入缺它 ⇒ 按「没有线路读它」拒 —— 判据与铸点读同一个原值,不另补一份 schema 缺省)。
+ * 整只判:任一名字 / 值不合 ⇒ 整只不收(留下好的那几个 = 让运维以为整袋生效了)。坏字段逐个列出(`headers.<名>`)。
+ */
+export declare function readCatalogEntryHeaders(raw: unknown, api: unknown): CatalogEntryHeadersVerdict;
+/**
+ * **唯一铸点**(`toModel` 调):判过的袋 → `Model.headers` 的键。缺席 ⇒ 不铸键(一个 `undefined` 值的键也不铸:
+ * 缺席只有一种拼法)。判不过 ⇒ **抛**:到这里的条目已经过 S-704 逐条判据(判不过的进 `modelRefusals`、到不了 `toModel`),
+ * 抛 = 两处判据分叉了,stage 整候选拒、响亮,不静默丢头。
+ */
+export declare function buildModelHeadersKey(entryName: string, raw: unknown, api: unknown): {
+    headers?: Record<string, string>;
+};
+//# sourceMappingURL=model-entry-headers.d.ts.map