@sema-agent/server 7.129.1 → 7.131.0

package/dist/config-catalog.js

@@ -16,7 +16,7 @@ import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { buildOutboundProxyPosture } from "./outbound-dispatcher.js";
-import { modelSupportsImages } from "./model-select.js";
+import { modelImageInput, modelReasoningDecl } from "./model-select.js";
 export const CATALOG_VALUE_TYPES = ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export const CATALOG_TIMINGS = ["hot", "restart", "deploy", "inert"];
 export const CATALOG_DANGER_AXES = ["security", "billing", "data"];
@@ -303,14 +303,18 @@ export const CONFIG_CATALOG = [
     r("MODEL_FIRST_BYTE_TIMEOUT_MS", "modelPlane", "number", `请求发出 → 响应头的等待(ms;缺席 = core 缺省 + 上传宽限;到点 core 自有一次加宽重试,配了 MODEL_GATEWAY_FALLBACK_URLS 也一样(之后才切备;server 不铸 firstByteRetries);0 = 该段不设引擎钟、传输层的响应头 / 响应体钟也关(TCP + TLS 建连仍归传输层自己的钟);自托管慢网关按排队 + prefill 留足;failover 拓扑想快切须显式设小;须为 [${FIRST_BYTE_TIMEOUT_BOUNDS.minMs}, ${FIRST_BYTE_TIMEOUT_BOUNDS.maxMs}] 内十进制整数,其余拒启)`, { derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随 core 缺省(本仓不复制上游数字;core 改缺省本旋钮照映不改)", resolve: (c) => c.resilience.firstByteTimeoutMs ?? null }),
     r("MODEL_FIRST_TOKEN_TIMEOUT_MS", "modelPlane", "number", "首 token 超时(ms;0 = 该段不设引擎钟、传输层的响应体钟也关 —— 开流不吐字的唯一看门狗;自托管长 prefill 后端按此档留足)", { staticDefault: String(RESILIENCE_DEFAULTS.firstTokenTimeoutMs.value) }),
     r("MODEL_FREQUENCY_PENALTY", "modelPlane", "number", "frequency_penalty 直通(压过 EXTRA_BODY 同键)"),
-    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(S-623:**无出厂缺省** —— 配置能派发到的每条 openai 兼容路由都必须解析到显式端点(条目自己的 baseUrl,或本键),否则拒启 / 热路径整批拒,机读码 `config.model_route_endpoint_missing`,拒因点名条目并给出本机写法 `MODEL_GATEWAY_BASEURL=<本机网关>/v1`;anthropic 单路由部署不设本键合法;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { derivedDefaultNote: "缺席 ⇒ 本部署没有网关(不铸键);有 openai 路由落不到端点 ⇒ 拒启", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
+    r("MODEL_GATEWAY_BASEURL", "modelPlane", "url", "openai 兼容网关 base URL(S-623:**无出厂缺省** —— 将要服务的那张表(目录被采纳判目录表,否则判 env 表)里每条 openai 兼容路由都必须解析到显式端点(条目自己的 baseUrl,或本键),否则拒启 / 热路径整批拒,机读码 `config.model_route_endpoint_missing`,拒因点名条目并给出本机写法 `MODEL_GATEWAY_BASEURL=<本机网关>/v1`;anthropic 单路由部署不设本键合法;S-475:带 userinfo 拒启,机读码 `config.gateway_url_userinfo` —— WHATWG 禁止用带凭据的 URL 构造 fetch Request,凭据放 MODEL_API_KEY;S-483:解析不动/不透明形拒启,机读码 `config.model_route_url_invalid`;S-514:带 `#fragment` 拒启,机读码 `config.model_route_url_fragment`)", { derivedDefaultNote: "缺席 ⇒ 本部署没有网关(不铸键);有 openai 路由落不到端点 ⇒ 拒启", configKey: "gatewayBaseUrl", center: cModels("models[].baseUrl") }),
     r("MODEL_GATEWAY_FALLBACK_URLS", "modelPlane", "url", "网关故障转移地址表(CSV;S-623:主网关 MODEL_GATEWAY_BASEURL 未设而本键设了 ⇒ 拒启,机读码 `config.gateway_fallback_without_primary` —— 备用是主网关的镜像;S-475:**逐项**判 userinfo,任一项带 ⇒ 拒启,机读码 `config.gateway_url_userinfo`;S-483:逐项判可解析性,机读码 `config.model_route_url_invalid`;S-514:**逐项**判 `#fragment`,机读码 `config.model_route_url_fragment`)", { configKey: "gatewayFallbackUrls" }),
-    r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省,缺 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
+    r("MODEL_ID", "modelPlane", "string", "主模型 id(3.0.0 起无出厂缺省;env 表的主槽。目录被采纳时整张换掉 env 表、本键不服务,目录第一次采纳那一拍说一行 `config_env_set_but_ineffective`;目录缺席时它是兜底,两者皆无 ⇒ 拒启指路)", { configKey: "model", resolve: (c) => c.model.id, center: cModels("models[].id") }),
     r("MODEL_IDLE_TIMEOUT_MS", "modelPlane", "number", "流中静默看门狗(ms;0 = 该段不设引擎钟、传输层的响应体钟也关)", { staticDefault: String(RESILIENCE_DEFAULTS.idleTimeoutMs.value) }),
     r("MODEL_MAX_TOKENS", "modelPlane", "number", "主模型输出上限", { derivedDefaultNote: "缺席 ⇒ min(32000, contextWindow)", resolve: (c) => c.model.maxTokens ?? null, center: cModels("models[].maxTokens") }),
     r("MODEL_PRESENCE_PENALTY", "modelPlane", "number", "presence_penalty 直通"),
     r("MODEL_PROVIDER", "modelPlane", "enum", "主模型 provider(路由选 brain;S-461 起是闭集,词表外的值启动期拒启并点名机读码 `config.model_provider_invalid`)", { enumValues: MODEL_PROVIDER_WORDS, derivedDefaultNote: "缺席:ANTHROPIC base+cred 同在 ⇒ anthropic,否则 gateway", resolve: (c) => c.model.provider, center: cModels("models[].provider") }),
-    r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明", { staticDefault: "true", resolve: (c) => c.model.reasoning ?? null, center: cModels("models[].reasoning") }),
+    r("MODEL_REASONING", "modelPlane", "boolean", "主模型 reasoning 声明(三态:true / false / 缺席 = 未声明)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 `Model.reasoning`(没有 true 缺省);引擎按真值读,缺席与 false 同读 —— 思考档不随请求发出;要开思考写 MODEL_REASONING=true。`GET /v1/models` 该行不带 `reasoning` 键",
+        resolve: (c) => modelReasoningDecl(c.model) ?? null,
+        center: cModels("models[].reasoning"),
+    }),
     r("MODEL_REASONING_EFFORT_LEVELS", "modelPlane", "csv", "openai 端点接受的思考档集(六档子集;高档 clamp-down 不 422;anthropic 腿不铸此键;未知词拒启)", {
         derivedDefaultNote: "缺席 ⇒ 不铸 compat,core 走保守梯(minimal|low|medium|high),xhigh/max 被 clamp 下来",
         resolve: (c) => {
@@ -332,7 +336,14 @@ export const CONFIG_CATALOG = [
         },
     }),
     r("MODEL_VERIFIER", "modelPlane", "string", "verify 门的异构 verifier(须命中目录;typo 回 default 并 boot warn=自评自批)", { derivedDefaultNote: "缺席/不在目录 ⇒ default(=implementer,去相关性失效警告)" }),
-    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(false = 明说不收图:带图请求的图被换成占位句交给模型,提交时计数并告警)", { staticDefault: "true", resolve: (c) => modelSupportsImages(c.model), center: cModels("models[].vision") }),
+    r("MODEL_VISION", "modelPlane", "boolean", "主模型 vision 声明(三态:true / false / 缺席 = 未声明;false = 明说不收图:带图请求的图被换成占位句交给模型,提交时计数并告警)", {
+        derivedDefaultNote: "缺席 ⇒ 不铸 `Model.input`(没有 true 缺省);引擎与带图预检都按「收」读(图原样交给模型,不出信号);`GET /v1/models` 该行不带 `vision` 键。要让预检对纯文本模型出信号写 MODEL_VISION=false",
+        resolve: (c) => {
+            const v = modelImageInput(c.model);
+            return v === "undeclared" ? null : v === "yes";
+        },
+        center: cModels("models[].vision"),
+    }),
     r("MYSQL_DATABASE", "store", "string", "MySQL 协议库名(选中该引擎时必填)", { danger: DATA }),
     r("MYSQL_HOST", "store", "string", "MySQL 协议主机(在场即算 SQL 信号,参与 DB_BACKEND 默认推导)", { danger: DATA }),
     r("MYSQL_PASSWORD", "store", "secret", "MySQL 协议口令", { danger: SEC }),

package/dist/config-invariants.js

@@ -232,8 +232,8 @@ export const CONFIG_CROSS_INVARIANTS = [
         id: "model-route-endpoint",
         keys: ["gatewayBaseUrl", "gatewayFallbackUrls", "anthropic", "models"],
         restartReason: "model-route-endpoint",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
-        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next)),
+        bootAnchor: { file: "src/boot/stage-02-web-admin-pull.ts", marker: "CROSS-INVARIANT:model-route-endpoint" },
+        check: ({ live, next }) => (next.models === live.models ? undefined : modelRouteEndpointRefusal(next, "catalog")),
     },
     {
         id: "default-model-resolvable",

package/dist/config-provider.js

@@ -149,8 +149,8 @@ export function mapToServiceEffective(eff, version) {
                 ...(m.sealedApiKey !== undefined ? { sealedApiKey: m.sealedApiKey } : {}),
                 ...(m.quotaWeight !== undefined ? { quotaWeight: m.quotaWeight } : {}),
                 tier: m.tier,
-                reasoning: m.reasoning,
-                vision: m.vision,
+                ...(m.reasoning !== undefined ? { reasoning: m.reasoning } : {}),
+                ...(m.vision !== undefined ? { vision: m.vision } : {}),
                 ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
                 ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),

package/dist/config-types.d.ts

@@ -548,6 +548,12 @@ export interface ServiceConfigFlat {
      *
      * 🔴 **必填、无可选形**:一个 `?` 会立刻招来一条「缺席就回落 `config.model`」的臂,而那条臂正是本键
      * 要消灭的东西([ref]:同一语义面禁两个写者)。测试夹具与 `loadConfig` 一样,与 `model` 同源铸。
+     *
+     * 🔴 **同引用是契约**:env 表服务时 `model` 与 `envModel` **恒是同一个对象**(`loadConfig` 把同一只模型放进两个键)。
+     * `servedModelTableLeg`(`model-select.ts`)拿这条**引用相等**当「这个进程服务的是哪张表」的唯一状态位 —— `model` 换成目录缺省 ⇒ 不再同引用 ⇒ 服务的是目录表。
+     * 所以写口恰好两处:`config.ts` 的铸造点(两键同一个对象)与 `web-admin-client/apply-effective.ts` 的 `commitStaged`(只换 `model`,`envModel` 永不被写);
+     * 克隆模型对象、或嵌入方手搓 `ServiceConfig` 时把两键指向两只对象,这一位会被误读成「目录在服务」(拒因句选错视图、`MODEL_ID` 通告误发)。
+     * 源码钉(`test/served-model-route.test.ts` 的类钉)把这两处写口列成白名单。
      */
     envModel: Model;
     /** Model catalog by name (1.24): always `default` + the main model's id, plus an optional cheap model.

package/dist/config.d.ts

@@ -229,7 +229,7 @@ export declare function parseEnvNameAllowlist(knob: RunnerEnvNameAllowlistKnob):
  *  Shared by the env lane (main + cheap models) and the center lane (web-admin toModel). */
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): "explicit" | "sonnet5" | "removed-1m" | "removed";
 /**
- * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与 S-623 端点判据同调这一只)。
+ * **严格名册布防**的唯一判据(boot 就绪门 `boot/web-admin.ts` 与装配第 2 段的路由端点判官同调这一只)。
  *
  * 布防 = 远程 registry ∧ 非 dryRun ∧ `CONFIG_REQUIRE_ROSTER=true`(严格 `"true"`,直读 env、不进 ServiceConfig —— 纯
  * boot 期姿势旋钮,原判据逐字搬来,零语义变化)。布防时运维声明 env MODEL_ID 是**占位**:名册落地前计费提交 503、
@@ -332,7 +332,7 @@ export declare function unmatchableToolNamesRefusal(source: string, names: reado
  * 7.117.0(core 7.42.0)起这张表整份投 `RunnerDeps.allowedTools`(引擎 allow 层的部署成员,构造时读一次),判据是**引擎的读法**,与请求的两张
  * allow 表同一份(`rule-entry-list.ts`):
  *  ① 值不是字符串表 ⇒ 拒(env 的 CSV 恒给字符串表;判在这里是为了「值一旦换了来源,第一道判仍在」);
- *  ② 引擎读成空的条目(`compileAllowList(names, "allow", 名册 = 空集).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
+ *  ② 引擎读成空的条目(`compileAllowList(names, "allow", 名册).inert` 非空 —— `*`、`mcp__*`、写路径 / 域名形、带空白或畸形的名字,以及
  *     core 7.43.0 起条目名过引擎判官读成 `tool_name` 的退役名 / 无前缀短名 / 对端段铸不出,core 7.48.0 #1400 起含工具段为空的 `mcp__<srv>__`;
  *     7.116.0–7.122.x 那一形由本仓先拒,随之退役)⇒ 拒,句子点名条目、引擎给的原因词(名字层带判词与现名)、
  *     该怎么写。请求的 allow 侧对 ② 只收通告;运维这一侧拒启:这是运维自己的配置,写错了当场改,而引擎对读成空的部署条目只在每一跑发一条通告。

package/dist/config.js

@@ -1,9 +1,9 @@
 import { readFileSync } from "node:fs";
-import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./model-select.js";
 import { homedir } from "node:os";
 import { join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
+import { compileAllowList, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -22,7 +22,7 @@ import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat,
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
+import { TOOL_NAME_ROSTER, describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
@@ -33,14 +33,14 @@ import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
-import { allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal } from "./url-refusal.js";
-import { csvOf, envLaneTable, judgeModelRouteGap, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
+import { csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
@@ -925,14 +925,14 @@ function parseModelDomain() {
         thinkingFormat: parseThinkingFormat(process.env.MODEL_THINKING_FORMAT),
     });
     const envCompat = provider === "anthropic" ? undefined : envCompatDeclared;
+    const modelCapability = { reasoning: parseBoolWord("MODEL_REASONING", process.env.MODEL_REASONING), vision: parseBoolWord("MODEL_VISION", process.env.MODEL_VISION) };
     const model = {
         id: modelId,
         name: modelId,
         api: provider === "anthropic" ? "anthropic-messages" : "openai-completions",
         provider,
         baseUrl: "",
-        reasoning: boolEnv("MODEL_REASONING", true),
-        input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"],
+        ...mintCapabilityKeys(modelCapability),
         ...buildModelCostKey(buildCostOrAbsent({
             input: costEnv("MODEL_COST_INPUT", "unset"),
             output: costEnv("MODEL_COST_OUTPUT", "unset"),
@@ -983,7 +983,7 @@ function parseModelDomain() {
             ...model,
             id: cheapMintedId,
             name: cheapMintedId,
-            input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
+            ...mintCapabilityKeys({ reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING), vision: parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION) }),
             ...buildModelCostKey(buildCostOrAbsent({
                 input: costEnv("MODEL_CHEAP_COST_INPUT", "declares-zero"),
                 output: costEnv("MODEL_CHEAP_COST_OUTPUT", "declares-zero"),
@@ -993,7 +993,6 @@ function parseModelDomain() {
             contextWindow: numEnvOr("MODEL_CHEAP_CONTEXT_WINDOW", model.contextWindow),
             maxTokens: numEnvOr("MODEL_CHEAP_MAX_TOKENS", model.maxTokens),
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
-            reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING) ?? model.reasoning,
         }
         : undefined;
     const mainAct = optFinitePositiveEnv("MODEL_AUTO_COMPACT_TOKENS");
@@ -1183,8 +1182,15 @@ function findUnmatchableToolNames(names, opts) {
             out.push({ name, guidance: uncompilable });
             continue;
         }
-        if (verdict !== undefined)
+        if (verdict !== undefined) {
             out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
+            continue;
+        }
+        const nearMiss = compileAllowList([subject], "deny", TOOL_NAME_ROSTER).inert.find((i) => i.reason === "near_miss");
+        if (nearMiss?.currentName !== undefined) {
+            const rest = name.startsWith(subject) ? name.slice(subject.length) : "";
+            out.push({ name, guidance: inertRuleEntryGuidance({ ...nearMiss, currentName: `${nearMiss.currentName}${rest}` }) });
+        }
     }
     return out;
 }
@@ -1192,9 +1198,10 @@ export function unmatchableToolNamesRefusal(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)
         return undefined;
+    const named = bad.slice(0, MAX_NAMED_INERT_ENTRIES).map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ");
     const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
         `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
-        bad.map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        (bad.length > MAX_NAMED_INERT_ENTRIES ? `${named}; and ${bad.length - MAX_NAMED_INERT_ENTRIES} more` : named)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
     return { message, names: bad.map((b) => b.name) };
 }
 const APPROVAL_GRANT_ENV = "APPROVAL_GRANT";
@@ -2521,12 +2528,6 @@ export function loadConfig() {
     if (laneRequiredRefusal !== undefined) {
         throw new Error(laneRequiredRefusal);
     }
-    {
-        const routeGap = judgeModelRouteGap(process.env, { envLaneDispatchable: !isRosterGateArmed(integrations.webAdmin) });
-        if (routeGap.gap !== "none") {
-            throw new Error(routeGap.reason);
-        }
-    }
     EXEC_LANE_NOTICE = buildExecLaneNotice(orchestration.remoteExec);
     return attachConfigGroups({
         ...store,

package/dist/elicitation.d.ts

@@ -19,6 +19,13 @@ export interface ElicitationFrame {
      *  no core-stream anchor, so no `eventId` (absence is honest, not an omission); this is the frame's own time
      *  coordinate instead, same posture as the stream-approval frames' `serverNowMs`. */
     serverNowMs?: number;
+    /** "elicitation" only (additive; the same window pair `question` carries): the coordinator's OWN answer window —
+     *  at expiry the ask releases as `decline`. Minted from the SAME `ttlMs` the `setTimeout` below arms (one source), so
+     *  a form replayed from the ledger can be judged still-waiting (no `elicitation_complete` with this id ∧
+     *  `expiresAtMs` not reached) or lapsed even when the close row never landed (a lost write, a crashed replica). */
+    expiresInMs?: number;
+    /** "elicitation" only: `serverNowMs + expiresInMs` — the absolute deadline on the server's clock. */
+    expiresAtMs?: number;
 }
 /** The per-run context `onElicit` recovers via ALS. `emit` delivers a frame to the run's live stream;
  *  `abortSignal` (the run's own cancel signal) lets a run-abort promptly cancel an elicitation parked awaiting a

package/dist/elicitation.js

@@ -112,18 +112,33 @@ export class ElicitationCoordinator {
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
         this.pending.set(id, { settle, owner: ctx.owner, taskId: ctx.taskId });
-        try {
-            await ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: this.now() });
+        const emitted = (async () => {
+            const now = this.now();
+            return ctx.emit({ type: "elicitation", elicitationId: id, mcpServerName: req.server, message, ...(requestedSchema !== undefined ? { requestedSchema } : {}), mode: "form", serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs });
+        })().then(() => "ok", () => "failed");
+        const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
+        if (delivery === "ok") {
             rc.total += 1;
             rc.lastByServer.set(req.server, t);
         }
-        catch {
+        else if (delivery === "failed") {
             recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
             settle({ action: "decline" });
         }
         const answer = await answerP;
-        void Promise.resolve()
-            .then(() => ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() }))
+        void emitted
+            .then((result) => {
+            if (result === "failed") {
+                if (delivery === "stalled")
+                    recordFailOpen("server.elicitation.open-frame-undelivered", `elicitation=${id} server=${req.server}`);
+                return undefined;
+            }
+            if (delivery === "stalled") {
+                rc.total += 1;
+                rc.lastByServer.set(req.server, t);
+            }
+            return ctx.emit({ type: "elicitation_complete", elicitationId: id, mcpServerName: req.server, action: answer.action, serverNowMs: this.now() });
+        })
             .catch(() => recordFailOpen("server.elicitation.complete-breadcrumb-dropped", `elicitation=${id}`));
         return answer;
     };

package/dist/exec-bounds.d.ts

@@ -1,9 +1,9 @@
 /**
- * 执行车道上「什么约束一条命令」的**唯一一条律**(host / e2b / k8s 三只 adapter 同读这一只;纯叶,零依赖):
+ * 执行车道上「什么约束一条命令」的**唯一一条律**(host / e2b / k8s / ssh / adb / local-docker 六条车道的 adapter 同读这一只;纯叶,零依赖):
  *
  *   命令由调用方**说出口**的界约束 —— 墙钟 `timeout`(buffered 与流式两面)与 / 或它自己的静默界 `readTimeoutMs`
  *   (流式面)。调用方**两样都没说**时,才由车道自己的活性界兜底:无输出满这么久即判挂死(k8s `K8S_LIVENESS_MS` /
- *   e2b `E2B_LIVENESS_MS`,缺省 {@link LIVENESS_MS_DEFAULT};host 没有这一界)—— 那时它是这条命令唯一的挂死护栏。
+ *   e2b `E2B_LIVENESS_MS`,缺省 {@link LIVENESS_MS_DEFAULT};host / ssh / adb / local-docker 没有这一界)—— 那时它是这条命令唯一的挂死护栏。
  *   切断时报的是**真正触发的那一界**(活性切断的句子只在 {@link livenessCutMessage} 铸)。
  *
  * 为什么「说了墙钟就不再活性切断」:墙钟本身就是挂死护栏(它到点必切),而调用方说出一个墙钟,就是在说「这条命令可以跑
@@ -12,7 +12,7 @@
  * 是它报的那一界。
  *
  * 与 core 远端契约(`ExecStreamOptions.readTimeoutMs`:「缺省也 SHOULD 有活性界,一条命令不得等到环境死」)的对齐:
- * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令仍有车道活性界。切断码沿用 core 的 `timeout`(core 远端码表
+ * 说了墙钟的命令被墙钟兜住,不会无限等;两界都没说的命令,在有活性界的车道(k8s / e2b)上仍由它兜底。切断码沿用 core 的 `timeout`(core 远端码表
  * 把墙钟与活性两种超界都归这一词);两者靠句子区分 —— 独立的活性码属于 core 的码表。
  *
  * 不在本律里的界(adapter 自己的上限,不是调用方说的话,不关活性界):k8s 文件读写的数据上限 `dataTimeoutMs`、e2b 交给
@@ -21,9 +21,9 @@
  */
 /** 车道活性界的缺省(ms)—— k8s / e2b 两只 adapter 与配置目录的「缺席 ⇒ 默认」说法同读这一只。 */
 export declare const LIVENESS_MS_DEFAULT = 120000;
-/** 有活性界的车道各自的旋钮名(闭集;切断句点名它,运维据此知道调哪一只)。 */
+/** 有活性界的车道(k8s / e2b)各自的旋钮名(闭集;切断句点名它,运维据此知道调哪一只)。 */
 export type LivenessKnob = "K8S_LIVENESS_MS" | "E2B_LIVENESS_MS";
-/** 一条车道自己的活性界:k8s / e2b 有,host 没有(传 `undefined`)。只经 {@link laneLivenessOf} 铸(值已判过)。 */
+/** 一条车道自己的活性界:k8s / e2b 有,host / ssh / adb / local-docker 没有(传 `undefined`)。只经 {@link laneLivenessOf} 铸(值已判过)。 */
 export interface LaneLiveness {
     readonly ms: number;
     readonly knob: LivenessKnob;
@@ -64,6 +64,6 @@ export declare function firstBoundOf(bounds: CommandBounds): {
     readonly ms: number;
     readonly cut: "wall" | LivenessBound;
 } | undefined;
-/** 活性切断的句子 —— 三车道唯一铸点(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。 */
+/** 活性切断的句子 —— 六条车道(host / e2b / k8s / ssh / adb / local-docker)唯一铸点(车道兜底的界点名旋钮与出路;调用方自己说的界点名那一参数)。 */
 export declare function livenessCutMessage(bound: LivenessBound): string;
 //# sourceMappingURL=exec-bounds.d.ts.map

package/dist/hooks/hook-llm.d.ts

@@ -5,7 +5,7 @@ import type { HookLlmCall } from "./hook-runner.js";
  * hookLlm(prompt 条目/session titler 的模型载体)= 直连一次非流式 completion,从 main.ts 抽出成可注入
  * 单元(fetchImpl/keyResolver 可假),因为这条 wire 在每个默认部署上都活(titler),必须可单测。
  *
- * api 形分派(2026-07-15,黑板 [ref]③b 真缺陷修):被选模型按 `Model.api` 分家 ——
+ * api 形分派(2026-07-15,黑板 [ref]③b 真缺陷修;**选线依据 S-1630 起改为引擎主路由同一只判词**,见下):被选模型按所落的 brain 腿分家 ——
  *  - `openai-completions` ⇒ POST {base}/chat/completions(现状,字节不变);
  *  - `anthropic-messages` ⇒ POST {base}/v1/messages(x-api-key / Authorization: Bearer + anthropic-version
  *    头,messages 数组,回包取 content[].text)。此前 hookLlm 只会说 openai 形且缺省 baseUrl 恒落
@@ -13,6 +13,16 @@ import type { HookLlmCall } from "./hook-runner.js";
  *    provider=anthropic 走 ANTHROPIC_BASE_URL,没配 MODEL_GATEWAY_BASEURL)下 titler 每会话打死
  *    localhost:8000 ⇒ `session_title_failed: TypeError: fetch failed`;即使端点活着,anthropic-messages
  *    模型也不能用 /chat/completions 形调。
+ *
+ * 🔴 **选线 = 引擎主路由同一只判词**(S-1630):「这只模型走 openai-completions 还是 anthropic-messages」不是本面的事,
+ * 是引擎主路由的事 —— `brain.ts` 按 `model.provider` 在「anthropic 路由(仅当 ANTHROPIC 凭据把它装上)/ 网关栈」之间选,
+ * 路由没装时整台机器只有网关这一只 brain,**连 `provider:"anthropic"` 的模型也落网关**(`dispatchBrainLane` 的合取,
+ * 端点判官 / 降级腿 / 启动摘要读的是同一只)。本面此前自己按 `provider === "anthropic"` / `api === "anthropic-messages"`
+ * 字面判线 ⇒ 在 `MODEL_PROVIDER=anthropic` 而只配了网关的部署上,主请求去网关、标题与 hooks 的 llm 面却要找一条没装的
+ * anthropic 路由,整条拒发(零请求,只落 fail-open 标签)。现在本面只问那一只判词,不留第二个读法 —— 含 `api` 词:
+ * 引擎不按 `api` 选线(core 的 `createRoutingBrain` 缺省按 `provider` 键),settings-schema 的 `ModelEntry` 又强制两个词同真同假。
+ * (core 目前只导出 `createRoutingBrain` 这个组合子,没有「给定模型与已装路由 → 哪条腿 / 哪个根」的判官;它导出之日,
+ * `dispatchBrainLane` 连同本调用点一并改为问它。)
  */
 export type HookModelPick = {
     ok: true;

package/dist/hooks/hook-llm.js

@@ -1,7 +1,8 @@
 import { adjudicateModelRoute, joinRequestUrl, resolveRouteCredential, routeKeyOf, routeRefusalText } from "@sema-agent/core";
-import { matchCatalogModel, refusedCatalogEntry } from "../model-select.js";
+import { matchCatalogModel, refusedCatalogEntry, servedModelTableLeg } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
+import { dispatchBrainLane } from "../model-provider.js";
 import { egressRedirectRefusal } from "../egress-redirect.js";
 import { buildDisplaySafeRefusal, redactSecrets } from "../trace/redact.js";
 export function buildHookFailureText(raw) {
@@ -16,21 +17,17 @@ export function buildHookFailureText(raw) {
 }
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
-    const anthropicRouteBaseUrl = () => config.anthropic ? config.anthropic.baseUrl || "https://api.anthropic.com" : undefined;
+    const anthropicRouteBaseUrl = () => config.anthropic?.baseUrl || "https://api.anthropic.com";
     const shapeFrom = (catalogRef, m, providerModelId) => {
-        const api = m?.api === "anthropic-messages" || m?.provider === "anthropic" ? "anthropic-messages" : "openai-completions";
-        if (api === "anthropic-messages") {
-            const baseUrl = m?.baseUrl || anthropicRouteBaseUrl();
-            if (!baseUrl) {
-                return {
-                    ok: false,
-                    error: `hook model "${catalogRef}" is served over anthropic-messages but no anthropic route is configured — set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN (plus ANTHROPIC_BASE_URL for a non-default endpoint), or give the model its own baseUrl`,
-                };
+        const lane = dispatchBrainLane(m?.provider, config.anthropic !== undefined);
+        switch (lane) {
+            case "anthropic":
+                return { ok: true, catalogRef, providerModelId, baseUrl: m?.baseUrl || anthropicRouteBaseUrl(), api: "anthropic-messages" };
+            case "gateway": {
+                const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m, config.gatewayBaseUrl, servedModelTableLeg(config));
+                return endpoint.ok ? { ok: true, catalogRef, providerModelId, baseUrl: endpoint.baseUrl, api: "openai-completions" } : { ok: false, error: endpoint.refusal };
             }
-            return { ok: true, catalogRef, providerModelId, baseUrl, api };
         }
-        const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m?.baseUrl, config.gatewayBaseUrl);
-        return endpoint.ok ? { ok: true, catalogRef, providerModelId, baseUrl: endpoint.baseUrl, api } : { ok: false, error: endpoint.refusal };
     };
     const hookModelFor = (requested) => {
         const shape = (ref) => shapeFrom(ref, config.models[ref], config.models[ref]?.id ?? ref);
@@ -135,7 +132,7 @@ export function createHookLlm(deps) {
             const r = await fetchImpl(url, { method: "POST", headers, body, signal: ac.signal, redirect: "manual" });
             const redirected = egressRedirectRefusal(r, "declare the final endpoint as this route's base URL");
             if (redirected !== undefined)
-                return { ok: false, error: `hook llm ${redirected}` };
+                return { ok: false, error: `hook llm ${redirected}`, code: "redirect_refused" };
             if (!r.ok)
                 return { ok: false, error: `hook llm HTTP ${r.status}` };
             let text;

package/dist/hooks/hook-runner.d.ts

@@ -1,4 +1,5 @@
-import { HooksConfig, type HookEventName } from "@sema-agent/settings-schema/hooks";
+import { type HookEntry, type HookEntryType, type HookEventName, type HooksDroppedPiece, type HooksRejection } from "@sema-agent/settings-schema/hooks";
+import { type ConfigPath } from "@sema-agent/settings-schema";
 import type { Hooks } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookNoticeObservation } from "../fleet/fleet-bus.js";
@@ -31,10 +32,45 @@ export declare const MAX_HOOK_OUTPUT_BYTES: number;
  * 且 4096 的单条帽保证**前两条**钩子的话仍整段进得去(截断是配置广度的代价,不是常态)。
  */
 export declare const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10000;
+/**
+ * 本仓对契约每一种 hook 条目类型的表态 —— **一张表**:受理面({@link parseHooksConfig})与执行侧({@link RunnableHookEntry},以及每个按条目类型分派的臂)读的都是它。
+ *
+ * `Record<HookEntryType, boolean>` 穷举:契约新增一种条目类型而这里没登记 ⇒ 编译红。`true` ⇒ 执行侧有这一型的臂 —— 把某一型改成 `true` 而执行侧没补臂,
+ * 分派处(`hookDisplayName` / `runMatchingEntries` 的类型分派)编译红;`false` ⇒ 本仓不跑它,受理面把含它的配置**整份拒**(提交 400),
+ * 不是记一条运维日志然后跳过:守卫事件里一条被跳过的条目,是「写的人以为在拦、其实没拦」。
+ */
+declare const HOOK_ENTRY_TYPE_RUNS: {
+    readonly command: true;
+    readonly http: true;
+    readonly prompt: true;
+    readonly agent: true;
+    readonly mcp_tool: false;
+};
+/** {@link HOOK_ENTRY_TYPE_RUNS} 里表态为 `true` 的类型(由表派生,不另写一份)。 */
+export type SupportedHookEntryType = {
+    [T in HookEntryType]: (typeof HOOK_ENTRY_TYPE_RUNS)[T] extends true ? T : never;
+}[HookEntryType];
+/** 本仓会真跑的条目类型闭集(契约 {@link HOOK_ENTRY_TYPES} 的次序)—— 拒句 `supported: …` 的词表与 {@link RunnableHookEntry} 的类型都出自这一张表。 */
+export declare const SUPPORTED_HOOK_ENTRY_TYPES: readonly SupportedHookEntryType[];
+/** 本 runner 会真跑的条目(契约 `HookEntry` 取表态为 `true` 的那几型)。 */
+export type RunnableHookEntry = Extract<HookEntry, {
+    type: SupportedHookEntryType;
+}>;
+/** 一个匹配器组,条目只含 {@link RunnableHookEntry}。 */
+export interface RunnableMatcherGroup {
+    matcher?: string;
+    hooks: RunnableHookEntry[];
+}
+/** 受理面通过后的 hooks 配置:每个事件下的条目都是本仓会跑的型 —— 执行侧({@link createTaskHooks})只收这一型,「不认识的类型」到不了它手里。 */
+export type RunnableHooksConfig = Partial<Record<HookEventName, RunnableMatcherGroup[]>>;
+/** 分类器点名的一块(被剔的块或整份被拒的理由):码 + 坐标 + 坏字段。 */
+export type HooksRefusalPiece = HooksDroppedPiece | HooksRejection;
 export interface ParseHooksConfigResult {
-    config?: HooksConfig;
-    /** 人可读的第一条校验错误(HTTP 层用它 400 fail-loud;resume 防御路径用它 warn)。 */
+    config?: RunnableHooksConfig;
+    /** 人可读的第一条拒因(HTTP 层用它 400 fail-loud;resume 防御路径用它 warn)。 */
     error?: string;
+    /** 拒因来自**分类器**时,它点名的每一块(数据,文档序);本仓自己的拒(条目类型 / 服务侧上限)不带这一位。一次性迁移读它按名剥键(`stored-request-hooks-m20.ts`)—— 迁移不另起读者。 */
+    pieces?: readonly HooksRefusalPiece[];
 }
 /**
  * 🔴 **S-924 → S-995(clay [ref] ③;八病审计 SG H6-d;test 7.112.0 验收 OBS ①)—— 工具事件的 matcher 选中了工具**别名**、却选不中它的正名 ⇒ fresh 提交面响亮拒。**
@@ -184,10 +220,19 @@ export declare function buildToolMatcherRefusal(issue: ToolMatcherIssue): ToolMa
  * `budget` **仅供测试注入**({@link MatcherEvalBudget});生产调用点只传前两个实参。
  * **只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。未判的 matcher 过 `recordFailOpen`(tag `MATCHER_UNJUDGED_TAG`);超预算的不是未判,是拒。
  */
-export declare function toolMatcherIssue(config: HooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): ToolMatcherIssue | undefined;
+export declare function toolMatcherIssue(config: RunnableHooksConfig, depth: MatcherEvalDepth, budget?: MatcherEvalBudget): ToolMatcherIssue | undefined;
+/** 坐标出门形:`settings.` + 契约包唯一的 stringify 点({@link formatConfigPath}),事件名等键段是用户文本 ⇒ 先过 {@link outgoingPath}(凭据形不原样回显)。 */
+export declare function hooksCoordinate(path: ConfigPath): string;
 /**
- * 把 wire 上的 untrusted `settings.hooks` 校验成契约 {@link HooksConfig} + 服务侧上限。
- * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop,由调用方选。
+ * 把 wire 上的 untrusted `settings.hooks` 判成 {@link RunnableHooksConfig} + 服务侧上限 —— **hooks 配置在本仓的唯一入口**。
+ *
+ *  · **一只读者**:合不合法只问契约包的 {@link classifyHooksConfig}(入参是 `{ hooks: raw }`,与契约 zod 面 `HooksConfig` 是同一读法的投影)。本仓只收 `loaded`:
+ *    一块被剔(`loaded-partial`)或整份被拒(`rejected`)都是拒 —— wire 面「剔掉坏块、其余照装」会让写的人以为生效的钩子无声消失(分类器的宽松粒度是读设置文件的宿主用的)。
+ *    拒句 = 分类器给的**码 + 坐标 + 坏字段**经 {@link hooksPieceRefusal} 铸(分类器不写句子)。
+ *  · **本仓不执行的条目类型整份拒**:分类器受理契约的全部五型,而本仓只跑 {@link SUPPORTED_HOOK_ENTRY_TYPES}。含其余类型的配置整份拒,不留跳过臂。
+ *  · **服务侧上限**(广度闸;契约本身不设量纲)。
+ *
+ * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop(hooks 整只不采纳),由调用方选;**读者与句子两腿同一只**,后果按腿分。
  */
 export declare function parseHooksConfig(raw: unknown): ParseHooksConfigResult;
 /**
@@ -270,7 +315,7 @@ export type HookLlmCall = (opts: {
 }>;
 /** 失败判别码(B8:判别一律走码,禁按 error 文案分支——v3.1 批2,统检第二波 high)。error 仍是给人看的
  *  自由文本;code 是给控制流的。缺席=未分类失败(不重试、不特判)。 */
-export type HookLlmFailureCode = "no_content" | "hard_timeout";
+export type HookLlmFailureCode = "no_content" | "hard_timeout" | "redirect_refused";
 /**
  * hook 上下文片段 → 喂给模型的单串。**所有** `additionalContext` 聚合点的唯一属主(此前是同一个
  * `contexts.join("\n")` 表达式抄在二十余处,总量帽无处可挂 —— 那正是漂移成因)。
@@ -320,10 +365,10 @@ export interface LlmHookExtra {
     transcript?: string;
 }
 /**
- * 把校验过的 {@link HooksConfig} 翻成 core `Hooks` 回调(阶段二:engine-owned 9 事件全点亮)。
+ * 把校验过的 {@link RunnableHooksConfig} 翻成 core `Hooks` 回调(阶段二:engine-owned 9 事件全点亮)。
  * 没有可点亮的条目 → undefined(spec 不挂 hooks,deps 路径原样)。
  */
-export declare function createTaskHooks(config: HooksConfig, ctx: HookRunnerContext): Hooks | undefined;
+export declare function createTaskHooks(config: RunnableHooksConfig, ctx: HookRunnerContext): Hooks | undefined;
 /**
  * 把部署级 hooks 基线(deps.hooks,如 TOOL_TRACE 观测)折进 task 级 hooks——core 是整槽覆盖
  * (`spec.hooks ?? deps.hooks`),不折叠就静默 shadow 部署观测(runtask gateBaseline 注释点名的坑)。
@@ -338,4 +383,5 @@ export declare function createTaskHooks(config: HooksConfig, ctx: HookRunnerCont
  * 单在则透传。
  */
 export declare function composeHooks(deployment: Hooks | undefined, task: Hooks): Hooks;
+export {};
 //# sourceMappingURL=hook-runner.d.ts.map