@sema-agent/server 7.146.0 → 7.148.0

package/dist/model-entry-refusal.js

@@ -26,36 +26,43 @@ export function judgeCatalogEntry(m, ctx) {
     const shape = ModelEntry.safeParse(m);
     if (!shape.success) {
         const fields = describeSchemaIssueFields(shape.error);
-        return entryInvalidRefusal(typeof m.id === "string" ? m.id : "", typeof m.provider === "string" ? m.provider : "", fields, describeSchemaIssues(shape.error) ?? fields.join(", "));
+        return { ok: false, refusal: entryInvalidRefusal(typeof m.id === "string" ? m.id : "", typeof m.provider === "string" ? m.provider : "", fields, describeSchemaIssues(shape.error) ?? fields.join(", ")) };
     }
-    const headers = readCatalogEntryHeaders(m.headers, m.api);
+    const e = shape.data;
+    const headers = readCatalogEntryHeaders(e.headers, e.api);
     if (!headers.ok)
-        return entryInvalidRefusal(m.id, m.provider, headers.fields, headers.issue);
-    if (Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0) {
+        return { ok: false, refusal: entryInvalidRefusal(e.id, e.provider, headers.fields, headers.issue) };
+    if (e.promptGuidance !== undefined && e.promptGuidance.length > 0) {
         return {
-            ...refusalCause("config.model_entry_invalid"),
-            id: m.id,
-            provider: m.provider,
-            fields: ["promptGuidance"],
-            detail: "the catalog entry carries per-model guidance sentences (promptGuidance), which the engine no longer delivers — the entry is not served here " +
-                "rather than served with its sentences silently dropped; move each sentence into a center or deployment prompt overlay on the behavior band " +
-                "and remove promptGuidance from the entry to bring it back",
+            ok: false,
+            refusal: {
+                ...refusalCause("config.model_entry_invalid"),
+                id: e.id,
+                provider: e.provider,
+                fields: ["promptGuidance"],
+                detail: "the catalog entry carries per-model guidance sentences (promptGuidance), which the engine no longer delivers — the entry is not served here " +
+                    "rather than served with its sentences silently dropped; move each sentence into a center or deployment prompt overlay on the behavior band " +
+                    "and remove promptGuidance from the entry to bring it back",
+            },
         };
     }
-    const lane = catalogBrainLane(m.provider);
+    const lane = catalogBrainLane(e.provider);
     const mount = laneMount(lane, ctx);
     if (!mount.mounted) {
         return {
-            ...refusalCause("config.model_no_brain"),
-            id: m.id,
-            provider: m.provider,
-            fields: [],
-            detail: `provider "${m.provider}" rides the ${lane} brain, which is not mounted on this deployment — the entry is not served here ` +
-                `(it is never routed to another brain with its own key); set ${mount.how}, ` +
-                'or change the entry\'s provider to an OpenAI-compatible route ("gateway" / "vllm") with its own baseUrl',
+            ok: false,
+            refusal: {
+                ...refusalCause("config.model_no_brain"),
+                id: e.id,
+                provider: e.provider,
+                fields: [],
+                detail: `provider "${e.provider}" rides the ${lane} brain, which is not mounted on this deployment — the entry is not served here ` +
+                    `(it is never routed to another brain with its own key); set ${mount.how}, ` +
+                    'or change the entry\'s provider to an OpenAI-compatible route ("gateway" / "vllm") with its own baseUrl',
+            },
         };
     }
-    return undefined;
+    return { ok: true, entry: e };
 }
 function entryInvalidRefusal(id, provider, fields, issues) {
     return {
@@ -67,6 +74,9 @@ function entryInvalidRefusal(id, provider, fields, issues) {
             "deployment's catalog on its own (the other entries keep serving) instead of being served with a value nothing validated; fix the entry to bring it back",
     };
 }
+function droppedRowEnabled(row) {
+    return row.identity?.enabled !== false;
+}
 const MALFORMED_CARRIER_NOT_A_LIST = "(droppedCatalogEntries is not a list)";
 export function judgeCatalogEntries(enabled, ctx, dropped) {
     const usable = [];
@@ -75,15 +85,15 @@ export function judgeCatalogEntries(enabled, ctx, dropped) {
         Object.defineProperty(refused, name, { value: r, enumerable: true, writable: true, configurable: true });
     };
     for (const m of enabled) {
-        const r = judgeCatalogEntry(m, ctx);
-        if (r === undefined)
-            usable.push(m);
+        const v = judgeCatalogEntry(m, ctx);
+        if (v.ok)
+            usable.push(v.entry);
         else
-            mint(String(m.name), r);
+            mint(String(m.name), v.refusal);
     }
     const rows = dropped === undefined ? [] : Array.isArray(dropped) ? dropped : undefined;
     if (rows === undefined)
-        return { usable, refused, malformed: [MALFORMED_CARRIER_NOT_A_LIST], dropped: [] };
+        return { usable, refused, malformed: [MALFORMED_CARRIER_NOT_A_LIST], dropped: [], manages: true };
     const malformed = [];
     const carried = [];
     for (const d of rows) {
@@ -95,13 +105,13 @@ export function judgeCatalogEntries(enabled, ctx, dropped) {
         }
         carried.push(row.data);
         const { identity } = row.data;
-        if (identity?.name === undefined || identity.enabled === false)
+        if (!droppedRowEnabled(row.data) || identity?.name === undefined)
             continue;
         if (Object.hasOwn(refused, identity.name))
             continue;
         mint(identity.name, entryInvalidRefusal(identity.id ?? "", "", row.data.fields, row.data.issues));
     }
-    return { usable, refused, malformed, dropped: carried };
+    return { usable, refused, malformed, dropped: carried, manages: enabled.length > 0 || malformed.length > 0 || carried.some(droppedRowEnabled) };
 }
 export function buildModelRefusalsSignal(v) {
     if (v === undefined)
@@ -152,6 +162,15 @@ export function modelUnavailableMessage(field, requested, name, r) {
     const alias = requested === name ? "" : ` (catalog entry "${name}")`;
     return `${field} "${echoModelRef(requested)}"${alias} is published in the catalog but unavailable on this deployment [${r.code}] — ${r.detail}`;
 }
+export function modelNotAllowedMessage(field, requested, resolved) {
+    return `${field} "${echoModelRef(requested)}" is not @-mentionable on this deployment (it resolves to catalog model "${resolved}") — which models can be @-mentioned is configured by the operator (models.atMention)`;
+}
+function candidateFellBackClause(notes) {
+    if (notes === undefined || notes.length === 0)
+        return "";
+    const rows = notes.map((n) => `"${n.document}" [${n.code}] ${n.cause}${n.path !== undefined ? `: ${n.path}` : ""}`);
+    return ` (the config candidate was rejected whole and none of its domains applied, so its catalog is not in this table; fix or remove the named document(s) — the config_candidate_rejected warn line has the full diagnostics — rejected: ${rows.join(" | ")})`;
+}
 export function defaultModelRefusal(view, leg) {
     if (Object.hasOwn(view.models, DEFAULT_MODEL_REF) && view.models[DEFAULT_MODEL_REF] !== undefined)
         return undefined;
@@ -161,6 +180,7 @@ export function defaultModelRefusal(view, leg) {
         case "env":
             return (`MODEL_ID is required when no catalog default resolves [${DEFAULT_MODEL_MISSING_CODE}] — this model table has no default model` +
                 unavailable +
+                candidateFellBackClause(view.candidateRejectionNotes) +
                 ". Set MODEL_ID=<model name your gateway serves>, or enable at least one model this host can serve in the catalog " +
                 "(config.d/models.json, or the web-admin) — either one is enough (a web-admin that answers after the boot budget " +
                 "counts as absent at boot: raise CONFIG_BOOT_FETCH_BUDGET_MS to wait for it).");

package/dist/model-plane-face.d.ts

@@ -23,13 +23,18 @@
  *  · `refusalCode` / `gap` —— **起服路由判官对当前 config 的判决**:`judgeServedModelRoute` 同一只函数(装配第 2 段与 `run-local` 调的就是它),通过 ⇒ 两键缺席。
  *    进程既然起来了,正常是缺席;测试夹具 / 自建装配 / 不拒启的入口可能在场 —— 如实投,不替它们编造通过。**不带句子**(拒因句只走日志与起服错误)。
  *
- * ## 只在起服后可答
- * 读面挂在运行中的进程上;判官必须在目录应用之后调(`judgeServedModelRoute` 头注),起服前没有「将要服务的表」,所以没有起服前的预判口。
+ * ## 两条读路,一只读口
+ * 判官必须在目录应用之后调(`judgeServedModelRoute` 头注):「将要服务的表」在装配第 2 段末才定形。读这一格的只有 {@link readModelPlaneFace} 一只,两条读路各调一次:
+ *  · 起服后 —— `GET /v1/models` 的 `modelPlane`(`http/routes/capabilities.ts`;座经 `ServiceDeps` 的两只取值口转到 web-admin 运行时);
+ *  · 起服前 —— 无监听探针 `model-plane-probe.ts`:跑**同一对**装配段(`runStage01` → `runStage02`)到模型表定形即停,同一只读口读同一个运行时的座,stdout 一行。
+ * 两路读同一批事实、同一只铸点 ⇒ 同一份部署配置、同一时点(第 2 段末;起服拉取超窗时那一份迟到的候选两路都还没采纳)两路的 JSON 字节同;
+ * 壳不再需要起服前的第二份判官。
  */
 import type { ModelPlaneRefusalCode } from "@sema-agent/settings-schema";
 import { type ModelRouteEndpointVerdict, type ModelRouteGap, type ServedModelRouteView } from "./model-route-endpoint.js";
 import { type ModelTableLeg } from "./model-select.js";
 import type { CandidateRejection } from "./web-admin-client/candidate-gate.js";
+import { type ServiceConfig } from "./config.js";
 /** `modelPlane.catalog` 的闭集(消费方用穷举 switch —— 加一词不补臂 ⇒ 编译红)。 */
 export declare const CATALOG_STANCES: readonly ["absent", "adopted", "refused"];
 export type CatalogStance = (typeof CATALOG_STANCES)[number];
@@ -44,14 +49,17 @@ export interface ModelPlaneFace {
     /** 最新到达的目录候选被模型面组拒的码(见文件头;缺席 ⇔ 最新到达的候选没有被模型面组拒)。 */
     readonly planeRefusalCode?: ModelPlaneRefusalCode;
 }
-/** {@link buildModelPlaneFace} 读的进程事实(都由调用方从各自的座取,本函数不碰任何全局)。 */
-export interface ModelPlaneFacts {
-    /** 严格名册布防(`isRosterGateArmed`):env 表是占位、不被判(装配第 2 段传的是同一只谓词)。 */
-    readonly envTableIsPlaceholder: boolean;
-    /** 候选判官最近一次整拒的结论座(`WebAdminRuntime.candidateRejectionState()`);座空 / 没有配置管道 ⇒ `undefined`。 */
-    readonly candidateRejection: CandidateRejection | undefined;
-    /** 最新到达的目录候选被模型面组拒的码(`WebAdminRuntime.latestPlaneRefusalState()`);没有 / 没有配置管道 ⇒ `undefined`。 */
-    readonly latestPlaneRefusal: ModelPlaneRefusalCode | undefined;
+/**
+ * 模型面读数取事实的两只座 —— 结构上就是 web-admin 运行时(`WebAdminRuntime`)的同名两只取值口:起服前探针递运行时本身,`GET /v1/models` 递 `ServiceDeps`
+ * (装配第 10 段把这两只接成 `() => webAdmin.<同名>()`)。没有配置管道的装配(纯 env 夹具 / 自建装配)两只都缺席 ⇒ 读作「没有整拒」。
+ */
+export interface ModelPlaneSeats {
+    readonly candidateRejectionState?: () => CandidateRejection | undefined;
+    readonly latestPlaneRefusalState?: () => ModelPlaneRefusalCode | undefined;
 }
-export declare function buildModelPlaneFace(config: ServedModelRouteView, facts: ModelPlaneFacts): ModelPlaneFace;
+/**
+ * `modelPlane` 的**唯一读口**(起服后的 HTTP 路由与起服前的探针各调一次,见文件头「两条读路,一只读口」):进程事实只在这里取齐 ——
+ * 名册布防读 `isRosterGateArmed(config.webAdmin)`(装配第 2 段的路由判官传的同一只谓词),两只座读调用方递来的运行时取值口 —— 再交铸点。
+ */
+export declare function readModelPlaneFace(config: ServedModelRouteView & Pick<ServiceConfig, "webAdmin">, seats: ModelPlaneSeats): ModelPlaneFace;
 //# sourceMappingURL=model-plane-face.d.ts.map

package/dist/model-plane-face.js

@@ -1,5 +1,6 @@
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { servedModelTableLeg } from "./model-select.js";
+import { isRosterGateArmed } from "./config.js";
 export const CATALOG_STANCES = ["absent", "adopted", "refused"];
 function catalogStanceOf(served, wholeRefused) {
     if (wholeRefused)
@@ -11,7 +12,14 @@ function catalogStanceOf(served, wholeRefused) {
             return "absent";
     }
 }
-export function buildModelPlaneFace(config, facts) {
+export function readModelPlaneFace(config, seats) {
+    return buildModelPlaneFace(config, {
+        envTableIsPlaceholder: isRosterGateArmed(config.webAdmin),
+        candidateRejection: seats.candidateRejectionState?.(),
+        latestPlaneRefusal: seats.latestPlaneRefusalState?.(),
+    });
+}
+function buildModelPlaneFace(config, facts) {
     const servedTable = servedModelTableLeg(config);
     const wholeRefused = facts.candidateRejection !== undefined || facts.latestPlaneRefusal !== undefined;
     const verdict = judgeServedModelRoute(config, { envTableIsPlaceholder: facts.envTableIsPlaceholder });

package/dist/model-plane-probe.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model-plane-probe.d.ts.map

package/dist/model-plane-probe.js

@@ -0,0 +1,17 @@
+import { fatalExit } from "./boot/fatal-exit.js";
+import { runStage01 } from "./boot/stage-01-config.js";
+import { runStage02 } from "./boot/stage-02-web-admin-pull.js";
+import { readModelPlaneFace } from "./model-plane-face.js";
+import { reserveStdoutForAnswer, writeCliResult } from "./observability/logger.js";
+async function probe() {
+    reserveStdoutForAnswer();
+    const s02 = await runStage02(runStage01());
+    const answer = JSON.stringify(readModelPlaneFace(s02.config, s02.webAdmin));
+    await s02.webAdmin.stopRefreshLoop();
+    await writeCliResult(answer);
+    process.exit(0);
+}
+void probe().catch((err) => {
+    fatalExit(err);
+});
+//# sourceMappingURL=model-plane-probe.js.map

package/dist/model-provider.d.ts

@@ -120,9 +120,9 @@ export declare function routeTableOf<R extends object>(view: {
  * 所以答案映到本仓两词闭集:`"anthropic"` ⇒ anthropic 腿,`undefined` ⇒ 网关腿;别的名字结构上不可能(表里没有那个键),真撞上 ⇒ **响亮抛**([ref]:运行期
  * miss 臂必须说出来,不静默折网关)。
  *
- * [ref](7.101.0):**目录条目**到不了「anthropic 词、路由没装」这一格 —— 模型面 stage 的逐条判据把它判成不可用(`config.model_no_brain`,那一判问的是
- * 「词想要的腿装没装」,{@link catalogBrainLane},与本判词是两个问题)。这一格今天只剩 **env 腿**:`MODEL_PROVIDER=anthropic` 而没配 anthropic 凭据的部署,
- * env 模型落网关腿、用的是网关自己的 `MODEL_API_KEY`(凭据与端点同属网关,不越界)。
+ * 「词想要的腿」({@link catalogBrainLane})与本判词的答案不是同一条的那一格(anthropic 词、路由没装)**不被服务**:目录条目在模型面 stage 的逐条判据里判成
+ * 不可用(`config.model_no_brain`);env 表在起服路由判官那里整表拒(`model-route-endpoint.ts`,缺口 `lane_credential_missing`,网关在不在都拒)。
+ * 所以到得了派发面的条目,词与本判词恒同一条;这里把 `undefined` 读成网关腿,是引擎路由器 fallback 的逐字转写,不是对那一格的放行。
  */
 export declare function brainLaneFor(provider: string | undefined, routes: Readonly<Record<string, unknown>>): ModelBrainLane;
 //# sourceMappingURL=model-provider.d.ts.map

package/dist/model-route-endpoint.d.ts

@@ -13,6 +13,9 @@
  * **`MODEL_GATEWAY_BASEURL` 没有出厂缺省;配置能派发到的每一条 openai 兼容路由,都必须解析到一个显式配置的
  * base URL(路由自己的 `baseUrl`,或显式设了的网关),否则拒。** 附带一条同类:备用网关
  * (`MODEL_GATEWAY_FALLBACK_URLS`)是主网关的镜像,没有主就没有镜像 ⇒ 拒。
+ * 同一只判官的第二条:**一条条目的 provider 词想要的腿(`catalogBrainLane`)与引擎路由器对本部署路由表的答案(`brainLaneFor`)不是同一条 ⇒ 拒**
+ * (今天只有一形:`anthropic` 词而 anthropic 路由没装)—— 词与实际线路只许一种说法:不把它交给网关腿冒名服务(网关拿自己的钥匙、自己的线路格式与
+ * 缓存口径答它,而条目行上的 `api` / 缓存族仍按词写),网关在不在都一样。
  *
  * ## 执法点(判据只在这里,执法点在调用处 —— 与 [ref] `gateway-url-userinfo` 同形)
  * **判官只判「将要服务的那张表」,拒因句按视图说真话**(视图词 = {@link ModelTableLeg} 两词,进判据入参,不靠调用方拼句):
@@ -21,7 +24,7 @@
  *    严格名册布防(`isRosterGateArmed`)时 env 表是占位、从不被派发 ⇒ 不判它(备用网关那一条与表无关,照判)。
  *    不在 `loadConfig()`:那是目录应用**之前**,env 表还不知道会不会服务(目录一旦采纳就整张换掉它);
  *  · 壳 / 包问「这台引擎服务哪张表、起服判官怎么说」读 `GET /v1/models` 的 `modelPlane`(`model-plane-face.ts`,同一只 {@link judgeServedModelRoute});
- *    起服前没有「将要服务的表」可判,所以没有起服前的预判口;
+ *    引擎起来之前读无监听探针(`model-plane-probe.ts`:跑同一对装配段到模型表定形即停,同一只读口)—— 不另设起服前的第二判官;
  *  · 热路径:`web-admin-client/apply-effective.ts` 的模型面 stage ⇒ 模型面组拒(opus 腿 O3:同候选其余组照落)、上一代模型面继续服务(目录视图);
  *  · run-local:配置源解析完之后按真要派发的表判(`run-local.ts`)—— 本入口没有名册门,不豁免占位;
  *  · 登记:`config-invariants.ts` 的 `model-route-endpoint` 条(表的「不许有表外不变量」职责);
@@ -49,8 +52,8 @@ export declare const GATEWAY_FALLBACK_WITHOUT_PRIMARY_CODE = "config.gateway_fal
  *  · `endpoint_missing` —— 缺的是网关端点:openai 兼容腿上的条目解析不到 base URL(或备用网关设了、主网关没设);
  *    出路 = 设 `MODEL_GATEWAY_BASEURL`,或(目录视图)给条目自己的 `baseUrl` / (env 视图)挂 anthropic 路由、或不设 `MODEL_ID` 让目录缺省服务;
  *  · `lane_credential_missing` —— 缺的是**车道凭据**:条目的 provider 词是 `anthropic`(用户选的是 anthropic 车道),
- *    却因 `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` 都没有而没装上 anthropic 路由、落进了 openai 腿,那条腿又没有端点;
- *    出路 = 补那两把钥匙之一(设网关是另一条出路,拒因句一并给)。
+ *    却因 `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` 都没有而没装上 anthropic 路由 —— 词想要的腿与路由器会给的腿不是同一条,网关在不在都拒;
+ *    出路 = 补那两把钥匙之一,或把词改成 openai 兼容腿的词(env 视图:`MODEL_PROVIDER=gateway`;目录视图:条目的 provider),拒因句一并给。
  *
  * **声明序 = 语义序**;加一词 ⇒ 所有穷举 switch 当场编译红。
  */
@@ -94,8 +97,9 @@ export interface ModelRouteEndpointView {
  *
  * 判序即语义:
  *  ① 备用网关设了、主网关没设 ⇒ `config.gateway_fallback_without_primary`(备用是主的镜像,这一条与条目无关,先说);
- *  ② 逐条目:按 {@link brainLaneFor}(引擎路由器对本部署路由表的答案)落 openai 腿、且 {@link openaiRouteBaseUrl} 解析不到 ⇒ 收集名字,
- *     一句话**全部点名**(运维一次改完,而不是改一个撞下一个)。
+ *  ② 逐条目:词想要的腿({@link catalogBrainLane})≠ 引擎路由器对本部署路由表的答案({@link brainLaneFor})⇒ 收进「车道没装」一组;
+ *     其余落 openai 腿、且 {@link openaiRouteBaseUrl} 解析不到 ⇒ 收进「端点缺」一组。两组一句话**全部点名**(运维一次改完,而不是改一个撞下一个),
+ *     车道没装的一组在前(缺口词 `lane_credential_missing`)。
  *
  * `default` 键是目录里另一条的别名(env 腿 `{default: m, [m.id]: m}`、center 腿 `models.default = models[picked]`),
  * 与别的键指同一只对象时不重复点名;只有它一个键时(手搓夹具)照样点名 `default`。

package/dist/model-route-endpoint.js

@@ -31,21 +31,43 @@ export function judgeModelRouteEndpoint(view, leg) {
     }
     const routes = routeTableOf(view);
     const entries = Object.entries(view.models ?? {});
+    const laneUnmounted = [];
     const unresolved = [];
-    let laneCredentialMissing = false;
     for (const [name, m] of entries) {
         if (name === DEFAULT_MODEL_REF && entries.some(([k, other]) => k !== name && other === m))
             continue;
-        if (brainLaneFor(m.provider, routes) !== "gateway")
+        const lane = brainLaneFor(m.provider, routes);
+        if (catalogBrainLane(m.provider) !== lane) {
+            laneUnmounted.push(`"${name}"`);
+            continue;
+        }
+        if (lane !== "gateway")
             continue;
         if (openaiRouteBaseUrl(m.baseUrl, gateway) !== undefined)
             continue;
-        laneCredentialMissing ||= catalogBrainLane(m.provider) === "anthropic";
-        unresolved.push(unresolvedRouteLabel(name, m.provider));
+        unresolved.push(`"${name}"`);
+    }
+    const endpointMissing = unresolved.length > 0 ? routeEndpointMissingRefusal(unresolved, leg) : undefined;
+    if (laneUnmounted.length > 0) {
+        const reason = laneUnmountedRefusal(laneUnmounted, leg) + (endpointMissing !== undefined ? ` Also: ${endpointMissing}` : "");
+        return { code: MODEL_ROUTE_ENDPOINT_MISSING_CODE, gap: "lane_credential_missing", reason };
+    }
+    return endpointMissing === undefined ? undefined : { code: MODEL_ROUTE_ENDPOINT_MISSING_CODE, gap: "endpoint_missing", reason: endpointMissing };
+}
+function laneUnmountedRefusal(quotedNames, leg) {
+    const one = quotedNames.length === 1;
+    const head = `${one ? `model ${quotedNames[0]} asks` : `models ${quotedNames.join(", ")} ask`} for the anthropic lane (provider "anthropic"), but no Anthropic route is mounted on this ` +
+        `deployment — ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN are both unset [${MODEL_ROUTE_ENDPOINT_MISSING_CODE}]. ${one ? "It is" : "They are"} not served rather than ` +
+        "handed to the openai-compatible gateway under an anthropic label (that lane would answer with its own key, its own wire format and its own cache accounting). ";
+    switch (leg) {
+        case "env":
+            return (head +
+                "Pick one way out: (1) set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN (plus ANTHROPIC_BASE_URL for a non-default endpoint); " +
+                "(2) set MODEL_PROVIDER=gateway (or vllm) to serve the env model on the openai-compatible gateway; " +
+                "(3) leave MODEL_ID unset and let the default entry of a catalog (config.d/models.json, or the web-admin) serve — a catalog in force replaces the env model table.");
+        case "catalog":
+            return head + `Set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN in this service's env, or change ${one ? "the entry's" : "each named entry's"} provider to an OpenAI-compatible route ("gateway" / "vllm") with its own baseUrl.`;
     }
-    if (unresolved.length === 0)
-        return undefined;
-    return { code: MODEL_ROUTE_ENDPOINT_MISSING_CODE, gap: laneCredentialMissing ? "lane_credential_missing" : "endpoint_missing", reason: routeEndpointMissingRefusal(unresolved, leg) };
 }
 function routeEndpointMissingRefusal(quotedNames, leg) {
     const one = quotedNames.length === 1;

package/dist/model-select.d.ts

@@ -84,6 +84,22 @@ export declare function resolveTaskModel(bodyModel: unknown, objective: string,
     notAllowed?: ModelNotAllowed;
     unavailable?: ModelUnavailable;
 };
+/** 用户选择被判的那一份模型面(`ServiceConfig` 结构上满足):目录、档位绑定、不可用条目、本代 `atMention` —— 四件出自同一份配置。 */
+export interface UserModelPlane<M> {
+    readonly models: Record<string, M>;
+    readonly tiers: Record<string, string> | undefined;
+    readonly modelRefusals: Readonly<Record<string, ModelEntryRefusal>> | undefined;
+    readonly atMention: AtMention;
+}
+/**
+ * 🔴 **用户选择的唯一入口**(请求面 `body.model` / `settings.model`、objective 内联 `@name`,每一条提交腿同调):在**可选目录**({@link selectableCatalog})上解析、
+ * 用本代 `atMention` 判许可({@link resolveTaskModel} → {@link isAtMentionable})。可选目录随结果交回(调用方其余显式选择通道 —— `compactionModel` /
+ * `agents[].model` / 未知模型拒体的 `available` —— 判的是同一张,不另铸)。哪张目录、哪份许可只在这里取,任何一条腿都没有「取契约缺省」的第二读法。
+ */
+export declare function pickUserModel<M>(plane: UserModelPlane<M>, bodyModel: unknown, objective: string): {
+    selectable: Record<string, M>;
+    picked: ReturnType<typeof resolveTaskModel>;
+};
 /**
  * [ref] 判别式拒因:这次**用户选择**点中的是一条已发布、但本部署不可用的目录条目(`config.modelRefusals`)。
  * 与 {@link ModelNotAllowed} 同一种处置口:本函数不 throw,调用点按 leg 分流(fresh 400 `request.model_unavailable` /

package/dist/model-select.js

@@ -57,6 +57,10 @@ export function resolveTaskModel(bodyModel, objective, catalog, atMention, refus
         ...(unavailable ? { unavailable } : {}),
     };
 }
+export function pickUserModel(plane, bodyModel, objective) {
+    const selectable = selectableCatalog(plane.models, plane.tiers, plane.modelRefusals);
+    return { selectable, picked: resolveTaskModel(bodyModel, objective, selectable, plane.atMention, plane.modelRefusals) };
+}
 export function selectableCatalog(models, tiers, refusals) {
     const expanded = (expandTiers(models, tiers ?? {}) ?? models);
     const reserved = Object.keys(refusals ?? {}).filter((n) => Object.hasOwn(expanded, n) && !Object.hasOwn(models, n));

package/dist/mountinfo.d.ts

@@ -0,0 +1,37 @@
+/** mountinfo 的一行里两位消费者要的几格。 */
+export interface MountRow {
+    readonly id: string;
+    readonly parent: string;
+    /** 这只挂载的文件系统(`主:次` 设备号;同一个超级块的挂载同号)。 */
+    readonly dev: string;
+    /** 这只挂载在源文件系统里的根路径(第 4 格;整只文件系统挂上来时是 `/`,绑定挂载一只子目录时是那只子目录)。 */
+    readonly root: string;
+    readonly mountPoint: string;
+    readonly options: readonly string[];
+    /** `-` 之后第 1 格(`ext4` / `overlay` / `tmpfs` / `nfs4` …)。 */
+    readonly fsType: string;
+    /** `-` 之后第 2 格(块设备 `/dev/…`、网络盘的 `主机:/导出`、伪文件系统的名字)。 */
+    readonly source: string;
+}
+/** 一份挂载表的解析结果:成形的行 + 读不懂的行数(非空却缺格的行;`-` 之后三格 —— fs 类型 / 挂载源 / 超级块选项 —— 缺任一格或为空串的行照样进表,同时计一行)。 */
+export interface MountTable {
+    readonly rows: readonly MountRow[];
+    readonly malformed: number;
+}
+/** `ancestor` 是不是 `p` 本身或它的祖先(按路径段比:`/etc/semaX` 不是 `/etc/sema` 的后代)。 */
+export declare const coversPath: (ancestor: string, p: string) => boolean;
+/**
+ * 逐行解析(纯函数)。空行不计;前 6 格缺席或为空、或 `-` 分隔缺席的行不进表、计一行读不懂;`-` 之后三格(内核恒写这三格,没有挂载源时写 `none`)
+ * 缺任一格或为空串的行进表(配置根信任判只看行,行为不变)、同时计一行读不懂 —— 持久性判者见到读不懂就整表不判(看见的那一只可能正是读丢的那一行)。
+ */
+export declare function parseMountinfo(text: string): MountTable;
+/**
+ * 走路径时**真正看见的**那一只挂载(按拓扑,不按行序 —— 挂载被 move 过去时 mountinfo 的行序不变):从这个视图的顶(parent 不在表里的行)起,
+ * 每一层在当前挂载的子挂载里找盖住 `dir` 的、挂载点最短的那一只(沿路径先跨进的那一只;同一挂载点叠挂时上层的 parent 是下层,下一层接着找),直到没有子挂载盖住它。
+ * 同一层里挂载点最短的有两只以上(传播出来的影子挂载:同父同点,内核按自己的哈希链查,mountinfo 判不出谁可见)⇒ `"ambiguous"` —— 判不出就不认,不靠行序猜。
+ * 没有任何一只盖住 `dir`(表里没有视图的顶)⇒ `undefined`。
+ */
+export declare function visibleMountOf(rows: readonly MountRow[], dir: string): MountRow | "ambiguous" | undefined;
+/** 生产的挂载表:Linux 上读本进程的 mountinfo(读不出 ⇒ 抛,调用方各自处置);别的平台没有 procfs 挂载表 ⇒ `null`。 */
+export declare function readProcessMountinfo(): Promise<string | null>;
+//# sourceMappingURL=mountinfo.d.ts.map

package/dist/mountinfo.js

@@ -0,0 +1,47 @@
+import { readFile } from "node:fs/promises";
+import { HOST_PLATFORM } from "./plugins/host-platform.js";
+const unescapeMountinfoPath = (field) => field.replace(/\\([0-7]{3})/g, (_m, oct) => String.fromCharCode(Number.parseInt(oct, 8)));
+export const coversPath = (ancestor, p) => ancestor === p || ancestor === "/" || p.startsWith(`${ancestor}/`);
+export function parseMountinfo(text) {
+    const rows = [];
+    let malformed = 0;
+    for (const line of text.split("\n")) {
+        if (line === "")
+            continue;
+        const f = line.split(" ");
+        const [id, parent, dev, root, mountPoint, options] = f;
+        const sep = f.indexOf("-", 6);
+        if (sep === -1 || !id || !parent || !dev || !root || !mountPoint || !options) {
+            malformed++;
+            continue;
+        }
+        const fsType = f[sep + 1];
+        const source = f[sep + 2];
+        if (!fsType || !source || !f[sep + 3])
+            malformed++;
+        rows.push({ id, parent, dev, root: unescapeMountinfoPath(root), mountPoint: unescapeMountinfoPath(mountPoint), options: options.split(","), fsType: fsType ?? "", source: unescapeMountinfoPath(source ?? "") });
+    }
+    return { rows, malformed };
+}
+export function visibleMountOf(rows, dir) {
+    const ids = new Set(rows.map((r) => r.id));
+    let level = rows.filter((r) => !ids.has(r.parent) || r.parent === r.id);
+    let visible;
+    for (let depth = 0; depth <= rows.length; depth++) {
+        const covering = level.filter((r) => coversPath(r.mountPoint, dir));
+        if (covering.length === 0)
+            break;
+        const shortest = Math.min(...covering.map((r) => r.mountPoint.length));
+        const first = covering.filter((r) => r.mountPoint.length === shortest);
+        if (first.length !== 1)
+            return "ambiguous";
+        const next = first[0];
+        visible = next;
+        level = rows.filter((r) => r.parent === next.id && r.id !== next.id);
+    }
+    return visible;
+}
+export async function readProcessMountinfo() {
+    return HOST_PLATFORM === "linux" ? readFile("/proc/self/mountinfo", "utf8") : null;
+}
+//# sourceMappingURL=mountinfo.js.map

package/dist/namespaced-rule-name.d.ts

@@ -7,7 +7,8 @@
  * (本文件那只判与它在会话规则写口、SQL 店写口、四张条目表上的调用)退役,零双读。
  *
  * **调它的面**(点名,不是「每个面」):运维三张名表(`APPROVAL_REQUIRE` / `DENY` / `NEVER_AUTO`)与中心下发的同名表、请求
- * `settings.permissions.{ask,deny}`(经 `config.ts` 的 `unmatchableToolNamesRefusal`)。会话规则写口直接调 core 的 `assertSessionRuleNamesCurrent`
+ * `settings.permissions.{ask,deny,neverAuto}`(经 `config.ts` 的 `unmatchableToolNamesRefusal`)。这些面上退役且无后继的名字在**有通告席**的表上不拒、行原样留着(唯一读法 = 引擎的账 {@link retiredLeftOutAccount};
+ * 通告席见 `UnmatchableToolNameJudgment.noticeSeat`;core 7.66.0 [ref] 起请求体 `neverAuto` 也有席 —— 本服务据同一本账铸通告)。会话规则写口直接调 core 的 `assertSessionRuleNamesCurrent`
  * (同一只判官的店形);引擎 allow 层的条目表(请求 `settings.permissions.allow`、运维 `APPROVAL_GRANT`、技能两只清单)交引擎 `compileAllowList`
  * (名册 = {@link TOOL_NAME_ROSTER};判官判非现役的条目读成 `tool_name`,名册里有的只差大小写读成 `near_miss`)。
  * **不调它的面**:`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`、`rules-consent.ts` 与两只持久规则店零判官调用)—— 如实未接,
@@ -18,7 +19,7 @@
  *
  * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表读它)。
  */
-import { type PermissionRule, type RuleToolNameVerdict } from "@sema-agent/core";
+import { retiredToolNameAccount, type PermissionRule, type RuleToolNameVerdict } from "@sema-agent/core";
 /**
  * 一条**规则文本**里的工具名那一段(判官与旧名判据的主语)= core 包根 `parsePermissionRule` 的 `toolName`,原样 —— 引擎的技能编译器
  * (`compileSkillGrant`)与规则编译器读条目用的就是这一只:`Bash(npm:*)` ⇒ `Bash`;`mcp__srv(*)` / `mcp__srv()` / 带首尾空格的 `mcp__srv ` ⇒ 光杆名 `mcp__srv`。
@@ -51,6 +52,31 @@ export declare const NAME_TABLE_BEHAVIOR: "deny";
  * (core 7.55.0 [ref]:`mcp__*` 在 deny / ask 里是这一协议的每一只工具、在 allow 里什么也不是),漏传态度的调用点是编译错,不是一条静默的「不带态度」读法。
  */
 export declare function unmatchableRuleNameOf(name: string, behavior: PermissionRule["behavior"]): UnmatchableRuleName | undefined;
+/** core 7.66.0 [ref] `retiredToolNameAccount` 的答形(包根不导出具名型 ⇒ 从返回型取,不手抄)。 */
+export type RetiredToolNameAccount = NonNullable<ReturnType<typeof retiredToolNameAccount>>;
+/**
+ * **限制表上跳过的那几行**,唯一一只读法 = **引擎的账**(core 7.66.0 [ref] `retiredToolNameAccount`):引擎自己的条目读法(`compileAllowList`)读每一条,
+ * 再问引擎自己的那一问 `isRetiredLeftOut` —— 退役且**无后继**(退役表那一行写 `removed` / `folded into`,不是 `renamed`),且名册里没有它的另一种大小写
+ * (`TEAMCREATE` 旁边挂着 `TeamCreate` ⇒ 那一条是写给那只工具的,照拒)。引擎的工具策略 `deny` / `ask`、任务的工具名清单、技能的 `disallowed-tools` 问的
+ * 就是这一问(core 7.65.0 [ref] / 7.66.0 [ref]);本服务的表问同一本账,不另写判官。7.147.0 及更早本仓按判词自判(`retired` ∧ 无 `currentName`),
+ * 少问名册孪生那一问 —— 同一事实的第二种读法,随 7.66.0 退役(零双读)。
+ * 这样一行够不着任何工具,也没有可以改写成的现名:**不拒、不改写表**(行原样留着 —— 与引擎同:引擎只把它排出拒判,编出的策略里那一行照在,名册里真有同名工具时
+ * 它照管);不拒必须配恰一句话 —— 谁读这张表谁说:引擎读的表(请求体 `settings.permissions` 的规则桶、选择器清单、技能表)由引擎铸 `config.legacy_tool_name`;
+ * 只有本服务读的表(运维 `APPROVAL_REQUIRE` / `DENY` / `NEVER_AUTO`、中心下发的 `approvalRequire`)由读它的那一处在起服 / 落配日志里点名;
+ * 请求体 `settings.permissions.neverAuto`(引擎不读、请求面无日志)由本服务按这本账铸那一条通告(`retired-name-host-notice.ts`)。
+ * 本服务的名册看不到嵌入方自挂的工具,所以「够不着」只对本服务知道的工具成立 —— 去掉这一行会让嵌入方自挂的同名工具失去这条限制(静默放宽),留着它最坏是一条死行。
+ * 有后继的改名(`Task` ⇒ `Agent`、`KillShell` ⇒ `TaskStop`)、无前缀短名、铸不出的对端段不在账里:照拒并给现名 / 出路。
+ * 名册 = {@link TOOL_NAME_ROSTER}(引擎拿这一 run 真挂的名册问;受理口只读得到这一张)。`source` = 这张表的名字(进句子与每条的 `source`,非空)。
+ * `deny` / `ask` 读名同(引擎:两者都收紧)。没有这种行 ⇒ `undefined`。账列至多 32 条(`total` 数全部)。
+ */
+export declare function retiredLeftOutAccount(field: "deny" | "ask", source: string, entries: readonly string[]): RetiredToolNameAccount | undefined;
+/** 一条条目是不是账里那种行(逐条问同一本账;限制表的拒判跳过它)。 */
+export declare function isRetiredLeftOut(entry: string): boolean;
+/** 一张**只有本服务读**的限制名表(运维 `APPROVAL_REQUIRE` / `DENY` / `NEVER_AUTO`、中心下发的 `approvalRequire`)里账上的那几行(带退役表自己那一行),供读表处点名;表本身不动。 */
+export declare function retiredLeftOutEntries(source: string, names: readonly string[]): readonly {
+    readonly entry: string;
+    readonly guidance: string;
+}[];
 /**
  * 判词 → 「为什么永远匹配不到 + 怎么写」(不复述条目本身 —— 调用方的句子已点名它)。引擎判词的 `guidance` 原样带出,是改法指引的**唯一**一句
  * (本仓不在后面追加 1:1 现名:通配名上那个现名是摘要名或更窄的写法,照写不生效;现名过境给机器读的位,如会话规则拒体顶层的 `currentName`);

package/dist/namespaced-rule-name.js

@@ -1,4 +1,4 @@
-import { PROTOCOL_TABLE, catalogToolNames, judgeRuleToolName, parsePermissionRule } from "@sema-agent/core";
+import { PROTOCOL_TABLE, catalogToolNames, judgeRuleToolName, parsePermissionRule, retiredToolNameAccount } from "@sema-agent/core";
 import { HOST_TOOL_NAMES } from "./capabilities/host-tool-names.js";
 import { displayListEntry } from "./list-entry-display.js";
 export function ruleEntryToolName(entry) {
@@ -10,6 +10,15 @@ export function unmatchableRuleNameOf(name, behavior) {
     const verdict = judgeRuleToolName(name, TOOL_NAME_ROSTER, behavior);
     return verdict.kind === "current" ? undefined : verdict;
 }
+export function retiredLeftOutAccount(field, source, entries) {
+    return retiredToolNameAccount({ field, source, entries }, TOOL_NAME_ROSTER);
+}
+export function isRetiredLeftOut(entry) {
+    return retiredLeftOutAccount(NAME_TABLE_BEHAVIOR, "entry", [entry]) !== undefined;
+}
+export function retiredLeftOutEntries(source, names) {
+    return retiredLeftOutAccount(NAME_TABLE_BEHAVIOR, source, names)?.detail.entries.map((e) => ({ entry: e.entry, guidance: e.guidance })) ?? [];
+}
 export function describeUnmatchableRuleName(v, name) {
     switch (v.kind) {
         case "retired":

package/dist/net-address.d.ts

@@ -45,7 +45,7 @@ export declare function createCidrSet(cidrs: readonly ParsedCidr[]): CidrSet;
 /** 可信代理名单(已由配置层逐项校验过的文本)⇒ 集合。坏项 = 装配缝(配置层已先拒),当场抛,不跳过。 */
 export declare function createTrustedProxySet(items: readonly string[]): CidrSet;
 /**
- * 地址的规范形(帽键的唯一拼法):IPv4 原样(`isIP` 已保证点分十进制、无前导零);IPv6 取 WHATWG 的压缩小写形;
+ * 地址的规范形(帽键 / 限流键 / 本机判 / 出网回环判的唯一拼法):IPv4 原样(`isIP` 已保证点分十进制、无前导零);IPv6 取 WHATWG 的压缩小写形;
  * IPv4-mapped IPv6(`::ffff:1.2.3.4` / `::ffff:102:304`)⇒ 点分 IPv4 —— 同一台主机经 IPv4 栈与双栈来时是同一个键。
  * 非地址、带 zone id、带端口、带方括号 ⇒ `undefined`(端口 / 方括号由调用方按自己的文法先剥)。
  */

package/dist/observability/corrupt-read-seat.d.ts

@@ -1,6 +1,6 @@
 import { type FileStorageCorruptReadInfo } from "@sema-agent/core";
 import { type FailOpenTag } from "./fail-open.js";
-import type { Logger } from "./logger.js";
+import { type Logger } from "./logger.js";
 /**
  * 铸一只腐读披露座。
  *
@@ -39,10 +39,10 @@ export declare function createCorruptReadFailOpenSeat(tag: FailOpenTag, leg?: (i
  *
  * ## 逐命中响亮不降级
  * 这一座里有安全轴的脸(session-policy),所以每命中一行 warn 保留(降成「每进程一次」是降级,[ref] 的裁定);**在此之上**,认出的脸另记账:
- *  · session-policy 脸 ⇒ `P-DEBT` tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。core 7.39.2 起按键读拒;
+ *  · session-policy 脸 ⇒ R 类 tag(`server.session-policy.corrupt-read-fail-open`)—— 计数逐次 + 探针行 + 一次性 warn。core 7.39.2 起按键读拒;
  *    core 7.41.0 [ref] 起本会话的枚举拒、别的会话的抹除不动它、重绑带走它 —— 但只对**有归属**的坏行(行里的 `__sid`,否则同名高水位标记的 `__sid`);
- *    无归属的坏行仍按「无规则」(会话规则只许收紧 ⇒ 丢的恰是收紧);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的)。
- *    抹除扫走无归属坏行那一形 core 是否披露、座上数不数得到,本车未亲核(未闭环,收车档登)。放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只登债、不改放行**;
+ *    无从归属的坏行仍按「无规则」(core 已知限制 KL-1299-a 接受:无从归属 ≠ 本会话);座上分不出读法 ⇒ 这一脸每一发都计(含已拒的)。
+ *    抹除扫走无归属坏行那一形 core 是否披露、座上数不数得到,未亲核。放行是 core 的裁定、本仓不包层(源头修复纪律),所以**只记账、不改放行**(R 类:有界放行,计数长期保留);
  *  · 其余脸 ⇒ 不计(见 {@link DurableAbsenceFace})。
  * 记账**先于** warn:记账是总函数,warn 可能抛(core 的 guard 会吞掉那个抛),一次日志故障不许吃掉计数。
  *

package/dist/observability/corrupt-read-seat.js

@@ -1,6 +1,7 @@
 import { join, sep } from "node:path";
 import { readJsonlRecords, resolveDataRoot } from "@sema-agent/core";
 import { recordFailOpen } from "./fail-open.js";
+import { createLogger } from "./logger.js";
 export function createCorruptReadSeat(warn, event, note) {
     return (info) => {
         return warn(event, {
@@ -180,10 +181,11 @@ export class JsonlStoreGate {
             throw new JsonlStoreCorruptError(this.seat, this.path, this.reason);
     }
 }
-const warnToConsole = (event, fields) => console.warn(event, fields);
+const seamLogger = createLogger();
+const warnToLogSeam = (event, fields) => seamLogger.warn(event, fields);
 const isThenable = (v) => typeof v === "object" && v !== null && typeof v.then === "function";
 function guardDisclosure(disclose, event) {
-    const reportSinkFailure = (info, err) => warnToConsole(`${event}_sink_failed`, { kind: info.kind, path: info.path, reason: info.reason, sinkError: err instanceof Error ? err.name : typeof err });
+    const reportSinkFailure = (info, err) => warnToLogSeam(`${event}_sink_failed`, { kind: info.kind, path: info.path, reason: info.reason, sinkError: err instanceof Error ? err.name : typeof err });
     return (info) => {
         let out;
         try {
@@ -224,7 +226,7 @@ function replayJsonl(path, seat, shape, onSkipped, disclose) {
 export function replayJsonlGuarded(path, seat, shape, warn) {
     const entry = JSONL_REPLAY_SEATS[seat];
     const gate = new JsonlStoreGate(seat, path);
-    const disclose = guardDisclosure(createCorruptReadSeat(warn ?? warnToConsole, entry.event, entry.note), entry.event);
+    const disclose = guardDisclosure(createCorruptReadSeat(warn ?? warnToLogSeam, entry.event, entry.note), entry.event);
     const records = replayJsonl(path, seat, shape, (info) => gate.trip(info.reason), disclose);
     return { records, gate };
 }