@sema-agent/server 7.99.0 → 7.101.0

package/dist/http/admission.js

@@ -1,5 +1,6 @@
 import { isThinkingLevel, expandTiers } from "@sema-agent/core";
-import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, SETTINGS_PERMISSION_MODE_WORDS, isSettingsPermissionMode, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
@@ -7,6 +8,7 @@ import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
+import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
@@ -38,7 +40,15 @@ const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
+    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
+}
+function refuseUnavailableModel(res, config, field, ref) {
+    const hit = refusedCatalogEntry(ref, config.modelRefusals);
+    if (hit === undefined)
+        return false;
+    const message = modelUnavailableMessage(field, ref.slice(0, 120), hit.name, hit.refusal);
+    sendError(res, 400, "request.model_unavailable", message);
+    return true;
 }
 export function createAdmission(ctx) {
     const { deps, readJson, runnerFor } = ctx;
@@ -193,6 +203,13 @@ export function createAdmission(ctx) {
                     return null;
                 }
             }
+            {
+                const webSearchVerdict = judgeRequestWebSearch(st.webSearch);
+                if (webSearchVerdict.kind === "malformed") {
+                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue);
+                    return null;
+                }
+            }
         }
         const skillsErr = validateUserSkills(body.skills);
         if (skillsErr) {
@@ -411,8 +428,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const agentsBare = deps.config.models ?? {};
-            const agentsCatalog = expandTiers(agentsBare, deps.config.tiers ?? {}) ?? agentsBare;
+            const agentsCatalog = selectableCatalog(agentsBare, deps.config.tiers, deps.config.modelRefusals);
             const um = unknownTaskAgentModelRef(body.agents, agentsCatalog);
+            if (um !== undefined && refuseUnavailableModel(res, deps.config, `agents[${um.index}].model`, um.ref))
+                return null;
             if (um !== undefined) {
                 sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
                 return null;
@@ -486,8 +505,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.model, catalog) === undefined) {
+            const catalog = selectableCatalog(bare, deps.config.tiers, deps.config.modelRefusals);
+            if (matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined) {
+                if (refuseUnavailableModel(res, deps.config, "model", body.model))
+                    return null;
                 sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }
@@ -498,8 +519,10 @@ export function createAdmission(ctx) {
                 return null;
             }
             const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.compactionModel, catalog) === undefined) {
+            const catalog = selectableCatalog(bare, deps.config.tiers, deps.config.modelRefusals);
+            if (matchCatalogModel(body.compactionModel, catalog, deps.config.modelRefusals) === undefined) {
+                if (refuseUnavailableModel(res, deps.config, "compactionModel", body.compactionModel))
+                    return null;
                 sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }

package/dist/http/memory-store-refusal-reply.d.ts

@@ -0,0 +1,24 @@
+/**
+ * core 7.31.1 #1094 `memory.target_outside_store` 的 **operator 面 HTTP 映射** —— 唯一一处字面量(判据在
+ * `src/memory-store-refusal.ts`)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * `routes/memory-compliance.ts`(出处 / 抹除)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
+ * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
+ * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里**(`routes/sessions.ts`:同码、固定文案,见那里的注)。
+ * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
+ * (码进文案,附录 A 该行),本码已在那条臂上,不再给它第二个码。
+ *
+ * ## 为什么 409
+ * core 的读法:operator 要处置的拒(去掉 store 里那只通到外面的目录链),不是可重试的 IO 故障,也不是对调用方的裁决。与
+ * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
+ * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在
+ * `test/memory-compliance-http.test.ts`);链在提交点之后才换上 ⇒ 已删的几条算数、journal 留盘 —— core 原句会带
+ * `after the commit point; the journal is kept`,本层原样转发、不嗅它分类(codex 一审 C1)。
+ *
+ * ## 文案原样
+ * core 的诊断句点名动作、路径与解析到哪 —— 那是运维找到那只链的唯一材料,与本族其它 core 码同一条「码与文案都不改写」纪律。
+ * 只对 operator 面这么做:这几口都过了 operator 门,宿主路径对这个受众不是泄露。
+ */
+import type { ServerResponse } from "node:http";
+/** `err` 是 `memory.target_outside_store` ⇒ 409 带码 + core 原句,返回 true(已应答);否则 false,一个字节都不写。 */
+export declare function sentMemoryStoreRefusal(res: ServerResponse, err: unknown): boolean;
+//# sourceMappingURL=memory-store-refusal-reply.d.ts.map

package/dist/http/memory-store-refusal-reply.js

@@ -0,0 +1,10 @@
+import { targetOutsideStoreOf } from "../memory-store-refusal.js";
+import { sendError } from "./send.js";
+export function sentMemoryStoreRefusal(res, err) {
+    const refusal = targetOutsideStoreOf(err);
+    if (refusal === undefined)
+        return false;
+    sendError(res, 409, "memory.target_outside_store", refusal.message);
+    return true;
+}
+//# sourceMappingURL=memory-store-refusal-reply.js.map

package/dist/http/resume-legs.d.ts

@@ -29,7 +29,7 @@ export declare function createResumeLegs(ctx: {
     routeCtxBase: RouteCtxBase;
     resumeCheckpoint: (sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (grant: {
         overrideSessionId?: string;
-        validatedToolName: string | null;
+        rememberableToolName: string | null;
     }) => Promise<void>, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;

package/dist/http/resume-legs.js

@@ -1,6 +1,6 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
-import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
+import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
@@ -9,10 +9,10 @@ import { mintCancelledResult } from "../run-cancel-context.js";
 import {} from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerMayRetire } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -198,11 +198,14 @@ export function createResumeLegs(ctx) {
             };
         }
         const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
-        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME
+        const rememberableTool = paForGrant !== undefined &&
+            paForGrant.toolName &&
+            paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            standingAnswerMayRetire(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
-            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
+            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), rememberableToolName: rememberableTool })
             : undefined;
         const lateSettleSink = deps.approvalLateSettle;
         const lateSettleAnchor = lateSettleSink !== undefined && req !== undefined && token
@@ -496,8 +499,9 @@ export function createResumeLegs(ctx) {
                         const { type, ...rest } = frame;
                         const f = frame;
                         const write = rs0.appendEvent(taskId, drainSeq++, type, rest);
-                        if (f.type === "task_notification" && f.task_id)
-                            resumeNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
+                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                        if (fKey !== undefined)
+                            resumeNotifiedKeys.set(fKey, write.then(() => true, () => false));
                         return write;
                     }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
                 }
@@ -544,7 +548,7 @@ export function createResumeLegs(ctx) {
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
+                                const key = taskNotificationDedupKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
@@ -671,7 +675,7 @@ export function createResumeLegs(ctx) {
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
+                                const key = taskNotificationDedupKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
@@ -780,7 +784,7 @@ export function createResumeLegs(ctx) {
                             case "task_notification": {
                                 await flush();
                                 const tnr = ev.notification;
-                                const tnrKey = tnr?.task_id ? taskNotificationStreamKey({ task_type: tnr.task_type, task_id: tnr.task_id, status: String(tnr.status), seq: tnr.seq }) : undefined;
+                                const tnrKey = taskNotificationStreamKeyOf(tnr);
                                 const tnrPrior = tnrKey !== undefined ? resumeNotifiedKeys.get(tnrKey) : undefined;
                                 if (tnrPrior === undefined || !(await tnrPrior)) {
                                     const write = append("task_notification", taskNotificationEventData(ev));

package/dist/http/route-ctx.d.ts

@@ -357,11 +357,11 @@ export interface RouteLegs {
     resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
-     *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`
+     *  载入 cp** 的可记工具名(`rememberableToolName`,非 tool_approval / AskUserQuestion / legacy null / S-663 强制卡 ⇒ `null`
      *  = 无可记)一并回传,路由只对这个逐字落店。`overrideSessionId` = parked 腿的 root/host 会话 grant 锚。 */
     onResumeCommitted?: (grant: {
         overrideSessionId?: string;
-        validatedToolName: string | null;
+        rememberableToolName: string | null;
     }) => Promise<void>, 
     /** [ref]:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/decide` 腿传 `true`;
      *  内部 D-D SLA deny-sweep 不传 —— 它没有在等响应的人,提前受理对它零收益而少一条同步失败面。 */

package/dist/http/routes/approvals-assistant.d.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
-import { type GovernancePosture } from "../active-run-conflict.js";
+import { type GovernancePosture } from "../../runtime-governance.js";
 import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 /**

package/dist/http/routes/approvals-assistant.js

@@ -16,7 +16,7 @@ import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
-import { governanceOriginOf } from "../active-run-conflict.js";
+import { governanceOriginOf } from "../../runtime-governance.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
@@ -288,6 +288,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(s.deadline !== undefined ? { deadline: s.deadline } : {}),
                     ...(s.hasBidiControls === true ? { hasBidiControls: true } : {}),
                     ...(s.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+                    ...(s.mandated === true ? { mandated: true } : {}),
                     ...(s.denialLimitFallback !== undefined ? { denialLimitFallback: s.denialLimitFallback } : {}),
                     ...(s.origin !== undefined ? { origin: s.origin } : {}),
                     ...(s.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: s.ruleStoreUnreadable } : {}),
@@ -689,7 +690,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             let pendingGrant;
             const grantOnCommit = remember && deps.approvalExemptionStore
                 ? async (grant) => {
-                    const canonical = grant.validatedToolName;
+                    const canonical = grant.rememberableToolName;
                     if (!canonical)
                         return;
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { isModelAllowlisted } from "../../model-select.js";
+import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -228,7 +228,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             return;
         }
         case "models": {
-            const atCatalog = expandTiers(deps.config.models, deps.config.tiers ?? {}) ?? deps.config.models;
+            const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
             const atAllowlist = deps.config.atModelAllowlist ?? [];
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
@@ -242,7 +242,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
+                ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist, deps.config.modelRefusals) } : {}),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");

package/dist/http/routes/memory-bundle.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +36,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
+    if (sentMemoryStoreRefusal(res, err))
+        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }

package/dist/http/routes/memory-compliance.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -38,6 +39,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
         return true;
+    if (sentMemoryStoreRefusal(res, err))
+        return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
         return true;

package/dist/http/routes/memory-origin.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
+import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -52,6 +53,8 @@ function sentClassifiedFailure(res, ctx, face, err) {
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))
             return true;
     }
+    if (face !== "clearances" && sentMemoryStoreRefusal(res, err))
+        return true;
     if (err instanceof ControlPlaneCorruptError) {
         sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
         return true;

package/dist/http/routes/sessions.js

@@ -4,6 +4,7 @@ import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
+import { targetOutsideStoreOf } from "../../memory-store-refusal.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionPolicyError, sseHeaders } from "../send.js";
@@ -504,6 +505,12 @@ export async function handleSessions(req, res, match, ctx) {
                     sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");
                     return;
                 }
+                const outside = targetOutsideStoreOf(err);
+                if (outside !== undefined) {
+                    deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: outside.message });
+                    sendError(res, 409, "memory.target_outside_store", "session memory erasure refused — a directory in this deployment's memory store leads outside it (a link), so this erasure did not complete (a refusal before its commit point changed nothing; one after it keeps the deletions already made and a journal that finishes the rest once the link is removed); ask the operator to remove the link, then resend with the same requestId");
+                    return;
+                }
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory erasure failed");
             }

package/dist/http/routes/side-query.js

@@ -1,6 +1,7 @@
 import { expandTiers, isThinkingLevel } from "@sema-agent/core";
 import { HttpError } from "../../security.js";
-import { isModelAllowlisted } from "../../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
+import { modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError, httpErrorCode, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
@@ -68,9 +69,14 @@ export async function handleSideQuery(req, res, match, ctx) {
                     return;
                 }
                 if (typeof body.model === "string" && body.model.length > 0) {
-                    const bare = deps.config.models ?? {};
-                    const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-                    if (!isModelAllowlisted(body.model, catalog, deps.config.atModelAllowlist)) {
+                    const catalog = selectableCatalog(deps.config.models ?? {}, deps.config.tiers, deps.config.modelRefusals);
+                    const unavailable = matchCatalogModel(body.model, catalog, deps.config.modelRefusals) === undefined ? refusedCatalogEntry(body.model, deps.config.modelRefusals) : undefined;
+                    if (unavailable !== undefined) {
+                        const message = modelUnavailableMessage("model", body.model.slice(0, 120), unavailable.name, unavailable.refusal);
+                        sendError(res, 400, "request.model_unavailable", message);
+                        return;
+                    }
+                    if (!isModelAllowlisted(body.model, catalog, deps.config.atModelAllowlist, deps.config.modelRefusals)) {
                         sendError(res, 400, "request.model_not_allowed", `model is not in this deployment's @-mention allowlist: "${body.model.slice(0, 120)}" — the allowlist is configured by the operator (config-center models.atModelAllowlist)`);
                         return;
                     }

package/dist/http/routes/tasks.js

@@ -1,12 +1,12 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
-import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
+import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
 import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
@@ -393,7 +393,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                                     }
                                     else if (deliverable) {
-                                        const key = taskNotificationStreamKey(n);
+                                        const key = taskNotificationDedupKey(n);
                                         if (syncNotifiedKeys.get(key) === undefined) {
                                             syncNotifiedKeys.set(key, Promise.resolve(true));
                                             sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
@@ -465,7 +465,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 }
                                 else if (ev.type === "task_notification") {
                                     const tnv = ev.notification;
-                                    const tnvKey = tnv?.task_id ? taskNotificationStreamKey({ task_type: tnv.task_type, task_id: tnv.task_id, status: String(tnv.status), seq: tnv.seq }) : undefined;
+                                    const tnvKey = taskNotificationStreamKeyOf(tnv);
                                     const tnvPrior = tnvKey !== undefined ? syncNotifiedKeys.get(tnvKey) : undefined;
                                     if (tnvPrior === undefined || !(await tnvPrior)) {
                                         if (tnvKey !== undefined)
@@ -553,8 +553,9 @@ export async function handleTasks(req, res, match, ctx) {
                         if (closed || res.writableEnded || res.destroyed)
                             throw new Error("stream ended before the completion frame was written");
                         const f = frame;
-                        if (f.type === "task_notification" && f.task_id)
-                            syncNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), Promise.resolve(true));
+                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                        if (fKey !== undefined)
+                            syncNotifiedKeys.set(fKey, Promise.resolve(true));
                         sseData(res, frame);
                     }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
                     const withElicit = deps.elicitation

package/dist/http/server.d.ts

@@ -659,7 +659,7 @@ export interface ServiceDeploymentDeps {
      *  registry 部署),现有部署零影响。main.ts 在 applyEffective 落模型后翻 true(one-way latch)。 */
     modelReady?: () => boolean;
     /** Sema-registry restart signal: the refresh loop sets this when a pull carries restart-to-apply
-     *  changes (skills/mcp/scenarios/runtime-gates baked at boot) that DIFFER from this process's boot config.
+     *  changes (skills/mcp/a2a/scenarios/… baked at boot — the `RestartSlice` closed set) that DIFFER from this process's boot config.
      *  Surfaced at GET /health as `restartRequired` + `restart{reasons,version,since}` so the orchestrator can
      *  auto rolling-restart the worker. Change-detected (not presence) — absent when nothing baked-at-boot
      *  changed, so polling it never causes a restart loop. */
@@ -686,10 +686,11 @@ export interface ServiceDeploymentDeps {
     mcpRevocationState?: () => {
         revoked: string[];
     } | undefined;
-    /** codex R18 (models-tiers deferral): the persistent "deferred WITHOUT a next-boot handoff" state — set when a
-     *  changed model plane could not hot-apply (tier-frozen Runner / tiered candidate) AND no restart-surviving LKG
-     *  exists to justify forcing a restart. Surfaced on /health (`modelPlaneDeferred`) so the stuck-degraded state
-     *  outlives the one-shot warn (the etag advances → later ticks 304 and never re-enter the defer branch). */
+    /** codex R18: the persistent "retained WITHOUT a next-boot handoff" state — a candidate whose restart signal is
+     *  withheld because no restart-surviving handoff exists yet (durable-declared LKG publication incomplete, or a
+     *  boot skills debt not yet proven repairable). Surfaced on /health (`modelPlaneDeferred` — the key keeps its birth
+     *  name: it was born for the model-plane deferral, which retired with the `models-tiers` slice in S-668 波 0) so
+     *  the stuck state outlives the one-shot warn (the etag advances → later ticks 304). */
     planeDeferredState?: () => {
         version: number;
         since: number;

package/dist/http/wire-types.d.ts

@@ -450,9 +450,12 @@ export interface TaskRequestBody {
     /** The caller's per-request settings stamp (the client-side `SemaSettings` shape). The KEY SET is deliberately
      *  NOT mirrored here — a hand-written second shape on this interface would be the classic mirror-drift form.
      *  Per-key ownership is split, not single: `parseTaskSettings` (src/task-settings.ts) defensively owns the
-     *  shared settings keys on every path, while `settings.webSearch` has its OWN validator on the single-user
-     *  scenario lane (capabilities/scenarios.ts `webSearchConfigFromSettings` — the multi-tenant lane ignores it
-     *  by design). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
+     *  shared settings keys on every path, while `settings.webSearch` has its OWN judge (plugins/web-search.ts
+     *  `judgeRequestWebSearch`, S-199): a malformed block — including a missing or unknown `provider` — 400s on submit
+     *  on every lane, and only the single-user
+     *  scenario lane honors a well-formed one (capabilities/scenarios.ts — the multi-tenant lane ignores it by design;
+     *  a malformed block replayed on resume mounts no WebSearch for that call — never a substitute destination — with a
+     *  fail-open count). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
      *  runtime drops garbage): a non-array object bag, or omit the key. A `null` reads as absence on both the
      *  fresh-submit wall (prepareSpec) and replay (parseTaskSettings), and malformed forms 400 on submit /
      *  no-op on replay. ([ref] 件1 leftover key, declared 2026-08-31; ownership wording per codex adversarial round.)

package/dist/instruction-source-notice.d.ts

@@ -0,0 +1,97 @@
+/**
+ * S-690 —— 项目指令文件**换源**通告(`engine_notice` 码 `instructions.source_changed`)的唯一铸点与基线属主口。
+ *
+ * ## 这件事为什么归本仓
+ * 选哪一份指令文件是**部署的内容半场**(`project-memory.ts` 的 `INSTRUCTION_FILE_CHAIN`;core 的 `loadProjectMemory`
+ * 契约逐字「core … NEVER hardcodes a filename」),所以「这一 run 读的是哪一份、上一 run 读的是哪一份」也只有本仓
+ * 答得出。core 的 run 内变更车道(`steering_injected`,`source: "instructions_change"`)只跟**本 run 自己声明的**
+ * 来源比,进程重启(= 升级)后没有任何东西记得上一 run 注入的是哪一份 —— 于是两文件并存的仓升级后静默换源
+ * (车MN 收车档 §1.5,判据 G6)。
+ *
+ * ## 基线 = 会话的服务端元数据
+ * 基线是「同一 session 上一次 run 选中的链成员相对路径」(不是指纹:指纹密钥每进程随机,跨进程不可比)。它住在会话店的
+ * 服务端元数据面 —— SQL 两孪生是 `session_meta.instruction_source` 一列,local 文件店是一只 sidecar —— 所以重启 /
+ * 跨副本都读得到、随会话删除一起消失,且不进模型上下文、不进 wire 会话面。不接这张面的店(core 的内存 dev 店、
+ * `run-local` 的 core 文件店)⇒ 席缺席 ⇒ 一帧不发(诚实缺席:那两形的会话本来就活不过进程,或没有会话流可投)。
+ *
+ * ## 铸点(唯一)
+ * {@link announceInstructionSource} 是本码**唯一**的铸点(`@contract instructions.source_changed.single_mint`)。
+ * 调用点只有一处:`makeLoadProjectMemory` 在每次**走了指令链**的 prepare 载入完成之后(core 每个 run 恰调一次 `loadProjectMemory`)
+ * ⇒ 一 run 至多一帧。走链之前就判「这次没有项目可读」的 prepare(无手场景、cwd 不是本机绝对目录)是**不适用**,不是
+ * 「来源 = 无」—— 不进本铸点,基线保持上一次真读的那份(O6,7.101.0 合并复审:无手孪生 Runner 与主 Runner 共用同一只
+ * loader 与会话店,把不适用折成 `null` 会让「默认 → 无手 → 默认」同 session 两跳无端发两帧)。分工照 `task-mcp.ts` `mintInjectionDropNotices` 的先例:本模块铸通告,`emit` 由装配方给
+ * (部署的 `onNotice` 转发体 —— 先日志后分流,白名单 / 归属 / 消毒 / 隔离四件判据一个不绕)。
+ *
+ * ## 不做的事
+ * 不区分「升级换源」与「用户改了文件」(跨进程指纹不可比;载荷只说前后两个来源)。detail 没有 `runId`:铸点在 core 的
+ * `loadProjectMemory` 席内,该席的 ctx 不带 runId(core 7.30.1 键集 = cwd / handsEnabled / isSubagent / agentName /
+ * sessionId / phase)—— 与 `mcp.injection_dropped`「装配期铸、无 runId」同形,run 归属由投递腿承载(这条 run 的 SSE /
+ * 这条 run 的账本)。向 core 要 ctx 加 runId 已登记为未闭环项。
+ */
+import type { EngineNotice } from "@sema-agent/core";
+import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
+export declare const INSTRUCTION_SOURCE_CHANGED: ServerNoticeCode;
+/** 基线读数。`recorded: false` = 这个会话还没有任何 run 记过基线(首 run ⇒ 只写不发);`source: null` = 记过,且那一次
+ *  没有项目指令文件被选中。两态必须可判别:把「没记过」读成「记过没有」会让新会话首 run 发一帧 `null → CLAUDE.md`。 */
+export type InstructionSourceBaseline = {
+    readonly recorded: false;
+} | {
+    readonly recorded: true;
+    readonly source: string | null;
+};
+/** 基线属主口(会话店的服务端元数据面)。 */
+export interface InstructionSourceStore {
+    readInstructionSource(sessionId: string): Promise<InstructionSourceBaseline>;
+    /**
+     * 覆写基线 —— **CAS**:只在店里此刻的基线仍等于 `expected`(调用方读到的那一份)时写,否则什么都不做(不抛)。
+     * 为什么是 CAS(codex che-NM r1 [high]):铸点对基线读写有期限,超期的写会**晚到**;不带期望值的覆写会让一个
+     * 基于过期读数的旧 run 盖掉更新的 run 写下的基线,下一 run 于是比错。会话行不存在 ⇒ 同样不写。
+     * 写**没有提交**必须抛(SQL 的写本来就如此;local sidecar 回滚内存再抛)—— 「内存已前进而盘没跟上」会让同来源的
+     * 后续 run 在相等比较上短路、再也不重写,重启后比的是一份过期的盘(codex che-NM r1 [medium])。
+     */
+    recordInstructionSource(sessionId: string, expected: InstructionSourceBaseline, source: string | null): Promise<void>;
+}
+/** 一只装配好的席:基线店 + 通告出口。 */
+export interface InstructionSourceSeat {
+    readonly store: InstructionSourceStore;
+    readonly emit: (notice: EngineNotice) => void;
+}
+/**
+ * 基线的**存储编码**(SQL 列与 local sidecar 同一只):「没有项目指令文件」存成空串,链成员存它的相对路径;
+ * 「没记过」是 SQL `NULL` / sidecar 里缺键。空串不会与任何文件名撞(没有叫空名的文件),所以不需要保留词。
+ */
+export declare function encodeInstructionSource(source: string | null): string;
+/** 两份基线读数是否同一(CAS 的判等;三店与测试夹具同用这一只)。 */
+export declare function sameInstructionSourceBaseline(a: InstructionSourceBaseline, b: InstructionSourceBaseline): boolean;
+/** {@link encodeInstructionSource} 的逆。非串非空的值 = 这一格被本仓以外的东西写坏了 ⇒ 抛(调用方按基线读不出处置)。 */
+export declare function decodeInstructionSource(raw: unknown): InstructionSourceBaseline;
+/**
+ * 会话店是否提供基线面 —— **两个方法都在**才算(只有一半的店让读写不同源,比整张缺席更坏)。结构判而不是按类名判
+ * (包装店 `CachingSessionStore` 逐方法转发,判据看的是能力不是名字)。
+ */
+export declare function instructionSourceStoreOf(sessionStore: unknown): InstructionSourceStore | undefined;
+/** 装配点的唯一口(server boot 与 run-local 两处同走):店没有基线面或没有通告出口 ⇒ 席缺席(一帧不发)。 */
+export declare function createInstructionSourceSeat(sessionStore: unknown, emit: ((notice: EngineNotice) => void) | undefined): InstructionSourceSeat | undefined;
+/**
+ * 基线每一次读 / 写的期限(codex che-NM r1 [high])。铸点跑在 prepare 里、loader 等它交出答案才返回,而两支 SQL 孪生的
+ * 查询默认没有超时(MySQL 无、PG `statement_timeout` 缺省关)—— 一次卡住的行锁 / 连接就会把整个 prepare 挂住,而修前
+ * loader 根本不碰库。两层同一个数:① 这里放手(超期 ⇒ 按读 / 写失败处置,留痕放行);② 两支 SQL 孪生的基线查询带**每查询
+ * 超时**(codex che-NM r2 [high];S-9 `write-behind-counter.ts` 先例:mysql2 `{sql, timeout}` / pg `query_timeout`,pg-pool
+ * 超时即销毁那条连接)—— 只放手不截断,卡住的查询会一直占着池里的连接。超期后仍在飞的写由 CAS 挡住,不会盖掉更新的基线。
+ * 数值与 core 给 `probeInstructionSources` 的 2s 天花板同量级:一行 PK 读写在健康库上是毫秒级。
+ */
+export declare const BASELINE_IO_DEADLINE_MS = 2000;
+/**
+ * **唯一铸点**:本次 prepare 选中的来源 `current`(链成员相对路径;没有 = `null`)与基线比。
+ *  · 没有基线 ⇒ 只写不发(新会话首 run);
+ *  · 相同 ⇒ 什么都不做(不写);
+ *  · 不同 ⇒ 铸一帧、再以读到的基线为期望值 CAS 覆写。
+ * 基线读 / 写各有 {@link BASELINE_IO_DEADLINE_MS} 的期限。
+ *
+ * 失败方向(F 类,`server.instruction-source.announce-degraded`,detail 带 `op=read|write|emit`):通告是**披露**面
+ * 不是执法面,所以基线读 / 写 / 出口失败一律留痕后放行,**绝不**抛回调用方 —— 抛回去会让 core 把这次 prepare 的项目记忆整块丢掉(loader 抛 ⇒ 不注入),
+ * 为一条通告赔上模型要读的指令本身。读失败 ⇒ 本 run 不比也不写;写失败 ⇒ 本 run 的帧照发(它对本 run 为真),代价是
+ * 下一 run 可能再说一遍同一次换源;出口抛(转发体今天结构上不抛,守的是「本函数不抛」这条契约)⇒ 本 run 缺这一帧。
+ */
+export declare function announceInstructionSource(seat: InstructionSourceSeat, sessionId: string, current: string | null): Promise<void>;
+//# sourceMappingURL=instruction-source-notice.d.ts.map