superlocalmemory 3.8.13 → 4.0.0

package/src/superlocalmemory/server/egress_policy.py

@@ -0,0 +1,258 @@
+"""SSRF-safe egress validation for outbound provider requests.
+
+Pre-admission, stateless validation for outbound HTTP fetches (embedding test,
+provider test, local model probe). It enforces three protections:
+
+* Cloud-metadata endpoints are blocked unconditionally and after hostname
+  normalization (trailing dot / case / IDNA), so ``metadata.google.internal.``
+  cannot slip past — including on the loopback path.
+* The full DNS answer set is validated (all A/AAAA records), not just the first
+  resolved address, which defeats mixed public/private answers (DNS rebinding).
+* DNS resolution failure fails closed (deny) for untrusted callers rather than
+  deferring the decision to the HTTP client.
+
+Trusted callers (the local dashboard on loopback, or an allowlisted LAN
+dashboard) keep the latitude to probe local/LAN model endpoints; metadata
+endpoints are denied for everyone.
+"""
+from __future__ import annotations
+
+import ipaddress
+import socket
+from dataclasses import dataclass
+from enum import Enum
+from urllib.parse import urlparse
+
+
+class EgressVerdict(str, Enum):
+    ALLOW = "allow"
+    DENY_SCHEME = "deny_scheme"
+    DENY_CREDENTIALS = "deny_credentials"
+    DENY_FRAGMENT = "deny_fragment"
+    DENY_HOST = "deny_host"
+    DENY_METADATA = "deny_metadata"
+    DENY_PRIVATE = "deny_private"
+    DENY_DNS_FAILURE = "deny_dns_failure"
+    DENY_MIXED_DNS = "deny_mixed_dns"
+
+
+# Cloud metadata endpoints — always blocked regardless of caller trust.
+METADATA_HOSTS: frozenset[str] = frozenset(
+    {
+        "169.254.169.254",
+        "metadata.google.internal",
+        "metadata",
+        "metadata.azure.internal",
+        "169.254.170.2",  # AWS ECS task metadata
+        "fd00:ec2::254",  # AWS IMDS over IPv6
+    }
+)
+
+_ALLOWED_SCHEMES: frozenset[str] = frozenset({"http", "https"})
+
+
+@dataclass(frozen=True, slots=True)
+class EgressPolicy:
+    """Configurable egress constraints (safe defaults)."""
+
+    allowed_schemes: frozenset[str] = _ALLOWED_SCHEMES
+    allow_private_for_local_actor: bool = True
+    allow_private_for_lan_actor: bool = True
+    reject_credentials: bool = True
+    reject_fragment: bool = True
+
+
+@dataclass(frozen=True, slots=True)
+class EgressActor:
+    """Minimal trust descriptor for the caller.
+
+    ``is_local``  — request originated from the loopback dashboard.
+    ``is_lan``    — request originated from an allowlisted LAN dashboard
+                    (remote mode ON *and* client IP in the allowlist).
+    A caller with neither flag is an untrusted/remote caller.
+    """
+
+    is_local: bool = False
+    is_lan: bool = False
+
+    @property
+    def is_trusted(self) -> bool:
+        return self.is_local or self.is_lan
+
+
+@dataclass(frozen=True, slots=True)
+class ResolvedTarget:
+    addresses: tuple[str, ...] = ()
+    has_private: bool = False
+    has_public: bool = False
+    error: str = ""
+
+    @property
+    def is_mixed(self) -> bool:
+        return self.has_private and self.has_public
+
+
+@dataclass(frozen=True, slots=True)
+class EgressResult:
+    verdict: EgressVerdict
+    resolved_ip: str = ""
+    error: str = ""
+    hostname: str = ""
+
+    @property
+    def allowed(self) -> bool:
+        return self.verdict is EgressVerdict.ALLOW
+
+
+def _normalize_host(hostname: str) -> str:
+    """Lowercase, strip a trailing dot, IDNA-encode non-ASCII hosts.
+
+    IDNA encoding is only attempted for hosts containing non-ASCII characters,
+    so IP literals and ordinary ASCII hostnames are left untouched (the ``idna``
+    codec rejects some all-ASCII inputs).
+    """
+    host = hostname.strip().lower().rstrip(".")
+    if host and any(ord(ch) > 127 for ch in host):
+        try:
+            host = host.encode("idna").decode("ascii")
+        except (UnicodeError, UnicodeDecodeError):
+            pass  # keep the raw host — classification below still applies
+    return host
+
+
+def _is_dangerous_ip(
+    addr: ipaddress.IPv4Address | ipaddress.IPv6Address,
+) -> bool:
+    return (
+        addr.is_private
+        or addr.is_loopback
+        or addr.is_link_local
+        or addr.is_reserved
+        or addr.is_multicast
+        or addr.is_unspecified
+    )
+
+
+def _coerce_ip(
+    ip_str: str,
+) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
+    try:
+        addr = ipaddress.ip_address(ip_str)
+    except ValueError:
+        return None
+    # Unwrap IPv4-mapped IPv6 (``::ffff:127.0.0.1``) before classification.
+    if isinstance(addr, ipaddress.IPv6Address) and addr.ipv4_mapped:
+        return addr.ipv4_mapped
+    return addr
+
+
+def resolve_and_validate_dns(
+    hostname: str, policy: EgressPolicy = EgressPolicy()
+) -> ResolvedTarget:
+    """Resolve every A/AAAA record and classify each address.
+
+    Fails closed: any resolution error, or an empty answer set, returns a
+    ``ResolvedTarget`` carrying a non-empty ``error``.
+    """
+    try:
+        infos = socket.getaddrinfo(
+            hostname, None, socket.AF_UNSPEC, socket.SOCK_STREAM
+        )
+    except (socket.gaierror, OSError, UnicodeError) as exc:
+        return ResolvedTarget(error=f"dns resolution failed: {exc}")
+
+    addresses: list[str] = []
+    has_private = False
+    has_public = False
+    for info in infos:
+        sockaddr = info[4]
+        addr = _coerce_ip(sockaddr[0])
+        if addr is None:
+            continue
+        addresses.append(str(addr))
+        if _is_dangerous_ip(addr):
+            has_private = True
+        else:
+            has_public = True
+
+    if not addresses:
+        return ResolvedTarget(error="no addresses resolved")
+    return ResolvedTarget(
+        addresses=tuple(addresses),
+        has_private=has_private,
+        has_public=has_public,
+    )
+
+
+def validate_egress_url(
+    url: str,
+    actor: EgressActor = EgressActor(),
+    policy: EgressPolicy = EgressPolicy(),
+) -> EgressResult:
+    """Full SSRF-safe validation of an outbound URL for a given caller."""
+    parsed = urlparse(url)
+
+    if parsed.scheme not in policy.allowed_schemes:
+        return EgressResult(
+            verdict=EgressVerdict.DENY_SCHEME, error=f"scheme {parsed.scheme!r}"
+        )
+    if policy.reject_credentials and (parsed.username or parsed.password):
+        return EgressResult(verdict=EgressVerdict.DENY_CREDENTIALS)
+    if policy.reject_fragment and parsed.fragment:
+        return EgressResult(verdict=EgressVerdict.DENY_FRAGMENT)
+
+    hostname = _normalize_host(parsed.hostname or "")
+    if not hostname:
+        return EgressResult(verdict=EgressVerdict.DENY_HOST, error="empty host")
+
+    # Metadata block — unconditional, before any trust short-circuit or DNS
+    # (defeats the trailing-dot / loopback-path bypass and DNS rebinding).
+    if hostname in METADATA_HOSTS:
+        return EgressResult(verdict=EgressVerdict.DENY_METADATA, hostname=hostname)
+    literal = _coerce_ip(hostname)
+    if literal is not None and str(literal) in METADATA_HOSTS:
+        return EgressResult(verdict=EgressVerdict.DENY_METADATA, hostname=hostname)
+
+    trusted = (
+        actor.is_local and policy.allow_private_for_local_actor
+    ) or (actor.is_lan and policy.allow_private_for_lan_actor)
+
+    # Literal IP target: classify directly, no DNS needed.
+    if literal is not None:
+        if _is_dangerous_ip(literal) and not trusted:
+            return EgressResult(
+                verdict=EgressVerdict.DENY_PRIVATE,
+                resolved_ip=str(literal),
+                hostname=hostname,
+            )
+        return EgressResult(
+            verdict=EgressVerdict.ALLOW, resolved_ip=str(literal), hostname=hostname
+        )
+
+    # Trusted callers may probe local/LAN endpoints by name without a forced
+    # DNS lookup — preserving pre-V4 loopback/LAN dashboard behaviour. Metadata
+    # was already denied above for everyone.
+    if trusted:
+        return EgressResult(verdict=EgressVerdict.ALLOW, hostname=hostname)
+
+    # Untrusted caller: resolve the full answer set and fail closed on error.
+    resolved = resolve_and_validate_dns(hostname, policy)
+    if resolved.error:
+        return EgressResult(
+            verdict=EgressVerdict.DENY_DNS_FAILURE,
+            error=resolved.error,
+            hostname=hostname,
+        )
+    if resolved.has_private:
+        verdict = (
+            EgressVerdict.DENY_MIXED_DNS
+            if resolved.is_mixed
+            else EgressVerdict.DENY_PRIVATE
+        )
+        return EgressResult(verdict=verdict, hostname=hostname)
+
+    return EgressResult(
+        verdict=EgressVerdict.ALLOW,
+        resolved_ip=resolved.addresses[0],
+        hostname=hostname,
+    )

package/src/superlocalmemory/server/rbac_enforce.py

@@ -114,6 +114,38 @@ def require_manage(request: Request, *, profile: str | None = None) -> dict:
     return require_permission(request, Permission.MANAGE, profile=profile)
 
 
+def resolve_actor_roles(request: Request, *, profile: str | None = None):
+    """Resolve the caller to concrete ActorContext roles (server-derived).
+
+    The machine operator (owner) is root. A logged-in user is mapped from their
+    persisted RBAC role on ``profile``. This must be called only after
+    ``require_permission`` has already authorized the operation, so the returned
+    role always includes the permission the caller was admitted with.
+    """
+    from superlocalmemory.core.actor_context import ActorRole
+
+    principal = resolve_principal(request)
+    if principal.get("kind") == "owner":
+        return frozenset({ActorRole.OWNER})
+    rbac = get_rbac_engine(request.app.state)
+    role = None
+    if rbac is not None:
+        try:
+            role = rbac.get_role(principal["user_id"], profile or _active_profile())
+        except Exception:
+            # The caller already passed require_permission for this operation, so
+            # a transient role lookup must not surface as a 500. Fall back to the
+            # least-privileged write-capable role rather than deny an authorized
+            # write.
+            return frozenset({ActorRole.MEMBER})
+    mapped = {
+        Role.ADMIN: ActorRole.ADMIN,
+        Role.MEMBER: ActorRole.MEMBER,
+        Role.VIEWER: ActorRole.VIEWER,
+    }.get(role)
+    return frozenset({mapped}) if mapped is not None else frozenset({ActorRole.ANONYMOUS})
+
+
 def principal_info(request: Request) -> dict:
     """Rich identity for /whoami: principal + role + effective permissions on
     the active profile. Never raises — used by the dashboard to render UI."""

package/src/superlocalmemory/server/route_mutations.py

@@ -74,6 +74,26 @@ def authorize_route_mutation(
     if content_preview:
         context["content_preview"] = content_preview[:100]
 
+    # Phase-1/E2: run admission registry before trust-hook pre-handler so
+    # enterprise policy can deny the mutation even if the trust hook allows it.
+    from superlocalmemory.core.admission import (
+        AdmissionDenied,
+        OperationKind,
+        _resolve_deployment,
+        admit,
+        resolve_actor,
+    )
+    from superlocalmemory.core.actor_context import Transport
+    deployment = _resolve_deployment()
+    tier = "enterprise" if deployment.is_enterprise else "personal"
+    mode = "company" if deployment.is_enterprise else "local"
+    http_actor = resolve_actor(Transport.HTTP, tier=tier, mode=mode)
+    kind = OperationKind.FORGET if operation == "delete" else OperationKind.CORRECT
+    try:
+        admit(kind, http_actor, mode=mode)
+    except AdmissionDenied as exc:
+        raise HTTPException(403, detail="Write authorization rejected") from exc
+
     try:
         engine._hooks.run_pre(operation, context)
     except Exception as exc:

package/src/superlocalmemory/server/routes/compliance.py

@@ -8,17 +8,17 @@ Routes: /api/compliance/status, /api/compliance/audit,
         /api/compliance/retention-policy
 Uses V3 compliance modules: ABACEngine, AuditChain, RetentionEngine.
 """
-import json
 import logging
 from typing import Optional
 
 from fastapi import APIRouter, Query, Request
 from fastapi.responses import JSONResponse
 
-from .helpers import get_active_profile, get_engine_lazy, MEMORY_DIR, DB_PATH
 from superlocalmemory.server.route_mutations import authorize_route_mutation
 from superlocalmemory.storage.memory_write import memory_write
 
+from .helpers import DB_PATH, MEMORY_DIR, get_active_profile, get_engine_lazy
+
 logger = logging.getLogger("superlocalmemory.routes.compliance")
 router = APIRouter()
 
@@ -31,10 +31,10 @@ AUDIT_DB = MEMORY_DIR / "audit_chain.db"
 # Feature detection
 COMPLIANCE_AVAILABLE = False
 try:
-    from superlocalmemory.compliance.audit import AuditChain
-    from superlocalmemory.compliance.retention import RetentionEngine
     from superlocalmemory.compliance.abac import ABACEngine
+    from superlocalmemory.compliance.audit import AuditChain
     from superlocalmemory.compliance.gdpr import GDPRCompliance
+    from superlocalmemory.compliance.retention import RetentionEngine
     COMPLIANCE_AVAILABLE = True
 except ImportError:
     logger.info("V3 compliance engine not available")
@@ -239,8 +239,8 @@ async def gdpr_export(request: Request):
     # remote uncredentialed fails closed) AND require MANAGE — in company mode
     # a session cookie flows on navigation, so a non-admin user is still denied;
     # the machine owner keeps MANAGE.
-    from superlocalmemory.server.write_identity import require_http_mutation_actor
     from superlocalmemory.server.rbac_enforce import require_manage
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
     require_http_mutation_actor(request, getattr(request.app.state, "daemon_descriptor", None),
                                 actor_kind="gdpr-export")
     require_manage(request)
@@ -299,9 +299,155 @@ async def gdpr_erase(request: Request, data: dict = {}):
             source_agent_id="http-gdpr-erase",
             profile_id=profile,
         )
-        result = GDPRCompliance(engine._db).forget_profile(profile)
+        result = GDPRCompliance(engine._db, engine=engine).forget_profile(profile)
         authorization.complete()
-        return {"success": True, "active_profile": profile, **(result or {})}
+        result = result or {}
+        failure_markers = (
+            "vector_store_failures",
+            "audit_completion_failed",
+            "audit_request_failed",
+            "receipt_persist_failed",
+        )
+        success = not any(result.get(marker) for marker in failure_markers)
+        return {"success": success, "active_profile": profile, **result}
     except Exception:
         logger.exception("gdpr_erase error")
         return {"success": False, "error": "Internal server error"}
+
+
+# ── GDPR Art. 17 — Entity-level Erasure ──────────────────────────────────────
+
+@router.post("/api/compliance/gdpr/erase-entity")
+async def gdpr_erase_entity(request: Request, data: dict = {}):
+    """Erase all facts mentioning a named entity for the active profile.
+
+    IRREVERSIBLE. Body must contain an ``entity_name`` and a ``confirm``
+    field that exactly matches ``entity_name`` — same confirm-guard pattern
+    as profile erasure. Mutation-authorized; requires MANAGE permission.
+    """
+    if not COMPLIANCE_AVAILABLE:
+        return {"success": False, "error": "Compliance engine not available"}
+    try:
+        engine = get_engine_lazy(request.app.state)
+        if engine is None:
+            return {"success": False, "error": "Engine not initialized"}
+        profile = get_active_profile()
+        entity_name = ((data or {}).get("entity_name") or "").strip()
+        confirm = (data or {}).get("confirm", "")
+        if not entity_name:
+            return {"success": False, "error": "entity_name is required"}
+        if confirm != entity_name:
+            return {
+                "success": False,
+                "error": (
+                    "Confirmation required: send {\"confirm\": \"" + entity_name +
+                    "\"} to erase this entity. This is irreversible."
+                ),
+            }
+        from superlocalmemory.server.rbac_enforce import require_manage
+        from superlocalmemory.server.write_identity import require_http_mutation_actor
+        require_http_mutation_actor(
+            request,
+            getattr(request.app.state, "daemon_descriptor", None),
+            actor_kind="gdpr-erase-entity",
+        )
+        require_manage(request, profile=profile)
+        authorization = authorize_route_mutation(
+            request,
+            operation="delete",
+            source_agent_id="http-gdpr-erase-entity",
+            profile_id=profile,
+        )
+        result = GDPRCompliance(engine._db, engine=engine).forget_entity(entity_name, profile)
+        authorization.complete()
+        result = result or {}
+        failure_markers = (
+            "vector_store_failures",
+            "audit_completion_failed",
+            "audit_request_failed",
+            "receipt_persist_failed",
+        )
+        success = not any(result.get(marker) for marker in failure_markers)
+        return {
+            "success": success, "active_profile": profile,
+            "entity_name": entity_name, **result,
+        }
+    except Exception:
+        logger.exception("gdpr_erase_entity error")
+        return {"success": False, "error": "Internal server error"}
+
+
+# ── Erasure Receipts — list + cryptographic verify ───────────────────────────
+
+@router.get("/api/compliance/receipts")
+async def list_erasure_receipts(
+    request: Request,
+    limit: int = Query(default=50, ge=1, le=200),
+):
+    """List recent erasure receipts for the active profile.
+
+    Returns summary rows from ``erasure_receipts`` (migration M035):
+    erasure_id, subject_type, subject_id, state, all_erased, fact_count,
+    requested_at, completed_at. Read-only; loopback-gated.
+    """
+    if not COMPLIANCE_AVAILABLE:
+        return {"available": False, "error": "Compliance engine not available"}
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+    require_http_mutation_actor(
+        request,
+        getattr(request.app.state, "daemon_descriptor", None),
+        actor_kind="erasure-receipts-read",
+    )
+    try:
+        engine = get_engine_lazy(request.app.state)
+        if engine is None:
+            return {"available": False, "error": "Engine not initialized"}
+        profile = get_active_profile()
+        try:
+            rows = engine._db.execute(
+                "SELECT erasure_id, subject_type, subject_id, state, all_erased, "
+                "fact_count, requested_at, completed_at "
+                "FROM erasure_receipts WHERE profile_id = ? "
+                "ORDER BY requested_at DESC LIMIT ?",
+                (profile, limit),
+            )
+            receipts = [dict(r) for r in rows]
+        except Exception:
+            receipts = []
+        return {
+            "available": True, "active_profile": profile,
+            "receipts": receipts, "total": len(receipts),
+        }
+    except Exception:
+        logger.exception("list_erasure_receipts error")
+        return {"available": False, "error": "Internal server error"}
+
+
+@router.get("/api/compliance/receipts/{erasure_id}/verify")
+async def verify_erasure_receipt(request: Request, erasure_id: str):
+    """Cryptographically verify an erasure receipt's audit hash.
+
+    Returns ``{verified: bool}`` — True means the stored hash matches a
+    recompute from the receipt fields (tamper-evident). Read-only;
+    loopback-gated.
+    """
+    if not COMPLIANCE_AVAILABLE:
+        return {"available": False, "error": "Compliance engine not available"}
+    from superlocalmemory.server.write_identity import require_http_mutation_actor
+    require_http_mutation_actor(
+        request,
+        getattr(request.app.state, "daemon_descriptor", None),
+        actor_kind="erasure-receipt-verify",
+    )
+    try:
+        engine = get_engine_lazy(request.app.state)
+        if engine is None:
+            return {"available": False, "error": "Engine not initialized"}
+        profile = get_active_profile()
+        from superlocalmemory.core.transactions.erasure import verify_receipt
+        with engine._db.raw_connection() as conn:
+            verified = verify_receipt(conn, erasure_id, profile_id=profile)
+        return {"available": True, "erasure_id": erasure_id, "verified": verified}
+    except Exception:
+        logger.exception("verify_erasure_receipt error")
+        return {"available": False, "error": "Internal server error"}

package/src/superlocalmemory/server/routes/data_io.py

@@ -6,6 +6,7 @@
 
 Routes: /api/export, /api/import
 """
+import asyncio
 import io
 import gzip
 import hashlib
@@ -27,6 +28,13 @@ from .helpers import (
 
 logger = logging.getLogger("superlocalmemory.routes.data_io")
 
+# Hard cap on the total decompressed byte count for gzip imports.
+# Bounding the compressed upload size alone does not prevent a decompression
+# bomb: a few kilobytes of input can expand to gigabytes.  This cap is checked
+# incrementally during streaming decompression so the full expanded content is
+# never materialized before the guard fires.
+_MAX_DECOMPRESSED_BYTES: int = 200 * 1024 * 1024  # 200 MB
+
 
 def _internal_error(detail: str = "Internal server error") -> HTTPException:
     """SEC-H-02: log full traceback server-side; return a generic message to the client."""
@@ -158,7 +166,27 @@ async def import_memories(request: Request, file: UploadFile = File(...)):
             raise HTTPException(status_code=413,
                                 detail="Import file exceeds the 50 MB limit")
         if file.filename and file.filename.endswith('.gz'):
-            content = gzip.decompress(content)
+            # Stream-decompress with an incremental byte counter so the full
+            # expanded payload is never allocated before the guard fires.
+            _chunk_size = 65_536
+            chunks: list[bytes] = []
+            total_decompressed = 0
+            with gzip.GzipFile(fileobj=io.BytesIO(content)) as _gz:
+                while True:
+                    chunk = _gz.read(_chunk_size)
+                    if not chunk:
+                        break
+                    total_decompressed += len(chunk)
+                    if total_decompressed > _MAX_DECOMPRESSED_BYTES:
+                        raise HTTPException(
+                            status_code=413,
+                            detail=(
+                                f"Decompressed content exceeds the "
+                                f"{_MAX_DECOMPRESSED_BYTES // (1024 * 1024)} MB limit"
+                            ),
+                        )
+                    chunks.append(chunk)
+            content = b"".join(chunks)
 
         try:
             data = json.loads(content)
@@ -204,12 +232,25 @@ async def import_memories(request: Request, file: UploadFile = File(...)):
                 if not memory_content:
                     errors.append(f"Memory {idx}: missing 'content' field")
                     continue
+                # Imported content is untrusted: scrub secrets before it reaches
+                # any durable or queryable store, exactly as the canonical
+                # ingest path does.
+                from superlocalmemory.core.ingest_policy import scrub_secrets_for_ingest
+                _scrub = scrub_secrets_for_ingest(memory_content)
+                if _scrub.redacted:
+                    memory_content = _scrub.content
 
                 metadata = {
                     "project_name": memory.get('project_name'),
                     "category": memory.get('category'),
                     "tags": memory.get('tags', ''),
                 }
+                for _field in (
+                    "fact_type", "confidence", "importance", "entities",
+                    "canonical_entities", "referenced_date", "pinned",
+                ):
+                    if _field in memory:
+                        metadata[_field] = memory[_field]
                 receipt, created = command.submit_with_status(IngestionRequest(
                     content=memory_content,
                     profile_id=engine._profile_id,
@@ -224,7 +265,7 @@ async def import_memories(request: Request, file: UploadFile = File(...)):
                     speaker=memory.get('speaker') or "",
                     role=memory.get('role') or "user",
                 ))
-                completed = command.materialize(receipt.operation_id)
+                completed = await asyncio.to_thread(command.materialize, receipt.operation_id)
                 if completed.state is not IngestionState.COMPLETE:
                     raise RuntimeError(
                         completed.last_error or "canonical import failed"

package/src/superlocalmemory/server/routes/events.py

@@ -34,6 +34,11 @@ except ImportError:
 _sse_queues: Set = set()
 _sse_queues_lock = threading.Lock()
 
+# Maximum concurrent SSE connections. Connections beyond this limit are
+# rejected immediately with an SSE error frame so the server cannot be
+# exhausted by many idle clients.
+_MAX_SSE_CONNECTIONS = 64
+
 
 def _event_to_sse_bridge(event: dict):
     """EventBus listener that pushes events to all SSE client queues."""
@@ -78,6 +83,16 @@ async def event_stream(
 
     client_queue = _queue.Queue(maxsize=100)
     with _sse_queues_lock:
+        if len(_sse_queues) >= _MAX_SSE_CONNECTIONS:
+            return StreamingResponse(
+                iter(['data: {"error": "SSE connection limit reached"}\n\n']),
+                media_type="text/event-stream",
+                headers={
+                    "Cache-Control": "no-cache",
+                    "Connection": "close",
+                    "X-Accel-Buffering": "no",
+                },
+            )
         _sse_queues.add(client_queue)
 
     async def generate():