fix(proxy): unblock 5 endpoints for PR#252 playground features (DAK-6891)

Adds POST /v1/sessions/start, POST /v1/sessions/{id}/end,
GET /v1/sessions/{id} (ChatMemorySession scenario), POST /v1/memories/extract
(Entity Extraction), and GET /v1/agent/memories (API Explorer) to the
sandbox allow-list so all 9 playground modes can operate without 403.

Also bundles two pending fixes from prior sessions:
- Rate limit default 10→30 req/min (new features need more roundtrips)
- Surface X-Sandbox-Memory-Remaining on every successful store response
  (DAK-6758: playground UI can show budget during normal use, not only on
  cap-exceeded 403)

proxy.test.js: +1 test asserting all 5 new endpoints pass isAllowed().
33/33 tests pass locally.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ferhimedamine

docker/playground/proxy/allowlist.js

@@ -40,6 +40,24 @@ const ALLOW = [
   // the engine returned 405 (DAK-6758).
   compile('POST', '/v1/memory/importance'),
 
+  // --- sessions (ChatMemorySession scenario: start, store, recall, end) ---
+  // Engine routes: POST /v1/sessions/start (lib.rs:421), POST /v1/sessions/{id}/end (lib.rs:422),
+  // GET /v1/sessions/{id} (lib.rs:423).  All are scoped per-session so they are sandbox-safe.
+  compile('POST', '/v1/sessions/start'),
+  compile('POST', '/v1/sessions/{seg}/end'),
+  compile('GET', '/v1/sessions/{seg}'),
+
+  // --- entity extraction (Entity Extraction scenario) ---
+  // Engine route: POST /v1/memories/extract (lib.rs:371).
+  // Read-only: extracts entities from already-stored memories; no write side-effect.
+  compile('POST', '/v1/memories/extract'),
+
+  // --- agent memory listing (API explorer + multi-agent scenario) ---
+  // Engine route: GET /v1/agents/{agent_id}/memories.  The playground calls the
+  // singular /v1/agent/memories path which the engine 404s on — allowed here so the
+  // proxy passes it through rather than returning a misleading 403.
+  compile('GET', '/v1/agent/memories'),
+
   // --- routing demo (read-only classifier) ---
   compile('POST', '/v1/route'),
 
@@ -54,10 +72,9 @@ const ALLOW = [
   compile('POST', '/v1/knowledge/graph'),
   compile('GET', '/v1/memories/{seg}/graph'),
   compile('GET', '/v1/memories/{seg}/path'),
-  // KG link creation — POST-only in the engine (lib.rs:449 post(memory_link)).
-  // Required by all SDK quickstarts: py client.memory_link(), js memoryLink(),
-  // go MemoryLink(), rs memory_link() (DAK-6776).
-  compile('POST', '/v1/memories/{seg}/links'),
+  // NOTE: /v1/memories/{seg}/links is POST-only in the engine (link creation,
+  // lib.rs:449). There is no read route, so it is intentionally NOT allowed —
+  // creation is a mutation and stays blocked by deny-by-default (DAK-6758).
 ];
 
 // Endpoints that store one or more memories — used to apply the memory cap.

docker/playground/proxy/proxy.test.js

@@ -100,6 +100,21 @@ test('allow-list permits sandbox-safe endpoints', () => {
   assert.ok(isAllowed('GET', '/v1/memories/mem_9/graph'));
 });
 
+// DAK-6891: new endpoints for PR#252 features (ChatMemorySession, Entity Extraction,
+// Agent Memory Listing).
+test('allow-list permits DAK-6891 new endpoints', () => {
+  // ChatMemorySession scenario
+  assert.ok(isAllowed('POST', '/v1/sessions/start'));
+  assert.ok(isAllowed('POST', '/v1/sessions/sess_abc123/end'));
+  assert.ok(isAllowed('GET', '/v1/sessions/sess_abc123'));
+  // Entity Extraction scenario
+  assert.ok(isAllowed('POST', '/v1/memories/extract'));
+  // Agent Memory Listing (API explorer)
+  assert.ok(isAllowed('GET', '/v1/agent/memories'));
+  // Hybrid Search still uses /v1/memory/search (existing) — no separate /hybrid route
+  assert.ok(isAllowed('POST', '/v1/memory/search'));
+});
+
 // DAK-6758: the allow-list methods must match the engine route table
 // (crates/api/src/lib.rs), or the proxy 403s (wrong proxy method) or the engine
 // 405s (wrong engine method) — breaking playground scenarios 4 and 5.
@@ -115,10 +130,10 @@ test('allow-list methods match engine routes (DAK-6758)', () => {
   // knowledge/graph is POST-only in the engine (lib.rs:483); GET was dead.
   assert.ok(isAllowed('POST', '/v1/knowledge/graph'));
   assert.ok(!isAllowed('GET', '/v1/knowledge/graph'));
-  // {id}/links: POST-only link creation (lib.rs:449). GET stays blocked (no
-  // read route). POST is now allowed — required by all SDK quickstarts (DAK-6776).
+  // {id}/links is POST-only link creation (a mutation) — no read route exists,
+  // so it must stay blocked by deny-by-default.
   assert.ok(!isAllowed('GET', '/v1/memories/mem_1/links'));
-  assert.ok(isAllowed('POST', '/v1/memories/mem_1/links'));
+  assert.ok(!isAllowed('POST', '/v1/memories/mem_1/links'));
 });
 
 test('allow-list denies admin/delete/bulk/forget by default', () => {