@sema-agent/client-core 0.99.0 → 0.101.0

package/dist/cloudConfigWireCaps.js

@@ -1,11 +1,14 @@
-import { MCP_CAPS, mcpAssertionHeaderNotSentNotice, mcpElicitationVerdict, mcpToolAxesVerdict, readMcpHttpIdentityHeaders } from './mcpWireCaps.js';
-import { toCappedSpec } from './skillsWireCaps.js';
+import { mcpAllowToolsVerdict, mcpAssertionHeaderNotSentNotice, mcpElicitationVerdict, mcpToolAxesVerdict, mcpToolFacesVerdict, readMcpHttpIdentityHeaders } from './mcpWireCaps.js';
+import { skillToolListsVerdict, toCappedSpec } from './skillsWireCaps.js';
+import { SETTINGS_DESCRIBE_BAD_WIRE_NAME, SETTINGS_IS_USABLE_WIRE_NAME, SETTINGS_READ_REQUEST_MCP_TRANSPORT } from './generated/settingsSchemaFns.js';
+import { snapshotArgs, wireTransportOf } from './mcpWireTransport.js';
 import { msg, renderMessage } from './i18n/translate.js';
 import { TIER_ORDER } from './model/tierVocabulary.js';
 import { SETTINGS_NARROW_AT_MENTION } from './generated/settingsSchemaFns.js';
 import { modelsPolicyOf } from './model/modelsPolicy.js';
 import { normalizeEngineBaseUrl } from './engineUrl.js';
 import { guardedRead, readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
+import { capForDisplay } from './fleetTaskDesc.js';
 import { SETTINGS_BUDGET_NUMBER_KEYS, SETTINGS_BUDGET_PER_MODEL_NUMBER_KEYS, SETTINGS_BUDGET_STRING_KEYS, SETTINGS_TIER_GROUP_NAME_RE, } from './generated/settingsSchemaTables.js';
 const asRec = (v) => (typeof v === 'object' && v !== null && !Array.isArray(v) ? v : undefined);
 const asArr = (v) => (Array.isArray(v) ? v : []);
@@ -14,115 +17,203 @@ export function cloudMcpToSpecs(servers, env) {
     const specs = [];
     const missingEnv = [];
     const droppedServers = [];
-    const drop = (name, reason) => {
-        droppedServers.push({ ...(name ? { name } : {}), reason });
+    const degradedServers = [];
+    const recordDrop = (name, reason, path, problem) => {
+        droppedServers.push({ ...(name ? { name } : {}), reason, ...(path !== undefined ? { path } : {}), ...(problem !== undefined ? { problem } : {}) });
     };
     for (const raw of asArr(servers)) {
-        const s = asRec(raw);
-        const name = s ? asStr(s.name) : undefined;
-        if (specs.length >= MCP_CAPS.items) {
-            drop(name, 'capped');
+        let s;
+        try {
+            s = asRec(raw);
+        }
+        catch {
+            recordDrop(undefined, 'entry-unreadable');
+            continue;
+        }
+        let name;
+        try {
+            name = s ? asStr(s.name) : undefined;
+        }
+        catch {
+            recordDrop(undefined, 'entry-unreadable');
             continue;
         }
-        if (!s || s.enabled === false) {
-            drop(name, s?.enabled === false ? 'disabled' : 'missing-field');
+        if (!s) {
+            recordDrop(name, 'missing-field');
+            continue;
+        }
+        let enabled;
+        try {
+            enabled = s.enabled;
+        }
+        catch {
+            recordDrop(name, 'entry-unreadable');
+            continue;
+        }
+        if (enabled === false) {
+            recordDrop(name, 'disabled');
+            continue;
+        }
+        let t;
+        try {
+            t = asRec(s.transport);
+        }
+        catch {
+            recordDrop(name, 'entry-unreadable');
             continue;
         }
-        const t = asRec(s.transport);
         if (!name || !t) {
-            drop(name, 'missing-field');
+            recordDrop(name, 'missing-field');
             continue;
         }
-        let transport = null;
-        if (t.kind === 'stdio') {
-            const command = asStr(t.command);
-            if (!command) {
-                drop(name, 'missing-field');
-                continue;
-            }
-            const envOut = {};
-            for (const [target, ref] of Object.entries(asRec(t.envRefs) ?? {})) {
+        if (!SETTINGS_IS_USABLE_WIRE_NAME(name)) {
+            recordDrop(name, 'name-unusable');
+            continue;
+        }
+        let candidate;
+        let requiredRaw;
+        const missingHere = [];
+        const resolveRefs = (refs) => {
+            const out = [];
+            for (const [target, ref] of Object.entries(asRec(refs) ?? {})) {
                 const refName = asStr(ref);
                 if (!refName)
                     continue;
                 const v = env[refName];
                 if (v === undefined || v === '')
-                    missingEnv.push(refName);
+                    missingHere.push(refName);
                 else
-                    envOut[target] = v;
+                    out.push([target, v]);
             }
-            const args = asArr(t.args).filter((a) => typeof a === 'string');
-            transport = {
-                kind: 'stdio',
-                command,
-                ...(args.length > 0 ? { args } : {}),
-                ...(Object.keys(envOut).length > 0 ? { env: envOut } : {}),
-            };
-        }
-        else if (t.kind === 'http') {
-            const url = asStr(t.url);
-            if (!url) {
-                drop(name, 'missing-field');
-                continue;
-            }
-            const identity = readMcpHttpIdentityHeaders(t);
-            if (identity.kind === 'both_set') {
-                drop(name, 'principal-and-assertion-header');
-                continue;
+            return out;
+        };
+        const dropHard = (issue, raw) => {
+            const missing = (issue.path === 'transport.command' || issue.path === 'transport.url') && asStr(raw) === undefined;
+            if (missing)
+                recordDrop(name, 'missing-field');
+            else
+                recordDrop(name, 'transport-invalid', issue.path);
+        };
+        try {
+            if (t.kind === 'stdio') {
+                const command = t.command;
+                requiredRaw = command;
+                const head = SETTINGS_READ_REQUEST_MCP_TRANSPORT({ kind: 'stdio', command });
+                if (!head.ok) {
+                    dropHard(head.issue, command);
+                    continue;
+                }
+                const envEntries = resolveRefs(t.envRefs);
+                candidate = { kind: 'stdio', command, args: snapshotArgs(t.args), env: envEntries.length > 0 ? Object.fromEntries(envEntries) : undefined };
             }
-            const headers = {};
-            for (const [headerName, ref] of Object.entries(asRec(t.headerRefs) ?? {})) {
-                const refName = asStr(ref);
-                if (!refName)
+            else if (t.kind === 'http') {
+                const url = t.url;
+                requiredRaw = url;
+                const head = SETTINGS_READ_REQUEST_MCP_TRANSPORT({ kind: 'http', url });
+                if (!head.ok) {
+                    dropHard(head.issue, url);
                     continue;
-                const v = env[refName];
-                if (v === undefined || v === '')
-                    missingEnv.push(refName);
-                else
-                    headers[headerName] = v;
+                }
+                const principalHeader = t.principalHeader;
+                const assertionHeader = t.assertionHeader;
+                if (readMcpHttpIdentityHeaders({ principalHeader, assertionHeader }).kind === 'both_set') {
+                    recordDrop(name, 'principal-and-assertion-header');
+                    continue;
+                }
+                const headerEntries = resolveRefs(t.headerRefs);
+                candidate = { kind: 'http', url, headers: headerEntries.length > 0 ? Object.fromEntries(headerEntries) : undefined, principalHeader, assertionHeader };
+            }
+            else {
+                recordDrop(name, 'unknown-transport');
+                continue;
             }
-            transport = {
-                kind: 'http',
-                url,
-                ...(Object.keys(headers).length > 0 ? { headers } : {}),
-                ...(identity.principalHeader !== undefined ? { principalHeader: identity.principalHeader } : {}),
-                ...(identity.assertionHeader !== undefined ? { assertionHeader: identity.assertionHeader } : {}),
-            };
         }
-        else {
-            drop(name, 'unknown-transport');
+        catch {
+            recordDrop(name, 'transport-invalid', 'transport');
+            continue;
+        }
+        let read;
+        try {
+            read = SETTINGS_READ_REQUEST_MCP_TRANSPORT(candidate);
+        }
+        catch {
+            recordDrop(name, 'transport-invalid', 'transport');
+            continue;
+        }
+        if (!read.ok) {
+            dropHard(read.issue, requiredRaw);
+            continue;
+        }
+        const transport = wireTransportOf(read.transport);
+        let axesDeclared;
+        let elicitationDeclared;
+        let allowDeclared;
+        try {
+            axesDeclared = s.toolAxes;
+            elicitationDeclared = s.elicitation;
+            allowDeclared = s.allowTools;
+        }
+        catch {
+            recordDrop(name, 'entry-unreadable');
             continue;
         }
-        const axesDeclared = s.toolAxes;
         const axesVerdict = mcpToolAxesVerdict(axesDeclared);
         if (axesVerdict.kind === 'bad') {
-            drop(name, 'tool-axes-invalid');
+            recordDrop(name, 'tool-axes-invalid');
             continue;
         }
         const axesShipped = axesVerdict.kind === 'ok' ? axesVerdict.toolAxes : axesDeclared;
-        const elVerdict = mcpElicitationVerdict(s.elicitation);
+        let facesDeclared;
+        let facesUnreadable = false;
+        try {
+            facesDeclared = s.toolFaces;
+        }
+        catch {
+            facesUnreadable = true;
+        }
+        const facesVerdict = facesUnreadable
+            ? Object.freeze({ kind: 'bad', problem: renderMessage(msg('config.mcp.toolFacesUnreadable')) })
+            : mcpToolFacesVerdict(facesDeclared);
+        if (facesVerdict.kind === 'bad') {
+            recordDrop(name, 'tool-faces-invalid', undefined, facesVerdict.problem);
+            continue;
+        }
+        const facesShipped = facesVerdict.kind === 'ok' ? facesVerdict.toolFaces : facesDeclared;
+        const elVerdict = mcpElicitationVerdict(elicitationDeclared);
         if (elVerdict.kind === 'bad') {
-            drop(name, 'elicitation-invalid');
+            recordDrop(name, 'elicitation-invalid');
+            continue;
+        }
+        const allowVerdict = mcpAllowToolsVerdict(() => allowDeclared, `config.mcp.servers.${capForDisplay(name, DEGRADED_NAME_SHOWN)}.`);
+        if (allowVerdict.kind === 'bad') {
+            recordDrop(name, 'allow-tools-invalid', allowVerdict.path, allowVerdict.problem);
             continue;
         }
-        const allowToolsWritten = Array.isArray(s.allowTools);
-        const allowTools = asArr(s.allowTools).filter((a) => typeof a === 'string');
+        missingEnv.push(...missingHere);
+        if (read.lost.length > 0)
+            degradedServers.push({ name, lost: Object.freeze([...read.lost]) });
         specs.push({
             name,
             transport,
-            ...(allowToolsWritten ? { allowTools } : {}),
+            ...(allowVerdict.allowTools !== undefined ? { allowTools: allowVerdict.allowTools } : {}),
             ...(elVerdict.elicitation !== undefined ? { elicitation: elVerdict.elicitation } : {}),
-            ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
+            ...(facesShipped !== undefined ? { toolFaces: facesShipped } : {}),
             ...(axesShipped !== undefined ? { toolAxes: axesShipped } : {}),
         });
     }
-    return { specs, missingEnv: [...new Set(missingEnv)], droppedServers };
+    return { specs, missingEnv: [...new Set(missingEnv)], droppedServers, degradedServers };
+}
+export function cloudSkillsToSpecs(manifestSkills, resolveBody, opts) {
+    return projectCloudSkills(manifestSkills, resolveBody, opts).specs;
 }
-export function cloudSkillsToSpecs(manifestSkills, resolveBody) {
+function projectCloudSkills(manifestSkills, resolveBody, opts) {
     const specs = [];
+    const dropped = [];
     const seen = new Set();
-    for (const raw of asArr(manifestSkills)) {
-        const s = asRec(raw);
+    const reading = opts?.skillToolLists;
+    const entries = asArr(manifestSkills);
+    for (let i = 0; i < entries.length; i++) {
+        const s = asRec(entries[i]);
         if (!s || s.enabled === false)
             continue;
         const name = asStr(s.name);
@@ -136,9 +227,14 @@ export function cloudSkillsToSpecs(manifestSkills, resolveBody) {
         if (!spec || seen.has(spec.name))
             continue;
         seen.add(spec.name);
-        specs.push(spec);
+        const verdict = skillToolListsVerdict(s, reading);
+        if (verdict.kind === 'bad') {
+            dropped.push({ name: spec.name, reason: 'tool-list-invalid', path: `skills[${i}].${verdict.key}${verdict.index !== undefined ? `[${verdict.index}]` : ''}` });
+            continue;
+        }
+        specs.push({ ...spec, ...verdict.lists });
     }
-    return specs;
+    return { specs, dropped };
 }
 const REGISTRY_ENTRY_ANNOTATION_KEYS = ['origin', 'overridesTeam'];
 function withoutRegistryAnnotations(e) {
@@ -222,7 +318,7 @@ function modelsDocOf(models, opts) {
     const acceptedFlags = accept ? stripped.map(acceptedName) : undefined;
     const names = acceptedFlags ? new Set(stripped.filter((_, i) => acceptedFlags[i]).map((e) => e.name)) : allNames;
     const issues = [...copyFailures];
-    const drop = (i) => {
+    const recordDrop = (i) => {
         issues.push({ ...i, outcome: 'dropped' });
     };
     const refOf = (v) => (typeof v === 'string' && v !== '' ? { target: v } : {});
@@ -243,13 +339,13 @@ function modelsDocOf(models, opts) {
     const doc = { models: written };
     const policy = modelsPolicyOf(m);
     if (policy.unreadable) {
-        drop({ key: 'roles', at: 'default', reason: 'unreadable' });
-        drop({ key: 'atMention', at: 'models', reason: 'unreadable' });
+        recordDrop({ key: 'roles', at: 'default', reason: 'unreadable' });
+        recordDrop({ key: 'atMention', at: 'models', reason: 'unreadable' });
     }
     const rolesRead = guarded(() => ({ value: m.roles }));
     const roleEntries = rolesRead === undefined ? undefined : guarded(() => Object.entries(asRec(rolesRead.value) ?? {}));
     if (roleEntries === undefined)
-        drop({ key: 'roles', at: 'models', reason: 'unreadable' });
+        recordDrop({ key: 'roles', at: 'models', reason: 'unreadable' });
     const keptRoles = {};
     for (const [role, t] of roleEntries ?? []) {
         const first = guarded(() => {
@@ -258,20 +354,20 @@ function modelsDocOf(models, opts) {
             return { tr: r, has, model: has ? r.model : undefined };
         });
         if (first === undefined) {
-            drop({ key: 'roles', at: role, reason: 'unreadable' });
+            recordDrop({ key: 'roles', at: role, reason: 'unreadable' });
             continue;
         }
         const { tr, has, model } = first;
         if (typeof model === 'string') {
             const verdict = modelRefVerdict(model);
             if (verdict !== 'accepted') {
-                drop({ key: 'roles', at: role, ...refOf(model), reason: verdict });
+                recordDrop({ key: 'roles', at: role, ...refOf(model), reason: verdict });
                 continue;
             }
         }
         const copy = writtenCopyOf(t, tr !== undefined && has ? { key: 'model', value: model } : undefined);
         if (copy === undefined) {
-            drop({ key: 'roles', at: role, ...refOf(model), reason: 'unreadable' });
+            recordDrop({ key: 'roles', at: role, ...refOf(model), reason: 'unreadable' });
             continue;
         }
         setOwn(keptRoles, role, copy.value);
@@ -286,14 +382,14 @@ function modelsDocOf(models, opts) {
         doc.roles = rolesOut;
     const am = policy.atMention;
     if (am?.kind === 'unreadable') {
-        drop({ key: 'atMention', at: 'atMention', reason: 'unreadable' });
+        recordDrop({ key: 'atMention', at: 'atMention', reason: 'unreadable' });
     }
     else if (am !== undefined) {
         const v = am.value;
         if (v.mode === 'only') {
             for (const n of v.models)
                 if (!names.has(n))
-                    drop({ key: 'atMention', target: n, reason: reasonOf(n) });
+                    recordDrop({ key: 'atMention', target: n, reason: reasonOf(n) });
             const narrowed = SETTINGS_NARROW_AT_MENTION(v, names);
             if (narrowed.mode === 'only') {
                 doc.atMention = { mode: 'only', models: [...narrowed.models] };
@@ -301,7 +397,7 @@ function modelsDocOf(models, opts) {
             else {
                 doc.atMention = { mode: narrowed.mode };
                 if (narrowed.mode === 'none' && !catalogKept)
-                    drop({ key: 'atMention', at: 'atMention', reason: 'dangling' });
+                    recordDrop({ key: 'atMention', at: 'atMention', reason: 'dangling' });
             }
         }
         else if (v.mode === 'none') {
@@ -315,11 +411,11 @@ function modelsDocOf(models, opts) {
         const tgValue = typeof tg === 'object' ? tg.value : undefined;
         const rawGroupNames = new Set((Array.isArray(tgValue) ? tgValue : []).map((g) => asStr(asRec(g)?.name)).filter((n) => !!n));
         if (tg === 'unreadable') {
-            drop({ key: 'tierGroups', at: 'models', reason: 'unreadable' });
+            recordDrop({ key: 'tierGroups', at: 'models', reason: 'unreadable' });
         }
         else if (tg !== 'absent') {
             if (!Array.isArray(tgValue)) {
-                drop({ key: 'tierGroups', reason: 'unreadable' });
+                recordDrop({ key: 'tierGroups', reason: 'unreadable' });
             }
             else {
                 const groups = [];
@@ -328,11 +424,11 @@ function modelsDocOf(models, opts) {
                     const g = asRec(raw);
                     const name = g ? asStr(g.name) : undefined;
                     if (!g || !name || !TIER_GROUP_NAME.test(name)) {
-                        drop({ key: 'tierGroups', ...(name ? { at: name } : {}), reason: 'unreadable' });
+                        recordDrop({ key: 'tierGroups', ...(name ? { at: name } : {}), reason: 'unreadable' });
                         continue;
                     }
                     if (groupNames.has(name)) {
-                        drop({ key: 'tierGroups', at: name, reason: 'duplicate' });
+                        recordDrop({ key: 'tierGroups', at: name, reason: 'duplicate' });
                         continue;
                     }
                     groupNames.add(name);
@@ -340,15 +436,15 @@ function modelsDocOf(models, opts) {
                     if (Object.hasOwn(g, 'tiers')) {
                         const t = asRec(g.tiers);
                         if (!t)
-                            drop({ key: 'tierGroups', at: `${name}.tiers`, reason: 'unreadable' });
+                            recordDrop({ key: 'tierGroups', at: `${name}.tiers`, reason: 'unreadable' });
                         else {
                             for (const [tier, model] of Object.entries(t)) {
                                 if (!TIER_WORDS.includes(tier))
-                                    drop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: 'unsupported' });
+                                    recordDrop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: 'unsupported' });
                                 else if (typeof model === 'string' && names.has(model))
                                     setOwn(tiers, tier, model);
                                 else
-                                    drop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: reasonOf(model) });
+                                    recordDrop({ key: 'tierGroups', at: `${name}.${tier}`, ...refOf(model), reason: reasonOf(model) });
                             }
                         }
                     }
@@ -358,14 +454,14 @@ function modelsDocOf(models, opts) {
             }
         }
         if (atg === 'unreadable') {
-            drop({ key: 'activeTierGroup', at: 'models', reason: 'unreadable' });
+            recordDrop({ key: 'activeTierGroup', at: 'models', reason: 'unreadable' });
         }
         else if (atg !== 'absent') {
             const a = atg.value;
             if (typeof a === 'string' && groupNames?.has(a))
                 doc.activeTierGroup = a;
             else
-                drop({ key: 'activeTierGroup', ...refOf(a), reason: typeof a === 'string' && a !== '' ? (rawGroupNames.has(a) ? 'rejected' : 'dangling') : 'unreadable' });
+                recordDrop({ key: 'activeTierGroup', ...refOf(a), reason: typeof a === 'string' && a !== '' ? (rawGroupNames.has(a) ? 'rejected' : 'dangling') : 'unreadable' });
         }
     }
     return { doc, issues, entriesRead: copied };
@@ -562,14 +658,14 @@ function runtimeCapsOf(b, mode) {
     }
     return { kind: 'configured', caps, uninterpretedKeys: uninterpreted };
 }
-export function projectEffectiveBody(body, skillBodies, env, rostersValue, opts) {
+export function projectEffectiveBody(body, skillBodies, env, rostersValue, opts, skills) {
     const b = asRec(body) ?? {};
     const config = asRec(b.config) ?? {};
     const mcpDomain = asRec(config.mcp);
     const skillsDomain = asRec(config.skills);
-    const { specs: mcp, missingEnv: mcpMissing, droppedServers: droppedMcpServers } = cloudMcpToSpecs(mcpDomain?.servers, env);
+    const { specs: mcp, missingEnv: mcpMissing, droppedServers: droppedMcpServers, degradedServers: degradedMcpServers } = cloudMcpToSpecs(mcpDomain?.servers, env);
     const manifest = asArr(skillsDomain?.skills);
-    const skills = cloudSkillsToSpecs(manifest, (hash) => skillBodies[hash] ?? null);
+    const { specs: skillSpecs, dropped: droppedSkills } = projectCloudSkills(manifest, (hash) => skillBodies[hash] ?? null, skills);
     const skillsMissingBody = manifest
         .map((raw) => {
         const s = asRec(raw);
@@ -584,14 +680,16 @@ export function projectEffectiveBody(body, skillBodies, env, rostersValue, opts)
     const view = viewModeOf(b);
     return {
         mcp,
-        skills,
+        skills: skillSpecs,
         modelsDoc,
         modelNames: cloudModelNames(modelsDoc),
         rosterNames: cloudRosterNames(rostersValue),
         missingEnv: [...new Set([...mcpMissing, ...cloudModelMissingKeyEnv(modelsDoc, env)])],
         scope: asStr(b.scope) ?? 'global',
         skillsMissingBody,
+        droppedSkills,
         droppedMcpServers,
+        degradedMcpServers,
         droppedModels: entriesRead === undefined ? [] : cloudModelsDropped({ models: entriesRead }),
         execution: cloudExecutionToPolicy(config.execution),
         effectiveWarnings: effectiveWarningsOf(b),
@@ -672,13 +770,29 @@ const MCP_DROP_SENTENCES = {
         level: 'warn',
         text: (who) => renderMessage(msg('config.mcp.cloudToolAxesInvalid', { who })),
     },
+    'tool-faces-invalid': {
+        level: 'warn',
+        text: (who) => renderMessage(msg('config.mcp.cloudToolFacesInvalid', { who })),
+    },
     'elicitation-invalid': {
         level: 'warn',
         text: (who) => renderMessage(msg('config.mcp.cloudElicitationInvalid', { who })),
     },
-    capped: {
+    'allow-tools-invalid': {
+        level: 'warn',
+        text: (who) => renderMessage(msg('config.mcp.cloudAllowToolsInvalid', { who })),
+    },
+    'entry-unreadable': {
+        level: 'warn',
+        text: (who) => renderMessage(msg('config.mcp.cloudEntryUnreadable', { who })),
+    },
+    'name-unusable': {
         level: 'warn',
-        text: (who) => `cloud config: MCP server entries left out because more than ${MCP_CAPS.items} were served to you and this client passes at most ${MCP_CAPS.items} to the engine: ${who}`,
+        text: (who) => renderMessage(msg('config.mcp.cloudNameUnusable', { who })),
+    },
+    'transport-invalid': {
+        level: 'warn',
+        text: (who) => renderMessage(msg('config.mcp.cloudTransportInvalid', { who })),
     },
     disabled: {
         level: 'info',
@@ -688,9 +802,9 @@ const MCP_DROP_SENTENCES = {
 const MCP_DROP_UNRECOGNISED = (who) => `cloud config: MCP server entries left out for a reason this client does not recognise: ${who}`;
 const MCP_DROP_LIST_UNREADABLE = 'cloud config: the list of MCP server entries left out could not be read by this client — servers missing from the local tool list may have been left out without notice';
 const MCP_DROP_NAMES_SHOWN = 5;
-function mcpDropWho(names, unnamed) {
-    const distinct = [...new Set(names)];
-    const parts = distinct.slice(0, MCP_DROP_NAMES_SHOWN).map((n) => `"${n}"`);
+function mcpDropWho(labels, unnamed) {
+    const distinct = [...new Set(labels)];
+    const parts = distinct.slice(0, MCP_DROP_NAMES_SHOWN);
     if (distinct.length > MCP_DROP_NAMES_SHOWN)
         parts.push(`+${distinct.length - MCP_DROP_NAMES_SHOWN} more`);
     if (unnamed > 0)
@@ -728,6 +842,8 @@ function droppedMcpNotices(carrier) {
     catch {
         return listUnreadable;
     }
+    if (typeof count !== 'number' || !Number.isSafeInteger(count) || count < 0)
+        return listUnreadable;
     const known = new Map();
     const unrecognised = { names: [], unnamed: 0 };
     for (let i = 0; i < count; i++) {
@@ -738,6 +854,15 @@ function droppedMcpNotices(carrier) {
             return typeof raw === 'string' && Object.hasOwn(MCP_DROP_SENTENCES, raw) ? raw : undefined;
         });
         const name = guarded(() => readOwnDataNonEmptyString(rowObj, 'name'));
+        const path = reason === 'transport-invalid' || reason === 'allow-tools-invalid' ? guarded(() => readOwnDataNonEmptyString(rowObj, 'path')) : undefined;
+        const pathLabel = path !== undefined && (reason === 'allow-tools-invalid' ? /^allowTools(\[\d{1,9}\])?$/ : /^transport(\.[A-Za-z]{1,32})?$/).test(path) ? ` (${path})` : '';
+        const label = name === undefined
+            ? undefined
+            : reason === 'name-unusable'
+                ? SETTINGS_DESCRIBE_BAD_WIRE_NAME(name)
+                : reason === 'transport-invalid' || reason === 'allow-tools-invalid' || reason === 'entry-unreadable'
+                    ? `"${capForDisplay(name, DEGRADED_NAME_SHOWN)}"${pathLabel}`
+                    : `"${name}"${pathLabel}`;
         let bucket = unrecognised;
         if (reason !== undefined) {
             let b = known.get(reason);
@@ -745,10 +870,10 @@ function droppedMcpNotices(carrier) {
                 known.set(reason, (b = { names: [], unnamed: 0 }));
             bucket = b;
         }
-        if (name === undefined)
+        if (label === undefined)
             bucket.unnamed++;
         else
-            bucket.names.push(name);
+            bucket.names.push(label);
     }
     const out = [];
     for (const reason of Object.keys(MCP_DROP_SENTENCES)) {
@@ -761,6 +886,110 @@ function droppedMcpNotices(carrier) {
     }
     return out;
 }
+const DEGRADED_LOST_SHOWN = 80;
+const DEGRADED_NAME_SHOWN = 128;
+const LOST_PATH_SHAPE = /^transport(\.[A-Za-z_][A-Za-z0-9_]{0,31}){1,2}$/;
+function degradedLostLabels(rowObj) {
+    const lost = readOwnDataValue(rowObj, 'lost');
+    const out = [];
+    if (!Array.isArray(lost))
+        return out;
+    const n = guarded(() => lost.length) ?? 0;
+    for (let i = 0; i < n; i++) {
+        const one = guarded(() => readOwnDataValue(lost, String(i)));
+        const issue = typeof one === 'object' && one !== null ? one : undefined;
+        const path = guarded(() => readOwnDataNonEmptyString(issue, 'path'));
+        if (path === undefined || !LOST_PATH_SHAPE.test(path))
+            continue;
+        const member = guarded(() => readOwnDataNonEmptyString(issue, 'member'));
+        out.push(member !== undefined && !path.endsWith(`.${member}`) ? `${path} (member "${capForDisplay(member, DEGRADED_LOST_SHOWN)}")` : path);
+    }
+    return [...new Set(out)];
+}
+function degradedMcpNotices(carrier) {
+    const unreadable = [{ level: 'warn', text: renderMessage(msg('config.mcp.cloudTransportDegradedUnreadable')) }];
+    let desc;
+    try {
+        desc = Object.getOwnPropertyDescriptor(carrier, 'degradedMcpServers');
+    }
+    catch {
+        return unreadable;
+    }
+    if (desc === undefined)
+        return [];
+    if (!Object.hasOwn(desc, 'value'))
+        return unreadable;
+    const rows = desc.value;
+    let count = 0;
+    try {
+        if (!Array.isArray(rows))
+            return unreadable;
+        count = rows.length;
+    }
+    catch {
+        return unreadable;
+    }
+    if (typeof count !== 'number' || !Number.isSafeInteger(count) || count < 0)
+        return unreadable;
+    const labels = [];
+    let unnamed = 0;
+    for (let i = 0; i < count; i++) {
+        const row = guarded(() => readOwnDataValue(rows, String(i)));
+        const rowObj = typeof row === 'object' && row !== null ? row : undefined;
+        const name = guarded(() => readOwnDataNonEmptyString(rowObj, 'name'));
+        if (name === undefined) {
+            unnamed++;
+            continue;
+        }
+        const paths = guarded(() => degradedLostLabels(rowObj)) ?? [];
+        labels.push(`"${capForDisplay(name, DEGRADED_NAME_SHOWN)}"${paths.length > 0 ? ` (${paths.join(', ')})` : ''}`);
+    }
+    if (labels.length + unnamed === 0)
+        return [];
+    return [{ level: 'warn', text: renderMessage(msg('config.mcp.cloudTransportDegraded', { who: mcpDropWho(labels, unnamed) })) }];
+}
+function droppedSkillNotices(carrier) {
+    const unreadable = [{ level: 'warn', text: renderMessage(msg('config.skills.cloudDroppedUnreadable')) }];
+    let desc;
+    try {
+        desc = Object.getOwnPropertyDescriptor(carrier, 'droppedSkills');
+    }
+    catch {
+        return unreadable;
+    }
+    if (desc === undefined)
+        return [];
+    if (!Object.hasOwn(desc, 'value'))
+        return unreadable;
+    const rows = desc.value;
+    let count = 0;
+    try {
+        if (!Array.isArray(rows))
+            return unreadable;
+        count = rows.length;
+    }
+    catch {
+        return unreadable;
+    }
+    if (typeof count !== 'number' || !Number.isSafeInteger(count) || count < 0)
+        return unreadable;
+    const labels = [];
+    let unnamed = 0;
+    for (let i = 0; i < count; i++) {
+        const row = guarded(() => readOwnDataValue(rows, String(i)));
+        const rowObj = typeof row === 'object' && row !== null ? row : undefined;
+        const name = guarded(() => readOwnDataNonEmptyString(rowObj, 'name'));
+        if (name === undefined) {
+            unnamed++;
+            continue;
+        }
+        const path = guarded(() => readOwnDataNonEmptyString(rowObj, 'path'));
+        labels.push(`"${capForDisplay(name, DEGRADED_NAME_SHOWN)}"${path !== undefined && /^skills\[\d{1,10}\]\.(?:allowedTools|disallowedTools)(?:\[\d{1,10}\])?$/.test(path) ? ` (${path})` : ''}`);
+    }
+    if (labels.length + unnamed === 0)
+        return [];
+    return [{ level: 'warn', text: renderMessage(msg('config.skills.cloudToolListInvalid', { who: mcpDropWho(labels, unnamed) })) }];
+}
 function budgetNotice(r) {
     switch (r.kind) {
         case 'configured': {
@@ -829,6 +1058,8 @@ export function cloudEffectiveNotices(p) {
         });
     }
     out.push(...droppedMcpNotices(p));
+    out.push(...degradedMcpNotices(p));
+    out.push(...droppedSkillNotices(p));
     const assertionLine = mcpAssertionHeaderNotSentNotice(guarded(() => readOwnDataValue(p, 'mcp')) ?? []);
     if (assertionLine !== undefined)
         out.push({ level: 'warn', text: `cloud config: ${assertionLine}` });