@sema-agent/core 7.21.1 → 7.22.0

package/dist/core/runner/mcp-redial.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The LIVE MCP roster lane: applying one server's intake result to a RUNNING roster, and the
+ * host-driven re-dial that is the second caller of it.
+ *
+ * Two faces change a task's MCP roster after prepare has finished — the model's `RefreshMcpTools`
+ * tool and the run handle's `reconnectMcpServer` verb — and what they must do to the roster is the
+ * same list in the same order: drop the deployment-excluded names, re-fold the safety axes (with the
+ * non-monotone restore arm on refusal), replace the server's whole name-prefix domain at its own
+ * anchor, rebuild the harness toolset, and re-mint the roster delta. That list lived inside the
+ * refresh tool's execute closure, where the second face could only have copied it; a copy would have
+ * been a second answer to "what does a mid-task roster change consist of".
+ *
+ * It is machinery, not a phase: the protocol-tools phase reaches DOWN for it to build the refresh
+ * tool, and the run's verb wiring reaches down for the same functions.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { McpDroppedTool, McpReconnectResult, MaterializedMcp, McpToolAxis } from "../mcp.js";
+import type { RunnerDeps, ToolEffect } from "../types.js";
+import type { IrreversibilityTier, ToolFaceSnapshot } from "./contracts.js";
+import type { RosterBuilder, ToolRosterDeltaSeat } from "../tool-roster.js";
+/** One server's assertion about its own prefix domain — the shape both faces reduce to. `tools` is
+ *  the roster the domain must END UP with (empty withdraws it); `added`/`removed` are the reporting
+ *  half and never drive the swap. */
+export interface McpRosterDelta {
+    server: string;
+    prefix: string;
+    tools: AgentTool[];
+    axes: McpToolAxis[];
+    dropped: McpDroppedTool[];
+}
+/** The seats a roster application writes through. Every one of them is borrowed from the phase that
+ *  minted it — this module owns nothing. */
+export interface McpRosterApplyInput {
+    /** borrowed-readonly — the frozen tool face; `exclude` keeps a deployment-excluded tool from ever
+     *  being re-mounted by a face the model or a host can trigger. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude">;
+    /** borrowed-readonly — the per-server face overlay (the phase's `withFaces`). */
+    withFaces: (tools: AgentTool[], server: string) => AgentTool[];
+    /** borrowed-readonly — the large-result wrapper every protocol tool is mounted through. */
+    remoteToolOffload: (tool: AgentTool) => AgentTool;
+    /** borrowed-readonly — the phase's axis fold (throws on a config contradiction). */
+    foldProtocolAxes: (axes: McpToolAxis[], label: string) => void;
+    /** borrowed-mutable — the two NON-MONOTONE tables the fold writes and this applier snapshots. */
+    toolEffects: Map<string, ToolEffect>;
+    axisExplicitNegatives: Map<string, {
+        irreversible?: false;
+        egress?: false;
+    }>;
+    /** borrowed-mutable — the run's shared roster. */
+    roster: RosterBuilder;
+}
+/** What one application did, for the caller's receipt. `applied:false` means the axis fold refused
+ *  and the domain was left exactly as it was (the tables restored) — no roster write happened. */
+export type McpRosterApplyOutcome = {
+    applied: true;
+    pushed: number;
+    excluded: string[];
+} | {
+    applied: false;
+    foldError: string;
+};
+/**
+ * Apply one server's delta to the live roster. Behavior-identical to the body this was extracted
+ * from; the comments are the extracted reasoning, not new claims.
+ */
+export declare function applyMcpRosterDelta(input: McpRosterApplyInput, delta: McpRosterDelta): McpRosterApplyOutcome;
+/** The seats the post-application commit writes through. */
+export interface McpRosterCommitInput {
+    rebuildHarnessToolsRef: {
+        current?: () => Promise<void>;
+    };
+    rosterSeat: ToolRosterDeltaSeat;
+    toolCallGateArmedRef: {
+        armed: boolean;
+    };
+    irreversibleTools: ReadonlySet<string>;
+    egressTools: ReadonlySet<string>;
+}
+/**
+ * Publish whatever the applications above changed: rebuild the harness toolset (the content-origin
+ * re-wrap runs inside it), then re-mint the roster delta so the stream's rows describe the LIVE
+ * objects. Batched deliberately — a refresh spanning several servers rebuilds once.
+ *
+ * Returns the gate-honesty line when one is due. The built-in integrity policies are composed
+ * UNCONDITIONALLY, so `armed` is always true in this engine and the line never fires today; the arm
+ * stays as a zero-cost guard for a refactor that would make the composition conditional.
+ */
+export declare function commitMcpRosterChanges(input: McpRosterCommitInput): Promise<string | undefined>;
+/** The re-dial's own seats: the handle it drives, the two operator sinks, and the run identity the
+ *  disclosure names. */
+export interface McpRedialInput extends McpRosterApplyInput, McpRosterCommitInput {
+    mcp: MaterializedMcp;
+    deps: Pick<RunnerDeps, "onError" | "onNotice">;
+    sessionId: string;
+    runId: string;
+    irreversibilityTier: IrreversibilityTier;
+}
+/**
+ * The run handle's `reconnectMcpServer` verb, phase-side: re-dial one server, put whatever it
+ * asserted about its prefix domain onto the live roster, and disclose.
+ *
+ * The roster is written IFF the result carries `tools` — the one rule this lane reads. That covers
+ * both directions with no second condition: a successful re-dial asserts its fresh roster, a failed
+ * DIAL asserts the empty one (the connection it tore down is gone, so leaving its names mounted would
+ * leave the model holding tools that can only fail), and an arm that never touched the connection —
+ * unknown name, revoked server, re-dial already in flight, disposed materialization — asserts nothing
+ * and the mounted roster is left alone.
+ */
+export declare function redialMcpServer(input: McpRedialInput, server: string): Promise<McpReconnectResult>;

package/dist/core/runner/mcp-redial.js

@@ -0,0 +1,60 @@
+import { deliverEngineNotice } from "../types.js";
+export function applyMcpRosterDelta(input, delta) {
+    const { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
+    const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
+    const pushable = delta.tools.filter((t) => !excludedSet.has(t.name));
+    const excluded = delta.tools.filter((t) => excludedSet.has(t.name)).map((t) => t.name);
+    const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(delta.prefix)));
+    const restoreDomain = (m, snap) => {
+        for (const name of [...m.keys()])
+            if (name.startsWith(delta.prefix))
+                m.delete(name);
+        for (const [name, v] of snap)
+            m.set(name, v);
+    };
+    const priorDomainEffects = domainSnapshot(toolEffects);
+    const priorDomainNegatives = domainSnapshot(axisExplicitNegatives);
+    for (const name of priorDomainEffects.keys())
+        toolEffects.delete(name);
+    for (const name of priorDomainNegatives.keys())
+        axisExplicitNegatives.delete(name);
+    try {
+        foldProtocolAxes(delta.axes.filter((a) => !excludedSet.has(a.name)), "MCP");
+    }
+    catch (foldErr) {
+        restoreDomain(toolEffects, priorDomainEffects);
+        restoreDomain(axisExplicitNegatives, priorDomainNegatives);
+        return { applied: false, foldError: foldErr instanceof Error ? foldErr.message : String(foldErr) };
+    }
+    roster.replaceDomain(delta.prefix, withFaces(pushable, delta.server).map((t) => remoteToolOffload(t)), { source: "mcp", mountedBy: "optional", origin: { peer: delta.server } });
+    return { applied: true, pushed: pushable.length, excluded };
+}
+export async function commitMcpRosterChanges(input) {
+    await input.rebuildHarnessToolsRef.current?.();
+    input.rosterSeat.republish();
+    if (!input.toolCallGateArmedRef.armed && (input.irreversibleTools.size > 0 || input.egressTools.size > 0)) {
+        return "WARNING: refreshed tools declare irreversible/egress safety hints, but this task started with no approval gate registered (no policy/hooks and no gated tools at start) — these hints cannot arm a gate mid-task (RB-46); the refreshed tools run ungated on this deployment shape.";
+    }
+    return undefined;
+}
+export async function redialMcpServer(input, server) {
+    const result = await input.mcp.reconnect(server);
+    if (result.tools !== undefined) {
+        const outcome = applyMcpRosterDelta(input, { server: result.server, prefix: result.prefix, tools: result.tools, axes: result.axes ?? [], dropped: result.dropped ?? [] });
+        if (!outcome.applied)
+            input.deps.onError?.(Object.assign(new Error(`MCP re-dial of "${server}" connected but its safety-axis fold refused, so its tools were not mounted: ${outcome.foldError}`), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
+        const ungated = await commitMcpRosterChanges(input);
+        if (ungated !== undefined)
+            input.deps.onError?.(Object.assign(new Error(ungated), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
+    }
+    for (const w of result.warnings ?? [])
+        input.deps.onError?.(Object.assign(new Error(w), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
+    deliverEngineNotice(input.deps.onNotice, {
+        code: "mcp.server_redialed",
+        message: result.outcome === "reconnected"
+            ? `MCP server "${server}" was re-dialed at the host's request: ${result.toolCount} tool${result.toolCount === 1 ? "" : "s"} mounted (${result.added.length} added, ${result.removed.length} removed)`
+            : `MCP server "${server}" was NOT re-dialed (${result.outcome})${result.reason !== undefined ? `: ${result.reason}` : ""}`,
+        detail: { server, outcome: result.outcome, added: result.added.length, removed: result.removed.length, ...(result.reason !== undefined ? { reason: result.reason } : {}), sessionId: input.sessionId, runId: input.runId },
+    });
+    return result;
+}

package/dist/core/runner/memory-consolidation-driver.d.ts

@@ -94,6 +94,8 @@ export declare const AUTO_RUN_ON_RECOMMENDATION_DEFAULT = true;
  *    switch wired AND a model seat resolvable) — the reference CLI's "auto-dream: off while
  *    auto-memory is off": a default-on world must not arm a deployment that wired no consolidation;
  *  - any other value ⇒ off (never arm on garbage; the door refuses it at prepare anyway).
+ *
+ * @contract memory.auto_consolidation.arming_has_one_resolver — whether a deployment's automatic consolidation is armed is answered here and nowhere else, a host that merely DISPLAYS the arming included: an ABSENT seat is not "off" (it reads the named default, and only where both seats are wired), so a reader branching on `RunnerDeps.autoRunOnRecommendation` alone is wrong in BOTH directions — it calls a default-armed deployment unarmed and a deployment with no consolidation armed. A deployment fact, never a per-session one; exported from the package root for that reason.
  */
 export declare function autoRunOnRecommendationEffective(deps: MemoryConsolidationDriverDeps & {
     autoRunOnRecommendation?: unknown;

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -7,7 +7,7 @@ import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-r
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { autoModeClassifierFallbackOf, autoModeRoundNotAsked, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
@@ -207,27 +207,24 @@ export async function prepareCapsAndWorkflow(input) {
         const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
         const classifierRuntime = brainToRuntime(deps.brain);
         const classifierRungs = classifierLadderRungs(am.classifierFallback, classifierModel, model);
-        const roundPrompt = new WeakMap();
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             candidates: classifierRungs.map((m) => m.id),
             onClassified: classifierRoundObserver({ tracer: deps.tracer, onNotice: deps.onNotice, taskId: hostTaskId, seatModelId: classifierModel.id, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) }),
-            classify: async (input, signal, rung) => {
+            assemble: async (input) => {
+                const ctx = await session.buildContext();
+                const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) && (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
+                return renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
+            },
+            classify: async (_input, signal, rung, userPrompt) => {
                 const rungModel = rung !== undefined ? classifierRungs[rung.index] : undefined;
                 if (rung === undefined || rungModel === undefined) {
                     throw new Error(`the auto-mode classifier was asked at ladder position ${JSON.stringify(rung?.index)}, which this arming did not build`);
                 }
-                let build = rung.index > 0 ? roundPrompt.get(input) : undefined;
-                if (build === undefined) {
-                    build = (async () => {
-                        const ctx = await session.buildContext();
-                        const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) && (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
-                        return renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
-                    })();
-                    roundPrompt.set(input, build);
+                if (userPrompt === undefined) {
+                    throw new Error("the auto-mode classifier was asked with no assembled question, which this arming builds once per classification");
                 }
-                const userPrompt = await build.catch((e) => { throw autoModeRoundNotAsked(e); });
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
                 const request = async (seat, suffix) => {
                     const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -284,6 +284,9 @@ export interface PrepareHandsReadFaceResult {
         pattern: string;
         caseSensitive: boolean;
     }>;
+    /** owned — the built-in deny TIERS this leg MATERIALLY activated, off the same snapshot the compile
+     *  judged with; empty ⇒ none. Relayed to the wiring manifest, never re-derived from `deps` there. */
+    readDenyBuiltinTiersActive: readonly string[];
     /** write-back (D-3 hold) — the hands-LESS legs' resolved face (the read posture is a
      *  property of the RUN, not the mount). Driver assigns onto its outer `let`. */
     handsLessResolvedFace: ContainmentFace | undefined;

package/dist/core/runner/prepare-hands-readface.js

@@ -3,7 +3,7 @@ import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
 import { boundaryIsTheSandbox } from "../remote-env.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReadBoundaryProbe, bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, resolveReadDenyBuiltins, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { bashReadBoundaryProbe, bashReversibilityProbe, activeReadDenyBuiltinTiers, compileReadDeny, createHandsToolkit, deploymentFaceClampNotice, pdfModelCapabilitiesOf, inheritSessionReadFileState, resolveContainmentFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
 import { resolveKey, sha256 } from "../../tools/fs/safety.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
@@ -98,6 +98,7 @@ export function resolveHandsLessReadFace(input) {
     let handsLessResolvedFace;
     let handsLessResolvedWriteFace;
     let readDenyAdditionsNormalized = [];
+    let readDenyBuiltinTiersActive = [];
     {
         const liveFace = resolveContainmentFace({
             kind: "read",
@@ -120,7 +121,7 @@ export function resolveHandsLessReadFace(input) {
         const seedWrite = resume?.seed.writeFace;
         handsLessResolvedWriteFace = resume !== undefined && (seedWrite === undefined || seedWrite.face === "roots") ? "roots" : liveWriteFace;
         const denyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seed?.denyEntries ?? [])];
-        resolveReadDenyBuiltins({
+        readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers({
             ...(deps.readDenyBuiltinTiers !== undefined ? { tiers: deps.readDenyBuiltinTiers } : {}),
             ...(deps.readDenyBuiltinExclude !== undefined ? { exclude: deps.readDenyBuiltinExclude } : {}),
         });
@@ -139,6 +140,7 @@ export function resolveHandsLessReadFace(input) {
         resolvedReadFace: undefined,
         resolvedWriteFace: undefined,
         readDenyAdditionsNormalized,
+        readDenyBuiltinTiersActive,
         handsLessResolvedFace,
         handsLessResolvedWriteFace,
         additionalRootsCanonical: [],
@@ -168,6 +170,7 @@ export async function prepareHandsMount(input) {
     let resolvedReadFace;
     let resolvedWriteFace;
     let readDenyAdditionsNormalized = [];
+    let readDenyBuiltinTiersActive = [];
     let handsLessResolvedFace;
     const handsLessResolvedWriteFace = undefined;
     const shellGatedTools = new Set();
@@ -245,6 +248,7 @@ export async function prepareHandsMount(input) {
             ...(deps.readDenyBuiltinExclude !== undefined ? { exclude: [...deps.readDenyBuiltinExclude] } : {}),
         };
         readDenyMatcher = compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg);
+        readDenyBuiltinTiersActive = activeReadDenyBuiltinTiers(readDenyBuiltinCfg);
         readDenyAdditionsNormalized = compileReadDeny(readDenyAdditions, "readDenyPatterns", { tiers: [] }).entries;
         let liveReadFace = resolveContainmentFace({
             kind: "read",
@@ -323,11 +327,16 @@ export async function prepareHandsMount(input) {
                         sessionSeats.reanchor(sessionId, readFileState, ownCommittedTailEntryId);
                 }
                 : undefined;
+        const compiledDeny = readDenyMatcher;
+        const denySeatJudge = compiledDeny !== undefined && compiledDeny.entries.length > 0
+            ? (p) => compiledDeny.matchPath(p)?.pattern ?? null
+            : undefined;
         const shellReadBoundary = () => ({
             roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
             ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
             ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
-            denyMatch: (p) => readDenyMatcher?.matchPath(p)?.pattern ?? null,
+            ...(denySeatJudge !== undefined ? { denyMatch: denySeatJudge } : {}),
+            denyEntries: (compiledDeny?.entries ?? []).map((e) => e.pattern),
             ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
         });
         const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {
@@ -421,6 +430,7 @@ export async function prepareHandsMount(input) {
         resolvedWriteFace,
         handsLessResolvedWriteFace,
         readDenyAdditionsNormalized,
+        readDenyBuiltinTiersActive,
         handsLessResolvedFace,
         additionalRootsCanonical,
         additionalReadRootsCanonical,

package/dist/core/runner/prepare-memory.js

@@ -171,7 +171,7 @@ export async function prepareMemory(input) {
             const choosePersonalBackend = () => typeof pinned === "string" && pinned ? new FileMemoryEngineBackend(personalMemoryDir, { controlDir: personalControlDir }) : backend;
             const createPersonalEngine = (personalBackend) => {
                 return {
-                    engine: new MemoryEngine({ backend: personalBackend, memoryDir: personalMemoryDir, controlDir: personalControlDir, onIncident: onEngineIncident, provenance: input.memoryProvenance, ...captureStoreOpt(personalBackend, personalControlDir), ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}) }),
+                    engine: new MemoryEngine({ backend: personalBackend, memoryDir: personalMemoryDir, controlDir: personalControlDir, onIncident: onEngineIncident, provenance: input.memoryProvenance, ...captureStoreOpt(personalBackend, personalControlDir), ...(deps.memorySessionIncarnation !== undefined ? { sessionIncarnation: deps.memorySessionIncarnation } : {}), ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}) }),
                     backend: personalBackend,
                 };
             };
@@ -359,7 +359,7 @@ export async function prepareMemory(input) {
                     controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot),
                     onIncident: onEngineIncident,
                     provenance: input.memoryProvenance,
-                    ...captureStoreOpt(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot)),
+                    ...captureStoreOpt(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot)), ...(deps.memorySessionIncarnation !== undefined ? { sessionIncarnation: deps.memorySessionIncarnation } : {}),
                     ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}),
                 });
                 const personal = createPersonalEngine(personalBackendChosen);
@@ -439,7 +439,7 @@ export async function prepareMemory(input) {
                     controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot),
                     onIncident: onEngineIncident,
                     provenance: input.memoryProvenance,
-                    ...captureStoreOpt(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot)),
+                    ...captureStoreOpt(backend, identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveRepoControlPlaneDir(engineRoot, repoRoot)), ...(deps.memorySessionIncarnation !== undefined ? { sessionIncarnation: deps.memorySessionIncarnation } : {}),
                     ...(input.deps.memoryConsolidation !== undefined ? { consolidation: input.deps.memoryConsolidation } : {}),
                 });
                 await armCaptureOptOut(engine);

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -1,5 +1,5 @@
 import type { AgentTool } from "../../internal/harness.js";
-import { type MaterializedMcp, type McpDroppedTool } from "../mcp.js";
+import { type MaterializedMcp, type McpDroppedTool, type McpReconnectResult } from "../mcp.js";
 import { type MaterializedA2a } from "../a2a.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
@@ -90,6 +90,11 @@ export interface PrepareProtocolToolsResult {
     toolCallGateArmedRef: {
         armed: boolean;
     };
+    /** owned — the run handle's `reconnectMcpServer` implementation, present ONLY when this leg declared
+     *  MCP servers (a leg with none has nothing to re-dial, and the stream verb refuses typed rather
+     *  than answering about a materialization that was never made). The driver projects it onto
+     *  `Prepared.mcpRedial`, from which the run's wiring binds the verb's seat. */
+    mcpRedial?: (server: string) => Promise<McpReconnectResult>;
 }
 /** The M5 phase body — prepareTask's protocol-tools stretch, verbatim (see the module header). */
 export declare function prepareProtocolTools(input: PrepareProtocolToolsInput): Promise<PrepareProtocolToolsResult>;

package/dist/core/runner/prepare-protocol-tools.js

@@ -1,5 +1,6 @@
 import { Type } from "typebox";
 import { materializeMcpTools } from "../mcp.js";
+import { applyMcpRosterDelta, commitMcpRosterChanges, redialMcpServer } from "./mcp-redial.js";
 import { materializeA2aTools } from "../a2a.js";
 import { deliverEngineNotice } from "../types.js";
 import { RosterBuilder } from "../tool-roster.js";
@@ -16,7 +17,8 @@ export async function prepareProtocolTools(input) {
     }
     const mcp = lockedPreflight.mcp?.length
         ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId))
-        : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
+        :
+            { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], reconnect: async (server) => ({ server, prefix: mintNamespacePrefix(MCP_NAMESPACE, server), outcome: "not_declared", reason: "this task declared no MCP servers", toolCount: 0, added: [], removed: [] }), dispose: async () => { } };
     if (lockedPreflight.mcp?.length)
         rollback.push(function mcpDispose() { return mcp.dispose(); });
     for (const w of mcp.warnings)
@@ -58,6 +60,10 @@ export async function prepareProtocolTools(input) {
     const rebuildHarnessToolsRef = {};
     const contentOriginWrapRef = {};
     const toolCallGateArmedRef = { armed: false };
+    const rosterApply = { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes: (axes, label) => foldProtocolAxes(axes, label), toolEffects, axisExplicitNegatives, roster };
+    const rosterCommit = { rebuildHarnessToolsRef, rosterSeat, toolCallGateArmedRef, irreversibleTools, egressTools };
+    const redialInput = { ...rosterApply, ...rosterCommit, mcp, deps, sessionId, runId, irreversibilityTier };
+    const mcpRedial = lockedPreflight.mcp?.length ? (server) => redialMcpServer(redialInput, server) : undefined;
     if (lockedPreflight.mcp?.length) {
         roster.mount({
             ...toolFace("refresh-mcp-tools"),
@@ -73,42 +79,20 @@ export async function prepareProtocolTools(input) {
                 const lines = [];
                 let changed = false;
                 let anyActiveFailure = false;
+                const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
                 for (const r of results) {
-                    if (r.status !== "refreshed" || r.tools === undefined) {
+                    if (r.tools === undefined) {
                         lines.push(`${r.server}: ${r.status}${r.error !== undefined ? ` (${r.error})` : ""}`);
                         if (r.status === "failed")
                             anyActiveFailure = true;
                         continue;
                     }
-                    const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
-                    const pushable = r.tools.filter((t) => !excludedSet.has(t.name));
-                    const excludedNow = r.tools.filter((t) => excludedSet.has(t.name)).map((t) => t.name);
-                    const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(r.prefix)));
-                    const restoreDomain = (m, snap) => {
-                        for (const name of [...m.keys()])
-                            if (name.startsWith(r.prefix))
-                                m.delete(name);
-                        for (const [name, v] of snap)
-                            m.set(name, v);
-                    };
-                    const priorDomainEffects = domainSnapshot(toolEffects);
-                    const priorDomainNegatives = domainSnapshot(axisExplicitNegatives);
-                    for (const name of priorDomainEffects.keys())
-                        toolEffects.delete(name);
-                    for (const name of priorDomainNegatives.keys())
-                        axisExplicitNegatives.delete(name);
-                    try {
-                        foldProtocolAxes((r.axes ?? []).filter((a) => !excludedSet.has(a.name)), "MCP");
-                    }
-                    catch (foldErr) {
-                        restoreDomain(toolEffects, priorDomainEffects);
-                        restoreDomain(axisExplicitNegatives, priorDomainNegatives);
-                        lines.push(`${r.server}: failed (${foldErr instanceof Error ? foldErr.message : String(foldErr)})`);
+                    const applied = applyMcpRosterDelta(rosterApply, { server: r.server, prefix: r.prefix, tools: r.tools, axes: r.axes ?? [], dropped: r.dropped ?? [] });
+                    if (!applied.applied) {
+                        lines.push(`${r.server}: failed (${applied.foldError})`);
                         anyActiveFailure = true;
                         continue;
                     }
-                    const refreshedMounts = withFaces(pushable, r.server).map((t) => remoteToolOffload(t));
-                    roster.replaceDomain(r.prefix, refreshedMounts, { source: "mcp", mountedBy: "optional", origin: { peer: r.server } });
                     changed = true;
                     const detail = [];
                     const shownAdded = r.added.filter((n) => !excludedSet.has(n));
@@ -116,18 +100,16 @@ export async function prepareProtocolTools(input) {
                         detail.push(`added: ${shownAdded.join(", ")}`);
                     if (r.removed.length > 0)
                         detail.push(`removed: ${r.removed.join(", ")}`);
-                    if (excludedNow.length > 0)
-                        detail.push(`excluded by deployment config (not mounted): ${excludedNow.join(", ")}`);
+                    if (applied.excluded.length > 0)
+                        detail.push(`excluded by deployment config (not mounted): ${applied.excluded.join(", ")}`);
                     if ((r.dropped?.length ?? 0) > 0)
                         detail.push(`dropped: ${r.dropped.map((d) => `${d.tool} (${d.reason.length > 90 ? `${d.reason.slice(0, 90)}…` : d.reason})`).join("; ")}`);
-                    lines.push(`${r.server}: refreshed — ${pushable.length} tool${pushable.length === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
+                    lines.push(`${r.server}: refreshed — ${applied.pushed} tool${applied.pushed === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
                 }
-                if (changed)
-                    await rebuildHarnessToolsRef.current?.();
-                if (changed)
-                    rosterSeat.republish();
-                if (changed && !toolCallGateArmedRef.armed && (irreversibleTools.size > 0 || egressTools.size > 0)) {
-                    lines.push("WARNING: refreshed tools declare irreversible/egress safety hints, but this task started with no approval gate registered (no policy/hooks and no gated tools at start) — these hints cannot arm a gate mid-task (RB-46); the refreshed tools run ungated on this deployment shape.");
+                if (changed) {
+                    const ungated = await commitMcpRosterChanges(rosterCommit);
+                    if (ungated !== undefined)
+                        lines.push(ungated);
                 }
                 const text = lines.length === 0 ? "No connected MCP servers to refresh." : lines.join("\n");
                 return {
@@ -184,7 +166,7 @@ export async function prepareProtocolTools(input) {
     for (const t of a2a.tools)
         roster.mount(remoteToolOffload(t), { source: "a2a", mountedBy: "optional", origin: { peer: A2A_NAMESPACE.parse(t.name)?.peer ?? t.name } });
     foldProtocolAxes(a2a.toolAxes, "A2A");
-    return { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef };
+    return { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef, ...(mcpRedial !== undefined ? { mcpRedial } : {}) };
 }
 function mcpRevocationWiring(deps, runId) {
     if (deps.mcpRevocations === undefined)

package/dist/core/runner/prepare-task.js

@@ -436,7 +436,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             roster.mount(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined), { source: "synthetic", mountedBy: "optional" });
         }
         const rosterSeat = new ToolRosterDeltaSeat();
-        const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
+        const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef, mcpRedial } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
         const callIssuedAtRef = {};
         const workCutRef = { continuation: false, abortedBeforeTurnEnd: false };
         const advertisedWritableDirs = handsEnabled
@@ -690,7 +690,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtectionCheck, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtectionCheck, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
                 await fileHistoryBoundary.settle();
@@ -706,7 +706,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -108,6 +108,10 @@ export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the leg's minted tool roster: rides the manifest's `tools` section and is the
      *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
     toolRoster: ToolRoster;
+    /** borrowed-readonly — from the read-face phase: the built-in read-deny TIERS that leg's own
+     *  resolution materially activated; relayed onto the manifest (present iff non-empty), never
+     *  re-derived from `deps` here (which by this phase sits past that phase's await). */
+    readDenyBuiltinTiersActive: readonly string[];
     /** borrowed-readonly — from the LSP phase's manager fold: gates the manifest's LSP section (absent ⇒ byte-identical manifest). */ lspManagerWired: boolean;
     /** borrowed-readonly — from the LSP phase: is the diagnostics lane live? The `lane` word's only input. */ lspDiagnosticsLive: boolean;
     /** borrowed-readonly — the arming outcome the caps phase minted (the manifest's auto-mode face). */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -113,7 +113,7 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, lspManagerWired, lspDiagnosticsLive } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive } = input;
     const onAsk = spec.onAsk ?? deps.onAsk;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
@@ -208,6 +208,7 @@ export function prepareWiringManifest(input) {
         autoMode: { ...autoModeArmReason },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
         ...(writeProtection !== undefined ? { writeProtectionTargetView: writeProtection.targetView } : {}),
+        readDenyBuiltinTiersActive,
         autoConsolidationOnRecommendation: autoRunOnRecommendationEffective(deps),
         tools: toolRoster,
         hooks: wiredHookEntries(hooks, spec.hooks !== undefined ? "spec" : "deps", preToolUseObservational),

package/dist/core/runner/run-identity-wiring.d.ts

@@ -3,7 +3,7 @@ import { type PendingSessionNotifications, type SystemInjectionPriority, type Ta
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent, TaskSpec } from "../types.js";
 import type { Stats } from "./assemble-result.js";
-import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, NotificationLaneBindings, NotifyRef, Prepared, RunInternals, RunnerDepsSeat, TaskIdRef } from "./contracts.js";
+import type { CaptureOptOutRef, LiveHandle, ManualCompactRef, McpRedialRef, NotificationLaneBindings, NotifyRef, Prepared, RunInternals, RunnerDepsSeat, TaskIdRef } from "./contracts.js";
 export interface RunIdentityWiringInput {
     /** borrowed-readonly — the task spec: the task id and the memory / notification seats it names. */
     spec: TaskSpec;
@@ -27,6 +27,8 @@ export interface RunIdentityWiringInput {
     notifyRef: NotifyRef | undefined;
     /** borrowed-mutable — the capture opt-out bridge: `flip` is bound here when a memory session mounted. */
     captureOptOutRef: CaptureOptOutRef | undefined;
+    /** borrowed-mutable — the MCP re-dial bridge: `redial` is bound here when the leg declared MCP servers. */
+    mcpRedialRef: McpRedialRef | undefined;
     /** borrowed-readonly — the notification lane's ONE injection entry (the R0 lane's). */
     injectTaskNotification: (notification: TaskNotificationPayload, opts?: {
         priority?: SystemInjectionPriority;

package/dist/core/runner/run-identity-wiring.js

@@ -3,7 +3,7 @@ import { createSafeNotifier } from "../safe-notify.js";
 import { discloseDroppedPending, renderTaskNotificationXml, taskNotificationDedupKey } from "../task-notification.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 export function runIdentityWiring(input) {
-    const { spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, notificationLane, pendingSessionNotifications, runner } = input;
+    const { spec, queue, prepared, internals, taskIdRef, onReady, manualCompactRef, notifyRef, captureOptOutRef, mcpRedialRef, injectTaskNotification, deliveredAtTurnOpen, peerInboundChainRef, notificationLane, pendingSessionNotifications, runner } = input;
     notificationLane.harness = prepared.harness;
     notificationLane.sessionId = prepared.sessionId;
     if (taskIdRef)
@@ -66,6 +66,9 @@ export function runIdentityWiring(input) {
     if (captureOptOutRef && prepared.memoryEngineSession?.captureOptOut !== undefined) {
         captureOptOutRef.flip = prepared.memoryEngineSession.captureOptOut.flip;
     }
+    if (mcpRedialRef && prepared.mcpRedial !== undefined) {
+        mcpRedialRef.redial = prepared.mcpRedial;
+    }
     try {
         internals?.onNotifyInjectorReady?.(injectTaskNotification);
     }

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -23,7 +23,7 @@ import type { AssistantMessage } from "../../internal/llm.js";
 import type { ResolvedReasoning } from "../../brain/reasoning.js";
 import type { PushQueue } from "../push-queue.js";
 import type { SessionStore } from "../session.js";
-import { type CompactOutcome, type DelegationLifecycleEvent, type TaskEvent, type TaskResult, type TaskSpec } from "../types.js";
+import { type CompactOutcome, type DelegationLifecycleEvent, type OwedUserInputAccount, type TaskEvent, type TaskResult, type TaskSpec } from "../types.js";
 import { type Stats } from "./assemble-result.js";
 import type { EndOfTaskCompaction, InstallingPhaseResult, ManualCompactRef, Prepared, ResumeRun, RunInternals, RunnerDepsSeat, RunState, SuspendReap, TaskIdRef } from "./contracts.js";
 export interface RunSettleAndTeardownInput {
@@ -94,6 +94,8 @@ export interface RunSettleAndTeardownInput {
     };
     /** borrowed-readonly — the end-of-task compaction's outcome (the terminal-adoption lane's `finish` call). */
     comp: EndOfTaskCompaction;
+    /** borrowed-readonly — the adoption lane's unsettled undrained-input account, closed below (after the reopen). */
+    owedUserInput: OwedUserInputAccount;
     /** borrowed-readonly — the stream's result setter: the assembled TaskResult is published through it exactly once. */
     setResult: (r: TaskResult) => void;
     /** borrowed-readonly — the stream's suggestions seat: the fire-and-forget suggestion pass's promise is handed to it. */