@sema-agent/core 7.54.1 → 7.55.0

package/dist/core/mcp.js

@@ -7,10 +7,13 @@ import { disposeSectionEntry, sectionAnswerWarning } from "./prompt-section-seat
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { McpConnectionPool } from "./mcp-connection-pool.js";
+import { SessionEndingTransport, requestSite } from "./mcp-session-end.js";
+import { mcpToolGate, UNPROVEN_GATE } from "./mcp-listing-drift.js";
+import { ConnectionListing, Flights, IDLE_WATCHDOG_ABORT_REASON, Resendable, armMcpIdleWatchdog, callThroughLink, listingRefusal } from "./mcp-server-link.js";
+import { underStartupBound } from "./mcp-startup-request.js";
 import { LIST_MCP_RESOURCES, MCP_RESOURCE_LIST_ALLOW, MCP_RESOURCE_READ_ALLOW, READ_MCP_RESOURCE, READ_MCP_RESOURCE_DIR, retractInstructions, tellInstructions, toldOnDial, unretractInstructions, withdrawInstructionAdds } from "./mounted-mcp.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { classifyMcpFailure, describeHttpTransportFailure, livenessOf } from "./mcp-failure.js";
+import { classifyMcpFailure, describeHttpTransportFailure, livenessOf, namingLostSession, sessionGone } from "./mcp-failure.js";
 import { lstat, mkdir, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -128,33 +131,6 @@ export function mcpIdleTimeoutMs(kind) {
 function idleKindOf(kind) {
     return kind === "stdio" ? "stdio" : "http";
 }
-const IDLE_WATCHDOG_ABORT_REASON = Symbol("mcp-idle-watchdog-abort");
-function armMcpIdleWatchdog(health, idleMs, outerSignal) {
-    const idleController = new AbortController();
-    let timer;
-    const rearm = () => {
-        if (timer !== undefined)
-            clearTimeout(timer);
-        const armedAt = Date.now();
-        timer = setTimeout(() => {
-            if (health.pendingElicitations > 0 || health.lastElicitationClosedAt > armedAt) {
-                rearm();
-                return;
-            }
-            idleController.abort(IDLE_WATCHDOG_ABORT_REASON);
-        }, idleMs);
-    };
-    rearm();
-    return {
-        combinedSignal: outerSignal !== undefined ? AbortSignal.any([outerSignal, idleController.signal]) : idleController.signal,
-        idleSignal: idleController.signal,
-        rearm,
-        dispose: () => {
-            if (timer !== undefined)
-                clearTimeout(timer);
-        },
-    };
-}
 export function mcpStartupTimeoutMs(server) {
     const fromEnv = parseEnvMs("MCP_TIMEOUT");
     const own = server?.startupTimeoutMs;
@@ -231,7 +207,7 @@ function rethrowHonestMcpError(err, ctx) {
         finish(err);
     const serverLabel = inlineUntrusted(ctx.server);
     const fenceServerText = (label, raw) => delimitUntrusted(label, truncateMcpErrorText(raw));
-    const failure = classifyMcpFailure(err, { phase: "request" });
+    const failure = classifyMcpFailure(err, ctx.site);
     ctx.liveness?.observe?.(failure.kind);
     const details = (extra) => ({ code: failure.kind, delivered: failure.delivered, server: ctx.server, ...extra });
     switch (failure.kind) {
@@ -248,12 +224,14 @@ function rethrowHonestMcpError(err, ctx) {
         case "not_mcp_response":
         case "connect_refused":
         case "connection_failed": {
-            const httpFailure = describeHttpTransportFailure(err);
+            const httpFailure = describeHttpTransportFailure(err, ctx.site);
             const detail = remoteErrorText(err);
             const fenced = `\nThe transport error follows as external/untrusted data:\n${fenceServerText(`${ctx.server} transport error`, detail)}`;
-            finish(markMcpFailure(new Error(failure.delivered === "no"
-                ? `${ctx.what} could not reach MCP server "${serverLabel}": ${httpFailure.condition}. The request was not delivered, so the server did not execute it. This server's tools and resources will keep failing until its endpoint is reachable again — do not retry them; use an alternative if one exists.${fenced}`
-                : `${ctx.what} failed at the transport layer of MCP server "${serverLabel}": ${httpFailure.condition}. The request may or may not have executed on the server — the outcome is unknown.${writeEffectWarning(ctx.writeEffect)}${fenced}`, { cause: err }), details(failure.httpStatus !== undefined ? { httpStatus: failure.httpStatus } : undefined)));
+            finish(markMcpFailure(new Error(sessionGone(err, ctx.site)
+                ? `${ctx.what} met a lost session on MCP server "${serverLabel}": ${httpFailure.condition}; ${ctx.resent === true ? "the call was sent again once on a fresh session, and the server reported that one gone too — if the server executed it before answering, it ran twice" : "the call was not sent again — if the server executed it before answering, it ran"}. The outcome is unknown.${writeEffectWarning(ctx.writeEffect)}${fenced}`
+                : failure.delivered === "no"
+                    ? `${ctx.what} could not reach MCP server "${serverLabel}": ${httpFailure.condition}. The request was not delivered, so the server did not execute it. This server's tools and resources will keep failing until its endpoint is reachable again — do not retry them; use an alternative if one exists.${fenced}`
+                    : `${ctx.what} failed at the transport layer of MCP server "${serverLabel}": ${httpFailure.condition}. The request may or may not have executed on the server — the outcome is unknown.${writeEffectWarning(ctx.writeEffect)}${fenced}`, { cause: err }), details(failure.httpStatus !== undefined ? { httpStatus: failure.httpStatus } : undefined)));
         }
         case "protocol": {
             const code = err.code;
@@ -396,7 +374,7 @@ function buildTransport(spec, principal, kind) {
     if (!("url" in t))
         throw new Error(`MCP server "${spec.name}": transport kind "${String(kind)}" carries no url`);
     const headers = resolveProtocolHttpHeaders(MCP_NAMESPACE.id, t, principal);
-    return new StreamableHTTPClientTransport(new URL(t.url), {
+    return new SessionEndingTransport(new URL(t.url), {
         requestInit: headers ? { headers } : undefined,
         fetch: declaredEndpointFetch,
     });
@@ -663,7 +641,7 @@ export function mcpToolSchemaProblem(schema) {
     }
     return undefined;
 }
-export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations, poolOpts, promptSections, dialable) {
+export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations, poolOpts, promptSections, dialable, signal) {
     const snapshot = snapshotMcpEntries(specs);
     const axesRefused = new WeakMap();
     const entries = snapshot.map((spec) => {
@@ -722,11 +700,10 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const droppedTools = [];
     let disposing = false;
     const serverHandles = [];
-    const redialsInFlight = new Set();
     const commitConnectedServer = (spec, s, transportKind) => {
         const raised = [];
         connections.push({ client: s.client, close: s.close });
-        const handle = { name: spec.name, spec, client: s.client, openListing: s.openListing, health: s.health, tools: s.tools, listedRaw: s.listedTools, transportKind, announce: s.announce, instructions: s.instructions };
+        const handle = { name: spec.name, spec, client: s.client, openListing: s.openListing, health: s.health, tools: s.tools, listing: s.listing, gatesAt: s.gatesAt, gates: () => gatesNow(handle), transportKind, announce: s.announce, instructions: s.instructions };
         const hIdx = serverHandles.findIndex((h) => h.name === spec.name);
         if (hIdx === -1)
             serverHandles.push(handle);
@@ -786,9 +763,20 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         }
     };
     const dialKinds = entries.map(readDialKind);
+    const liveOf = (server) => serverHandles.find((h) => h.name === server);
+    const gatesNow = (h) => {
+        const latest = h.listing.latest();
+        if (latest.at !== h.gatesAt.at)
+            h.gatesAt = { at: latest.at, gates: intakeListedTools({ tools: [...latest.entries], unproven: latest.unproven }, h.spec, linkOf(h.name), imageResizer, mcpDisclosure, isServerRevoked, h.transportKind).gates };
+        return h.gatesAt.gates;
+    };
+    const linkOf = (server) => ({
+        live: () => liveOf(server),
+        recover: (lost) => redialFlights.running(server) ?? (liveOf(server) === lost ? redialFlights.start(server, () => redialDial(server)) : Promise.resolve()),
+    });
     const dialServer = (spec, dialKind, dialOpts) => {
         const refusal = axesRefused.get(spec);
-        return refusal !== undefined ? Promise.reject(refusal) : connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKind, poolOpts?.pool, dialOpts);
+        return refusal !== undefined ? Promise.reject(refusal) : connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKind, poolOpts?.pool, { ...dialOpts, link: linkOf(spec.name), ...(signal !== undefined ? { signal } : {}) });
     };
     const prefixOf = (name) => mintNamespacePrefix(MCP_NAMESPACE, name);
     const heldCount = (name) => serverHandles.find((h) => h.name === name)?.tools.length ?? 0;
@@ -834,89 +822,87 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         await Promise.allSettled(settled.map((r) => (r.status === "fulfilled" && r.value !== null ? r.value.close() : Promise.resolve())));
         throw mergeErr;
     }
-    const redialOnce = async (server) => {
+    const declineRedial = (server, outcome, reason) => ({ server, prefix: prefixOf(server), outcome, reason, toolCount: heldCount(server), added: [], removed: [] });
+    const redialFlights = new Flights();
+    const ownerStopped = () => (disposing ? "this materialization is being disposed — the task is tearing down" : signal?.aborted === true ? "the run was aborted" : undefined);
+    const redialDial = async (server) => {
         const prefix = prefixOf(server);
-        const declined = (outcome, reason) => ({ server, prefix, outcome, reason, toolCount: heldCount(server), added: [], removed: [] });
-        if (disposing)
-            return declined("refused", "this materialization is being disposed — the task is tearing down");
+        const declined = (outcome, reason) => declineRedial(server, outcome, reason);
+        const stopped = ownerStopped();
+        if (stopped !== undefined)
+            return declined("refused", stopped);
         const spec = entries.find((e) => e.name === server);
         if (spec === undefined)
             return declined("not_declared", `no MCP server named ${inlineUntrusted(server, 120)} is declared for this task`);
         if (isServerRevoked(server))
             return declined("refused", "server revoked by the operator — the re-dial did not contact it");
-        if (redialsInFlight.has(server))
-            return declined("refused", "a re-dial of this server is already in flight — wait for it to settle");
-        redialsInFlight.add(server);
-        try {
-            const hIdx = serverHandles.findIndex((h) => h.name === server);
-            const prior = hIdx === -1 ? undefined : serverHandles[hIdx];
-            const priorNames = prior ? prior.tools.map((t) => t.name) : [];
-            if (prior) {
-                prior.announce.fn = undefined;
-                prior.health.observe = undefined;
-                serverHandles.splice(hIdx, 1);
-                const cIdx = connections.findIndex((c) => c.client === prior.client);
-                const priorConnection = cIdx === -1 ? undefined : connections.splice(cIdx, 1)[0];
-                await (priorConnection?.close() ?? prior.client.close()).catch(() => undefined);
-            }
-            const dialKind = readDialKind(spec);
-            let connected;
-            try {
-                connected = await dialServer(spec, dialKind, { fresh: true, sections: promptSections });
-            }
-            catch (err) {
-                const { kind, delivered, httpStatus } = classifyMcpFailure(err, { phase: "connect", transport: dialKind });
-                const redialLiveness = livenessOf(kind, Date.now());
-                const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(err), ...(redialLiveness !== undefined ? { liveness: redialLiveness } : {}) };
-                const sIdx = statuses.findIndex((st) => st.name === server);
-                if (sIdx === -1)
-                    statuses.push(status);
-                else
-                    statuses[sIdx] = status;
-                const raised = asServerWarning(spec, err);
-                warnings.push(raised);
-                reconcileInstructions(server, undefined, false);
-                return {
-                    server,
-                    prefix,
-                    outcome: "refused",
-                    reason: inlineUntrusted(namedMcpFailureText(err), 240),
-                    toolCount: 0,
-                    added: [],
-                    removed: priorNames,
-                    tools: [],
-                    axes: [],
-                    dropped: [],
-                    warnings: [raised.message],
-                    status,
-                };
-            }
-            if (disposing) {
-                await connected.close().catch(() => undefined);
-                return declined("refused", "this materialization was disposed while the re-dial was in flight — the new connection was closed");
-            }
-            const raised = commitConnectedServer(spec, connected, dialKind);
-            reconcileInstructions(server, connected.instructions, true);
-            const newNames = connected.tools.map((t) => t.name);
+        const hIdx = serverHandles.findIndex((h) => h.name === server);
+        const prior = hIdx === -1 ? undefined : serverHandles[hIdx];
+        const priorNames = prior ? prior.tools.map((t) => t.name) : [];
+        if (prior) {
+            prior.announce.fn = undefined;
+            prior.health.observe = undefined;
+            serverHandles.splice(hIdx, 1);
+            const cIdx = connections.findIndex((c) => c.client === prior.client);
+            const priorConnection = cIdx === -1 ? undefined : connections.splice(cIdx, 1)[0];
+            await (priorConnection?.close() ?? prior.client.close()).catch(() => undefined);
+        }
+        const dialKind = readDialKind(spec);
+        const dialed = await dialServer(spec, dialKind, { fresh: true, sections: promptSections, ...(prior !== undefined ? { carried: prior.listing.latest().entries } : {}) }).then((connected) => ({ connected }), (err) => ({ err }));
+        const stoppedLate = ownerStopped();
+        if (stoppedLate !== undefined) {
+            if ("connected" in dialed)
+                await dialed.connected.close().catch(() => undefined);
+            return declined("refused", `${stoppedLate} while the re-dial was in flight — nothing new was kept or recorded`);
+        }
+        if ("err" in dialed) {
+            const err = dialed.err;
+            const { kind, delivered, httpStatus } = classifyMcpFailure(err, { phase: "connect", transport: dialKind });
+            const redialLiveness = livenessOf(kind, Date.now());
+            const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(err), ...(redialLiveness !== undefined ? { liveness: redialLiveness } : {}) };
+            const sIdx = statuses.findIndex((st) => st.name === server);
+            if (sIdx === -1)
+                statuses.push(status);
+            else
+                statuses[sIdx] = status;
+            const raised = asServerWarning(spec, err);
+            warnings.push(raised);
+            reconcileInstructions(server, undefined, false);
             return {
                 server,
                 prefix,
-                outcome: "reconnected",
-                toolCount: newNames.length,
-                added: newNames.filter((n) => !priorNames.includes(n)),
-                removed: priorNames.filter((n) => !newNames.includes(n)),
-                tools: connected.tools,
-                axes: connected.axes,
-                dropped: connected.dropped.map((d) => ({ server: inlineUntrusted(server, 160), ...d })),
-                ...(raised.length > 0 ? { warnings: raised.map((w) => w.message) } : {}),
-                status: connected.status,
-                ...(connected.listingIncomplete !== undefined ? { listingIncomplete: connected.listingIncomplete } : {}),
+                outcome: "refused",
+                reason: inlineUntrusted(namedMcpFailureText(err), 240),
+                toolCount: 0,
+                added: [],
+                removed: priorNames,
+                tools: [],
+                axes: [],
+                dropped: [],
+                warnings: [raised.message],
+                status,
             };
         }
-        finally {
-            redialsInFlight.delete(server);
-        }
+        const { connected } = dialed;
+        const raised = commitConnectedServer(spec, connected, dialKind);
+        reconcileInstructions(server, connected.instructions, true);
+        const newNames = connected.tools.map((t) => t.name);
+        return {
+            server,
+            prefix,
+            outcome: "reconnected",
+            toolCount: newNames.length,
+            added: newNames.filter((n) => !priorNames.includes(n)),
+            removed: priorNames.filter((n) => !newNames.includes(n)),
+            tools: connected.tools,
+            axes: connected.axes,
+            dropped: connected.dropped.map((d) => ({ server: inlineUntrusted(server, 160), ...d })),
+            ...(raised.length > 0 ? { warnings: raised.map((w) => w.message) } : {}),
+            status: connected.status,
+            ...(connected.listingIncomplete !== undefined ? { listingIncomplete: connected.listingIncomplete } : {}),
+        };
     };
+    const redialOnce = (server) => (redialFlights.running(server) === undefined ? redialFlights.start(server, () => redialDial(server)) : Promise.resolve(declineRedial(server, "refused", "a re-dial of this server is already in flight — wait for it to settle")));
     return {
         tools,
         toolAxes,
@@ -940,20 +926,25 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                     results.push({ server: h.name, prefix: prefixOf(h.name), status: "revoked", toolCount: h.tools.length, added: [], removed: [], error: "server revoked by the operator — the refresh did not contact it" });
                     continue;
                 }
+                const site = requestSite(h.client);
                 try {
+                    const at = h.listing.open();
                     const cacheTools = h.openListing();
                     const listed = await listToolsLenient(h.client);
-                    const advertised = new Set(listed.tools.map((t) => t.name));
-                    const retainedRaw = listed.incomplete !== undefined ? h.listedRaw.filter((t) => !advertised.has(t.name)) : [];
-                    const mergedRaw = retainedRaw.length > 0 ? [...listed.tools, ...retainedRaw] : listed.tools;
-                    const { serverTools, serverAxes, dropped, accepted } = intakeListedTools({ tools: mergedRaw }, h.spec, h.client, h.health, imageResizer, mcpDisclosure, isServerRevoked, h.transportKind);
-                    cacheTools(accepted, new Set(retainedRaw.map((t) => t.name)));
+                    const answered = h.listing.answer(at, listed.tools, listed.incomplete !== undefined);
+                    const mergedRaw = answered.view;
+                    if (!answered.recorded) {
+                        results.push({ server: h.name, prefix: prefixOf(h.name), status: "failed", toolCount: h.tools.length, added: [], removed: [], error: "a later listing of this server was opened and applied while this one was in the air — this one was discarded" });
+                        continue;
+                    }
+                    const { serverTools, serverAxes, gates, dropped, accepted } = intakeListedTools({ tools: [...mergedRaw], unproven: answered.unproven }, h.spec, linkOf(h.name), imageResizer, mcpDisclosure, isServerRevoked, h.transportKind);
+                    cacheTools(accepted, answered.kept);
                     const priorNames = h.tools.map((t) => t.name);
                     const newNames = serverTools.map((t) => t.name);
                     const added = newNames.filter((n) => !priorNames.includes(n));
                     const removed = priorNames.filter((n) => !newNames.includes(n));
                     h.tools = serverTools;
-                    h.listedRaw = mergedRaw;
+                    h.gatesAt = { at, gates };
                     results.push({
                         server: h.name,
                         prefix: prefixOf(h.name),
@@ -971,7 +962,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                     });
                 }
                 catch (err) {
-                    h.health.observe?.(classifyMcpFailure(err, { phase: "request" }).kind);
+                    h.health.observe?.(classifyMcpFailure(err, site).kind);
                     results.push({
                         server: h.name,
                         prefix: prefixOf(h.name),
@@ -979,7 +970,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                         toolCount: h.tools.length,
                         added: [],
                         removed: [],
-                        error: inlineUntrusted(namedMcpFailureText(err), 240),
+                        error: inlineUntrusted(namingLostSession(err, site, namedMcpFailureText(err)), 240),
                     });
                 }
             }
@@ -1266,6 +1257,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                     }
                     const idleMs = mcpIdleTimeoutMs(rs.transportKind);
                     const watchdog = armMcpIdleWatchdog(rs.health, idleMs, signal);
+                    const site = requestSite(rs.client);
                     try {
                         const walk = await walkMcpListPages(async (cursor, remainingMs) => {
                             const page = await rs.client
@@ -1291,7 +1283,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                             throw err;
                         const msg = watchdog.idleSignal.reason === IDLE_WATCHDOG_ABORT_REASON
                             ? idleWatchdogTripText(idleMs)
-                            : remoteErrorText(err);
+                            : namingLostSession(err, site, remoteErrorText(err));
                         errors.push({ server: rs.server, error: msg });
                         sections.push(`[${rs.server}] Error: could not list resources: ${inlineUntrusted(msg)}`);
                     }
@@ -1345,11 +1337,12 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 const timeoutMs = mcpToolTimeoutMs();
                 const idleMs = mcpIdleTimeoutMs(rs.transportKind);
                 const watchdog = armMcpIdleWatchdog(rs.health, idleMs, signal);
+                const site = requestSite(rs.client);
                 let res;
                 try {
                     res = await rs.client
                         .readResource({ uri }, { signal: watchdog.combinedSignal, timeout: timeoutMs })
-                        .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                        .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                     rs.health.observe?.("completed");
                 }
                 finally {
@@ -1406,10 +1399,11 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 const timeoutMs = mcpToolTimeoutMs();
                 const idleMs = mcpIdleTimeoutMs(rs.transportKind);
                 const watchdog = armMcpIdleWatchdog(rs.health, idleMs, signal);
+                const site = requestSite(rs.client);
                 try {
                     const ext = rs.client.getServerCapabilities()?.extensions?.[MCP_SKILLS_EXTENSION];
                     if (ext?.directoryRead === true) {
-                        const r = await readDirViaExtension(rs, uri, signal, timeoutMs, watchdog).catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                        const r = await readDirViaExtension(rs, uri, signal, timeoutMs, watchdog).catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                         const serverSaid = (detail) => `\nThe server's error text follows as external/untrusted data:\n${delimitUntrusted(`${server} error`, truncateMcpErrorText(detail))}`;
                         if (r.kind === "not_found") {
                             return {
@@ -1437,7 +1431,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                     const walk = await walkMcpListPages(async (cursor, remainingMs) => {
                         const page = await rs.client
                             .listResources(cursor === undefined ? undefined : { cursor }, { signal: watchdog.combinedSignal, timeout: remainingMs })
-                            .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs: remainingMs, writeEffect: false, signal, attributeServer: true, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                            .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs: remainingMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                         rs.health.observe?.("completed");
                         return { items: page.resources, ...(page.nextCursor !== undefined ? { nextCursor: page.nextCursor } : {}) };
                     }, { budgetMs: timeoutMs, onPage: () => watchdog.rearm(), fingerprintOf: listEntryFingerprint, ...(signal !== undefined ? { signal } : {}) });
@@ -1532,7 +1526,8 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
     const announce = {};
     const startupMs = mcpStartupTimeoutMs(spec);
     const startupOpts = startupMs !== undefined ? { timeout: startupMs } : undefined;
-    const dialClient = async () => {
+    const dialClient = async (stop = dialOpts?.signal) => {
+        stop?.throwIfAborted();
         const client = new Client({ name: `sema-core/${spec.name}`, version: "0.1.0" }, { capabilities: elicitOn ? { elicitation: { form: {} } } : {} });
         if (elicitOn) {
             client.setRequestHandler(ElicitRequestSchema, async (request, extra) => {
@@ -1555,12 +1550,17 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             });
         }
         const transport = buildTransport(spec, principal, transportKind);
+        const hangUp = () => void client.close().catch(() => undefined);
+        stop?.addEventListener("abort", hangUp, { once: true });
         try {
             await client.connect(transport, startupOpts);
         }
         catch (err) {
             await client.close().catch(() => undefined);
-            throw err;
+            throw stop?.aborted === true ? stop.reason : err;
+        }
+        finally {
+            stop?.removeEventListener("abort", hangUp);
         }
         return client;
     };
@@ -1580,10 +1580,13 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             lease.onClose(onClosed);
         else
             client.onclose = onClosed;
+        const listing = lease?.listing ?? new ConnectionListing();
+        const at = listing.open();
         const cacheTools = openListing();
-        const listed = await listToolsLenient(client, startupOpts);
-        const { serverTools, serverAxes, dropped, advisories, accepted } = intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked, transportKind);
-        cacheTools(accepted);
+        const listed = await underStartupBound(startupMs, dialOpts?.signal, (options) => listToolsLenient(client, options));
+        const answered = listing.answer(at, listed.tools, listed.incomplete !== undefined, dialOpts.carried);
+        const { serverTools, serverAxes, gates, dropped, advisories, accepted } = intakeListedTools({ tools: [...answered.view], unproven: answered.unproven }, spec, dialOpts.link, imageResizer, reminderDisclosure, isServerRevoked, transportKind);
+        cacheTools(accepted, answered.kept);
         const caps = client.getServerCapabilities();
         const resourceInfo = caps?.resources
             ? {
@@ -1612,10 +1615,11 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             announce,
             tools: serverTools,
             axes: serverAxes,
+            listing,
+            gatesAt: { at, gates },
             dropped,
             schemaAdvisories: advisories,
             ...(listed.toolsCapabilityAbsent === true ? { toolsCapabilityAbsent: true } : {}),
-            listedTools: listed.tools,
             ...(instructions ? { instructions } : {}),
             ...(disposed?.defect !== undefined ? { instructionsDefect: disposed.defect } : {}),
             ...(listed.incomplete !== undefined ? { listingIncomplete: listed.incomplete } : {}),
@@ -1627,10 +1631,11 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         throw err;
     }
 }
-function intakeListedTools(listed, spec, client, health, imageResizer, reminderDisclosure, isServerRevoked, transportKind) {
+function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure, isServerRevoked, transportKind) {
     const declaredContentOrigin = spec.contentOrigin;
     const serverTools = [];
     const serverAxes = [];
+    const gates = new Map();
     const dropped = [];
     const accepted = [];
     const advisories = [];
@@ -1697,6 +1702,9 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
         if (interaction.advisory !== undefined)
             advisories.push({ tool: inlineUntrusted(t.name), reason: interaction.advisory });
         const mcpAlwaysLoad = mcpToolMeta?.["anthropic/alwaysLoad"] === true;
+        const gateFace = { ...(interaction.declared ? { mcpRequiresUserInteraction: true } : {}), ...(t.annotations?.readOnlyHint === true ? { mcpReadOnlyHint: true } : {}) };
+        const gate = mcpToolGate(remoteName, axis, gateFace, taskRequired);
+        gates.set(namespacedName, listed.unproven?.has(remoteName) === true ? UNPROVEN_GATE : gate);
         const mounted = {
             name: namespacedName,
             description: capMcpToolDescription(effectiveDescription ?? `MCP tool ${inlineUntrusted(sanitizeMcpModelFacingText(remoteName))} from ${spec.name}`),
@@ -1704,8 +1712,8 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
             parameters: (effectiveInputSchema ?? { type: "object" }),
             ...(mcpMaxResultSizeChars !== undefined ? { mcpMaxResultSizeChars } : {}),
             ...(mcpAlwaysLoad ? { mcpAlwaysLoad: true } : {}),
-            ...(interaction.declared ? { mcpRequiresUserInteraction: true } : {}),
-            mcpRemoteName: remoteName, ...boundaryFlowFace(spec.toolAxes?.[remoteName]), ...(t.annotations?.readOnlyHint === true ? { mcpReadOnlyHint: true } : {}), permissionSeat: "passthrough",
+            ...gateFace,
+            mcpRemoteName: remoteName, ...boundaryFlowFace(spec.toolAxes?.[remoteName]), permissionSeat: "passthrough",
             execute: async (_toolCallId, params, signal) => {
                 const what = `The call to tool ${inlineUntrusted(remoteName)}`;
                 if (isServerRevoked?.(spec.name) === true) {
@@ -1724,38 +1732,55 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
                         isError: true,
                     };
                 }
-                if (health.dead)
-                    throwDeadServer(spec.name, what);
                 const timeoutMs = mcpToolTimeoutMs();
                 const idleMs = mcpIdleTimeoutMs(idleKindOf(transportKind));
-                const watchdog = armMcpIdleWatchdog(health, idleMs, signal);
-                let res;
-                try {
-                    res = await client
-                        .callTool({ name: remoteName, arguments: (params ?? {}) }, LENIENT_CALL_TOOL_RESULT_SCHEMA, {
-                        signal: watchdog.combinedSignal,
-                        timeout: timeoutMs,
-                        resetTimeoutOnProgress: true,
-                        onprogress: () => watchdog.rearm(),
-                        maxTotalTimeout: mcpToolTotalTimeoutMs(timeoutMs),
-                    })
-                        .catch((err) => rethrowHonestMcpError(err, {
-                        server: spec.name,
-                        what,
-                        timeoutMs,
-                        writeEffect,
-                        signal,
-                        idle: { signal: watchdog.idleSignal, idleMs },
-                        liveness: health,
-                        ...(reminderDisclosure !== undefined
-                            ? { reminder: { mark: reminderDisclosure.mark, outlet: "mcp", ...(reminderDisclosure.counts !== undefined ? { counts: reminderDisclosure.counts } : {}) } }
-                            : {}),
-                    }));
-                    health.observe?.("completed");
-                }
-                finally {
-                    watchdog.dispose();
-                }
+                const send = async (conn, resent) => {
+                    const site = requestSite(conn.client);
+                    const watchdog = armMcpIdleWatchdog(conn.health, idleMs, signal);
+                    try {
+                        const res = await conn.client
+                            .callTool({ name: remoteName, arguments: (params ?? {}) }, LENIENT_CALL_TOOL_RESULT_SCHEMA, {
+                            signal: watchdog.combinedSignal,
+                            timeout: timeoutMs,
+                            resetTimeoutOnProgress: true,
+                            onprogress: () => watchdog.rearm(),
+                            maxTotalTimeout: mcpToolTotalTimeoutMs(timeoutMs),
+                        })
+                            .catch((err) => {
+                            try {
+                                return rethrowHonestMcpError(err, {
+                                    server: spec.name,
+                                    what,
+                                    timeoutMs,
+                                    writeEffect,
+                                    signal,
+                                    site,
+                                    ...(resent ? { resent: true } : {}),
+                                    idle: { signal: watchdog.idleSignal, idleMs },
+                                    liveness: conn.health,
+                                    ...(reminderDisclosure !== undefined
+                                        ? { reminder: { mark: reminderDisclosure.mark, outlet: "mcp", ...(reminderDisclosure.counts !== undefined ? { counts: reminderDisclosure.counts } : {}) } }
+                                        : {}),
+                                });
+                            }
+                            catch (failure) {
+                                if (sessionGone(err, site) && signal?.aborted !== true)
+                                    return new Resendable(conn, failure);
+                                throw failure;
+                            }
+                        });
+                        if (res instanceof Resendable)
+                            return res;
+                        conn.health.observe?.("completed");
+                        return res;
+                    }
+                    finally {
+                        watchdog.dispose();
+                    }
+                };
+                const res = await callThroughLink(link, namespacedName, gate, signal, send, () => throwDeadServer(spec.name, what));
+                if (typeof res === "string")
+                    return listingRefusal(res, remoteName, spec.name);
                 const mapped = await mapContent(res.content, spec.name, imageResizer);
                 if (res.isError === true) {
                     const parts = [];
@@ -1815,7 +1840,7 @@ function intakeListedTools(listed, spec, client, health, imageResizer, reminderD
         serverTools.push(declaredContentOrigin !== undefined ? withContentOrigin(mounted, declaredContentOrigin) : mounted);
         accepted.push(t);
     }
-    return { serverTools, serverAxes, dropped, advisories, accepted };
+    return { serverTools, serverAxes, gates, dropped, advisories, accepted };
 }
 function asServerWarning(spec, err) {
     const warning = new Error(`mcp: server "${spec.name}" failed to connect — skipped (${namedMcpFailureText(err)})`, { cause: sanitizedCause(err) });

package/dist/core/media-byte-cap.d.ts

@@ -4,7 +4,7 @@ import type { DocumentContent, ImageContent } from "../internal/llm.js";
  * Aggregate MEDIA (image) byte budget — the multimodal sibling of {@link AGGREGATE_TOOL_RESULT_BUDGET_CHARS}
  * (which only counts TEXT, design/64 §17.2). batch-C added image reads (`Read` → `ImageContent`); each is bounded
  * per-image (`MAX_IMAGE_READ_BYTES`), but N images accumulate ACROSS turns in the context and would otherwise grow
- * the request unboundedly (a real gap — CC 2.1.196 added the same cap, `tengu_media_byte_cap`, validating it).
+ * the request unboundedly (a real gap — the reference added the same cap, `tengu_media_byte_cap`, validating it).
  *
  * This caps the SUM of inline image bytes across the whole message list: while over budget, the OLDEST images are
  * stripped (replaced with a short text marker) until it fits — recent media (most relevant) is kept. Like the text