@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/mcp.js

@@ -1,10 +1,10 @@
-import { egressText } from "./untrusted-egress.js";
 import { __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
 import { resolveEnvBudget } from "./env-budget.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
-import { resolveProtocolHttpHeaders } from "./protocol-http-auth.js";
+import { declaredHeaderValues, remoteWords, resolveProtocolHttpHeaders } from "./protocol-http-auth.js";
 import { disposeSectionEntry, sectionAnswerWarning } from "./prompt-section-seat.js";
-import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
+import { createToolNameClaims, mintNamespacePrefix, normalizeNameSegment } from "./protocol-naming.js";
+import { mcpToolDropReason, refuseCollidingMcpServerNames } from "./mcp-name-judge.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { McpConnectionPool } from "./mcp-connection-pool.js";
 import { SessionEndingTransport, requestSite } from "./mcp-session-end.js";
@@ -22,6 +22,7 @@ import { DEFAULT_REQUEST_TIMEOUT_MSEC } from "@modelcontextprotocol/sdk/shared/p
 import { MCP_IMAGE_MAX_BASE64, sharpImageResizer } from "./image-downsample.js";
 import { sliceHeadSafe, sliceTailSafe } from "./surrogate-safe-slice.js";
 import { truncateError } from "./tool-errors.js";
+import { peerRequestRefusal } from "./host-floor.js";
 import { delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { discloseReminderShaped, observeReminderMarkEcho } from "./reminder-disclosure.js";
 import { MARKED_BLOCK_AFTER_DATA } from "./reminder-mint.js";
@@ -161,21 +162,21 @@ export function collapseMcpErrorPrefix(message) {
         out = out.slice(m[0].length);
     }
 }
-function sanitizeMcpErrorTextInPlace(err) {
+function sanitizeMcpErrorTextInPlace(err, declared) {
     if (!(err instanceof Error))
         return;
-    const sanitized = egressText("same-principal", err instanceof McpError ? collapseMcpErrorPrefix(err.message) : err.message);
+    const sanitized = remoteWords(err instanceof McpError ? collapseMcpErrorPrefix(err.message) : err.message, declared);
     if (sanitized !== err.message)
         err.message = sanitized;
 }
-function namedMcpFailureText(err) {
-    const detail = remoteErrorText(err, { collapse: true });
+function namedMcpFailureText(err, declared) {
+    const detail = remoteErrorText(err, declared, { collapse: true });
     const condition = thrownIs(err, McpError) ? describeMcpSpecErrorCode(readMember(err, "code")) : undefined;
     return condition !== undefined ? `${condition}: ${detail}` : detail;
 }
-function remoteErrorText(err, opts) {
+function remoteErrorText(err, declared, opts) {
     const raw = thrownText(err);
-    return egressText("same-principal", opts?.collapse === true ? collapseMcpErrorPrefix(raw) : raw);
+    return remoteWords(opts?.collapse === true ? collapseMcpErrorPrefix(raw) : raw, declared);
 }
 function writeEffectWarning(writeEffect) {
     return writeEffect
@@ -194,7 +195,7 @@ function rethrowHonestMcpError(err, ctx) {
         }
         throw e;
     };
-    sanitizeMcpErrorTextInPlace(err);
+    sanitizeMcpErrorTextInPlace(err, ctx.declared);
     if (ctx.idle?.signal.reason === IDLE_WATCHDOG_ABORT_REASON) {
         ctx.liveness?.observe?.("timeout");
         const serverLabel = inlineUntrusted(ctx.server);
@@ -225,7 +226,7 @@ function rethrowHonestMcpError(err, ctx) {
         case "connect_refused":
         case "connection_failed": {
             const httpFailure = describeHttpTransportFailure(err, ctx.site);
-            const detail = remoteErrorText(err);
+            const detail = remoteErrorText(err, ctx.declared);
             const fenced = `\nThe transport error follows as external/untrusted data:\n${fenceServerText(`${ctx.server} transport error`, detail)}`;
             finish(markMcpFailure(new Error(sessionGone(err, ctx.site)
                 ? `${ctx.what} met a lost session on MCP server "${serverLabel}": ${httpFailure.condition}; ${ctx.resent === true ? "the call was sent again once on a fresh session, and the server reported that one gone too — if the server executed it before answering, it ran twice" : "the call was not sent again — if the server executed it before answering, it ran"}. The outcome is unknown.${writeEffectWarning(ctx.writeEffect)}${fenced}`
@@ -240,7 +241,7 @@ function rethrowHonestMcpError(err, ctx) {
                 finish(markMcpFailure(new Error(`${ctx.what} on MCP server "${serverLabel}" was rejected with MCP protocol error ${code} — ${condition}. The server's error text follows as external/untrusted data:\n${fenceServerText(`${ctx.server} error`, err.message)}`, { cause: err }), details({ specErrorCode: code })));
             }
             if (ctx.attributeServer) {
-                finish(markMcpFailure(new Error(`${ctx.what} on MCP server "${serverLabel}" failed. The server's error text follows as external/untrusted data:\n${fenceServerText(`${ctx.server} error`, remoteErrorText(err))}`, { cause: err }), details()));
+                finish(markMcpFailure(new Error(`${ctx.what} on MCP server "${serverLabel}" failed. The server's error text follows as external/untrusted data:\n${fenceServerText(`${ctx.server} error`, remoteErrorText(err, ctx.declared))}`, { cause: err }), details()));
             }
             finish(markMcpFailure(err, details()));
         }
@@ -248,7 +249,7 @@ function rethrowHonestMcpError(err, ctx) {
         case "invalid_config":
         case "unknown": {
             if (ctx.attributeServer) {
-                finish(markMcpFailure(new Error(`${ctx.what} on MCP server "${serverLabel}" failed. The server's error text follows as external/untrusted data:\n${fenceServerText(`${ctx.server} error`, remoteErrorText(err))}`, { cause: err }), details()));
+                finish(markMcpFailure(new Error(`${ctx.what} on MCP server "${serverLabel}" failed. The server's error text follows as external/untrusted data:\n${fenceServerText(`${ctx.server} error`, remoteErrorText(err, ctx.declared))}`, { cause: err }), details()));
             }
             if (err instanceof Error)
                 finish(markMcpFailure(err, details()));
@@ -641,7 +642,7 @@ export function mcpToolSchemaProblem(schema) {
     }
     return undefined;
 }
-export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations, poolOpts, promptSections, dialable, signal) {
+export async function materializeMcpTools(specs, principal, onElicit, imageResizer, reminderDisclosure, mcpRevocations, poolOpts, promptSections, dialable, signal, hostFloor) {
     const snapshot = snapshotMcpEntries(specs);
     const axesRefused = new WeakMap();
     const entries = snapshot.map((spec) => {
@@ -651,17 +652,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
         axesRefused.set(spec, judged.error);
         return spec;
     });
-    {
-        const collision = findNamespacePrefixCollision(MCP_NAMESPACE, entries.map((s) => s.name));
-        if (collision) {
-            const [a, b] = collision.peers;
-            const e = new Error(a === b
-                ? `MCP server "${inlineUntrusted(a, 120)}" is declared twice — each server needs its own name (both mount under "${collision.prefix}", so their tools would shadow each other and a refresh of one would unmount the other's).`
-                : `MCP server names "${inlineUntrusted(a, 120)}" and "${inlineUntrusted(b, 120)}" both mount under "${collision.prefix}" — the namespaced tool name keeps only [a-zA-Z0-9_-], so they are the same domain to this engine (their tools would shadow each other and a refresh of one would unmount the other's). Rename one.`);
-            e.code = "config.mcp_server_name_collision";
-            throw e;
-        }
-    }
+    refuseCollidingMcpServerNames(entries.map((s) => s.name));
     let revocationProbeFailed = false;
     const isServerRevoked = (serverName) => {
         if (mcpRevocations === undefined)
@@ -767,18 +758,33 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
     const gatesNow = (h) => {
         const latest = h.listing.latest();
         if (latest.at !== h.gatesAt.at)
-            h.gatesAt = { at: latest.at, gates: intakeListedTools({ tools: [...latest.entries], unproven: latest.unproven }, h.spec, linkOf(h.name), imageResizer, mcpDisclosure, isServerRevoked, h.transportKind).gates };
+            h.gatesAt = { at: latest.at, gates: intakeListedTools({ tools: [...latest.entries], unproven: latest.unproven }, h.spec, linkOf(h.name), echoOf(h.spec), imageResizer, mcpDisclosure, isServerRevoked, h.transportKind).gates };
         return h.gatesAt.gates;
     };
     const linkOf = (server) => ({
         live: () => liveOf(server),
         recover: (lost) => redialFlights.running(server) ?? (liveOf(server) === lost ? redialFlights.start(server, () => redialDial(server)) : Promise.resolve()),
     });
+    const endpointRefusal = (spec, dialKind) => {
+        const transport = spec.transport;
+        const raw = dialKind !== "stdio" && typeof transport === "object" && transport !== null && "url" in transport ? transport.url : undefined;
+        let url;
+        try {
+            if (typeof raw !== "string")
+                return undefined;
+            url = new URL(raw);
+        }
+        catch {
+            return undefined;
+        }
+        return peerRequestRefusal(`mcp: server "${inlineUntrusted(spec.name, 120)}"`, url, hostFloor);
+    };
     const dialServer = (spec, dialKind, dialOpts) => {
-        const refusal = axesRefused.get(spec);
+        const refusal = axesRefused.get(spec) ?? endpointRefusal(spec, dialKind);
         return refusal !== undefined ? Promise.reject(refusal) : connectServer(spec, principal, onElicit, imageResizer, mcpDisclosure, isServerRevoked, dialKind, poolOpts?.pool, { ...dialOpts, link: linkOf(spec.name), ...(signal !== undefined ? { signal } : {}) });
     };
     const prefixOf = (name) => mintNamespacePrefix(MCP_NAMESPACE, name);
+    const echoOf = (spec) => declaredHeaderValues(spec.transport, principal);
     const heldCount = (name) => serverHandles.find((h) => h.name === name)?.tools.length ?? 0;
     const reconcileInstructions = (name, after, connected) => {
         if (!connected)
@@ -808,10 +814,11 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                 commitConnectedServer(spec, s, dialKinds[i]);
             }
             else {
-                warnings.push(asServerWarning(spec, r.reason));
+                const declared = echoOf(spec);
+                warnings.push(asServerWarning(spec, r.reason, declared));
                 const { kind, delivered, httpStatus } = classifyMcpFailure(r.reason, { phase: "connect", transport: dialKinds[i] });
                 const liveness = livenessOf(kind, Date.now());
-                statuses.push({ name: spec.name, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(r.reason), ...(liveness !== undefined ? { liveness } : {}) });
+                statuses.push({ name: spec.name, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(r.reason, declared), ...(liveness !== undefined ? { liveness } : {}) });
             }
         }
         const resourceTools = buildResourceTools(resourceServers, isServerRevoked);
@@ -859,20 +866,22 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
             const err = dialed.err;
             const { kind, delivered, httpStatus } = classifyMcpFailure(err, { phase: "connect", transport: dialKind });
             const redialLiveness = livenessOf(kind, Date.now());
-            const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: namedMcpFailureText(err), ...(redialLiveness !== undefined ? { liveness: redialLiveness } : {}) };
+            const declared = echoOf(spec);
+            const failure = namedMcpFailureText(err, declared);
+            const status = { name: server, status: "failed", errorCode: kind, delivered, ...(httpStatus !== undefined ? { httpStatus } : {}), error: failure, ...(redialLiveness !== undefined ? { liveness: redialLiveness } : {}) };
             const sIdx = statuses.findIndex((st) => st.name === server);
             if (sIdx === -1)
                 statuses.push(status);
             else
                 statuses[sIdx] = status;
-            const raised = asServerWarning(spec, err);
+            const raised = asServerWarning(spec, err, declared);
             warnings.push(raised);
             reconcileInstructions(server, undefined, false);
             return {
                 server,
                 prefix,
                 outcome: "refused",
-                reason: inlineUntrusted(namedMcpFailureText(err), 240),
+                reason: inlineUntrusted(failure, 240),
                 toolCount: 0,
                 added: [],
                 removed: priorNames,
@@ -930,14 +939,14 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                 try {
                     const at = h.listing.open();
                     const cacheTools = h.openListing();
-                    const listed = await listToolsLenient(h.client);
+                    const listed = await listToolsLenient(h.client, undefined, echoOf(h.spec));
                     const answered = h.listing.answer(at, listed.tools, listed.incomplete !== undefined);
                     const mergedRaw = answered.view;
                     if (!answered.recorded) {
                         results.push({ server: h.name, prefix: prefixOf(h.name), status: "failed", toolCount: h.tools.length, added: [], removed: [], error: "a later listing of this server was opened and applied while this one was in the air — this one was discarded" });
                         continue;
                     }
-                    const { serverTools, serverAxes, gates, dropped, accepted } = intakeListedTools({ tools: [...mergedRaw], unproven: answered.unproven }, h.spec, linkOf(h.name), imageResizer, mcpDisclosure, isServerRevoked, h.transportKind);
+                    const { serverTools, serverAxes, gates, dropped, accepted } = intakeListedTools({ tools: [...mergedRaw], unproven: answered.unproven }, h.spec, linkOf(h.name), echoOf(h.spec), imageResizer, mcpDisclosure, isServerRevoked, h.transportKind);
                     cacheTools(accepted, answered.kept);
                     const priorNames = h.tools.map((t) => t.name);
                     const newNames = serverTools.map((t) => t.name);
@@ -970,7 +979,7 @@ export async function materializeMcpTools(specs, principal, onElicit, imageResiz
                         toolCount: h.tools.length,
                         added: [],
                         removed: [],
-                        error: inlineUntrusted(namingLostSession(err, site, namedMcpFailureText(err)), 240),
+                        error: inlineUntrusted(namingLostSession(err, site, namedMcpFailureText(err, echoOf(h.spec))), 240),
                     });
                 }
             }
@@ -1085,7 +1094,7 @@ export async function walkMcpListPages(fetchPage, opts) {
         catch (err) {
             if (pages === 0 || opts.signal?.aborted)
                 throw err;
-            return { items, incomplete: { reason: "page_error", pages, error: remoteErrorText(err) } };
+            return { items, incomplete: { reason: "page_error", pages, error: remoteErrorText(err, opts.declared ?? []) } };
         }
         opts.onPage?.();
         const pageStart = items.length;
@@ -1168,13 +1177,13 @@ async function readDirViaExtension(rs, uri, signal, timeoutMs, watchdog) {
             if (err instanceof McpError && err.code === ErrorCode.InvalidParams) {
                 if (pages > 0)
                     return { kind: "ok", resources, cursorInvalid: true };
-                const detail = remoteErrorText(err, { collapse: true });
+                const detail = remoteErrorText(err, rs.declared, { collapse: true });
                 return { kind: classifyDirReadInvalidParams(detail), detail };
             }
             if (err instanceof McpError && err.code === ErrorCode.MethodNotFound)
                 return { kind: "unsupported" };
             if (pages > 0 && !signal?.aborted) {
-                return { kind: "ok", resources, incomplete: remoteErrorText(err) };
+                return { kind: "ok", resources, incomplete: remoteErrorText(err, rs.declared) };
             }
             throw err;
         }
@@ -1266,7 +1275,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                                 throw watchdog.idleSignal.reason === IDLE_WATCHDOG_ABORT_REASON ? new Error(idleWatchdogTripText(idleMs)) : err;
                             });
                             return { items: page.resources, ...(page.nextCursor !== undefined ? { nextCursor: page.nextCursor } : {}) };
-                        }, { budgetMs: mcpToolTimeoutMs(), onPage: () => watchdog.rearm(), fingerprintOf: listEntryFingerprint, ...(signal !== undefined ? { signal } : {}) });
+                        }, { budgetMs: mcpToolTimeoutMs(), onPage: () => watchdog.rearm(), fingerprintOf: listEntryFingerprint, declared: rs.declared, ...(signal !== undefined ? { signal } : {}) });
                         all.push(...walk.items.map((r) => ({ server: rs.server, ...r })));
                         const lines = walk.items.map((r) => resourceLine(r));
                         const body = lines.length ? lines.join("\n") : "(no resources)";
@@ -1279,11 +1288,12 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                         }
                     }
                     catch (err) {
+                        sanitizeMcpErrorTextInPlace(err, rs.declared);
                         if (signal?.aborted)
                             throw err;
                         const msg = watchdog.idleSignal.reason === IDLE_WATCHDOG_ABORT_REASON
                             ? idleWatchdogTripText(idleMs)
-                            : namingLostSession(err, site, remoteErrorText(err));
+                            : namingLostSession(err, site, remoteErrorText(err, rs.declared));
                         errors.push({ server: rs.server, error: msg });
                         sections.push(`[${rs.server}] Error: could not list resources: ${inlineUntrusted(msg)}`);
                     }
@@ -1342,7 +1352,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 try {
                     res = await rs.client
                         .readResource({ uri }, { signal: watchdog.combinedSignal, timeout: timeoutMs })
-                        .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                        .catch((err) => rethrowHonestMcpError(err, { server, declared: rs.declared, what, timeoutMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                     rs.health.observe?.("completed");
                 }
                 finally {
@@ -1403,7 +1413,7 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                 try {
                     const ext = rs.client.getServerCapabilities()?.extensions?.[MCP_SKILLS_EXTENSION];
                     if (ext?.directoryRead === true) {
-                        const r = await readDirViaExtension(rs, uri, signal, timeoutMs, watchdog).catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                        const r = await readDirViaExtension(rs, uri, signal, timeoutMs, watchdog).catch((err) => rethrowHonestMcpError(err, { server, declared: rs.declared, what, timeoutMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                         const serverSaid = (detail) => `\nThe server's error text follows as external/untrusted data:\n${delimitUntrusted(`${server} error`, truncateMcpErrorText(detail))}`;
                         if (r.kind === "not_found") {
                             return {
@@ -1431,10 +1441,10 @@ function buildResourceTools(resourceServers, isServerRevoked = () => false) {
                     const walk = await walkMcpListPages(async (cursor, remainingMs) => {
                         const page = await rs.client
                             .listResources(cursor === undefined ? undefined : { cursor }, { signal: watchdog.combinedSignal, timeout: remainingMs })
-                            .catch((err) => rethrowHonestMcpError(err, { server, what, timeoutMs: remainingMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
+                            .catch((err) => rethrowHonestMcpError(err, { server, declared: rs.declared, what, timeoutMs: remainingMs, writeEffect: false, signal, attributeServer: true, site, idle: { signal: watchdog.idleSignal, idleMs }, liveness: rs.health }));
                         rs.health.observe?.("completed");
                         return { items: page.resources, ...(page.nextCursor !== undefined ? { nextCursor: page.nextCursor } : {}) };
-                    }, { budgetMs: timeoutMs, onPage: () => watchdog.rearm(), fingerprintOf: listEntryFingerprint, ...(signal !== undefined ? { signal } : {}) });
+                    }, { budgetMs: timeoutMs, onPage: () => watchdog.rearm(), fingerprintOf: listEntryFingerprint, declared: rs.declared, ...(signal !== undefined ? { signal } : {}) });
                     const dirPrefix = uri.endsWith("/") ? uri : `${uri}/`;
                     const children = walk.items.filter((r) => typeof r.uri === "string" && r.uri !== uri && r.uri.startsWith(dirPrefix));
                     return renderDirChildren(server, uri, children, walk.incomplete ? { listing: walk.incomplete } : undefined);
@@ -1499,7 +1509,7 @@ export function parseCallToolResultLenient(data) {
     return { success: true, data: { ...parsed.data, structuredContent } };
 }
 const LENIENT_CALL_TOOL_RESULT_SCHEMA = { safeParse: parseCallToolResultLenient };
-async function listToolsLenient(client, options) {
+async function listToolsLenient(client, options, declared) {
     if (!client.getServerCapabilities()?.tools)
         return { tools: [], toolsCapabilityAbsent: true };
     const walk = await walkMcpListPages(async (cursor, remainingMs) => {
@@ -1512,6 +1522,7 @@ async function listToolsLenient(client, options) {
     }, {
         budgetMs: options?.timeout ?? DEFAULT_REQUEST_TIMEOUT_MSEC,
         fingerprintOf: listEntryFingerprint,
+        declared,
         ...(options?.signal !== undefined ? { signal: options.signal } : {}),
     });
     return { tools: walk.items, ...(walk.incomplete !== undefined ? { incomplete: walk.incomplete } : {}) };
@@ -1583,9 +1594,10 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         const listing = lease?.listing ?? new ConnectionListing();
         const at = listing.open();
         const cacheTools = openListing();
-        const listed = await underStartupBound(startupMs, dialOpts?.signal, (options) => listToolsLenient(client, options));
+        const declared = declaredHeaderValues(spec.transport, principal);
+        const listed = await underStartupBound(startupMs, dialOpts?.signal, (options) => listToolsLenient(client, options, declared));
         const answered = listing.answer(at, listed.tools, listed.incomplete !== undefined, dialOpts.carried);
-        const { serverTools, serverAxes, gates, dropped, advisories, accepted } = intakeListedTools({ tools: [...answered.view], unproven: answered.unproven }, spec, dialOpts.link, imageResizer, reminderDisclosure, isServerRevoked, transportKind);
+        const { serverTools, serverAxes, gates, dropped, advisories, accepted } = intakeListedTools({ tools: [...answered.view], unproven: answered.unproven }, spec, dialOpts.link, declared, imageResizer, reminderDisclosure, isServerRevoked, transportKind);
         cacheTools(accepted, answered.kept);
         const caps = client.getServerCapabilities();
         const resourceInfo = caps?.resources
@@ -1623,7 +1635,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
             ...(instructions ? { instructions } : {}),
             ...(disposed?.defect !== undefined ? { instructionsDefect: disposed.defect } : {}),
             ...(listed.incomplete !== undefined ? { listingIncomplete: listed.incomplete } : {}),
-            ...(resourceInfo && (resourceInfo.listAllowed || resourceInfo.readAllowed) ? { resourceServer: { server: spec.name, client, health, transportKind: idleKindOf(transportKind), ...resourceInfo } } : {}),
+            ...(resourceInfo && (resourceInfo.listAllowed || resourceInfo.readAllowed) ? { resourceServer: { server: spec.name, client, health, transportKind: idleKindOf(transportKind), declared, ...resourceInfo } } : {}),
         };
     }
     catch (err) {
@@ -1631,7 +1643,7 @@ async function connectServer(spec, principal, onElicit, imageResizer, reminderDi
         throw err;
     }
 }
-function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure, isServerRevoked, transportKind) {
+function intakeListedTools(listed, spec, link, declared, imageResizer, reminderDisclosure, isServerRevoked, transportKind) {
     const declaredContentOrigin = spec.contentOrigin;
     const serverTools = [];
     const serverAxes = [];
@@ -1639,7 +1651,7 @@ function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure,
     const dropped = [];
     const accepted = [];
     const advisories = [];
-    const mintedNames = new Map();
+    const claimToolName = createToolNameClaims(MCP_NAMESPACE, spec.name);
     for (const t of listed.tools) {
         if (spec.allowTools && !spec.allowTools.includes(t.name)) {
             continue;
@@ -1679,18 +1691,11 @@ function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure,
         }
         const remoteName = t.name;
         const taskRequired = t.execution !== null && typeof t.execution === "object" && t.execution.taskSupport === "required";
-        const namespacedName = mintNamespacedToolName(MCP_NAMESPACE, spec.name, remoteName);
-        const mintedBy = mintedNames.get(namespacedName);
+        const { minted: namespacedName, heldBy: mintedBy } = claimToolName(remoteName);
         if (mintedBy !== undefined) {
-            dropped.push({
-                tool: inlineUntrusted(t.name),
-                reason: mintedBy === t.name
-                    ? `this server listed this tool name more than once in one listing; the first entry is mounted as "${namespacedName}" and the repeat is dropped (one name cannot denote two tools)`
-                    : `name collides with an earlier tool of this server: both mount as "${namespacedName}" after namespacing (only [a-zA-Z0-9_-] survives), and one name cannot denote two tools`,
-            });
+            dropped.push({ tool: inlineUntrusted(t.name), reason: mcpToolDropReason(namespacedName, mintedBy, t.name) });
             continue;
         }
-        mintedNames.set(namespacedName, t.name);
         const hintAxis = mcpAxisFor(namespacedName, t.annotations);
         const axis = applyCallerAxisOverride(namespacedName, hintAxis, spec.toolAxes?.[remoteName]);
         if (axis)
@@ -1750,6 +1755,7 @@ function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure,
                             try {
                                 return rethrowHonestMcpError(err, {
                                     server: spec.name,
+                                    declared,
                                     what,
                                     timeoutMs,
                                     writeEffect,
@@ -1793,7 +1799,7 @@ function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure,
                     const errScLine = structuredContentErrorLine(res.structuredContent, parts.join("\n"));
                     if (errScLine !== undefined)
                         parts.push(errScLine);
-                    const body = truncateMcpErrorText(egressText("same-principal", parts.join("\n").trim()));
+                    const body = truncateMcpErrorText(remoteWords(parts.join("\n").trim(), declared));
                     const msg = body
                         ? `MCP tool ${inlineUntrusted(remoteName)} reported an error. The server's error content follows as external/untrusted data:\n${delimitUntrusted(`${spec.name} tool error`, body)}`
                         : `MCP tool ${inlineUntrusted(remoteName)} reported an error`;
@@ -1842,8 +1848,8 @@ function intakeListedTools(listed, spec, link, imageResizer, reminderDisclosure,
     }
     return { serverTools, serverAxes, gates, dropped, advisories, accepted };
 }
-function asServerWarning(spec, err) {
-    const warning = new Error(`mcp: server "${spec.name}" failed to connect — skipped (${namedMcpFailureText(err)})`, { cause: sanitizedCause(err) });
+function asServerWarning(spec, err, declared) {
+    const warning = new Error(`mcp: server "${spec.name}" failed to connect — skipped (${namedMcpFailureText(err, declared)})`, { cause: sanitizedCause(err, declared) });
     warning.code = "mcp.server_unavailable";
     return warning;
 }
@@ -1868,8 +1874,8 @@ function dialDecision(dialable, spec) {
     }
     throw Object.assign(new Error(`MCP materialization refused: the dialable seat could not decide whether to dial server "${inlineUntrusted(spec.name, 120)}" — ${inlineUntrusted(why, 240)}. No server was dialed.`, cause), { code: "config.mcp_dialable_failed" });
 }
-function sanitizedCause(err) {
-    const copy = new Error(namedMcpFailureText(err));
+function sanitizedCause(err, declared) {
+    const copy = new Error(namedMcpFailureText(err, declared));
     const name = thrownName(err);
     if (name !== undefined) {
         if (name !== "")

package/dist/core/memory-engine/consolidation-driver.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { uuidv7 } from "../../internal/harness.js";
 import { atomicWriteFileSync, ensureDirExists, lockedStrictUpdate, readStrictSidecar, enqueueMemoryAnnouncement, ControlPlaneCorruptError } from "./layout.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { extensionWords } from "../untrusted-egress.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, updateConsolidationGate, recommendationUnconsumed, CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError, } from "./consolidation.js";
 import { memoryConsolidationIncompleteNotice, memoryConsolidationWithheldNotice } from "./engine.js";
@@ -510,15 +511,15 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     }
     catch (err) {
         if (err instanceof DriverMintFailure) {
-            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} FAILED before any write: ${inlineUntrusted(err.detail, 300)}`]);
+            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} FAILED before any write: ${extensionWords(err.detail, 300)}`]);
             return settle("driver_failed", undefined, err.detail);
         }
         if (err instanceof DriverPurityViolation) {
-            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} REFUSED on the clean-arm purity gate (no writes): ${inlineUntrusted(err.detail, 300)}`]);
+            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} REFUSED on the clean-arm purity gate (no writes): ${extensionWords(err.detail, 300)}`]);
             return settle("purity_violation", undefined, err.detail);
         }
         if (err instanceof MintInvalidated) {
-            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} MINT INVALIDATED: ${inlineUntrusted(err.detail, 300)}`]);
+            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} MINT INVALIDATED: ${extensionWords(err.detail, 300)}`]);
             if (run.residue === undefined && err.residue.length > 0)
                 run.residue = err.residue;
             const partial = {

package/dist/core/memory-engine/delegation-settlement.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, fsyncSync, linkSync, lstatSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { QUARANTINE_DIR, appendChallengeEvents, enqueueMemoryAnnouncement, ensureDirExists, v1MemoryPathKeyResolver, lineageContributionsOfSession, lockedStrictUpdate, markSessionPolluted, readProjectionDebts, readSessionPollution, readStrictSidecar, ControlPlaneCorruptError } from "./layout.js";
+import { QUARANTINE_DIR, appendChallengeEvents, claimStaging, enqueueMemoryAnnouncement, ensureDirExists, isSameFile, mintStagingName, stagingNamePattern, v1MemoryPathKeyResolver, lineageContributionsOfSession, lockedStrictUpdate, markSessionPolluted, readProjectionDebts, readSessionPollution, readStrictSidecar, ControlPlaneCorruptError } from "./layout.js";
 import { thrownText } from "../thrown-value.js";
 export const DELEGATION_SETTLEMENT_FILE = "delegation-settlement.json";
 function reqStr(v) {
@@ -495,25 +495,6 @@ export function readHolds(controlDir) {
 function sha256(buf) {
     return createHash("sha256").update(buf).digest("hex");
 }
-let stagingSeq = 0;
-function uniqueStagingName(holdId, now) {
-    stagingSeq += 1;
-    return `${holdId}.staging-${now()}-${process.pid}-${stagingSeq}`;
-}
-function stagingGenerationPattern(holdId) {
-    return new RegExp(`^${holdId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.staging-\\d+-\\d+-\\d+(?:\\.claim-\\d+-\\d+)*$`);
-}
-function claimStaging(stagingPath) {
-    stagingSeq += 1;
-    const claimed = `${stagingPath}.claim-${process.pid}-${stagingSeq}`;
-    try {
-        renameSync(stagingPath, claimed);
-        return claimed;
-    }
-    catch {
-        return stagingPath;
-    }
-}
 function dropStaging(claimedPath) {
     try {
         unlinkSync(claimedPath);
@@ -638,7 +619,7 @@ export function openInstructionHold(controlDir, input) {
     if (!writeCustodyVerified(join(holdDir, captureName), buf)) {
         return refuse("hold capture verification failed (the custody copy could not be written, made durable, or hashed back to the captured digest)", "capture_lost");
     }
-    const stagingName = uniqueStagingName(holdId, input.now);
+    const stagingName = mintStagingName(holdId, input.now);
     const stagingPath = stagingPathBeside(input.absPath, stagingName);
     try {
         renameSync(input.absPath, stagingPath);
@@ -695,7 +676,7 @@ export function reconcileHolds(controlDir, input) {
         }
     };
     const finishRemoval = (row, plane) => {
-        const stagingName = uniqueStagingName(row.holdId, input.now);
+        const stagingName = mintStagingName(row.holdId, input.now);
         renameSync(plane, stagingPathBeside(plane, stagingName));
         const staging = claimStaging(stagingPathBeside(plane, stagingName));
         if (sha256(readFileSync(staging)) === row.contentDigest) {
@@ -726,7 +707,14 @@ export function reconcileHolds(controlDir, input) {
     };
     const sweepStagingGenerations = (row, plane, custody) => {
         const seatDir = dirname(plane);
-        const pattern = stagingGenerationPattern(row.holdId);
+        const pattern = stagingNamePattern(row.holdId);
+        let seat;
+        try {
+            seat = lstatSync(plane);
+        }
+        catch {
+            seat = undefined;
+        }
         for (const name of listSeat(seatDir)) {
             if (!pattern.test(name))
                 continue;
@@ -746,7 +734,10 @@ export function reconcileHolds(controlDir, input) {
                     continue;
                 }
             }
-            discloseStranded(row.holdId, row.rel, retireStagingToCustody(staged, holdDir, name).at);
+            const onSeat = seat !== undefined && isSameFile(staged, seat);
+            const retired = retireStagingToCustody(staged, holdDir, name);
+            if (!(onSeat && retired.settled && isSameFile(plane, seat)))
+                discloseStranded(row.holdId, row.rel, retired.at);
         }
     };
     const rows = readHolds(controlDir).filter((r) => r.status === "capturing");

package/dist/core/memory-engine/distiller.js

@@ -1,7 +1,8 @@
 import { requireWriteGate } from "./consolidation-write-gate.js";
 import { readMember, thrownText } from "../thrown-value.js";
 import { assertServableRequestRoot, joinRequestUrl } from "../../brain/route-adjudicator.js";
-import { holdOwnCredentialValues } from "../secret-env.js";
+import { holdOwnCredentialValues, namesASecret } from "../secret-env.js";
+import { remoteWords } from "../protocol-http-auth.js";
 export const DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT = 32;
 const SIZE_CLAUSE = {
     "dl-2": "- the index should be as small as it can be made without losing either of the above.",
@@ -171,29 +172,37 @@ export function openAiCompatChatSeat(seat) {
     catch (e) {
         throw distillerConfigRefusal(thrownText(e), e);
     }
+    const declared = namesASecret(apiKey) ? [apiKey] : [];
     return async (req) => {
-        const res = await fetch(joinRequestUrl(requestRoot, "/chat/completions"), {
-            method: "POST",
-            headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
-            body: JSON.stringify({
-                model: seat.model,
-                messages: [
-                    { role: "system", content: req.system },
-                    { role: "user", content: req.user },
-                ],
-                temperature: req.temperature,
-                max_tokens: req.maxTokens,
-            }),
-        });
-        const text = await res.text();
+        let res;
+        let text;
+        try {
+            res = await fetch(joinRequestUrl(requestRoot, "/chat/completions"), {
+                method: "POST",
+                headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+                body: JSON.stringify({
+                    model: seat.model,
+                    messages: [
+                        { role: "system", content: req.system },
+                        { role: "user", content: req.user },
+                    ],
+                    temperature: req.temperature,
+                    max_tokens: req.maxTokens,
+                }),
+            });
+            text = await res.text();
+        }
+        catch (e) {
+            throw new Error(`model call failed: ${remoteWords(thrownText(e), declared)}`);
+        }
         if (!res.ok)
-            throw new Error(`model call failed ${res.status}: ${text.slice(0, 400)}`);
+            throw new Error(`model call failed ${res.status}: ${remoteWords(text, declared).slice(0, 400)}`);
         let body;
         try {
             body = JSON.parse(text);
         }
         catch {
-            throw new Error(`model returned non-JSON envelope: ${text.slice(0, 400)}`);
+            throw new Error(`model returned non-JSON envelope: ${remoteWords(text, declared).slice(0, 400)}`);
         }
         return {
             content: body.choices?.[0]?.message?.content ?? "",

package/dist/core/memory-engine/engine.js

@@ -19,7 +19,7 @@ import { landedUndecided, layerDigest, layerObservationLookup, readOnlyLayerCand
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
-import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, anchorStoreRoot, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, adoptRootScopeLayout, clearScanFuse, effectiveControlRootOf, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
+import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, mintStagingName, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, anchorStoreRoot, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, adoptRootScopeLayout, clearScanFuse, effectiveControlRootOf, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, writeFileNoReplace, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
 import { createSessionIncarnationSeat, recalledForAnyIdentity, recalledForIdentity, rememberForIdentity } from "./session-incarnation.js";
 import { scanMemoryFileName, scanMemoryWrite, scanRemediation } from "./scan.js";
 import { writableRootOf } from "./types.js";
@@ -1516,7 +1516,7 @@ export class MemoryEngine {
                                     }
                                     let restoredCommitted = false;
                                     if (captured) {
-                                        const stagingName = `${captureName}.staging`;
+                                        const stagingName = mintStagingName(captureName, this.now);
                                         const stagingPath = stagingPathBeside(canonical, stagingName);
                                         try {
                                             this.refuseOutsideStore(canonical, "containing session residue");
@@ -2475,8 +2475,8 @@ export class MemoryEngine {
                         if (committed !== undefined) {
                             try {
                                 this.refuseOutsideStore(f.canonical, "restoring a held entry's committed content", handle);
-                                writeFileNoFollow(f.canonical, committed);
-                                report.restored.push(rel);
+                                if (writeFileNoReplace(f.canonical, committed) === "written")
+                                    report.restored.push(rel);
                             }
                             catch (err) {
                                 report.warnings.push(`${rel}: the committed content could not be restored after the hold captured this session's edit — the entry is unavailable on the plane until release or the next restore: ${this.writeFailureText(err)}`);