@sema-agent/server 7.129.0 → 7.130.0

package/dist/plugins/remote-env-host.js

@@ -6,6 +6,7 @@ import { randomBytes } from "node:crypto";
 import { openSync, closeSync, readSync, statSync, truncateSync, unlinkSync, mkdirSync, rmdirSync, mkdtempSync, existsSync, realpathSync, accessSync, constants as FS_CONST } from "node:fs";
 import { StringDecoder } from "node:string_decoder";
 import { armPipeDestroyGrace, numEnvOr, SYMLINK_CHAIN_MAX_HOPS } from "./remote-shell.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
 import { IS_WIN32, resolveHostShell, hostShell, pinHostShell, spawnGroupOptions, killTreeHard, killTreeSoft, hardKillGroupNow, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
@@ -810,8 +811,9 @@ export class RemoteHostExecutionEnv {
         if (!ready.ok)
             throw new RemoteExecutionError("connect_failed", ready.error.message, ready.error);
         const cwd = this.resolve(options?.cwd ?? this.cwd);
-        const timeoutMs = options?.timeout != null ? options.timeout * 1000 : undefined;
-        const idleMs = options?.readTimeoutMs;
+        const bounds = commandBoundsOf({ timeoutMs: options?.timeout != null ? options.timeout * 1000 : undefined, readTimeoutMs: options?.readTimeoutMs }, undefined);
+        const timeoutMs = bounds.wallMs;
+        const liveness = bounds.liveness;
         const cap = options?.maxOutputBytes;
         const queue = [];
         let finished = false;
@@ -905,7 +907,7 @@ export class RemoteHostExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs != null ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => { wake = r; waitTimer = setTimeout(r, waitMs); });
@@ -914,10 +916,10 @@ export class RemoteHostExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs != null && !finished && Date.now() - lastChunk >= idleMs) {
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms) {
                     finished = true;
                     kill();
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (command hang)`);
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
                 }
             }
             while (queue.length)

package/dist/plugins/remote-env-k8s.d.ts

@@ -38,7 +38,9 @@ export interface K8sEnvConfig {
     readyTimeoutMs?: number;
     /** Control-plane RPC wall-clock (pod create/get/delete). */
     rpcTimeoutMs?: number;
-    /** Zero-progress liveness bound for commands (no output AND not finished ⇒ hang). */
+    /** The lane's zero-progress liveness bound (env `K8S_LIVENESS_MS`; default {@link LIVENESS_MS_DEFAULT}): a command that
+     *  produces no output for this long and has not finished is cut as a hang — ONLY when its caller stated neither a wall-clock
+     *  (`timeout`) nor its own idle bound (`readTimeoutMs`); a stated bound replaces it (the rule: `exec-bounds.ts`). */
     livenessMs?: number;
     /** The ONE data bound (`WORKSPACE_SNAPSHOT_TIMEOUT_MS`; default = `WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT`, owned by
      *  `workspace-space.ts`): the snapshot upload's and restore's wall-clock, the deadline this replica's commits write into
@@ -257,6 +259,8 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     /** The known occupant's incarnation (`undefined` = this run has no known occupant: a delegated child, an unread session, a direct construction) — the
      *  ownership mark of every snapshot id this env mints, both lanes ({@link mintSnapshotId}); the space lane's partition is the same reading. */
     private readonly occupantIncarnation;
+    /** This lane's own liveness bound — what {@link commandBoundsOf} falls back to when a command's caller stated no bound. */
+    private readonly laneLiveness;
     /** This env's space lane (resolved once from the policy + the occupant's incarnation; see {@link SpaceLane}). */
     private readonly spaceLane;
     /** `workspace_space_unavailable` is said once per env. */
@@ -551,8 +555,10 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     private execUrl;
     /**
      * Run a command over the exec WebSocket. Frames: byte0=channel (1 stdout / 2 stderr / 3 status JSON with the
-     * REAL exit code). Bounds: caller wall-clock (explicit `timeout`) + zero-progress liveness (`livenessMs`) —
-     * a socket killed by either does NOT kill the remote process (disposable-pod posture, see header).
+     * REAL exit code). Bounds = {@link commandBoundsOf} over what the caller stated (`timeoutMs` wall / `readTimeoutMs` idle)
+     * and this lane's liveness — the one rule, decided here and nowhere else on this lane — plus the adapter's own ceiling
+     * `capMs` (a data bound, not a statement: it never turns the liveness bound off). A socket killed by any bound does NOT
+     * kill the remote process (disposable-pod posture, see header).
      */
     private runExec;
     exec(command: string, options?: ExecOpts): Promise<Result<{
@@ -654,7 +660,9 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
         suffix?: string;
         abortSignal?: AbortSignal;
     }): Promise<Result<string, FileError>>;
-    /** exec with the data-transfer bound (large reads/writes legitimately run longer than a control op). */
+    /** exec with the data-transfer ceiling (large reads/writes legitimately run longer than a control op). The engine states no
+     *  bound for a file op, so the lane liveness bound stays on (a stalled transfer is cut by it); the data bound is this
+     *  adapter's own ceiling (`capMs`), not a statement. */
     private execData;
     /** 本腿只定工作目录(缺省 cwd 规则 + 绝对化);串的形状归 {@link buildCwdEnvCommand} / {@link createCwdGuardedCall}(S-410:cwd 不可用 ⇒ 命令不跑;
      *  车PL:buffered `exec` 上守卫触发 ⇒ `spawn_error`)。 */

package/dist/plugins/remote-env-k8s.js

@@ -11,6 +11,7 @@ import { spaceCommitAlive } from "../workspace-space-commit.js";
 import { incarnationLogPrefix, redactIncarnations } from "../session-incarnation.js";
 import { WORKSPACE_CACHE_SPACE_LABEL, workspaceCacheClaimOf, workspaceCacheEnv } from "../workspace-cache.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { commandBoundsOf, laneLivenessOf, livenessCutMessage, LIVENESS_MS_DEFAULT } from "../exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, sandboxEgressGaps, sandboxPodSysctls } from "../sandbox-egress-policy.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
@@ -141,6 +142,7 @@ export class RemoteK8sExecutionEnv {
     cfg;
     deps;
     occupantIncarnation;
+    laneLiveness;
     spaceLane;
     spaceUnavailableSaid = false;
     unreadableOccupantSaid = false;
@@ -161,7 +163,7 @@ export class RemoteK8sExecutionEnv {
             timeoutMs: config.timeoutMs ?? 30 * 60_000,
             readyTimeoutMs: config.readyTimeoutMs ?? 120_000,
             rpcTimeoutMs: config.rpcTimeoutMs ?? 30_000,
-            livenessMs: config.livenessMs ?? 120_000,
+            livenessMs: config.livenessMs ?? LIVENESS_MS_DEFAULT,
             dataTimeoutMs: dataTimeoutMsOf(config),
             cpu: config.cpu ?? "1",
             memory: config.memory ?? "2Gi",
@@ -176,6 +178,7 @@ export class RemoteK8sExecutionEnv {
         this.cwd = this.cfg.mountPath;
         this.homeDir = config.homeDir;
         this.deps = deps ?? {};
+        this.laneLiveness = laneLivenessOf(this.cfg.livenessMs, "K8S_LIVENESS_MS");
         const occupant = occupantKeyOf(config.spaceOccupant);
         this.occupantIncarnation = "incarnation" in occupant ? occupant.incarnation : undefined;
         this.spaceLane = spaceLaneOf(config.s3Snapshot?.space, config.spaceOccupant);
@@ -875,7 +878,7 @@ export class RemoteK8sExecutionEnv {
         const excludes = (this.cfg.snapshotExclude ?? []).map((item) => ` --exclude=${shellQuote(`./${item}`)}`).join("");
         const cmd = `tar czf ${tmp}${excludes} -C ${shellQuote(this.cfg.mountPath)} . && curl -fsS -X PUT -T ${tmp} ${shellQuote(url)}; ` +
             `rc=$?; rm -f ${tmp}; exit $rc`;
-        const r = await this.runExec(cmd, { timeoutMs: this.cfg.dataTimeoutMs, livenessMs: 0 });
+        const r = await this.runExec(cmd, { timeoutMs: this.cfg.dataTimeoutMs });
         if (!r.ok)
             return { ok: false, error: new RemoteExecutionError("connect_failed", `workspace snapshot upload failed: ${this.redactUrl(r.error.message, url)}`, r.error) };
         if (r.value.exitCode !== 0)
@@ -911,7 +914,7 @@ export class RemoteK8sExecutionEnv {
             const c = await this.provision(abortSignal);
             if (!c.ok)
                 return c;
-            const r = await this.runExec(cmd, { timeoutMs: this.cfg.dataTimeoutMs, livenessMs: 0 });
+            const r = await this.runExec(cmd, { timeoutMs: this.cfg.dataTimeoutMs });
             const failure = !r.ok
                 ? { cls: r.error.code === "timeout" ? "timeout" : "transport", detail: `workspace snapshot restore failed: ${this.redactUrl(r.error.message, url)}`, cause: r.error }
                 : r.value.exitCode !== 0
@@ -1127,20 +1130,22 @@ export class RemoteK8sExecutionEnv {
                 }
                 resolvePromise(r);
             };
-            const wallMs = opts?.timeoutMs;
-            const wallTimer = wallMs ? setTimeout(() => finish({ ok: false, error: new ExecutionError("timeout", `command exceeded ${wallMs}ms`) }), wallMs) : undefined;
+            const bounds = commandBoundsOf({ timeoutMs: opts?.timeoutMs, readTimeoutMs: opts?.readTimeoutMs }, this.laneLiveness);
+            const capMs = opts?.capMs;
+            const wallMs = bounds.wallMs === undefined ? capMs : capMs === undefined ? bounds.wallMs : Math.min(bounds.wallMs, capMs);
+            const wallTimer = wallMs !== undefined ? setTimeout(() => finish({ ok: false, error: new ExecutionError("timeout", `command exceeded ${wallMs}ms`) }), wallMs) : undefined;
             let livenessTimer;
-            const livenessMs = opts?.livenessMs ?? this.cfg.livenessMs;
+            const liveness = bounds.liveness;
             const armLiveness = () => {
-                if (livenessMs <= 0)
+                if (liveness === undefined)
                     return;
                 clearTimeout(livenessTimer);
                 const idle = Date.now() - lastProgress;
-                if (idle >= livenessMs) {
-                    finish({ ok: false, error: new ExecutionError("timeout", `no output for ${idle}ms (exec liveness) — suspected hang`) });
+                if (idle >= liveness.ms) {
+                    finish({ ok: false, error: new ExecutionError("timeout", livenessCutMessage(liveness)) });
                     return;
                 }
-                livenessTimer = setTimeout(armLiveness, livenessMs - idle);
+                livenessTimer = setTimeout(armLiveness, liveness.ms - idle);
             };
             armLiveness();
             const onAbort = () => finish({ ok: false, error: new ExecutionError("aborted", "command aborted") });
@@ -1343,22 +1348,20 @@ export class RemoteK8sExecutionEnv {
             wake = undefined;
             w?.();
         };
-        let lastChunk = Date.now();
-        const idleMs = options?.readTimeoutMs ?? this.cfg.livenessMs;
         const cap = options?.maxOutputBytes;
         let bytes = 0;
         const ac = new AbortController();
         const signal = options?.signal ? AbortSignal.any([options.signal, ac.signal]) : ac.signal;
         const done = this.runExec(buildCwdEnvCommand(command, this.workingDirOf(options?.cwd), options?.env, "raw").command, {
             signal,
+            timeoutMs: options?.timeout != null ? options.timeout * 1000 : undefined,
+            readTimeoutMs: options?.readTimeoutMs,
             boundOutput: true,
             onStdout: (d) => {
-                lastChunk = Date.now();
                 queue.push({ type: "stdout", data: d });
                 signalReady();
             },
             onStderr: (d) => {
-                lastChunk = Date.now();
                 queue.push({ type: "stderr", data: d });
                 signalReady();
             },
@@ -1395,21 +1398,9 @@ export class RemoteK8sExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = Math.max(1, idleMs - (Date.now() - lastChunk));
-                let waitTimer;
-                try {
-                    await new Promise((r) => {
-                        wake = r;
-                        waitTimer = setTimeout(r, Math.min(waitMs, 30_000));
-                    });
-                }
-                finally {
-                    if (waitTimer !== undefined)
-                        clearTimeout(waitTimer);
-                }
-                if (!finished && Date.now() - lastChunk >= idleMs) {
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (suspected hang)`);
-                }
+                await new Promise((r) => {
+                    wake = r;
+                });
             }
             while (queue.length)
                 yield queue.shift();
@@ -1428,7 +1419,7 @@ export class RemoteK8sExecutionEnv {
     }
     makeBgDriver() {
         const self = this;
-        const bgExec = (script, boundOutput) => self.runExec(script, { timeoutMs: self.cfg.rpcTimeoutMs, livenessMs: self.cfg.livenessMs, boundOutput });
+        const bgExec = (script, boundOutput) => self.runExec(script, { timeoutMs: self.cfg.rpcTimeoutMs, boundOutput });
         return {
             async launch(command, options, ctx) {
                 const conn = await self.ensureConnected();
@@ -1628,7 +1619,7 @@ export class RemoteK8sExecutionEnv {
         const c = await this.ensureConnected();
         if (!c.ok)
             return c;
-        return this.runExec(command, { signal: abortSignal, timeoutMs: this.cfg.dataTimeoutMs });
+        return this.runExec(command, { signal: abortSignal, capMs: this.cfg.dataTimeoutMs });
     }
     workingDirOf(cwd) {
         const dir = cwd ?? this.cwd;

package/dist/plugins/remote-env-local-docker.js

@@ -5,6 +5,7 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -188,7 +189,7 @@ export class RemoteLocalDockerExecutionEnv {
         let paused = false;
         let wake;
         const signalReady = () => { const w = wake; wake = undefined; w?.(); };
-        const idleMs = options?.readTimeoutMs;
+        const liveness = commandBoundsOf({ readTimeoutMs: options?.readTimeoutMs }, undefined).liveness;
         const cap = options?.maxOutputBytes;
         let onAbort;
         const enqueue = (type, data) => {
@@ -270,7 +271,7 @@ export class RemoteLocalDockerExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs != null ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => { wake = r; waitTimer = setTimeout(r, waitMs); });
@@ -279,13 +280,13 @@ export class RemoteLocalDockerExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs != null && !finished && Date.now() - lastChunk >= idleMs) {
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms) {
                     finished = true;
                     try {
                         child.kill("SIGKILL");
                     }
                     catch { }
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (command hang)`);
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
                 }
             }
             while (queue.length)

package/dist/plugins/remote-env-ssh.js

@@ -3,6 +3,7 @@ import { Client } from "ssh2";
 import { createSshHostKeyVerifier } from "../ssh-host-key.js";
 import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
@@ -335,7 +336,7 @@ export class RemoteSshExecutionEnv {
             w?.();
         };
         let lastChunk = Date.now();
-        const idleMs = options?.readTimeoutMs;
+        const liveness = commandBoundsOf({ readTimeoutMs: options?.readTimeoutMs }, undefined).liveness;
         let streamRef;
         let onAbort;
         let paused = false;
@@ -422,7 +423,7 @@ export class RemoteSshExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => {
@@ -434,8 +435,8 @@ export class RemoteSshExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs && !finished && Date.now() - lastChunk >= idleMs)
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (provider hang / unreachable host)`);
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms)
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
             }
             while (queue.length)
                 yield queue.shift();

package/dist/runtime-caps-resolver.d.ts

@@ -175,6 +175,13 @@ export interface PrincipalEntitlementsClient {
      *  FAIL-OPEN on error / older center without scenario keys / no principal (undefined = no governance, legacy passthrough).
      *  Scenario switching is not a privilege-amplifying face; a center blip must not pin users to `default`. */
     scenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
+    /**
+     * {@link PrincipalEntitlementsClient.scenarioRuling} 的**只读**孪生(同 {@link PrincipalEntitlementsClient.peekRuntimeCaps} 的界):同一只缓存 / 同一条抓取 /
+     * 同一份 fail-open 判决(`undefined` = 无治理),唯一的差别是 center 硬失败时本腿铸的 fail-closed 降级项**只对读面自己算数**,提交腿不认、照常重抓。
+     * 读面(`GET /v1/capabilities/mcp?scenario=` 的场景门)问中心裁定时必须走这一只 —— 经 `scenarioRuling` 问,center 抖动的那一拍会替这个主体的**真提交**
+     * 留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面成了别人被拒的原因,与 `peekRuntimeCaps` 的病灶同一类)。
+     */
+    peekScenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
     /** (stage7 P5) The resolved per-principal execution-lane ruling for resolveSpec's
      *  gateExecutionLane. FAIL-OPEN + audit on error (this phase is "honest-but-bypassable";
      *  tightening to fail-closed is a future, separate decision) / older center without the execution key / no principal. */

package/dist/runtime-caps-resolver.js

@@ -167,6 +167,7 @@ export function createPrincipalEntitlementsClient(opts) {
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
         peekRuntimeCaps: async (principal) => (principal ? (await load(principal, false)).caps : undefined),
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
+        peekScenarioRuling: async (principal) => (principal ? (await load(principal, false)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
 }

package/dist/session-titler.d.ts

@@ -14,10 +14,12 @@
  * main model; bounded + timed out).
  *
  * FAILURE POSTURE: everything is best-effort — a generation/store failure logs and leaves title null (the
- * list falls back to objectivePreview). An in-process pending set dedupes concurrent submits on the same
+ * list falls back to objectivePreview). The fail-open tag it leaves names the CAUSE FAMILY (one tag, one family):
+ * the llm face's failure CODE picks it (`failOpenTagFor`), never the error's wording. An in-process pending set dedupes concurrent submits on the same
  * session; the store's IS NULL guard closes the cross-replica race (double generation costs one extra cheap
  * call at worst, and exactly one title lands).
  */
+import type { HookLlmFailureCode } from "./hooks/hook-runner.js";
 export interface SessionTitlerDeps {
     /** Secret scrub applied to the RAW llm text before sanitize/persist (workflow audit 2026-07-13: the
      *  objective may carry a pasted secret and the model can echo it into the title — titles are persisted,
@@ -42,6 +44,7 @@ export interface SessionTitlerDeps {
     } | {
         ok: false;
         error: string;
+        code?: HookLlmFailureCode;
     }>;
     logger?: {
         debug?(msg: string, meta?: unknown): void;

package/dist/session-titler.js

@@ -8,6 +8,16 @@ const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
 const FAIL_CAUSE_KEY_CHARS = 80;
 const SEEN_CAP = 10_000;
+function failOpenTagFor(code) {
+    switch (code) {
+        case "redirect_refused":
+            return "server.session-titler.redirect-refused";
+        case "no_content":
+        case "hard_timeout":
+        case undefined:
+            return "server.session-titler.gateway-unreachable";
+    }
+}
 export function sanitizeTitle(raw) {
     const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
@@ -25,10 +35,10 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const logFailure = (sessionId, error) => {
+    const logFailure = (sessionId, error, code) => {
         const safe = redactSecrets(error);
         deps.logger?.debug?.("session_title_failed", { sessionId, error: safe.slice(0, 200) });
-        recordFailOpen("server.session-titler.gateway-unreachable", safe.slice(0, FAIL_CAUSE_KEY_CHARS));
+        recordFailOpen(failOpenTagFor(code), safe.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
     const probeOrContinue = async (sessionId, continueWord) => deps
         .probeTitle(sessionId)
@@ -65,7 +75,7 @@ export function createSessionTitler(deps) {
                 const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS, model });
                 if (!r.ok) {
                     deps.metrics?.inc("session_title_total", { outcome: "llm_failed" });
-                    logFailure(sessionId, r.error);
+                    logFailure(sessionId, r.error, r.code);
                     return;
                 }
                 const title = sanitizeTitle(deps.redact ? deps.redact(r.text) : r.text);

package/dist/stored-request-tool-axes-m19.d.ts

@@ -0,0 +1,29 @@
+/**
+ * 一次性迁移 M19 —— 续跑重放腿上,升级前存下的请求体里引擎判官判不过的 `mcpServers[].toolAxes`,窗内按升级前的读法重读一次。
+ * 🔴 M19 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 请求腿读 `toolAxes` 的判官是引擎根导出的 `readMcpToolAxes`(整份一坏全拒、不默认)。升级前的请求腿读者是另一种读法:不是对象(含 `null`)⇒ 整键忽略、
+ * server 照挂;是对象 ⇒ 逐成员判形,过不了形的成员剔掉、好的留下。续跑重放腿重放的是**升级前存下的**请求体(`checkpoint_ctx` 里那一份),那时这台 server
+ * 是挂着的 —— 一条停驻在它某只工具审批上的任务,升级后若这台 server 整条不进,批准即撞引擎的 `resume.tool_unavailable`、检查点重开、每次重试重放同一份体
+ * ⇒ 永远批不过去。持久数据面不能「翻红」,所以给它一次性迁移:窗开着时,续跑重放腿把判官判不过的那一格按升级前的读法重读一次,产物**再交同一只判官**
+ * (不过 ⇒ 原臂:整条不进);真挂上的这类 server 由请求腿说一行运维 warn `mcp_tool_axes_read_as_before_upgrade`。窗关之后回到今天的读法,删码零行为变化。
+ *
+ * ## 可达面(结构上只在续跑重放腿)
+ *  · 本模块的值只被 `boot/resolve-spec.ts` 引用一处,挂在 `opts.leg` 不是 `"fresh"` 的那一臂(续跑家族经 `http/resume-legs.ts` 的 `resolveResumeSpec`
+ *    递 `leg: "resume"`);新提交腿递 `"fresh"` 拿不到重读座,且在腿首已经被同一只判官 400 掉(`assertRequestMcpToolAxes`),读器根本见不到坏形;
+ *  · 请求腿(`task-mcp.ts`)只 import 本模块的**型**:重读座是 `resolveRequestMcp` 的一个形参,没人递就没有;探测口(`validateRequestMcp`)没有这个形参;
+ *  · 部署腿(`web-admin-client/skills-mcp.ts` 的 `resolveMcpServers`)是另一只铸 spec 处,不读本模块。
+ * 机器锚:`test/mcp-tool-axes-m19.test.ts` 的结构格。
+ */
+import type { McpServerSpec } from "@sema-agent/core";
+type ToolAxes = NonNullable<McpServerSpec["toolAxes"]>;
+/** 重读座:一份原始 `toolAxes` 声明 → 升级前的读法读出的那一份(`undefined` = 升级前读成「没声明」)。产物由调用方再交引擎判官。 */
+export type StoredToolAxesRereadM19 = (declared: unknown) => ToolAxes | undefined;
+/**
+ * 此刻(`today` = UTC 日历日 YYYY-MM-DD)M19 的窗开着 ⇒ 交回重读座;关了 ⇒ `undefined`(今天的读法)。窗只读登记表 M19 那一行
+ * (`migrationWindowOpen`,与 M10 的认领窗同一只判据)。登记表里没有 M19 ⇒ 响亮抛:重读臂活过了它的登记行,该随那一行一起删。
+ */
+export declare function storedToolAxesRereadM19(today: string): StoredToolAxesRereadM19 | undefined;
+export {};
+//# sourceMappingURL=stored-request-tool-axes-m19.d.ts.map

package/dist/stored-request-tool-axes-m19.js

@@ -0,0 +1,27 @@
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
+function readToolAxesAsServer7129M19(declared) {
+    if (!declared || typeof declared !== "object" || Array.isArray(declared))
+        return undefined;
+    const axes = {};
+    for (const [tool, ax] of Object.entries(declared)) {
+        if (!ax || typeof ax !== "object" || Array.isArray(ax))
+            continue;
+        const a = ax;
+        const entry = {
+            ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
+            ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
+            ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
+        };
+        if (Object.keys(entry).length > 0)
+            axes[tool] = entry;
+    }
+    return Object.keys(axes).length > 0 ? axes : undefined;
+}
+export function storedToolAxesRereadM19(today) {
+    const window = ONE_TIME_MIGRATIONS.find((w) => w.id === "M19");
+    if (window === undefined)
+        throw new Error("stored-request-tool-axes-m19: the one-time migration registry has no M19 row (the replay-leg toolAxes re-read window) — the re-read arm outlived its registry row; delete it with that row");
+    return migrationWindowOpen(window, today) ? readToolAxesAsServer7129M19 : undefined;
+}
+//# sourceMappingURL=stored-request-tool-axes-m19.js.map

package/dist/task-mcp.d.ts

@@ -24,6 +24,7 @@
  */
 import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 import { type McpIdentityHeadersIssue, type RequestMcpServerSpec } from "./mcp-assertion-header.js";
+import type { StoredToolAxesRereadM19 } from "./stored-request-tool-axes-m19.js";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
 /**
@@ -114,6 +115,7 @@ export interface McpInjectionDropSeat {
  * Shape-check the raw `body.mcpServers`. `null` → a non-array (caller error; the route may 400). Otherwise the
  * valid subset + the names of dropped (malformed/over-cap) entries + [ref]'s `badContentOrigin`
  * (**降级**掉的内容出处声明,与 `dropped` 是两回事:那条 server **留着**,丢的只是它的声明)。
+ * 这一口没有 M19 的重读座(探测口与单测读到的 `toolAxes` 恒是判官的读数);重读只在续跑重放腿经 {@link resolveRequestMcp} 发生。
  */
 export declare function validateRequestMcp(raw: unknown): ValidatedRequestMcp | null;
 type ValidatedRequestMcp = {
@@ -208,6 +210,32 @@ export declare function requestEntryIdentityRefusal(entry: unknown): {
     errorCode: "request.body_shape" | "request.field_invalid";
     message: string;
 } | undefined;
+/**
+ * S-1604 —— `mcpServers[].toolAxes` 的**值域门**(fresh 腿限定,同步 400):判官是引擎根导出的 `readMcpToolAxes`(与部署腿铸 spec 处同一只),
+ * 判出 `ok:false` ⇒ `400 request.field_invalid`,点名 `mcpServers[i].toolAxes`、server 名与引擎的原因句(点名工具与成员,不带值)。
+ *
+ * ## 为什么拒而不是剔
+ * `toolAxes` 是调用方对这台 server 每只工具的**双向**风险轴声明(能压低一只工具的效应让审批门放行,也能抬高)。静默剔掉坏成员 = 调用方拿到 2xx、
+ * 以为整份声明生效,实际只有另一半在力 —— 一份没有生效的信任根声明。引擎的读法本就是「整份一坏全拒、好的那几只也不留、什么都不默认」,
+ * 请求腿修前自铸的读者与它相反;从此只有一只判官,两条腿同读。
+ *
+ * ## 位置与 leg 分流(与 {@link assertRequestMcpContentOrigin} / {@link assertRequestMcpIdentityHeaders} 同款理由,不发明第二套)
+ * 排在腿首、任何副作用之前;**只在 fresh 腿**:`checkpoint_ctx` 存的是原始 `TaskRequestBody`,耐久 resume 逐字重放它,从这里逃出去的 `HttpError`
+ * 会被折成 `409 resume_blocked_by_policy`,把一条升级前 park 的任务永久砖死。resume 腿走读器({@link normalizeServer}):同一只判官判出坏形 ⇒ 这一条 server
+ * 不进 + `malformed_entry` 点名(运维 warn + 用户面通告,不抛);一次性迁移 M19 的窗开着时先按升级前读法重读一次(见那只读器的注)。
+ * 判据是纯值域、与租户车道无关(多租户腿本来就忽略整只数组,告诉调用方「你这条写错了」只多不少)。
+ * 探测口读同一只 {@link requestEntryToolAxesRefusal},同一句拒。
+ */
+export declare function assertRequestMcpToolAxes(bodyMcp: unknown): void;
+/**
+ * 一条**原始**请求条目上 `toolAxes` 的拒面(码 + 句子);没有问题 / 条目不是对象 / 没写 `toolAxes` ⇒ `undefined`。提交腿的门({@link assertRequestMcpToolAxes})与探测口
+ * (`mcp-probe.ts` 的 `entryValueIssue`)两扇拒绝门同读这一只,所以两处是**同一句**。判官是引擎的 `readMcpToolAxes`,句子里的原因句逐字取它的 `problem`
+ * (只剥控制与双向字符:工具名是调用方写的);不回显值 —— 引擎的句子点名工具与成员、不带值。`at` = 条目的键路径(`mcpServers[3]`)。
+ */
+export declare function requestEntryToolAxesRefusal(entry: unknown, at: string): {
+    errorCode: "request.field_invalid";
+    message: string;
+} | undefined;
 /**
  * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
  * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
@@ -247,6 +275,9 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
 /** L-167:本条腿的**用户面**投递口。`sessionId` = 通告的路由半场(缺席 ⇒ 一条都不铸,见
  *  {@link mintInjectionDropNotices});`emit` 收下 core 铸好的通告,由调用腿决定投到哪(见 `boot/resolve-spec.ts`)。
  *  整段缺席(桩、单测、非 HTTP 腿)⇒ 只走日志终点,行为逐字与本件之前相同。 */
-notice?: McpInjectionDropSeat): McpServerSpec[] | undefined;
+notice?: McpInjectionDropSeat, 
+/** 一次性迁移 M19 的重读座(窗口见 `plugins/one-time-migrations.ts` 登记表):只在续跑重放腿、只在窗开着时由 `boot/resolve-spec.ts` 递进来;
+ *  缺席(新提交腿 / 窗关 / 桩)⇒ 判官判不过的 `toolAxes` 照原臂整条不进。 */
+storedToolAxes?: StoredToolAxesRereadM19): McpServerSpec[] | undefined;
 export {};
 //# sourceMappingURL=task-mcp.d.ts.map