@sema-agent/server 7.129.0 → 7.130.0

package/dist/task-mcp.js

@@ -1,4 +1,4 @@
-import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, readMcpToolAxes, resolveComplianceDenies } from "@sema-agent/core";
 import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError, createCodedHttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
@@ -6,8 +6,8 @@ import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } f
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { declaresMcpAssertionHeader, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, readMcpIdentityHeaders, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
 import { echoKeyName } from "./request-key-closure.js";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
-import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
@@ -34,7 +34,7 @@ function declaredName(e) {
         ? String(e.name)
         : MALFORMED_NAME;
 }
-function normalizeServer(e, noteBadOrigin) {
+function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     if (!e || typeof e !== "object")
         return bad("entry");
     const o = e;
@@ -76,23 +76,20 @@ function normalizeServer(e, noteBadOrigin) {
     }
     if (typeof o.elicitation === "boolean")
         spec.elicitation = o.elicitation;
-    if (o.toolAxes && typeof o.toolAxes === "object" && !Array.isArray(o.toolAxes)) {
-        const axes = {};
-        for (const [tool, ax] of Object.entries(o.toolAxes)) {
-            if (!ax || typeof ax !== "object" || Array.isArray(ax))
-                continue;
-            const a = ax;
-            const entry = {
-                ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
-                ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
-                ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
-            };
-            if (Object.keys(entry).length > 0)
-                axes[tool] = entry;
+    const axes = readMcpToolAxes(o.toolAxes);
+    let judged = axes;
+    let toolAxesReread;
+    if (!axes.ok && storedToolAxes !== undefined) {
+        const again = readMcpToolAxes(storedToolAxes(o.toolAxes));
+        if (again.ok) {
+            judged = again;
+            toolAxesReread = axes.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "");
         }
-        if (Object.keys(axes).length > 0)
-            spec.toolAxes = axes;
     }
+    if (!judged.ok)
+        return bad("toolAxes");
+    if (judged.toolAxes !== undefined)
+        spec.toolAxes = judged.toolAxes;
     if (o.contentOrigin !== undefined) {
         if (isContentOriginWord(o.contentOrigin))
             spec.contentOrigin = o.contentOrigin;
@@ -105,29 +102,32 @@ function normalizeServer(e, noteBadOrigin) {
         return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
-    return { ok: true, spec };
+    return { ok: true, spec, ...(toolAxesReread !== undefined ? { toolAxesReread } : {}) };
 }
 export function validateRequestMcp(raw) {
-    if (raw === undefined || raw === null)
-        return validateRequestMcpEntries([]);
-    if (!Array.isArray(raw))
+    if (raw !== undefined && raw !== null && !Array.isArray(raw))
         return null;
-    return validateRequestMcpEntries(raw);
+    const { ok, dropped, droppedTotal, badContentOrigin } = validateRequestMcpEntries(Array.isArray(raw) ? raw : []);
+    return { ok, dropped, droppedTotal, badContentOrigin };
 }
-function validateRequestMcpEntries(raw) {
+function validateRequestMcpEntries(raw, storedToolAxes) {
     const ok = [];
     const dropped = [];
     const badContentOrigin = [];
+    const toolAxesReread = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
-        const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }));
-        if (v.ok)
+        const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }), storedToolAxes);
+        if (v.ok) {
             ok.push(v.spec);
+            if (v.toolAxesReread !== undefined)
+                toolAxesReread.push({ server: v.spec.name, problem: v.toolAxesReread });
+        }
         else
             dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
     for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
         dropped.push({ server: declaredName(e), reason: "over_cap" });
-    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin };
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread };
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -180,6 +180,29 @@ export function requestEntryIdentityRefusal(entry) {
     const value = (entry.transport).assertionHeader;
     return { errorCode: "request.field_invalid", message: describeMcpAssertionHeaderNotAString(name, value) };
 }
+export function assertRequestMcpToolAxes(bodyMcp) {
+    if (!Array.isArray(bodyMcp))
+        return;
+    for (let i = 0; i < bodyMcp.length; i++) {
+        const refusal = requestEntryToolAxesRefusal(bodyMcp[i], `mcpServers[${i}]`);
+        if (refusal !== undefined)
+            throw createCodedHttpError(400, refusal.errorCode, refusal.message);
+    }
+}
+export function requestEntryToolAxesRefusal(entry, at) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+        return undefined;
+    const read = readMcpToolAxes(entry.toolAxes);
+    if (read.ok)
+        return undefined;
+    const server = echoKeyName("", declaredName(entry));
+    return {
+        errorCode: "request.field_invalid",
+        message: `${at}.toolAxes (server "${server}") is not a usable declaration — ${read.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "")}. ` +
+            `The whole declaration is refused: the tools that were fine are not kept and nothing is defaulted, because a toolAxes declaration is your own risk-axis judgement for this server's tools ` +
+            `(it can move a tool down or up), and a half-applied one would silently differ from what you declared. Fix the entry, or omit the key to declare nothing.`,
+    };
+}
 export function deploymentClosedMcpNames(baseline, reservedNames) {
     return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
 }
@@ -190,20 +213,20 @@ export function mergeRequestMcp(baseline, gated, reservedNames) {
     const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
-export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice) {
+export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice, storedToolAxes) {
     if (bodyMcp === undefined || bodyMcp === null)
         return baseline;
-    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger);
+    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes);
     mintInjectionDropNotices(drops, notice);
     return mcp;
 }
-function classifyRequestMcp(baseline, bodyMcp, config, logger) {
+function classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes) {
     if (bodyMcp !== undefined && bodyMcp !== null && !Array.isArray(bodyMcp)) {
         logger?.warn("mcp_injection_ignored", { reason: "mcpServers not an array" });
         return { mcp: baseline, drops: [] };
     }
     const entries = Array.isArray(bodyMcp) ? bodyMcp : [];
-    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger) : classifyGateClosed(baseline, entries);
+    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger, storedToolAxes) : classifyGateClosed(baseline, entries);
     if (outcome.drops.length > 0)
         logger?.warn("mcp_injection_dropped", { dropped: outcome.drops, droppedTotal: outcome.droppedTotal });
     return { mcp: outcome.mcp, drops: outcome.drops };
@@ -215,8 +238,8 @@ function classifyGateClosed(baseline, entries) {
         droppedTotal: entries.length,
     };
 }
-function classifyHonored(baseline, entries, config, logger) {
-    const v = validateRequestMcpEntries(entries);
+function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
+    const v = validateRequestMcpEntries(entries, storedToolAxes);
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
             entries: v.badContentOrigin,
@@ -236,6 +259,16 @@ function classifyHonored(baseline, entries, config, logger) {
         if (issue !== undefined && mounted.has(declaredName(e)))
             noteMcpAssertionHeaderIgnored(logger, declaredName(e), issue);
     }
+    for (const r of v.toolAxesReread) {
+        if (!mounted.has(r.server))
+            continue;
+        logger?.warn("mcp_tool_axes_read_as_before_upgrade", {
+            server: r.server,
+            migration: "M19",
+            problem: r.problem,
+            note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
+        });
+    }
     return {
         mcp: mergeRequestMcp(baseline, v.ok.map(toCoreMcpServerSpec), reservedNames),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],

package/dist/tool-axis-words.d.ts

@@ -1,30 +1,27 @@
 /**
- * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词,**两面共用一份**。
+ * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词(读者:**A2A 请求腿**;以及一次性迁移 M19 的升级前读法 `stored-request-tool-axes-m19.ts`,随 M19 的登记行退役)。
  *
- * ## 病(修前)
- * `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构
- * (`effect` / `egress` / `irreversibility`),而两个**闭集词表**是**手抄的字面串**:四份字面量
- * (两文件 × 两个词轴),没有一份钉在 core 的型上。后果不是「今天判错了」,而是**判据比声明窄**这件事
- * 没有任何门看得见 —— core 哪天给 `ToolEffect` 加一个词(或把 `irreversibility` 的两词改成三词,它在
- * `AskOrigin` 那一面**已经**是 `never|maybe|always` 三词了),两条请求腿会把那个**合法**的新词
- * **静默剔除**(MCP 腿)或**整条 server 判假**(A2A 腿),而 tsc 一声不吭。
+ * ## 历史与现状
+ * 修前 `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构(`effect` / `egress` / `irreversibility`),两个**闭集词表**是手抄的字面串,
+ * 没有一份钉在 core 的型上;S-249 把词表收到本文件并**两向钉死在 core 的型上**(core 加词 ⇒ 正向门红;本表留了 core 已没有的词 ⇒ 反向门红),两条腿读同一只谓词。
  *
- * ## 修法
- * 词表留在本仓(运行期要它),但**两向钉死在 core 的型上**:core 加词 ⇒ 正向门红;本表留了一个 core
- * 已经没有的词 ⇒ 反向门红。两个面共用**同一只**谓词,于是「什么算一个合法的轴值」在本仓只有一个答案。
+ * 之后 MCP 面的 `toolAxes` 判官整个换给了**引擎**:core 7.51.2 起根导出 `readMcpToolAxes`(整份声明一坏全拒、不默认),部署腿(`web-admin-client/skills-mcp.ts`)
+ * 与请求腿(`task-mcp.ts`)都问它,本仓不再有 MCP 面的自铸读者、也不再 import 本文件的谓词。**A2A 面引擎没有对应的判官**(core 暂无 `readA2aToolAxes`),
+ * 所以 A2A 请求腿(`task-a2a.ts`)仍用本文件的谓词;引擎一旦给 A2A 也立一只判官,本文件随之退役。另一个读者是 M19 的迁移读者:续跑重放腿把升级前存下的
+ * `mcpServers[].toolAxes` 按升级前那只读者的读法重读一次(产物再交引擎的判官),那段读法当年就读本文件的谓词,逐字搬回;它不是 MCP 面的第二只判官。
  *
- * 🔴 **只管值域,不管处置**:两条腿对坏值的处置**刻意不同**(MCP = 丢这一键、留 server;A2A = 整条拒),
- * 判据与理由各写在各自的调用点。合并处置会抹掉那条真实的分歧(MCP 的 `toolAxes` 有 server-hint 腿可折,
- * A2A 收下的就是最终值),而分歧本身是裁定过的。
+ * 下面的同型钉(A2A 的轴型与 MCP 的轴型逐字同声明)仍有意义:A2A 的词表跟着引擎 MCP 面的轴型走,哪一边加词、改词,另一边在这里当场红。
+ *
+ * 🔴 **只管值域,不管处置**:A2A 腿对坏值的处置是整条拒(MCP 面是引擎判官的「整份全拒」;两面方向一致),M19 的迁移读者剔坏成员(升级前的读法),判据与理由写在各自的调用点。
  */
 import type { McpServerSpec, ToolEffect } from "@sema-agent/core";
-/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明两面逐字同声明。 */
+/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明 A2A 面与它逐字同声明。 */
 export type ToolAxisEntry = NonNullable<McpServerSpec["toolAxes"]>[string];
 /** 轴覆写上那个**两词**的不可逆档(⚠️ 与 `AskOrigin` 面的**三词** `never|maybe|always` 不是同一个词表:
  *  覆写面只收两极,`maybe` 是引擎按工具自己的声明定的,调用方说不出口)。 */
 export type ToolAxisIrreversibility = NonNullable<ToolAxisEntry["irreversibility"]>;
-/** 值是不是一个合法的 `effect` 词(两条请求腿共用)。 */
+/** 值是不是一个合法的 `effect` 词(A2A 请求腿与 M19 的迁移读者读它)。 */
 export declare function isToolEffect(v: unknown): v is ToolEffect;
-/** 值是不是一个合法的**覆写面** `irreversibility` 词(两条请求腿共用)。 */
+/** 值是不是一个合法的**覆写面** `irreversibility` 词(A2A 请求腿与 M19 的迁移读者读它)。 */
 export declare function isToolAxisIrreversibility(v: unknown): v is ToolAxisIrreversibility;
 //# sourceMappingURL=tool-axis-words.d.ts.map

package/dist/web-admin-client/skills-mcp.d.ts

@@ -27,7 +27,7 @@ export declare function applySkillsManifest(baseline: LoadedSkill[], manifest: {
  * Resolve center MCP servers (`/effective.mcp`) into core `McpServerSpec`s + the scenarios each applies to.
  * env-NAME refs → real values from THIS service's env (secret boundary unchanged); a server with any missing
  * ref is skipped (`resolveRefs` → null). `enabled:false` skipped. A server whose `toolFaces` / `toolAxes` declaration is
- * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / `mcp-tool-axes.ts`). Restart-to-apply
+ * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / the engine's `readMcpToolAxes`). Restart-to-apply
  * (filtered per scenario in `resolveSpec` via `mcpForScenario`).
  */
 export declare function resolveMcpServers(mcp: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.129.0",
+  "version": "7.130.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",