@sema-agent/server 7.129.1 → 7.130.0

package/dist/plugins/one-time-migrations.js

@@ -241,6 +241,23 @@ export const ONE_TIME_MIGRATIONS = [
             "引擎续跑不受影响:续跑入口读行摘要、不按今日闭集重判停驻行上的这两座,行字节引擎怎么写的还是怎么在",
         reportKeys: ["retiredCardWordAskRowsRewritten", "retiredCardWordRowsUnreadable"],
     },
+    {
+        id: "M19",
+        introducedIn: "7.130.0",
+        releasedOn: "2026-10-16",
+        removableAfter: "2026-11-15",
+        removal: "删 `src/stored-request-tool-axes-m19.ts` 整只文件(`storedToolAxesRereadM19` / `readToolAxesAsServer7129M19` / `StoredToolAxesRereadM19`);" +
+            "`boot/resolve-spec.ts` 里递给 `resolveRequestMcp` 的那一实参(`opts?.leg === \"fresh\" ? undefined : storedToolAxesRereadM19(…)`)与它的 import;" +
+            "`task-mcp.ts` 里 `resolveRequestMcp` / `classifyRequestMcp` / `classifyHonored` / `validateRequestMcpEntries` / `normalizeServer` 的 `storedToolAxes` 形参、" +
+            "`toolAxesReread` 事实与运维行 `mcp_tool_axes_read_as_before_upgrade`,以及对本模块的型 import;`tool-axis-words.ts` 头注与两只谓词 JSDoc 里点名 M19 的那几处;" +
+            "`test/mcp-tool-axes-m19.test.ts`(窗关那一格 —— 存量坏形整条不进、warn 与通告点名 `field: toolAxes` —— 改钉到 `test/task-mcp.test.ts`);" +
+            "本文件的 `migrationWindowOpen`(若再无别的读者)",
+        afterRemoval: "没有新的臂,接住它的是今天的读法(删码零行为变化:窗关那一刻起重读臂已经不生效):升级前存下的请求体里引擎判官判不过的 `toolAxes`,续跑重放时这一条 server 整条不进," +
+            "运维 warn `mcp_injection_dropped`(`reason: malformed_entry`、`field: toolAxes`)+ 用户面通告 `mcp.injection_dropped`,兄弟照挂;停驻在这台 server 工具审批上的任务" +
+            "批准后撞 `resume.tool_unavailable`(拒绝照常可出)—— 出路是拒绝那张卡,用改好的 `toolAxes` 重新提交。会撞上它的是活过窗的升级前停驻行:发布后才升级的部署、" +
+            "调长了 `APPROVAL_TERMINAL_BACKSTOP_MS` 的部署、滚动升级里旧副本在窗内新写的行(头注 M19 段)",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;

package/dist/plugins/remote-env-adb.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { classifyFsStderr, fileErrorFromExec } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -191,7 +192,7 @@ export class RemoteAdbExecutionEnv {
             w?.();
         };
         let lastChunk = Date.now();
-        const idleMs = options?.readTimeoutMs;
+        const liveness = commandBoundsOf({ readTimeoutMs: options?.readTimeoutMs }, undefined).liveness;
         let paused = false;
         let onAbort;
         const teardown = () => {
@@ -262,7 +263,7 @@ export class RemoteAdbExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => {
@@ -274,8 +275,8 @@ export class RemoteAdbExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs && !finished && Date.now() - lastChunk >= idleMs) {
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (device hang / disconnected)`);
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms) {
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
                 }
             }
             while (queue.length)

package/dist/plugins/remote-env-local-docker.js

@@ -5,6 +5,7 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
@@ -188,7 +189,7 @@ export class RemoteLocalDockerExecutionEnv {
         let paused = false;
         let wake;
         const signalReady = () => { const w = wake; wake = undefined; w?.(); };
-        const idleMs = options?.readTimeoutMs;
+        const liveness = commandBoundsOf({ readTimeoutMs: options?.readTimeoutMs }, undefined).liveness;
         const cap = options?.maxOutputBytes;
         let onAbort;
         const enqueue = (type, data) => {
@@ -270,7 +271,7 @@ export class RemoteLocalDockerExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs != null ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => { wake = r; waitTimer = setTimeout(r, waitMs); });
@@ -279,13 +280,13 @@ export class RemoteLocalDockerExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs != null && !finished && Date.now() - lastChunk >= idleMs) {
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms) {
                     finished = true;
                     try {
                         child.kill("SIGKILL");
                     }
                     catch { }
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (command hang)`);
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
                 }
             }
             while (queue.length)

package/dist/plugins/remote-env-ssh.js

@@ -3,6 +3,7 @@ import { Client } from "ssh2";
 import { createSshHostKeyVerifier } from "../ssh-host-key.js";
 import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
+import { commandBoundsOf, livenessCutMessage } from "../exec-bounds.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec } from "./remote-env-file-error.js";
@@ -335,7 +336,7 @@ export class RemoteSshExecutionEnv {
             w?.();
         };
         let lastChunk = Date.now();
-        const idleMs = options?.readTimeoutMs;
+        const liveness = commandBoundsOf({ readTimeoutMs: options?.readTimeoutMs }, undefined).liveness;
         let streamRef;
         let onAbort;
         let paused = false;
@@ -422,7 +423,7 @@ export class RemoteSshExecutionEnv {
                     throw failure;
                 if (finished)
                     break;
-                const waitMs = idleMs ? Math.max(1, idleMs - (Date.now() - lastChunk)) : 30_000;
+                const waitMs = liveness !== undefined ? Math.max(1, liveness.ms - (Date.now() - lastChunk)) : 30_000;
                 let waitTimer;
                 try {
                     await new Promise((r) => {
@@ -434,8 +435,8 @@ export class RemoteSshExecutionEnv {
                     if (waitTimer !== undefined)
                         clearTimeout(waitTimer);
                 }
-                if (idleMs && !finished && Date.now() - lastChunk >= idleMs)
-                    throw new RemoteExecutionError("timeout", `execStream idle > ${idleMs}ms (provider hang / unreachable host)`);
+                if (liveness !== undefined && !finished && Date.now() - lastChunk >= liveness.ms)
+                    throw new RemoteExecutionError("timeout", livenessCutMessage(liveness));
             }
             while (queue.length)
                 yield queue.shift();

package/dist/runtime-caps-resolver.d.ts

@@ -175,6 +175,13 @@ export interface PrincipalEntitlementsClient {
      *  FAIL-OPEN on error / older center without scenario keys / no principal (undefined = no governance, legacy passthrough).
      *  Scenario switching is not a privilege-amplifying face; a center blip must not pin users to `default`. */
     scenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
+    /**
+     * {@link PrincipalEntitlementsClient.scenarioRuling} 的**只读**孪生(同 {@link PrincipalEntitlementsClient.peekRuntimeCaps} 的界):同一只缓存 / 同一条抓取 /
+     * 同一份 fail-open 判决(`undefined` = 无治理),唯一的差别是 center 硬失败时本腿铸的 fail-closed 降级项**只对读面自己算数**,提交腿不认、照常重抓。
+     * 读面(`GET /v1/capabilities/mcp?scenario=` 的场景门)问中心裁定时必须走这一只 —— 经 `scenarioRuling` 问,center 抖动的那一拍会替这个主体的**真提交**
+     * 留下 `{allowWorkflows:false, allowFork:false, autoMode:false}` 的短窗 deny(读面成了别人被拒的原因,与 `peekRuntimeCaps` 的病灶同一类)。
+     */
+    peekScenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
     /** (stage7 P5) The resolved per-principal execution-lane ruling for resolveSpec's
      *  gateExecutionLane. FAIL-OPEN + audit on error (this phase is "honest-but-bypassable";
      *  tightening to fail-closed is a future, separate decision) / older center without the execution key / no principal. */

package/dist/runtime-caps-resolver.js

@@ -167,6 +167,7 @@ export function createPrincipalEntitlementsClient(opts) {
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
         peekRuntimeCaps: async (principal) => (principal ? (await load(principal, false)).caps : undefined),
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
+        peekScenarioRuling: async (principal) => (principal ? (await load(principal, false)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
 }

package/dist/session-titler.d.ts

@@ -14,10 +14,12 @@
  * main model; bounded + timed out).
  *
  * FAILURE POSTURE: everything is best-effort — a generation/store failure logs and leaves title null (the
- * list falls back to objectivePreview). An in-process pending set dedupes concurrent submits on the same
+ * list falls back to objectivePreview). The fail-open tag it leaves names the CAUSE FAMILY (one tag, one family):
+ * the llm face's failure CODE picks it (`failOpenTagFor`), never the error's wording. An in-process pending set dedupes concurrent submits on the same
  * session; the store's IS NULL guard closes the cross-replica race (double generation costs one extra cheap
  * call at worst, and exactly one title lands).
  */
+import type { HookLlmFailureCode } from "./hooks/hook-runner.js";
 export interface SessionTitlerDeps {
     /** Secret scrub applied to the RAW llm text before sanitize/persist (workflow audit 2026-07-13: the
      *  objective may carry a pasted secret and the model can echo it into the title — titles are persisted,
@@ -42,6 +44,7 @@ export interface SessionTitlerDeps {
     } | {
         ok: false;
         error: string;
+        code?: HookLlmFailureCode;
     }>;
     logger?: {
         debug?(msg: string, meta?: unknown): void;

package/dist/session-titler.js

@@ -8,6 +8,16 @@ const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
 const FAIL_CAUSE_KEY_CHARS = 80;
 const SEEN_CAP = 10_000;
+function failOpenTagFor(code) {
+    switch (code) {
+        case "redirect_refused":
+            return "server.session-titler.redirect-refused";
+        case "no_content":
+        case "hard_timeout":
+        case undefined:
+            return "server.session-titler.gateway-unreachable";
+    }
+}
 export function sanitizeTitle(raw) {
     const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
@@ -25,10 +35,10 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const logFailure = (sessionId, error) => {
+    const logFailure = (sessionId, error, code) => {
         const safe = redactSecrets(error);
         deps.logger?.debug?.("session_title_failed", { sessionId, error: safe.slice(0, 200) });
-        recordFailOpen("server.session-titler.gateway-unreachable", safe.slice(0, FAIL_CAUSE_KEY_CHARS));
+        recordFailOpen(failOpenTagFor(code), safe.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
     const probeOrContinue = async (sessionId, continueWord) => deps
         .probeTitle(sessionId)
@@ -65,7 +75,7 @@ export function createSessionTitler(deps) {
                 const r = await deps.llm({ prompt: buildTitlePrompt(objective), timeoutMs: LLM_TIMEOUT_MS, model });
                 if (!r.ok) {
                     deps.metrics?.inc("session_title_total", { outcome: "llm_failed" });
-                    logFailure(sessionId, r.error);
+                    logFailure(sessionId, r.error, r.code);
                     return;
                 }
                 const title = sanitizeTitle(deps.redact ? deps.redact(r.text) : r.text);

package/dist/stored-request-tool-axes-m19.d.ts

@@ -0,0 +1,29 @@
+/**
+ * 一次性迁移 M19 —— 续跑重放腿上,升级前存下的请求体里引擎判官判不过的 `mcpServers[].toolAxes`,窗内按升级前的读法重读一次。
+ * 🔴 M19 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 请求腿读 `toolAxes` 的判官是引擎根导出的 `readMcpToolAxes`(整份一坏全拒、不默认)。升级前的请求腿读者是另一种读法:不是对象(含 `null`)⇒ 整键忽略、
+ * server 照挂;是对象 ⇒ 逐成员判形,过不了形的成员剔掉、好的留下。续跑重放腿重放的是**升级前存下的**请求体(`checkpoint_ctx` 里那一份),那时这台 server
+ * 是挂着的 —— 一条停驻在它某只工具审批上的任务,升级后若这台 server 整条不进,批准即撞引擎的 `resume.tool_unavailable`、检查点重开、每次重试重放同一份体
+ * ⇒ 永远批不过去。持久数据面不能「翻红」,所以给它一次性迁移:窗开着时,续跑重放腿把判官判不过的那一格按升级前的读法重读一次,产物**再交同一只判官**
+ * (不过 ⇒ 原臂:整条不进);真挂上的这类 server 由请求腿说一行运维 warn `mcp_tool_axes_read_as_before_upgrade`。窗关之后回到今天的读法,删码零行为变化。
+ *
+ * ## 可达面(结构上只在续跑重放腿)
+ *  · 本模块的值只被 `boot/resolve-spec.ts` 引用一处,挂在 `opts.leg` 不是 `"fresh"` 的那一臂(续跑家族经 `http/resume-legs.ts` 的 `resolveResumeSpec`
+ *    递 `leg: "resume"`);新提交腿递 `"fresh"` 拿不到重读座,且在腿首已经被同一只判官 400 掉(`assertRequestMcpToolAxes`),读器根本见不到坏形;
+ *  · 请求腿(`task-mcp.ts`)只 import 本模块的**型**:重读座是 `resolveRequestMcp` 的一个形参,没人递就没有;探测口(`validateRequestMcp`)没有这个形参;
+ *  · 部署腿(`web-admin-client/skills-mcp.ts` 的 `resolveMcpServers`)是另一只铸 spec 处,不读本模块。
+ * 机器锚:`test/mcp-tool-axes-m19.test.ts` 的结构格。
+ */
+import type { McpServerSpec } from "@sema-agent/core";
+type ToolAxes = NonNullable<McpServerSpec["toolAxes"]>;
+/** 重读座:一份原始 `toolAxes` 声明 → 升级前的读法读出的那一份(`undefined` = 升级前读成「没声明」)。产物由调用方再交引擎判官。 */
+export type StoredToolAxesRereadM19 = (declared: unknown) => ToolAxes | undefined;
+/**
+ * 此刻(`today` = UTC 日历日 YYYY-MM-DD)M19 的窗开着 ⇒ 交回重读座;关了 ⇒ `undefined`(今天的读法)。窗只读登记表 M19 那一行
+ * (`migrationWindowOpen`,与 M10 的认领窗同一只判据)。登记表里没有 M19 ⇒ 响亮抛:重读臂活过了它的登记行,该随那一行一起删。
+ */
+export declare function storedToolAxesRereadM19(today: string): StoredToolAxesRereadM19 | undefined;
+export {};
+//# sourceMappingURL=stored-request-tool-axes-m19.d.ts.map

package/dist/stored-request-tool-axes-m19.js

@@ -0,0 +1,27 @@
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
+function readToolAxesAsServer7129M19(declared) {
+    if (!declared || typeof declared !== "object" || Array.isArray(declared))
+        return undefined;
+    const axes = {};
+    for (const [tool, ax] of Object.entries(declared)) {
+        if (!ax || typeof ax !== "object" || Array.isArray(ax))
+            continue;
+        const a = ax;
+        const entry = {
+            ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
+            ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
+            ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
+        };
+        if (Object.keys(entry).length > 0)
+            axes[tool] = entry;
+    }
+    return Object.keys(axes).length > 0 ? axes : undefined;
+}
+export function storedToolAxesRereadM19(today) {
+    const window = ONE_TIME_MIGRATIONS.find((w) => w.id === "M19");
+    if (window === undefined)
+        throw new Error("stored-request-tool-axes-m19: the one-time migration registry has no M19 row (the replay-leg toolAxes re-read window) — the re-read arm outlived its registry row; delete it with that row");
+    return migrationWindowOpen(window, today) ? readToolAxesAsServer7129M19 : undefined;
+}
+//# sourceMappingURL=stored-request-tool-axes-m19.js.map

package/dist/task-mcp.d.ts

@@ -24,6 +24,7 @@
  */
 import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 import { type McpIdentityHeadersIssue, type RequestMcpServerSpec } from "./mcp-assertion-header.js";
+import type { StoredToolAxesRereadM19 } from "./stored-request-tool-axes-m19.js";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
 /**
@@ -114,6 +115,7 @@ export interface McpInjectionDropSeat {
  * Shape-check the raw `body.mcpServers`. `null` → a non-array (caller error; the route may 400). Otherwise the
  * valid subset + the names of dropped (malformed/over-cap) entries + [ref]'s `badContentOrigin`
  * (**降级**掉的内容出处声明,与 `dropped` 是两回事:那条 server **留着**,丢的只是它的声明)。
+ * 这一口没有 M19 的重读座(探测口与单测读到的 `toolAxes` 恒是判官的读数);重读只在续跑重放腿经 {@link resolveRequestMcp} 发生。
  */
 export declare function validateRequestMcp(raw: unknown): ValidatedRequestMcp | null;
 type ValidatedRequestMcp = {
@@ -208,6 +210,32 @@ export declare function requestEntryIdentityRefusal(entry: unknown): {
     errorCode: "request.body_shape" | "request.field_invalid";
     message: string;
 } | undefined;
+/**
+ * S-1604 —— `mcpServers[].toolAxes` 的**值域门**(fresh 腿限定,同步 400):判官是引擎根导出的 `readMcpToolAxes`(与部署腿铸 spec 处同一只),
+ * 判出 `ok:false` ⇒ `400 request.field_invalid`,点名 `mcpServers[i].toolAxes`、server 名与引擎的原因句(点名工具与成员,不带值)。
+ *
+ * ## 为什么拒而不是剔
+ * `toolAxes` 是调用方对这台 server 每只工具的**双向**风险轴声明(能压低一只工具的效应让审批门放行,也能抬高)。静默剔掉坏成员 = 调用方拿到 2xx、
+ * 以为整份声明生效,实际只有另一半在力 —— 一份没有生效的信任根声明。引擎的读法本就是「整份一坏全拒、好的那几只也不留、什么都不默认」,
+ * 请求腿修前自铸的读者与它相反;从此只有一只判官,两条腿同读。
+ *
+ * ## 位置与 leg 分流(与 {@link assertRequestMcpContentOrigin} / {@link assertRequestMcpIdentityHeaders} 同款理由,不发明第二套)
+ * 排在腿首、任何副作用之前;**只在 fresh 腿**:`checkpoint_ctx` 存的是原始 `TaskRequestBody`,耐久 resume 逐字重放它,从这里逃出去的 `HttpError`
+ * 会被折成 `409 resume_blocked_by_policy`,把一条升级前 park 的任务永久砖死。resume 腿走读器({@link normalizeServer}):同一只判官判出坏形 ⇒ 这一条 server
+ * 不进 + `malformed_entry` 点名(运维 warn + 用户面通告,不抛);一次性迁移 M19 的窗开着时先按升级前读法重读一次(见那只读器的注)。
+ * 判据是纯值域、与租户车道无关(多租户腿本来就忽略整只数组,告诉调用方「你这条写错了」只多不少)。
+ * 探测口读同一只 {@link requestEntryToolAxesRefusal},同一句拒。
+ */
+export declare function assertRequestMcpToolAxes(bodyMcp: unknown): void;
+/**
+ * 一条**原始**请求条目上 `toolAxes` 的拒面(码 + 句子);没有问题 / 条目不是对象 / 没写 `toolAxes` ⇒ `undefined`。提交腿的门({@link assertRequestMcpToolAxes})与探测口
+ * (`mcp-probe.ts` 的 `entryValueIssue`)两扇拒绝门同读这一只,所以两处是**同一句**。判官是引擎的 `readMcpToolAxes`,句子里的原因句逐字取它的 `problem`
+ * (只剥控制与双向字符:工具名是调用方写的);不回显值 —— 引擎的句子点名工具与成员、不带值。`at` = 条目的键路径(`mcpServers[3]`)。
+ */
+export declare function requestEntryToolAxesRefusal(entry: unknown, at: string): {
+    errorCode: "request.field_invalid";
+    message: string;
+} | undefined;
 /**
  * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
  * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
@@ -247,6 +275,9 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
 /** L-167:本条腿的**用户面**投递口。`sessionId` = 通告的路由半场(缺席 ⇒ 一条都不铸,见
  *  {@link mintInjectionDropNotices});`emit` 收下 core 铸好的通告,由调用腿决定投到哪(见 `boot/resolve-spec.ts`)。
  *  整段缺席(桩、单测、非 HTTP 腿)⇒ 只走日志终点,行为逐字与本件之前相同。 */
-notice?: McpInjectionDropSeat): McpServerSpec[] | undefined;
+notice?: McpInjectionDropSeat, 
+/** 一次性迁移 M19 的重读座(窗口见 `plugins/one-time-migrations.ts` 登记表):只在续跑重放腿、只在窗开着时由 `boot/resolve-spec.ts` 递进来;
+ *  缺席(新提交腿 / 窗关 / 桩)⇒ 判官判不过的 `toolAxes` 照原臂整条不进。 */
+storedToolAxes?: StoredToolAxesRereadM19): McpServerSpec[] | undefined;
 export {};
 //# sourceMappingURL=task-mcp.d.ts.map

package/dist/task-mcp.js

@@ -1,4 +1,4 @@
-import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, readMcpToolAxes, resolveComplianceDenies } from "@sema-agent/core";
 import { isUsableWireName } from "./wire-name-bound.js";
 import { HttpError, createCodedHttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
@@ -6,8 +6,8 @@ import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } f
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { declaresMcpAssertionHeader, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, readMcpIdentityHeaders, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
 import { echoKeyName } from "./request-key-closure.js";
+import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
-import { isToolAxisIrreversibility, isToolEffect } from "./tool-axis-words.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "toolAxes", "toolFaces", "transport"];
@@ -34,7 +34,7 @@ function declaredName(e) {
         ? String(e.name)
         : MALFORMED_NAME;
 }
-function normalizeServer(e, noteBadOrigin) {
+function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     if (!e || typeof e !== "object")
         return bad("entry");
     const o = e;
@@ -76,23 +76,20 @@ function normalizeServer(e, noteBadOrigin) {
     }
     if (typeof o.elicitation === "boolean")
         spec.elicitation = o.elicitation;
-    if (o.toolAxes && typeof o.toolAxes === "object" && !Array.isArray(o.toolAxes)) {
-        const axes = {};
-        for (const [tool, ax] of Object.entries(o.toolAxes)) {
-            if (!ax || typeof ax !== "object" || Array.isArray(ax))
-                continue;
-            const a = ax;
-            const entry = {
-                ...(isToolEffect(a.effect) ? { effect: a.effect } : {}),
-                ...(typeof a.egress === "boolean" ? { egress: a.egress } : {}),
-                ...(isToolAxisIrreversibility(a.irreversibility) ? { irreversibility: a.irreversibility } : {}),
-            };
-            if (Object.keys(entry).length > 0)
-                axes[tool] = entry;
+    const axes = readMcpToolAxes(o.toolAxes);
+    let judged = axes;
+    let toolAxesReread;
+    if (!axes.ok && storedToolAxes !== undefined) {
+        const again = readMcpToolAxes(storedToolAxes(o.toolAxes));
+        if (again.ok) {
+            judged = again;
+            toolAxesReread = axes.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "");
         }
-        if (Object.keys(axes).length > 0)
-            spec.toolAxes = axes;
     }
+    if (!judged.ok)
+        return bad("toolAxes");
+    if (judged.toolAxes !== undefined)
+        spec.toolAxes = judged.toolAxes;
     if (o.contentOrigin !== undefined) {
         if (isContentOriginWord(o.contentOrigin))
             spec.contentOrigin = o.contentOrigin;
@@ -105,29 +102,32 @@ function normalizeServer(e, noteBadOrigin) {
         return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
-    return { ok: true, spec };
+    return { ok: true, spec, ...(toolAxesReread !== undefined ? { toolAxesReread } : {}) };
 }
 export function validateRequestMcp(raw) {
-    if (raw === undefined || raw === null)
-        return validateRequestMcpEntries([]);
-    if (!Array.isArray(raw))
+    if (raw !== undefined && raw !== null && !Array.isArray(raw))
         return null;
-    return validateRequestMcpEntries(raw);
+    const { ok, dropped, droppedTotal, badContentOrigin } = validateRequestMcpEntries(Array.isArray(raw) ? raw : []);
+    return { ok, dropped, droppedTotal, badContentOrigin };
 }
-function validateRequestMcpEntries(raw) {
+function validateRequestMcpEntries(raw, storedToolAxes) {
     const ok = [];
     const dropped = [];
     const badContentOrigin = [];
+    const toolAxesReread = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
-        const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }));
-        if (v.ok)
+        const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }), storedToolAxes);
+        if (v.ok) {
             ok.push(v.spec);
+            if (v.toolAxesReread !== undefined)
+                toolAxesReread.push({ server: v.spec.name, problem: v.toolAxesReread });
+        }
         else
             dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
     for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
         dropped.push({ server: declaredName(e), reason: "over_cap" });
-    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin };
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin, toolAxesReread };
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -180,6 +180,29 @@ export function requestEntryIdentityRefusal(entry) {
     const value = (entry.transport).assertionHeader;
     return { errorCode: "request.field_invalid", message: describeMcpAssertionHeaderNotAString(name, value) };
 }
+export function assertRequestMcpToolAxes(bodyMcp) {
+    if (!Array.isArray(bodyMcp))
+        return;
+    for (let i = 0; i < bodyMcp.length; i++) {
+        const refusal = requestEntryToolAxesRefusal(bodyMcp[i], `mcpServers[${i}]`);
+        if (refusal !== undefined)
+            throw createCodedHttpError(400, refusal.errorCode, refusal.message);
+    }
+}
+export function requestEntryToolAxesRefusal(entry, at) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry))
+        return undefined;
+    const read = readMcpToolAxes(entry.toolAxes);
+    if (read.ok)
+        return undefined;
+    const server = echoKeyName("", declaredName(entry));
+    return {
+        errorCode: "request.field_invalid",
+        message: `${at}.toolAxes (server "${server}") is not a usable declaration — ${read.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "")}. ` +
+            `The whole declaration is refused: the tools that were fine are not kept and nothing is defaulted, because a toolAxes declaration is your own risk-axis judgement for this server's tools ` +
+            `(it can move a tool down or up), and a half-applied one would silently differ from what you declared. Fix the entry, or omit the key to declare nothing.`,
+    };
+}
 export function deploymentClosedMcpNames(baseline, reservedNames) {
     return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
 }
@@ -190,20 +213,20 @@ export function mergeRequestMcp(baseline, gated, reservedNames) {
     const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
-export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice) {
+export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice, storedToolAxes) {
     if (bodyMcp === undefined || bodyMcp === null)
         return baseline;
-    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger);
+    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes);
     mintInjectionDropNotices(drops, notice);
     return mcp;
 }
-function classifyRequestMcp(baseline, bodyMcp, config, logger) {
+function classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes) {
     if (bodyMcp !== undefined && bodyMcp !== null && !Array.isArray(bodyMcp)) {
         logger?.warn("mcp_injection_ignored", { reason: "mcpServers not an array" });
         return { mcp: baseline, drops: [] };
     }
     const entries = Array.isArray(bodyMcp) ? bodyMcp : [];
-    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger) : classifyGateClosed(baseline, entries);
+    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger, storedToolAxes) : classifyGateClosed(baseline, entries);
     if (outcome.drops.length > 0)
         logger?.warn("mcp_injection_dropped", { dropped: outcome.drops, droppedTotal: outcome.droppedTotal });
     return { mcp: outcome.mcp, drops: outcome.drops };
@@ -215,8 +238,8 @@ function classifyGateClosed(baseline, entries) {
         droppedTotal: entries.length,
     };
 }
-function classifyHonored(baseline, entries, config, logger) {
-    const v = validateRequestMcpEntries(entries);
+function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
+    const v = validateRequestMcpEntries(entries, storedToolAxes);
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
             entries: v.badContentOrigin,
@@ -236,6 +259,16 @@ function classifyHonored(baseline, entries, config, logger) {
         if (issue !== undefined && mounted.has(declaredName(e)))
             noteMcpAssertionHeaderIgnored(logger, declaredName(e), issue);
     }
+    for (const r of v.toolAxesReread) {
+        if (!mounted.has(r.server))
+            continue;
+        logger?.warn("mcp_tool_axes_read_as_before_upgrade", {
+            server: r.server,
+            migration: "M19",
+            problem: r.problem,
+            note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
+        });
+    }
     return {
         mcp: mergeRequestMcp(baseline, v.ok.map(toCoreMcpServerSpec), reservedNames),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],

package/dist/tool-axis-words.d.ts

@@ -1,30 +1,27 @@
 /**
- * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词,**两面共用一份**。
+ * S-249(DT-13)—— per-tool **风险轴覆写**的值域词表与谓词(读者:**A2A 请求腿**;以及一次性迁移 M19 的升级前读法 `stored-request-tool-axes-m19.ts`,随 M19 的登记行退役)。
  *
- * ## 病(修前)
- * `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构
- * (`effect` / `egress` / `irreversibility`),而两个**闭集词表**是**手抄的字面串**:四份字面量
- * (两文件 × 两个词轴),没有一份钉在 core 的型上。后果不是「今天判错了」,而是**判据比声明窄**这件事
- * 没有任何门看得见 —— core 哪天给 `ToolEffect` 加一个词(或把 `irreversibility` 的两词改成三词,它在
- * `AskOrigin` 那一面**已经**是 `never|maybe|always` 三词了),两条请求腿会把那个**合法**的新词
- * **静默剔除**(MCP 腿)或**整条 server 判假**(A2A 腿),而 tsc 一声不吭。
+ * ## 历史与现状
+ * 修前 `task-mcp.ts` 与 `task-a2a.ts` 各自在请求腿上逐键校验同一个三成员结构(`effect` / `egress` / `irreversibility`),两个**闭集词表**是手抄的字面串,
+ * 没有一份钉在 core 的型上;S-249 把词表收到本文件并**两向钉死在 core 的型上**(core 加词 ⇒ 正向门红;本表留了 core 已没有的词 ⇒ 反向门红),两条腿读同一只谓词。
  *
- * ## 修法
- * 词表留在本仓(运行期要它),但**两向钉死在 core 的型上**:core 加词 ⇒ 正向门红;本表留了一个 core
- * 已经没有的词 ⇒ 反向门红。两个面共用**同一只**谓词,于是「什么算一个合法的轴值」在本仓只有一个答案。
+ * 之后 MCP 面的 `toolAxes` 判官整个换给了**引擎**:core 7.51.2 起根导出 `readMcpToolAxes`(整份声明一坏全拒、不默认),部署腿(`web-admin-client/skills-mcp.ts`)
+ * 与请求腿(`task-mcp.ts`)都问它,本仓不再有 MCP 面的自铸读者、也不再 import 本文件的谓词。**A2A 面引擎没有对应的判官**(core 暂无 `readA2aToolAxes`),
+ * 所以 A2A 请求腿(`task-a2a.ts`)仍用本文件的谓词;引擎一旦给 A2A 也立一只判官,本文件随之退役。另一个读者是 M19 的迁移读者:续跑重放腿把升级前存下的
+ * `mcpServers[].toolAxes` 按升级前那只读者的读法重读一次(产物再交引擎的判官),那段读法当年就读本文件的谓词,逐字搬回;它不是 MCP 面的第二只判官。
  *
- * 🔴 **只管值域,不管处置**:两条腿对坏值的处置**刻意不同**(MCP = 丢这一键、留 server;A2A = 整条拒),
- * 判据与理由各写在各自的调用点。合并处置会抹掉那条真实的分歧(MCP 的 `toolAxes` 有 server-hint 腿可折,
- * A2A 收下的就是最终值),而分歧本身是裁定过的。
+ * 下面的同型钉(A2A 的轴型与 MCP 的轴型逐字同声明)仍有意义:A2A 的词表跟着引擎 MCP 面的轴型走,哪一边加词、改词,另一边在这里当场红。
+ *
+ * 🔴 **只管值域,不管处置**:A2A 腿对坏值的处置是整条拒(MCP 面是引擎判官的「整份全拒」;两面方向一致),M19 的迁移读者剔坏成员(升级前的读法),判据与理由写在各自的调用点。
  */
 import type { McpServerSpec, ToolEffect } from "@sema-agent/core";
-/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明两面逐字同声明。 */
+/** 一条 per-tool 轴覆写的形。取 MCP 那一面作代表 —— 下面的同型钉证明 A2A 面与它逐字同声明。 */
 export type ToolAxisEntry = NonNullable<McpServerSpec["toolAxes"]>[string];
 /** 轴覆写上那个**两词**的不可逆档(⚠️ 与 `AskOrigin` 面的**三词** `never|maybe|always` 不是同一个词表:
  *  覆写面只收两极,`maybe` 是引擎按工具自己的声明定的,调用方说不出口)。 */
 export type ToolAxisIrreversibility = NonNullable<ToolAxisEntry["irreversibility"]>;
-/** 值是不是一个合法的 `effect` 词(两条请求腿共用)。 */
+/** 值是不是一个合法的 `effect` 词(A2A 请求腿与 M19 的迁移读者读它)。 */
 export declare function isToolEffect(v: unknown): v is ToolEffect;
-/** 值是不是一个合法的**覆写面** `irreversibility` 词(两条请求腿共用)。 */
+/** 值是不是一个合法的**覆写面** `irreversibility` 词(A2A 请求腿与 M19 的迁移读者读它)。 */
 export declare function isToolAxisIrreversibility(v: unknown): v is ToolAxisIrreversibility;
 //# sourceMappingURL=tool-axis-words.d.ts.map

package/dist/web-admin-client/skills-mcp.d.ts

@@ -27,7 +27,7 @@ export declare function applySkillsManifest(baseline: LoadedSkill[], manifest: {
  * Resolve center MCP servers (`/effective.mcp`) into core `McpServerSpec`s + the scenarios each applies to.
  * env-NAME refs → real values from THIS service's env (secret boundary unchanged); a server with any missing
  * ref is skipped (`resolveRefs` → null). `enabled:false` skipped. A server whose `toolFaces` / `toolAxes` declaration is
- * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / `mcp-tool-axes.ts`). Restart-to-apply
+ * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / the engine's `readMcpToolAxes`). Restart-to-apply
  * (filtered per scenario in `resolveSpec` via `mcpForScenario`).
  */
 export declare function resolveMcpServers(mcp: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.129.1",
+  "version": "7.130.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",