@sema-agent/server 7.131.0 → 7.133.0

package/dist/capabilities/hands-lane.d.ts

@@ -19,23 +19,34 @@ import { type Runner, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 /** 场景对手带工具面的表态(闭集)。`full` = core 手带 band 照常 mount;`none` = 不挂 executionEnvFactory 的 Runner。 */
 export type ScenarioHands = "full" | "none";
 /**
- * 无手孪生 Runner 的 deps 构造:把 `executionEnvFactory` **与 `lspManager`** 一起**摘键**(不是置 undefined)。
+ * 无手孪生 Runner 的 deps 构造:把 `executionEnvFactory` **摘键**(不是置 undefined)。
  * 摘键让「这只 Runner 没有手」在 deps 字面量上自证;置 undefined 留下一个值为 undefined 的键,
  * 与 core 现在的 `deps.executionEnvFactory ||` 判读结果相同,但把正确性寄托在真值判断上。
- * **无手就无 LSP**:LSP 管理器是手的附属(宿主车道的 `NodeLspManager` 经 `defaultLspReadText` 直读本地盘,
- * 没有读面围栏;沙箱车道推断降级为 unavailable)—— 只摘手不摘它,无手 Runner 会在 StubExecutionEnv 上挂 LSP。
+ *
+ * **LSP 的 manager 座照传,不摘**:挂不挂 LSP 由引擎一处决定 —— core 7.49.2 起 LSP 只在「有手腿 ∧ 接了 manager 座」的腿上挂,无手腿
+ * (`hands=none` 的场景、委派子代、后台代理)天然没有。本仓此前在这里再摘一次 `lspManager`(宿主车道的 `NodeLspManager` 经
+ * `defaultLspReadText` 直读本地盘、没有读面围栏,当年引擎还会在 StubExecutionEnv 上挂它),是同一件事的第二只写者:引擎一旦决定
+ * 它自己的读法,两处只会各改各的。引擎的读数钉在 `test/scenario-hands-lane.test.ts` 的 S-1502 段(同一份含 manager 座的 deps,有手腿 roster 有
+ * `LSP`、无手孪生没有)。
  */
 export declare function withoutHands<T extends {
     executionEnvFactory?: unknown;
-    lspManager?: unknown;
-}>(deps: T): Omit<T, "executionEnvFactory" | "lspManager">;
-/** 一对 Runner:同 deps,唯一差别是 `handsless` 不挂 `executionEnvFactory` 与 `lspManager`。 */
+}>(deps: T): Omit<T, "executionEnvFactory">;
+/** 一对 Runner:同 deps,唯一差别是 `handsless` 不挂 `executionEnvFactory`。 */
 export interface HandsRunnerPair {
     full: Runner;
     handsless: Runner;
 }
 /** 按场景表态取 Runner。**穷举 switch**:`ScenarioHands` 加词而此处不改 = 编译错(无 default 臂)。 */
 export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerPair): Runner;
+/**
+ * 一个场景在一台部署上起的 run **有没有工作区** —— core prepare 的 `handsEnabled`(`ownedEnv || deps.executionEnv`)在本仓的镜像,**唯一一只判官**。
+ * 两个条件缺一不可:场景挂手({@link pickHandsRunner} 选有手 Runner,即带 `executionEnvFactory` 的那只)∧ 这台部署的执行车道有手
+ * (`execution-lane-caps.ts` 的 `laneWiresExecutionEnv`:`in-process` 车道整台没有 factory)。引擎对 `userAttachments` 里 `path` 条目的拒
+ * (`config.user_attachment_invalid`「this run has no workspace」)与场景详情读面的 `attachmentSupplies` 都落在这一只的答案上。
+ * **穷举 switch**:`ScenarioHands` 加词而此处不表态 = 编译红(与 {@link pickHandsRunner} 同一条纪律)。
+ */
+export declare function runHasWorkspace(hands: ScenarioHands, laneHasHands: boolean): boolean;
 /**
  * core 手带 band 的工具名**全集** —— 「挂 executionEnvFactory 才出现、不挂就消失」的那一批。
  *
@@ -75,6 +86,19 @@ export declare const HANDS_BAND_TOOL_NAMES: readonly string[];
  */
 export declare const HANDS_DUAL_USE_TOOL_NAMES: readonly string[];
 export declare const HANDS_EXCLUSIVE_TOOL_NAMES: readonly string[];
+/**
+ * S-1376:办公向场景(`cowork`)**保留**的手带工具 —— 文件读三件。办公场景挂手(`hands: "full"`:run 有工作区,附件 `path` 受理,这三件要这只手),
+ * 但不带编码类工具;「编码类」的定义是**手独占名单减去这张保留表**({@link OFFICE_EXCLUDED_TOOL_NAMES}),不是另抄一张编码工具名单:
+ * core 往 band 里加新的手带工具,办公场景**默认就卸它**(fail-closed),要保留得在这里显式点名并过评审。
+ * 保留表里每一项必须是 band 全集的成员(对表钉在 `test/cowork-scenario.test.ts`)。
+ */
+export declare const OFFICE_KEPT_HAND_TOOL_NAMES: readonly string[];
+/**
+ * 办公向场景从 roster 里**真卸载**的手带工具名单(`TaskSpec.excludeTools`:per-scenario 的 roster 移除,工具 schema 不进 `tools[]`;不是策略 deny)=
+ * 手独占名单({@link HANDS_EXCLUSIVE_TOOL_NAMES},两用件不在内:委派 / workflow 车道要它们)∖ {@link OFFICE_KEPT_HAND_TOOL_NAMES}。
+ * 今天 = Edit · Write · NotebookEdit · Bash · RepoMap · LSP · EnterWorktree · ExitWorktree · Monitor。
+ */
+export declare const OFFICE_EXCLUDED_TOOL_NAMES: readonly string[];
 /** 手独占名单的 deny 策略(纵深层)。名单是常量 ⇒ 每次调用产出等价策略,构造成本可忽略。 */
 export declare function handsDenyPolicy(): ToolPolicy;
 /**

package/dist/capabilities/hands-lane.js

@@ -1,7 +1,7 @@
 import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
 import { TOOL_NAME_ROSTER } from "../namespaced-rule-name.js";
 export function withoutHands(deps) {
-    const { executionEnvFactory: _handsDropped, lspManager: _lspDropped, ...rest } = deps;
+    const { executionEnvFactory: _handsDropped, ...rest } = deps;
     return rest;
 }
 export function pickHandsRunner(hands, pair) {
@@ -12,6 +12,14 @@ export function pickHandsRunner(hands, pair) {
             return pair.handsless;
     }
 }
+export function runHasWorkspace(hands, laneHasHands) {
+    switch (hands) {
+        case "full":
+            return laneHasHands;
+        case "none":
+            return false;
+    }
+}
 export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     ...handBandEffects().keys(),
     "SendMessage",
@@ -23,6 +31,8 @@ export const HANDS_BAND_TOOL_NAMES = Object.freeze([
 ].filter((n, i, all) => judgeRuleToolName(n, TOOL_NAME_ROSTER).kind === "current" && all.indexOf(n) === i));
 export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
+export const OFFICE_KEPT_HAND_TOOL_NAMES = Object.freeze(["Read", "Glob", "Grep"]);
+export const OFFICE_EXCLUDED_TOOL_NAMES = Object.freeze(HANDS_EXCLUSIVE_TOOL_NAMES.filter((n) => !OFFICE_KEPT_HAND_TOOL_NAMES.includes(n)));
 export function handsDenyPolicy() {
     return createAllowDenyPolicy({ deny: [...HANDS_EXCLUSIVE_TOOL_NAMES] });
 }

package/dist/capabilities/mcp-probe.d.ts

@@ -108,7 +108,7 @@ export declare function buildMcpProbeWalkTimeoutMs(declarations: number): number
  * 一次走查里**同时追裁决**的台数,喂 core 的 `opts.concurrency`。
  *
  * 为什么不用缺省的 1:core 的 d.ts 明写整次调用的时长 = 每台时长在 `ceil(n / concurrency)` 轮上的和。
- * 缺省 1 下一个 32 台(={@link MAX_REQUEST_MCP_SERVERS})的申报最坏是 32 × {@link MCP_PROBE_VERDICT_TIMEOUT_MS}
+ * 缺省 1 下一个 32 台(= `task-mcp.ts` 的 `MAX_REQUEST_MCP_SERVERS`)的申报最坏是 32 × {@link MCP_PROBE_VERDICT_TIMEOUT_MS}
  * —— 一条 HTTP 请求挂五分钟。8 把最坏收进 4 轮。代价 core 也写明了:并发只影响 `connectMs` 这个读数的
  * 争用度,**行与下标对齐不受影响**(而本面根本不发 `connectMs`)。
  * ⚠️ 它**不是**「同时开几条传输」的帽:被时钟放弃的拨号仍在飞,最坏可达一条/台申报(core 原话)。
@@ -134,8 +134,10 @@ export interface McpProbeFaceBody {
     /** 这份读数还能复用多久(秒)= {@link MCP_PROBE_CACHE_TTL_MS}。 */
     readonly ttlSec: number;
     /**
-     * 逐字 = `wiring_manifest.mcp[]` 在 wire 上的那一行 —— **同一只投影**
-     * ({@link projectWiringManifestMcpRows},契约 §G.7),不是本面自己挑的一份键。与入参申报**同序同长**
+     * 每一行 = `wiring_manifest.mcp[]` 在 wire 上的那一行 —— **同一只投影**
+     * ({@link projectWiringManifestMcpRows},契约 §G.7),不是本面自己挑的一份键 —— **外加本面独有的两个可选键**
+     * `toolNames` / `toolNamesTruncated`({@link buildMcpProbeFaceRows};名字的来源只有同一次探测的读数
+     * `servers[i].tools`,§G.7 的行与 `wiring_manifest.mcp[]` 上都没有它们)。与入参申报**同序同长**
      * (core `@contract mcp.probe.index_aligned`;下标对齐,不按 name)。
      *
      * 🔴 **`error`(远端原话)因此在本面上同样缺席**,而这**不是**本车的选择:§G.7 第 3 条是一条成文裁定
@@ -159,6 +161,19 @@ export interface McpProbeRefusal {
 /**
  * `POST …/probe` 的体读器:闭形、逐条点名、零静默丢。成功 ⇒ 交给 core 的 `specs`(**原样**转发被读出来的
  * 条目,`McpServerSpec` 的可选键一个都不重写 —— 重写就是在 core 的型上做第二次投影)。
+ *
+ * ## 申报「能不能原样用」:问提交腿 fresh 门**同一只**回答者,不另判
+ * 本面只判自己那一层(体是对象、顶层只受理 `mcpServers`、这个键必填);`mcpServers` 本身 —— 列表的形、上限、每条的键名与键值 —— 全部交给
+ * `task-mcp.ts` 的 `requestMcpDeclarationRefusal`,拒(码 + 句 + `unknownKeys`)原样转述:同一份申报在两扇门上只有一个答案,零拨号之前就给。
+ * 回答者受理的申报由**同一只**读器(`validateRequestMcp`)交回,读器的产物就是申报本身(只差判官自己的合法归一),经 `toCoreMcpServerSpec`
+ * 得到的就是一条任务提交会交给引擎的那一份 —— 本面拨的正是它。读器只在回答者受理之后才跑,所以它对重放存量 body 才有的降级留痕
+ * (`source` 写坏的 F 类丢弃)不会在一次被拒的探测上虚记。
+ *
+ * ## 唯一一处按门分的后果:声明了 `assertionHeader`(引擎尚无断言头座)
+ * 事实只有一个、读它的谓词只有一只(`specWithholdsMcpAssertionHeader`,读发送开关 `MCP_ASSERTION_HEADER_SENT`):这台 server 声明的断言头本版**承载、不发送**,交给引擎的规格里没有它。
+ * 新提交照挂并给运维一行 info(`mcp_assertion_header_not_sent`;settings 面同读法);本面**整条拒** —— 拨出去的不是申报的那一份,一台握手放行、
+ * 调用才要断言的对端会被答成 connected,而它的调用会被拒。判据同一只、后果按门分(与重放腿对同一组身份头「降级到升级前读法」同一个姿势);
+ * 引擎长出同名座的那天,开关翻真,`toCoreMcpServerSpec` 的剥键与这一拒一起退役(`mcp-assertion-header.ts` 的退役门编译红)。
  */
 export declare function readMcpProbeBody(raw: unknown): {
     ok: true;
@@ -221,6 +236,28 @@ export interface McpProbeLocal {
 }
 /** 带行为的东西 ⇒ `create*`(工厂命名律:`build*` 出纯数据,`create*` 出活对象)。 */
 export declare function createMcpProbeLocal(): McpProbeLocal;
+/**
+ * S-1734 —— 一行的**本面独有**两键:`toolNames` / `toolNamesTruncated`。两条口走同一只 {@link createMcpProbeWalk},
+ * 所以这是它们**唯一**的铸点。
+ *
+ * ## 来源只有一个
+ * core 7.52.0 的 `probeMcpServers().servers[i].tools` —— 这台"会挂上"的工具名,形是引擎的命名空间形
+ * `mcp__<server>__<tool>`(= 会话面板 `toolNames` 同一只来源,过了 schema 闸与逐台白名单之后的名册,`tools.length` 恒等于该行的 `toolCount`)。
+ * server **不拼、不改名、不加前缀**:引擎是什么形,wire 上就是什么形。
+ *
+ * ## 失败方向(与 `toolCount` 不编 0 同律,逐键独立)
+ *  · 这一格的 `tools` 缺席 / 非数组 / 带任何非串元素(含稀疏数组的空槽) ⇒ **两个键都缺席**(不编 `[]`:编出来的空名单会被读成「这台没有工具」;
+ *    带非串元素的数组整只不要 —— 少一半的名单看着像完整的那一份,而「会撒谎的读面比大的读面更贵」);
+ *  · 在场的 `[]` 原样保留(core 对没连上的台给 `[]`,`toolCount` 同行为 0 —— 与「写了就在场」同律,不折成缺席);
+ *  · 超过 {@link import("../panel-tool-names.js").PANEL_MAX_TOOL_NAMES} 只截**表**:`toolNamesTruncated: true`,`toolCount` 仍是 §G.7 投影出的真数。
+ *
+ * ## 下标对齐是承诺,不是约定
+ * `rows` 与 `readings` 按**下标**配(core `@contract mcp.probe.index_aligned`,名字不保证唯一)。读数不是数组、或条数与行数不等 ⇒
+ * **抛** {@link McpProbeMisaligned},不发一份会配错的名单 —— 与 {@link createMcpProbeWalk} 对 `rows` 条数的那道断言同一条纪律、同一个具名型
+ * (今天结构上不可达,所以是断言而不是兜底路径;一旦发生是服务内部的读数违约,两条口都答 5xx,不归到调用方的申报)。
+ * `rows` 一个字都不被改写(不过滤、不排序、不改已有键)。
+ */
+export declare function buildMcpProbeFaceRows(rows: readonly Record<string, unknown>[], readings: unknown): Array<Record<string, unknown>>;
 /**
  * 一次走查。**两只 promise,两件事**(合并树 codex ① [high],亲跑复现后按类修):
  *  · `answer` —— **HTTP 应答面**:到本面的期限就 reject {@link McpProbeIncomplete},调用腿据它答 503;
@@ -241,6 +278,14 @@ export interface McpProbeWalk {
     readonly dials: Promise<unknown>;
 }
 export declare function createMcpProbeWalk(specs: readonly McpServerSpec[], principal: string | undefined, now?: () => number): McpProbeWalk;
+/**
+ * 下标对齐的**内部断言**没过(行数 ≠ 申报数,或读数条数 ≠ 行数):core 的 `@contract mcp.probe.index_aligned` 在今天结构上保证它不发生,
+ * 所以它一旦发生,是**这台服务内部的读数违约**,不是调用方的申报写错 —— 修申报修不好它。**具名型**而不是按文案或按「非 Incomplete 的 reject」分诊:
+ * 调用腿据它把 `POST` 也答成 5xx(与 `GET` 同),而不是落进「core 物化拒了这份申报 ⇒ 400 点名调用方」那一臂。
+ */
+export declare class McpProbeMisaligned extends Error {
+    constructor(message: string);
+}
 /** 整次走查没在 {@link MCP_PROBE_WALK_TIMEOUT_MS} 内落地。**具名型**而不是一个字符串比较:调用腿要据它
  *  分诊(503 + 退避),而按错误文案分诊是本仓明令不许的形。 */
 export declare class McpProbeIncomplete extends Error {

package/dist/capabilities/mcp-probe.js

@@ -1,13 +1,12 @@
-import { probeMcpServers, readMcpToolAxes } from "@sema-agent/core";
+import { probeMcpServers } from "@sema-agent/core";
 import { createHash } from "node:crypto";
 import { createFixedWindowRateLimiter } from "../device-enrollment.js";
 import { canonicalJson } from "../canonical-json.js";
-import { echoKeyName, keyClosureClause, scanKeyClosure } from "../request-key-closure.js";
-import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
-import { HTTP_MCP_TRANSPORT_KEYS, MAX_REQUEST_MCP_SERVERS, MCP_ENTRY_EMPTY_ARRAY_KEYS, MCP_ENTRY_EMPTY_RECORD_KEYS, MCP_SERVER_ENTRY_KEYS, MCP_TRANSPORT_EMPTY_ARRAY_KEYS, MCP_TRANSPORT_EMPTY_RECORD_KEYS, STDIO_MCP_TRANSPORT_KEYS, requestEntryIdentityRefusal, requestEntryToolAxesRefusal, validateRequestMcp, } from "../task-mcp.js";
-import { toCoreMcpServerSpec } from "../mcp-assertion-header.js";
-import { buildDisplaySafeUrl } from "../trace/redact.js";
+import { keyClosureClause, scanKeyClosure } from "../request-key-closure.js";
+import { requestMcpDeclarationRefusal, validateRequestMcp } from "../task-mcp.js";
+import { specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "../mcp-assertion-header.js";
 import { projectWiringManifestMcpRows } from "../trace/project.js";
+import { buildBoundedToolNames } from "../panel-tool-names.js";
 export const MCP_PROBE_REFUSAL_CODES = [
     "capability.mcp_injection_required",
     "limit.rate_exceeded",
@@ -42,113 +41,6 @@ const shapeRefusal = (message, unknownKeys) => ({
     ...(unknownKeys !== undefined ? { unknownKeys } : {}),
 });
 const fieldRefusal = (message) => ({ errorCode: "request.field_invalid", message });
-function entryKeyIssue(entry, at) {
-    const buckets = { unknown: [], unsupported: [] };
-    scanKeyClosure(entry, `${at}.`, new Set(MCP_SERVER_ENTRY_KEYS), NO_TOLERATED_KEYS, buckets);
-    const t = entry.transport;
-    if (t !== null && typeof t === "object" && !Array.isArray(t)) {
-        const kind = t.kind;
-        const keys = kind === "stdio" ? STDIO_MCP_TRANSPORT_KEYS : kind === "http" ? HTTP_MCP_TRANSPORT_KEYS : undefined;
-        if (keys !== undefined)
-            scanKeyClosure(t, `${at}.transport.`, new Set(keys), NO_TOLERATED_KEYS, buckets);
-    }
-    if (buckets.unknown.length === 0) {
-        const refusal = requestEntryIdentityRefusal(entry, at);
-        if (refusal === undefined)
-            return null;
-        return refusal.errorCode === "request.body_shape" ? shapeRefusal(refusal.message) : fieldRefusal(refusal.message);
-    }
-    buckets.unknown.sort();
-    return shapeRefusal(`body: unrecognized key(s) on an MCP declaration — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
-        `${keyClosureClause(buckets.unknown, "unknown (not an mcpServers[] key — check the spelling)")}. ` +
-        `Accepted per entry: ${[...MCP_SERVER_ENTRY_KEYS].sort().join(",")} (transport.kind "stdio": ${[...STDIO_MCP_TRANSPORT_KEYS].sort().join(",")}; "http": ${[...HTTP_MCP_TRANSPORT_KEYS].sort().join(",")})`, buckets.unknown);
-}
-function entryValueIssue(entry, at) {
-    const axesRefusal = requestEntryToolAxesRefusal(entry, at);
-    if (axesRefusal !== undefined)
-        return fieldRefusal(axesRefusal.message);
-    const read = validateRequestMcp([entry]);
-    if (read === null)
-        return fieldRefusal(`${at} is not a readable MCP declaration`);
-    const dropped = read.dropped[0];
-    if (dropped !== undefined || read.ok.length !== 1) {
-        const field = dropped?.field ?? "entry";
-        return fieldRefusal(`${at}.${field} is not a usable value${urlEchoFor(entry, field)} — this endpoint refuses the whole list rather than dialing a silently shortened one` +
-            ` (a probe answering "can I use these" must not quietly answer about fewer)`);
-    }
-    if (read.badContentOrigin.length > 0) {
-        return fieldRefusal(`${at}.contentOrigin must be one of ${CONTENT_ORIGIN_WORDS.map((w) => `"${w}"`).join(" | ")} — got ${describeBadContentOrigin(entry.contentOrigin)} (omit the key for the default: this server's tools classify as external content)`);
-    }
-    const read0 = read.ok[0];
-    return declarationDowngradeIssue(entry, read0 === undefined ? undefined : toCoreMcpServerSpec(read0), at);
-}
-function declarationDowngradeIssue(entry, spec, at) {
-    if (spec === undefined)
-        return fieldRefusal(`${at} is not a readable MCP declaration`);
-    const diff = jsonPathDiff(stripEquivalentEmpties(declaredAsJudged(entry)), stripEquivalentEmpties(spec), at);
-    if (diff.length === 0)
-        return null;
-    diff.sort();
-    return fieldRefusal(`${keyClosureClause(diff, "unusable value(s)")} — this deployment's declaration reader could not use these exactly as written, and a probe must not dial a configuration that differs from the one you declared` +
-        " (this endpoint refuses, because the reading would then describe a server you did not ask about)");
-}
-function declaredAsJudged(entry) {
-    const declared = entry;
-    if (!("toolAxes" in declared))
-        return declared;
-    const read = readMcpToolAxes(declared.toolAxes);
-    if (!read.ok)
-        return declared;
-    const { toolAxes: _declaredAxes, ...rest } = declared;
-    return read.toolAxes === undefined ? rest : { ...rest, toolAxes: read.toolAxes };
-}
-function stripEquivalentEmpties(entry) {
-    const emptyRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v) && Object.keys(v).length === 0;
-    const emptyArray = (v) => Array.isArray(v) && v.length === 0;
-    const keep = (bag, recordKeys, arrayKeys) => {
-        const out = {};
-        for (const [k, v] of Object.entries(bag)) {
-            if (recordKeys.includes(k) && emptyRecord(v))
-                continue;
-            if (arrayKeys.includes(k) && emptyArray(v))
-                continue;
-            out[k] = v;
-        }
-        return out;
-    };
-    const top = keep(entry, MCP_ENTRY_EMPTY_RECORD_KEYS, MCP_ENTRY_EMPTY_ARRAY_KEYS);
-    const t = top.transport;
-    if (t !== null && typeof t === "object" && !Array.isArray(t)) {
-        top.transport = keep(t, MCP_TRANSPORT_EMPTY_RECORD_KEYS, MCP_TRANSPORT_EMPTY_ARRAY_KEYS);
-    }
-    return top;
-}
-function jsonPathDiff(a, b, path) {
-    if (canonicalJson(a) === canonicalJson(b))
-        return [];
-    const aRec = a !== null && typeof a === "object" && !Array.isArray(a) ? a : undefined;
-    const bRec = b !== null && typeof b === "object" && !Array.isArray(b) ? b : undefined;
-    if (aRec !== undefined && bRec !== undefined) {
-        const out = [];
-        for (const k of new Set([...Object.keys(aRec), ...Object.keys(bRec)]))
-            out.push(...jsonPathDiff(aRec[k], bRec[k], `${path}.${k}`));
-        return out.length > 0 ? out : [path];
-    }
-    if (Array.isArray(a) && Array.isArray(b) && a.length === b.length) {
-        const out = [];
-        for (let i = 0; i < a.length; i++)
-            out.push(...jsonPathDiff(a[i], b[i], `${path}[${i}]`));
-        return out.length > 0 ? out : [path];
-    }
-    return [path];
-}
-function urlEchoFor(entry, field) {
-    if (field !== "transport.url")
-        return "";
-    const t = entry.transport;
-    const raw = t !== null && typeof t === "object" ? t.url : undefined;
-    return typeof raw === "string" ? ` (got "${buildDisplaySafeUrl(raw)}"; an MCP declaration's address must be an http(s) URL — put credentials in transport.headers, never in the URL)` : "";
-}
 export function readMcpProbeBody(raw) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw))
         return { ok: false, refusal: shapeRefusal("body must be a JSON object of the shape { mcpServers: [ … ] } (the same declaration list a task submits)") };
@@ -164,32 +56,30 @@ export function readMcpProbeBody(raw) {
         };
     }
     const list = raw.mcpServers;
-    if (!Array.isArray(list))
-        return { ok: false, refusal: shapeRefusal("mcpServers must be an array of MCP server declarations (send [] to ask about nothing)") };
-    if (list.length > MAX_REQUEST_MCP_SERVERS) {
-        return { ok: false, refusal: fieldRefusal(`mcpServers carries ${list.length} declarations, above this deployment's ceiling of ${MAX_REQUEST_MCP_SERVERS} — the probe dials every one of them, so the list is refused whole rather than silently truncated to a partial answer`) };
-    }
-    for (let i = 0; i < list.length; i++) {
-        const at = `mcpServers[${i}]`;
-        const entry = list[i];
-        if (entry === null || typeof entry !== "object" || Array.isArray(entry))
-            return { ok: false, refusal: shapeRefusal(`${at} must be an object`) };
-        const keyIssue = entryKeyIssue(entry, at);
-        if (keyIssue)
-            return { ok: false, refusal: keyIssue };
-        const valueIssue = entryValueIssue(entry, at);
-        if (valueIssue)
-            return { ok: false, refusal: valueIssue };
-    }
+    if (list === undefined || list === null)
+        return { ok: false, refusal: shapeRefusal("mcpServers is required: the declaration list to probe (send [] to ask about nothing)") };
+    const refusal = requestMcpDeclarationRefusal(list);
+    if (refusal !== undefined)
+        return { ok: false, refusal };
     const validated = validateRequestMcp(list);
-    if (validated === null || validated.ok.length !== list.length) {
+    const declared = Array.isArray(list) ? list.length : 0;
+    if (validated === null || validated.ok.length !== declared) {
         return {
             ok: false,
-            refusal: fieldRefusal(`mcpServers: this deployment's declaration reader answered differently for the list (${validated === null ? 0 : validated.ok.length}) than it did entry by entry (${list.length}),` +
-                " so the probe refuses rather than dialing a silently shortened list. This is a belt on a path that should not be reachable (the reader is deterministic and the list was already capped)," +
+            refusal: fieldRefusal(`mcpServers: this deployment's declaration reader kept ${validated === null ? 0 : validated.ok.length} of the ${declared} declarations its judge accepted,` +
+                " so the probe refuses rather than dialing a silently shortened list. This is a belt on a path that should not be reachable (the judge and the reader read every key with the same predicate)," +
                 " so nothing in your body needs changing — if you see it, this deployment has a bug worth reporting"),
         };
     }
+    const carried = validated.ok.findIndex(specWithholdsMcpAssertionHeader);
+    if (carried >= 0) {
+        return {
+            ok: false,
+            refusal: fieldRefusal(`mcpServers[${carried}].transport.assertionHeader is declared, but this engine does not send an assertion header yet — a task would mount the server WITHOUT it, ` +
+                "so a probe dialing it would describe a configuration you did not declare (a server that answers the handshake and asks for the assertion only on calls would read as connected). " +
+                "Probe the entry without the key to see how the server answers without it"),
+        };
+    }
     return { ok: true, specs: validated.ok.map(toCoreMcpServerSpec) };
 }
 export function buildMcpProbeIdentity(principal) {
@@ -249,6 +139,22 @@ export function createMcpProbeLocal() {
         inflight: () => [...cache.values()].filter((v) => v.settledAt === undefined).length,
     };
 }
+export function buildMcpProbeFaceRows(rows, readings) {
+    if (!Array.isArray(readings) || readings.length !== rows.length) {
+        const got = Array.isArray(readings) ? `${readings.length} readings` : "no reading array";
+        throw new McpProbeMisaligned(`mcp probe returned ${got} for the ${rows.length} rows it must align with by index — refusing to publish tool names a consumer would mis-pair`);
+    }
+    return rows.map((row, i) => {
+        const reading = readings[i];
+        const tools = typeof reading === "object" && reading !== null ? reading.tools : undefined;
+        if (!isStringList(tools))
+            return row;
+        return { ...row, ...buildBoundedToolNames(tools) };
+    });
+}
+function isStringList(v) {
+    return Array.isArray(v) && Array.from(v).every((t) => typeof t === "string");
+}
 export function createMcpProbeWalk(specs, principal, now = Date.now) {
     const bound = buildMcpProbeWalkTimeoutMs(specs.length);
     const controller = new AbortController();
@@ -271,9 +177,9 @@ export function createMcpProbeWalk(specs, principal, now = Date.now) {
             const result = await Promise.race([dials, deadline]);
             const rows = projectWiringManifestMcpRows(result.entries) ?? [];
             if (rows.length !== specs.length) {
-                throw new Error(`mcp probe row count ${rows.length} does not match the ${specs.length} declarations it must align with by index — refusing to publish a list a consumer would mis-pair`);
+                throw new McpProbeMisaligned(`mcp probe row count ${rows.length} does not match the ${specs.length} declarations it must align with by index — refusing to publish a list a consumer would mis-pair`);
             }
-            return { probedAt: new Date(now()).toISOString(), ttlSec: Math.floor(MCP_PROBE_CACHE_TTL_MS / 1000), servers: rows };
+            return { probedAt: new Date(now()).toISOString(), ttlSec: Math.floor(MCP_PROBE_CACHE_TTL_MS / 1000), servers: buildMcpProbeFaceRows(rows, result.servers) };
         }
         finally {
             if (timer !== undefined)
@@ -283,6 +189,12 @@ export function createMcpProbeWalk(specs, principal, now = Date.now) {
     answer.catch(() => undefined);
     return { answer, dials };
 }
+export class McpProbeMisaligned extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpProbeMisaligned";
+    }
+}
 export class McpProbeIncomplete extends Error {
     boundMs;
     constructor(boundMs) {