@sema-agent/server 7.132.0 → 7.134.0

package/dist/session-sync-kernel.d.ts

@@ -6,10 +6,11 @@
  * symbols WITHOUT touching the orchestration module — session-sync.ts value-imports StoreBackend and type-imports
  * security's OwnerAwareSessionStore, so importing it from security.ts formed the repo's only true type cycle
  * (security ↔ session-sync; lens2 §B/§E). This file imports nothing from the repo but TYPES from leaves (core types, and
- * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
+ * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. Its one VALUE import is
+ * core's `SessionError` class (the closed-set store error the three adapters already throw). session-sync.ts re-exports everything here, so existing import sites
  * keep working unchanged.
  */
-import type { SessionTreeEntry } from "@sema-agent/core";
+import { SessionError, type SessionTreeEntry } from "@sema-agent/core";
 import type { SessionFace } from "./session-incarnation.js";
 /**
  * P1d-β (PUSH streaming, sema-internal server/docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
@@ -23,8 +24,9 @@ import type { SessionFace } from "./session-incarnation.js";
  * Invariants the implementations uphold:
  *  - The staging rows live under `stagingId = ${realSessionId}#stg-${token}` (the `#` is illegal in a real uuidv7, so
  *    it can NEVER collide with a real session id) and have NO `session_meta` row → they are INVISIBLE to wake / ownerOf
- *    / listSessions (the existing orphan invariant) until `commit` writes the real session_meta LAST as the sole
- *    commit point. A crash before commit leaves only collectable orphan staging rows, never a half-session.
+ *    / listSessions (the existing orphan invariant) until `commit`'s transaction COMMITs the real session_meta row together
+ *    with the swap (the sole commit point; a fresh push claims that row first inside the same txn, invisible to everyone else
+ *    until COMMIT). A crash before commit leaves only collectable orphan staging rows, never a half-session.
  *  - `appendBatch` is IDEMPOTENT (INSERT … ON DUPLICATE KEY / ON CONFLICT DO NOTHING on the `(session_id, entry_id)`
  *    uk), so a re-streamed batch (a resumed Phase B) is a no-op.
  *  - `commit` re-classifies the relation IN-TXN against the dst's CURRENT entry ids (closing the Phase-A plan→commit
@@ -38,23 +40,48 @@ export interface StagingHandle {
     /** Append a bounded batch of entries to the staging id, re-seq'd dense from a running counter held in the handle.
      *  Idempotent (ON DUPLICATE KEY / ON CONFLICT DO NOTHING) — a re-streamed batch is a no-op. One txn per batch. */
     appendBatch(entries: SessionTreeEntry[]): Promise<void>;
-    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): in-txn re-classify (TOCTOU close) → purge dst
-     *  → row-key rename staging→real → session_meta LAST (the commit point). `owner` is re-stamped (§9). Throws
-     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation **and the settled session
+    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): owner CAS ({@link StagedCommitOptions.expectedOwner},
+     *  before anything about the row is classified or reported, so a refused commit reveals nothing about a row it did not judge — no
+     *  placement, no relation, no entry ids) → in-txn re-classify
+     *  (TOCTOU close) → purge dst → row-key rename staging→real → session_meta settled; COMMIT is the commit point. `owner` is re-stamped (§9).
+     *  Throws {@link StagedCommitOwnerChangedError} when the owner cell is not the one the import's gate judged, and
+     *  {@link SyncConflictError} on an unconsented fork/stale flip — both after rolling back. Returns the committed relation **and the settled session
      *  face** — the occupant (owner + incarnation) the commit left in the real session id, read INSIDE the same txn (the local
      *  store: the same hold of the session's write lock), never re-read afterwards. The post-commit replays conditioned on the
      *  occupant (the session row's two bits) write on exactly this face — a session deleted and re-created after the commit,
      *  even by the same owner, is a different occupant and is not written. A row without an incarnation is refused at that read
      *  (`sessionFaceFromRow`, the same law as every face read). */
-    commit(owner: string | null, opts?: {
-        resolution?: "overwrite-dst";
-    }): Promise<{
+    commit(owner: string | null, opts: StagedCommitOptions): Promise<{
         relation: SyncRelation["relation"];
         face: SessionFace;
     }>;
     /** Drop the staging rows (Phase B aborted before commit) — DELETE the staging-id session_event rows. Idempotent. */
     abort(): Promise<void>;
 }
+/**
+ * What a staged commit is conditioned on (S-1938 — one gate predicate, two phases). `expectedOwner` = the owner cell the import's gate
+ * judged when it opened the staging, in the `ownerOf` reading: `undefined` = no such session (a fresh push), `null` = ownerless, a string =
+ * that owner. The route judges `mayTouch` on that cell at Phase A and again on the session's current cell right before Phase B commits; the
+ * commit itself lands only on that same cell — each store compares it inside the commit txn (local: inside the session's write lock) and, when
+ * the cell differs, rolls back and throws {@link StagedCommitOwnerChangedError} without writing a byte. The compare is on the owner cell, not
+ * on the incarnation: the gate's predicate reads only the owner (plus placement, which the commit gate refuses on its own), so a same-owner
+ * re-create is judged the same and is not a reason to refuse.
+ */
+export interface StagedCommitOptions {
+    readonly expectedOwner: string | null | undefined;
+    readonly resolution?: "overwrite-dst";
+}
+/**
+ * The staged commit's owner CAS did not hold: the session's owner cell at commit time is not the one the import's gate judged (another replica
+ * deleted / re-created / claimed / created the session while the import streamed). Code = core's closed-set `conflict` (wire: the import face's
+ * row in `session-error-wire.ts`, 409); thrown after the commit txn rolled back — the destination is untouched. The three stores throw this one
+ * class (one sentence, minted here).
+ */
+export declare class StagedCommitOwnerChangedError extends SessionError {
+    constructor(sessionId: string);
+}
+/** The owner-cell comparison of {@link StagedCommitOptions.expectedOwner} against a store's own `ownerOf`-shaped read (`undefined` = no row). */
+export declare function ownerCellIs(expectedOwner: string | null | undefined, actual: string | null | undefined): boolean;
 /** A session store that can stage a streamed import (P1d-β). The 3 backends implement it; the in-memory dev store
  *  does not → the method is optional (the route 501s when absent, parity with the other §0.5 optional seams). */
 export type ImportStagingStore = {

package/dist/session-sync-kernel.js

@@ -1,3 +1,13 @@
+import { SessionError } from "@sema-agent/core";
+export class StagedCommitOwnerChangedError extends SessionError {
+    constructor(sessionId) {
+        super("conflict", `session ${sessionId}: owner changed while the import streamed — the staged commit was rolled back`);
+        this.name = "StagedCommitOwnerChangedError";
+    }
+}
+export function ownerCellIs(expectedOwner, actual) {
+    return expectedOwner === undefined ? actual === undefined : actual !== undefined && (actual ?? null) === expectedOwner;
+}
 export function stagingIdFor(realSessionId, token) {
     return `${realSessionId}#stg-${token}`;
 }

package/dist/session-titled-frame.d.ts

@@ -0,0 +1,33 @@
+/**
+ * **会话标题帧 `session_titled`** —— 标题器把标题写进会话行**之后**,在**这条 run 的活流**上自铸的一帧(契约 §4a-ttl)。
+ *
+ * ## 为什么有这一帧
+ * 标题器是 fire-and-forget:run 被引擎受理之后才起、在 run 跑的同时生成,写成时那条 run 的流往往还开着。此前写成只落行
+ * (`setTitleIfNull`)+ 一行运维日志 —— wire 上零通知,端上(桌面 / web 座位)只能在首轮之后有界轮询读会话行。
+ * 这一帧把「标题写成了」交给已经在 tail 这条流的人,轮询可以删。
+ *
+ * ## 律(一条)
+ * **只活不存**:会话行是标题的唯一真源,本帧只是「行刚刚变了」的活通知 —— 不落账本(`GET /v1/runs/:id/events` 回放读不出它)、
+ * 不进任何重放面;冷启动 / 多窗口 / 断线重连读会话行(`GET /v1/sessions` 的列表行 `title`;`/v1/sessions/:id/head` 只带 `leafId`,不是标题的读面)。因此:
+ *  · 读者 = **这条 run 的流读者**,与会话行的读权同一(流是提交这条 run 的人开的,会话行归同一个人);
+ *  · 只有持活流的腿才收得到(今天 = `POST /v1/tasks/stream`);同步 JSON 腿 / durable 后台腿没有活流 ⇒ 这一帧结构上不存在,读行;
+ *  · 流已经走到终帧(`done`)或连接已断 ⇒ 丢弃(终帧是流的最后一帧);
+ *  · `PATCH /v1/sessions/:id` 的改名 / 置顶不经标题器 ⇒ 不发(调用方自知);用户清空标题后下一次提交由标题器重填,那一次重填照发(例外:本进程里此前为这个会话生成失败 / 回空过 —— 标题器不再为它重试,直到进程重启)。
+ *
+ * ## 谁铸
+ * 唯一铸点 = {@link buildSessionTitledFrame},唯一调用方 = `session-titler.ts`(落行成功的那一支,实参 = 落进行里的**同一个**标题 ——
+ * 已脱敏、已清洗;帧上的标题与行上的标题是一个值,不从模型原文另铸)。键集登记在 `trace/self-minted-wire.ts` 的 `sessionTitledFrameKey`
+ * (成员集 `satisfies Record<keyof SessionTitledFrame, …>`:加一个键而登记没跟 ⇒ tsc 红)。
+ *
+ * 帧上没有 `eventId` ⇒ SSE 不发 `id:` 行(契约 §0.6「无锚不发行」):它不是引擎的内容帧,没有续流位置可言。
+ */
+/** 标题帧的形 —— 键集就是这个接口的键(登记表按 `keyof` 绑定)。 */
+export interface SessionTitledFrame {
+    readonly type: "session_titled";
+    readonly sessionId: string;
+    /** 落进会话行的那个标题(已过标题器的脱敏与清洗,≤ `TITLE_MAX_CHARS` 个字符)。 */
+    readonly title: string;
+}
+/** 唯一铸点:纯数据,无行为。 */
+export declare function buildSessionTitledFrame(sessionId: string, title: string): SessionTitledFrame;
+//# sourceMappingURL=session-titled-frame.d.ts.map

package/dist/session-titled-frame.js

@@ -0,0 +1,4 @@
+export function buildSessionTitledFrame(sessionId, title) {
+    return { type: "session_titled", sessionId, title };
+}
+//# sourceMappingURL=session-titled-frame.js.map

package/dist/session-titler.d.ts

@@ -13,6 +13,11 @@
  * cheap-model one-liner via the deployment's hookLlm face (summarize role → MODEL_CHEAP_ID when configured, else the
  * main model; bounded + timed out).
  *
+ * WRITE-AFTER NOTICE: the title that lands is announced to the run that triggered it — `maybeTitle`'s `onTitled` hands the
+ * seat (`run-acceptance.ts`) the one `session_titled` frame (`session-titled-frame.ts`, contract §4a-ttl) built from the
+ * SAME string the row now holds; the seat forwards it to the live stream when the leg has one. Live-only: the row is the
+ * truth, nothing else stores the frame.
+ *
  * FAILURE POSTURE: everything is best-effort — a generation/store failure logs and leaves title null (the
  * list falls back to objectivePreview). The fail-open tag it leaves names the CAUSE FAMILY (one tag, one family):
  * the llm face's failure CODE picks it (`failOpenTagFor`), never the error's wording. An in-process pending set dedupes concurrent submits on the same
@@ -20,6 +25,7 @@
  * call at worst, and exactly one title lands).
  */
 import type { HookLlmFailureCode } from "./hooks/hook-runner.js";
+import { type SessionTitledFrame } from "./session-titled-frame.js";
 export interface SessionTitlerDeps {
     /** Secret scrub applied to the RAW llm text before sanitize/persist (workflow audit 2026-07-13: the
      *  objective may carry a pasted secret and the model can echo it into the title — titles are persisted,
@@ -58,7 +64,9 @@ export interface SessionTitlerDeps {
 export interface SessionTitler {
     /** Fire-and-forget: maybe generate + persist a title for this session. Never throws, never blocks the caller. */
     /** `model`([ref]②)= 本 turn 真实驱动的模型——带上则标题 hook 同链路,不再裸落 env 缺省。 */
-    maybeTitle(sessionId: string, objective: string, model?: string): void;
+    /** `onTitled` = 这一次调用**自己**把标题写成之后(`setTitleIfNull` 落行)交出的活通知(`session_titled` 帧,契约 §4a-ttl):只在落行的那一支调用恰一次 ——
+     *  已有标题 / 竞态输了 / 模型失败 / 空标题 / 这个会话已有一次在飞的调用,都不调。回调同步执行、**不许抛**;抛了也不影响已落行的标题(见下 `frame_failed`)。 */
+    maybeTitle(sessionId: string, objective: string, model?: string, onTitled?: (frame: SessionTitledFrame) => void): void;
 }
 export declare const TITLE_MAX_CHARS = 80;
 /** Single line, control chars stripped, hard cap; surrounding quotes (a common LLM tic) trimmed. */

package/dist/session-titler.js

@@ -1,7 +1,8 @@
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
 import { userAuthoredText } from "./user-authored-text.js";
+import { buildSessionTitledFrame } from "./session-titled-frame.js";
 export const TITLE_MAX_CHARS = 80;
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
@@ -29,7 +30,7 @@ function failOpenTagFor(code) {
     }
 }
 export function sanitizeTitle(raw) {
-    const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
+    const oneLine = stripControlAndBidi(raw.replace(/[\r\n]+/g, " ")).trim();
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
     return unquoted.length > TITLE_MAX_CHARS ? `${unquoted.slice(0, TITLE_MAX_CHARS - 1)}…` : unquoted;
 }
@@ -45,8 +46,9 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
+    const redactedError = (error) => redactSecrets(error);
     const logFailure = (sessionId, error, code) => {
-        const safe = redactSecrets(error);
+        const safe = redactedError(error);
         deps.logger?.debug?.("session_title_failed", { sessionId, error: safe.slice(0, 200) });
         recordFailOpen(failOpenTagFor(code), safe.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
@@ -55,7 +57,7 @@ export function createSessionTitler(deps) {
         .then((state) => ({ state, unreadable: false }))
         .catch(() => ({ state: continueWord, unreadable: true }));
     return {
-        maybeTitle(sessionId, objective, model) {
+        maybeTitle(sessionId, objective, model, onTitled) {
             if (!sessionId || !userAuthoredText(objective))
                 return;
             if (seen.has(sessionId))
@@ -104,6 +106,15 @@ export function createSessionTitler(deps) {
                 seen.delete(sessionId);
                 deps.metrics?.inc("session_title_total", { outcome: "set" });
                 deps.logger?.info?.("session_titled", { sessionId, titleChars: title.length });
+                if (onTitled) {
+                    try {
+                        onTitled(buildSessionTitledFrame(sessionId, title));
+                    }
+                    catch (e) {
+                        deps.metrics?.inc("session_title_total", { outcome: "frame_failed" });
+                        deps.logger?.warn?.("session_titled_frame_failed", { sessionId, error: redactedError(String(e)).slice(0, 200) });
+                    }
+                }
             })().catch((e) => {
                 deps.metrics?.inc("session_title_total", { outcome: "error" });
                 logFailure(sessionId, String(e));

package/dist/spec-fields.js

@@ -1,6 +1,6 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
-import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
+import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { ruleEntryListShapeOk, skillToolListsOverCap } from "./rule-entry-list.js";
 import { describeLimit, limitFacts, limitRefusal } from "./limit-refusal.js";
 import { quotedCallerText } from "./caller-text-echo.js";
@@ -110,6 +110,23 @@ const skillOk = (s) => {
     }
     return true;
 };
+const skillsLimit = (v) => {
+    if (!Array.isArray(v))
+        return undefined;
+    const j = v.findIndex((s) => !skillOk(s));
+    const s = j < 0 ? undefined : v[j];
+    if (!plainObject(s))
+        return undefined;
+    const content = s["content"];
+    const baseDir = s["baseDir"];
+    if (typeof content === "string" && content.length > MAX_AGENT_SKILL_CONTENT_CHARS) {
+        return { sub: `[${j}].content`, measure: "characters", count: content.length, cap: MAX_AGENT_SKILL_CONTENT_CHARS, keepShapeSentence: true };
+    }
+    if (typeof baseDir === "string" && baseDir.length > ABSOLUTE_HOST_PATH_MAX) {
+        return { sub: `[${j}].baseDir`, measure: "characters", count: baseDir.length, cap: ABSOLUTE_HOST_PATH_MAX, keepShapeSentence: true };
+    }
+    return undefined;
+};
 const memoryOk = (v) => {
     if (!plainObject(v))
         return false;
@@ -140,6 +157,7 @@ const TASK_AGENT_FIELD_SHAPES = {
     skills: {
         desc: "an array of { name, description, content } skill objects (optional allowedTools/disallowedTools/files/baseDir; allowedTools/disallowedTools are arrays of strings; files entries need { path, content }; baseDir must be an absolute path with no \"..\" segment) — no count cap; the engine renders the listing within its own byte budget",
         ok: (v) => Array.isArray(v) && v.every(skillOk),
+        limit: skillsLimit,
     },
     background: { desc: "a boolean", ok: (v) => typeof v === "boolean" },
     isolation: { desc: '"worktree"', ok: (v) => v === "worktree" },
@@ -180,7 +198,8 @@ export function taskAgentIssue(item) {
         if (hit === undefined)
             return { message: `agent.${k} must be ${shape.desc}` };
         const rel = `${k}${hit.sub}`;
-        return { message: describeLimit(`agent.${rel}`, hit.measure, hit.count, hit.cap), limit: { rel, measure: hit.measure, count: hit.count, cap: hit.cap } };
+        const limit = { rel, measure: hit.measure, count: hit.count, cap: hit.cap };
+        return hit.keepShapeSentence === true ? { message: `agent.${k} must be ${shape.desc}`, limit } : { message: describeLimit(`agent.${rel}`, hit.measure, hit.count, hit.cap), limit };
     }
     return null;
 }

package/dist/sql-engine-posture.d.ts

@@ -60,7 +60,9 @@ export interface SqlEngineCapability {
 }
 /**
  * Boot 期建立引擎事实:借一条池连接(初始化随之跑),再原样归还。返回本池的**引擎读口**(驱动本身:方言 + 活的 `facts`)—— 事实由
- * 驱动持有,重连后它会被下一次初始化刷新,快照会说谎;方言与事实同出这一只,写入要装进的墙(`sqlWallsOf`)只读它。
+ * 驱动持有,重连后它会被下一次初始化刷新,快照会说谎;方言与事实同出这一只,写入要装进的墙(`sqlWallsOf`)只读它。读到的是**最近一次初始化的那条连接**的事实:隔离级 / 事务模式每条连接
+ * 同钉同验,所以就是池的事实;包墙 `maxPacketBytes` 是会话值、随连接不同,这里只是那一条连接的读数(池见过的最新读数 —— 只在有连接初始化时才更新,DBA 调了全局值之后、下一条连接初始化之前它仍是旧值;
+ * 运维读面与提交受理口的提前一跑读它),终判读将要执行写入的那条连接自己的读数(`sql-driver.ts` `connectJudged`)。
  *
  * 抛出 = 拒启:连接初始化拒绝了这个后端(TiDB 乐观模式设不成悲观、隔离级复核不符、服务器太旧读不出
  * `@@transaction_isolation`)。这条错**刻意不吞** —— 本仓所有 `FOR UPDATE` 判据都以它为前提。

package/dist/task-a2a.js

@@ -1,7 +1,8 @@
-import { readToolAxes, resolveComplianceDenies } from "@sema-agent/core";
+import { resolveComplianceDenies } from "@sema-agent/core";
 import { isUsableWireName } from "@sema-agent/settings-schema";
 import { HttpError } from "./security.js";
 import { readPlainStringRecord } from "./plain-string-record.js";
+import { readRequestToolAxes } from "./request-tool-axes.js";
 import { echoKeyName } from "./request-key-closure.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
@@ -45,12 +46,12 @@ function normalizeA2aPeer(e, leg, storedToolAxes) {
     if (Array.isArray(o.allowSkills))
         spec.allowSkills = o.allowSkills;
     if (o.toolAxes !== undefined) {
-        const axes = readToolAxes(o.toolAxes, "a2a");
+        const axes = readRequestToolAxes(o.toolAxes, "a2a");
         if (!axes.ok && storedToolAxes !== undefined) {
             const before = storedToolAxes.a2a(o.toolAxes);
             if (before === null)
                 return dropped;
-            const again = readToolAxes(before, "a2a");
+            const again = readRequestToolAxes(before, "a2a");
             if (!again.ok)
                 return dropped;
             if (again.toolAxes !== undefined)

package/dist/task-cwd.d.ts

@@ -34,7 +34,7 @@ export declare function cwdHonored(config: {
 }): boolean;
 /**
  * S-377 —— 「**工具跑的那台机器**就是本进程这台吗」。回答的是一个**文件系统同一性**问题,不是权限问题:
- * server 盘上的一条绝对路径(出厂 `SKILLS_DIR` 下某个技能自己的目录)对模型的工具**有没有意义**。
+ * server 盘上的一条绝对路径(出厂 `SKILLS_DIR` 下、或中心 plugin 缓存里某个技能自己的目录)对模型的工具**有没有意义**。
  *
  * 判据 = 能力表两位的合取 {@link handsOnWorkerFilePlane}(`coreRemoteExecutionEnv ∧ hostFilePlane`,都读表,
  * 本函数不手写任何车道词):

package/dist/task-mcp.d.ts

@@ -158,13 +158,13 @@ export interface RequestMcpRefusal {
  *  ② **键名**:条目层、或 `transport` 按 `kind` 那一形的键闭集之外的键 ⇒ `400 request.body_shape`,拒体带 `unknownKeys`(拼错的键被悄悄不读,同样读起来像生效了)。
  *  ③ **身份头的键组合**(`principalHeader` 与 `assertionHeader` 同设 / `assertionHeader` 非串)⇒ {@link requestEntryIdentityRefusal}(同设那一句对契约包解析期原句逐字)。
  *  ④ **受理键的值** ⇒ 逐键问判官表 {@link ENTRY_KEY_JUDGES},`400 request.field_invalid`,拒句点名 `mcpServers[i].<键路径>`、server 名与**该键判官的原因句**({@link entryFieldRefusal})。
- *     判官**就是读器用的那一只**,不是第二份:`toolAxes` = 引擎根导出的 `readMcpToolAxes`;`toolFaces` = `readMcpToolFaces`;`contentOrigin` = `isContentOriginWord`;`source` = `isMcpSourceLabel`;
- *     `name` = `isUsableWireName`;`allowTools` / `transport.args` = {@link isStringArray};`transport.env` / `headers` = {@link readPlainStringRecord};`elicitation` = {@link isElicitationFlag};
- *     `transport` 的硬字段(`kind` / `command` / `url`)与软字段(`args` / `env` / `headers` / `principalHeader`)= {@link readRequestTransport}(读器投影 transport 的那一只函数,门读它报的 `lost`)。
- *     判官只在引擎里、包根没给读口的键(今天只有 `startupTimeoutMs`)不在这里判,原样过境、由引擎在拨号时按 server 拒(不写第二份判据;到货读口即换)。
+ *     判官**就是读器用的那一只**,不是第二份:`toolAxes` = {@link readRequestToolAxes}(引擎根导出的 `readToolAxes` + 请求腿不收 `boundaryFlow`);`toolFaces` = 引擎根导出的 `readToolFaces`;
+ *     `startupTimeoutMs` = 引擎根导出的 `mcpStartupTimeoutMs`(坏值抛 `config.mcp_startup_timeout_invalid`,本门把那一句作原因句);`contentOrigin` = `isContentOriginWord`;`source` = `isMcpSourceLabel`;
+ *     `name` = `isUsableWireName`;`allowTools` / `transport.args` = {@link isStringArray};`transport.env` / `headers` = 契约包读器 {@link readRequestMcpTransport} 的纯数据记录读法;`elicitation` = {@link isElicitationFlag};
+ *     `transport` 的硬字段(`kind` / `command` / `url`)与软字段(`args` / `env` / `headers` / `principalHeader`)= {@link readRequestMcpTransport}(读器投影 transport 的那一只函数,门读它报的 `lost`;读器在契约包,本仓只据 `lost[0]` 拒、据 `lost` 在重放腿逐处点名)。
  * 于是判官受理的条目,读器({@link normalizeServer})交回的就是申报本身(只差判官自己的合法归一:空容器 / `skillScopeEligible:false` 折成缺席、`toolAxes` 取引擎的拷贝)——
  * 探测口拨的那一份因此就是提交腿会挂的那一份,不另比一遍(另比就是第二只回答者)。唯一按门分的后果是「声明了 `assertionHeader`」这一个事实(引擎尚无座,
- * 承载、不发送):新提交照挂 + 运维 info,探测口整条拒 —— 判据是同一只谓词 `declaresMcpAssertionHeader`,不是第二份判法(见 `readMcpProbeBody`)。
+ * 承载、不发送):新提交照挂 + 运维 info,探测口整条拒 —— 判据是同一只谓词 `specWithholdsMcpAssertionHeader`(开关 `MCP_ASSERTION_HEADER_SENT` 假时「声明了」即「被扣下」),不是第二份判法(见 `readMcpProbeBody`)。
  *
  * ## 射程
  * 纯值域、与租户车道无关(一个写坏的请求在哪条车道上都是写坏的;多租户腿本来就忽略整只数组,告诉调用方「你写错了」只多不少)。

package/dist/task-mcp.js

@@ -1,14 +1,11 @@
-import { mcpInjectionDroppedNotice, readMcpToolAxes, resolveComplianceDenies } from "@sema-agent/core";
-import { MCP_CONTENT_ORIGINS, describeNotStringArray, describeValueShape, isContentOriginWord, isStringArray, isUsableWireName, readMcpIdentityHeaders, } from "@sema-agent/settings-schema";
-import { describeBadContentOrigin, describeBadWireName } from "./caller-text-echo.js";
+import { mcpInjectionDroppedNotice, mcpStartupTimeoutMs, readToolFaces, resolveComplianceDenies } from "@sema-agent/core";
+import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, describeNotStringArray, describeValueShape, isContentOriginWord, isStringArray, isUsableWireName, readRequestMcpTransport, stripControlAndBidi, } from "@sema-agent/settings-schema";
 import { HttpError, createCodedHttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
-import { declaresMcpAssertionHeader, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
+import { describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
-import { readMcpToolFaces } from "./mcp-tool-faces.js";
-import { readPlainStringRecord } from "./plain-string-record.js";
+import { readRequestToolAxes } from "./request-tool-axes.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
@@ -27,62 +24,6 @@ function isRecord(v) {
 function isElicitationFlag(v) {
     return typeof v === "boolean";
 }
-const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
-function readRequestTransport(t) {
-    if (!t || typeof t !== "object")
-        return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
-    const tr = t;
-    const lost = [];
-    if (tr.kind === "stdio") {
-        if (typeof tr.command !== "string" || tr.command.length === 0)
-            return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
-        if (tr.args !== undefined && !isStringArray(tr.args))
-            lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
-        const env = readTransportRecord("transport.env", tr.env, lost);
-        return {
-            ok: true,
-            transport: {
-                kind: "stdio",
-                command: tr.command,
-                ...(isStringArray(tr.args) ? { args: tr.args } : {}),
-                ...(env !== undefined ? { env } : {}),
-            },
-            lost,
-        };
-    }
-    if (tr.kind === "http") {
-        if (typeof tr.url !== "string" || !/^https?:\/\//i.test(tr.url))
-            return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
-        const ids = readMcpIdentityHeaders(tr);
-        const headers = readTransportRecord("transport.headers", tr.headers, lost);
-        if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
-            lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
-        }
-        return {
-            ok: true,
-            transport: {
-                kind: "http",
-                url: tr.url,
-                ...(headers !== undefined ? { headers } : {}),
-                ...ids,
-            },
-            lost,
-        };
-    }
-    return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
-}
-function readTransportRecord(path, raw, lost) {
-    if (raw === undefined)
-        return undefined;
-    const read = readPlainStringRecord(raw);
-    if (!read.ok) {
-        lost.push({ path, reason: `must be a plain object of string values — ${read.member === undefined ? read.fault : `its member "${echoKeyName("", read.member)}" ${read.fault}`}` });
-        return undefined;
-    }
-    for (const m of read.stripped)
-        lost.push({ path: echoKeyName(`${path}.`, m.name), reason: m.fault });
-    return read.record;
-}
 const bad = (field) => ({ ok: false, field });
 const MALFORMED_NAME = "<malformed>";
 function declaredName(e) {
@@ -96,7 +37,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     const o = e;
     if (!isUsableWireName(o.name))
         return bad("name");
-    const read = readRequestTransport(o.transport);
+    const read = readRequestMcpTransport(o.transport);
     if (!read.ok)
         return bad(read.issue.path);
     const spec = { name: o.name, transport: read.transport };
@@ -107,14 +48,14 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     }
     if (isElicitationFlag(o.elicitation))
         spec.elicitation = o.elicitation;
-    const axes = readMcpToolAxes(o.toolAxes);
+    const axes = readRequestToolAxes(o.toolAxes, "mcp");
     let judged = axes;
     let toolAxesReread;
     if (!axes.ok && storedToolAxes !== undefined) {
-        const again = readMcpToolAxes(storedToolAxes.mcp(o.toolAxes));
+        const again = readRequestToolAxes(storedToolAxes.mcp(o.toolAxes), "mcp");
         if (again.ok) {
             judged = again;
-            toolAxesReread = axes.problem.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+            toolAxesReread = stripControlAndBidi(axes.problem);
         }
     }
     if (!judged.ok)
@@ -130,7 +71,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
     if (o.startupTimeoutMs !== undefined)
         spec.startupTimeoutMs = o.startupTimeoutMs;
-    const faces = readMcpToolFaces(o.toolFaces);
+    const faces = readToolFaces(o.toolFaces);
     if (!faces.ok)
         return bad("toolFaces");
     if (faces.faces !== undefined)
@@ -247,17 +188,29 @@ const ENTRY_KEY_JUDGES = {
     source: (o) => o.source === undefined || isMcpSourceLabel(o.source)
         ? undefined
         : { path: "source", reason: `must be a non-empty string of at most ${MCP_SOURCE_LABEL_MAX} characters (a display label) — got ${describeValueShape(o.source)}` },
-    startupTimeoutMs: () => undefined,
+    startupTimeoutMs: (o) => {
+        if (o.startupTimeoutMs === undefined)
+            return undefined;
+        try {
+            mcpStartupTimeoutMs({ name: typeof o.name === "string" ? o.name : "", startupTimeoutMs: o.startupTimeoutMs });
+            return undefined;
+        }
+        catch (e) {
+            if (e.code !== "config.mcp_startup_timeout_invalid")
+                throw e;
+            return { path: "startupTimeoutMs", reason: e instanceof Error ? e.message : String(e) };
+        }
+    },
     toolAxes: (o) => {
-        const read = readMcpToolAxes(o.toolAxes);
+        const read = readRequestToolAxes(o.toolAxes, "mcp");
         return read.ok ? undefined : { path: "toolAxes", reason: read.problem };
     },
     toolFaces: (o) => {
-        const read = readMcpToolFaces(o.toolFaces);
+        const read = readToolFaces(o.toolFaces);
         return read.ok ? undefined : { path: "toolFaces", reason: read.problem };
     },
     transport: (o) => {
-        const read = readRequestTransport(o.transport);
+        const read = readRequestMcpTransport(o.transport);
         return read.ok ? read.lost[0] : read.issue;
     },
 };
@@ -267,7 +220,7 @@ function entryFieldRefusal(entry, at, issue) {
     const server = echoKeyName("", declaredName(entry));
     return {
         errorCode: "request.field_invalid",
-        message: `${at}.${issue.path} (server "${server}") is not a usable declaration — ${issue.reason.replace(CONTROL_AND_BIDI_STRIP_RE, "")}. ${ENTRY_REFUSAL_TAIL}`,
+        message: `${at}.${issue.path} (server "${server}") is not a usable declaration — ${stripControlAndBidi(issue.reason)}. ${ENTRY_REFUSAL_TAIL}`,
     };
 }
 function requestEntryRefusal(entry, at) {
@@ -341,7 +294,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
     const closed = deploymentClosedMcpNames(baseline, reservedNames);
     const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
     for (const s of v.ok)
-        if (declaresMcpAssertionHeader(s) && !closed.has(s.name))
+        if (specWithholdsMcpAssertionHeader(s) && !closed.has(s.name))
             noteMcpAssertionHeaderNotSent(logger, s.name);
     const mounted = new Set(v.ok.filter((s) => !closed.has(s.name)).map((s) => s.name));
     for (const e of entries.slice(0, MAX_REQUEST_MCP_SERVERS)) {