@sema-agent/server 7.132.0 → 7.134.0

package/dist/web-admin-client/apply-effective.js

@@ -64,7 +64,27 @@ export function mutateInPlace(target, source) {
     Object.assign(target, source);
 }
 const appliedGeneration = new WeakMap();
-const envRolesBaseline = new WeakMap();
+const envModelPlane = new WeakMap();
+function envModelPlaneOf(config) {
+    let snap = envModelPlane.get(config);
+    if (snap === undefined) {
+        snap = {
+            models: { ...config.models },
+            model: config.envModel,
+            modelApiKeyEnv: { ...config.modelApiKeyEnv },
+            modelApiKeys: { ...config.modelApiKeys },
+            modelRefusals: { ...config.modelRefusals },
+            droppedCatalogEntries: [...config.droppedCatalogEntries],
+            quotaWeights: { ...config.modelQuotaWeights },
+            roles: { ...config.roles },
+            activeTiers: { ...config.tiers },
+            atMention: config.atMention,
+            infoLine: {},
+        };
+        envModelPlane.set(config, snap);
+    }
+    return snap;
+}
 function stageAtMention(raw, usableNames, logger) {
     const read = readAtMention(raw);
     if (read === undefined) {
@@ -172,7 +192,7 @@ function commitStaged(config, staged) {
         config.droppedCatalogEntries = mp.droppedCatalogEntries;
         mutateInPlace(config.modelQuotaWeights, mp.quotaWeights);
         mutateInPlace(config.models, mp.models);
-        config.model = config.models.default;
+        config.model = mp.model;
         mutateInPlace(config.roles, mp.roles);
         mutateInPlace(config.tiers, mp.activeTiers);
         config.atMention = mp.atMention;
@@ -227,7 +247,38 @@ function modelPlaneGroupReport(group) {
     };
 }
 const ROLE_BINDING_UNAVAILABLE_HINT = "tasks resolving this role fail: alias/tier expansion cannot mint this name; the engine refuses it loud — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
+export const NO_CENTER_EFFECTIVE = deepFreeze({ version: 0, updatedAt: "", models: { models: [], roles: {} }, mcp: { servers: [] } });
+export const isNoCenterEffective = (eff) => eff === NO_CENTER_EFFECTIVE;
+function deepFreeze(v) {
+    if (v !== null && typeof v === "object") {
+        for (const x of Object.values(v))
+            deepFreeze(x);
+        Object.freeze(v);
+    }
+    return v;
+}
+function stageEnvModelPlane(config) {
+    if (servedModelTableLeg(config) === "env")
+        return { stages: {} };
+    const snap = envModelPlane.get(config);
+    if (snap === undefined)
+        throw new Error("applyEffective: the center model plane is in force but no env snapshot was taken — the model plane was written outside applyEffective, so the no-center tier has no baseline to return to");
+    return {
+        stages: {
+            models: {
+                ...snap,
+                modelApiKeyEnv: { ...snap.modelApiKeyEnv },
+                modelApiKeys: { ...snap.modelApiKeys },
+                modelRefusals: { ...snap.modelRefusals },
+                droppedCatalogEntries: [...snap.droppedCatalogEntries],
+                infoLine: { source: "no-center-baseline", default: snap.model.id, roles: Object.keys(snap.roles), tiers: [], atMention: snap.atMention.mode },
+            },
+        },
+    };
+}
 function stageModelPlane(config, eff, logger, sealedKeys) {
+    if (isNoCenterEffective(eff))
+        return stageEnvModelPlane(config);
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
     const verdict = judgeCatalogEntries(enabled, { anthropicRouteMounted: config.anthropic !== undefined }, eff.models?.droppedCatalogEntries);
     if (enabled.length === 0 && verdict.malformed.length === 0 && verdict.dropped.every((row) => row.identity?.enabled === false))
@@ -293,8 +344,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
                     quotaWeights[m.id] = qw;
             }
         }
-        if (!envRolesBaseline.has(config))
-            envRolesBaseline.set(config, { ...config.roles });
+        const envPlane = envModelPlaneOf(config);
         const centerRoles = {};
         for (const [role, tgt] of Object.entries(eff.models.roles ?? {})) {
             if ("model" in tgt)
@@ -302,7 +352,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             else if ("select" in tgt)
                 centerRoles[role] = { select: tgt.select };
         }
-        const roles = { ...envRolesBaseline.get(config), ...centerRoles };
+        const roles = { ...envPlane.roles, ...centerRoles };
         const activeTiers = {};
         for (const [tier, target] of Object.entries(resolveActiveTiers(eff.models) ?? {})) {
             if (models[target] !== undefined) {
@@ -365,6 +415,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         const defaultModel = models.default;
         const plane = {
             models,
+            model: defaultModel,
             modelApiKeyEnv,
             modelApiKeys,
             modelRefusals: { ...verdict.refused },

package/dist/web-admin-client/facade.d.ts

@@ -48,7 +48,7 @@
  * importers to update, which was done in the same commit.
  */
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, NO_CENTER_EFFECTIVE, isNoCenterEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type EngineRestartSignal, } from "./restart-signal.js";
 export { applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline, type ReadFaceSeat } from "./read-face.js";

package/dist/web-admin-client/facade.js

@@ -1,5 +1,5 @@
 export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./http-client.js";
-export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
+export { mutateInPlace, applyEffective, NO_CENTER_EFFECTIVE, isNoCenterEffective, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
 export { applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";

package/dist/web-admin-client/read-face.js

@@ -1,4 +1,5 @@
 import { compileReadDeny, isSwappableDepSeat, resolveReadDenyBuiltins } from "@sema-agent/core";
+import { readReadDenyEntry } from "../read-deny-entry.js";
 export function buildReadFaceBaseline(config) {
     return {
         ...(config.readFace !== undefined ? { readFace: config.readFace } : {}),
@@ -44,15 +45,10 @@ function normalizeDenyPatterns(raw) {
     if (!Array.isArray(raw))
         throw new ReadFaceDomainError("readFace.denyPatterns must be an array of \"pattern\" strings or {pattern, caseSensitive?} objects");
     return raw.map((it, i) => {
-        if (typeof it === "string")
-            return { pattern: it, caseSensitive: false };
-        if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
-            throw new ReadFaceDomainError(`readFace.denyPatterns[${i}] must be a string or an object with a string 'pattern'`);
-        }
-        const cs = it.caseSensitive;
-        if (cs !== undefined && typeof cs !== "boolean")
-            throw new ReadFaceDomainError(`readFace.denyPatterns[${i}].caseSensitive must be boolean when present`);
-        return { pattern: it.pattern, caseSensitive: cs === true };
+        const read = readReadDenyEntry(it);
+        if (!read.ok)
+            throw new ReadFaceDomainError(`readFace.denyPatterns[${i}]${read.after}`);
+        return read.entry;
     });
 }
 function assertFace(raw) {

package/dist/web-admin-client/skills-mcp.d.ts

@@ -30,7 +30,7 @@ export declare function applySkillsManifest(baseline: LoadedSkill[], manifest: {
  * Resolve center MCP servers (`/effective.mcp`) into core `McpServerSpec`s + the scenarios each applies to.
  * env-NAME refs → real values from THIS service's env (secret boundary unchanged); a server with any missing
  * ref is skipped (`resolveRefs` → null). `enabled:false` skipped. A server whose `toolFaces` / `toolAxes` declaration is
- * malformed is skipped whole (both are trust-root declarations — see `mcp-tool-faces.ts` / the engine's `readMcpToolAxes`). Restart-to-apply
+ * malformed is skipped whole (both are trust-root declarations — the engine's `readToolFaces` / `readMcpToolAxes` judge them). Restart-to-apply
  * (filtered per scenario in `resolveSpec` via `mcpForScenario`).
  */
 export declare function resolveMcpServers(mcp: {

package/dist/web-admin-client/skills-mcp.js

@@ -1,10 +1,8 @@
 import { readMcpSourceLabel } from "../mcp-source-label.js";
-import { readMcpToolFaces } from "../mcp-tool-faces.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
-import { readMcpToolAxes } from "@sema-agent/core";
-import { MCP_CONTENT_ORIGINS, isContentOriginWord, isUsableWireName } from "@sema-agent/settings-schema";
-import { describeBadContentOrigin, describeBadWireName } from "../caller-text-echo.js";
-import { noteMcpAssertionHeaderNotSent } from "../mcp-assertion-header.js";
+import { readMcpToolAxes, readToolFaces } from "@sema-agent/core";
+import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, isContentOriginWord, isUsableWireName } from "@sema-agent/settings-schema";
+import { noteMcpAssertionHeaderNotSent, sentMcpAssertionHeaderMember, withholdsMcpAssertionHeader } from "../mcp-assertion-header.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 function skillBodyPresent(body) {
     return body !== undefined && body !== "";
@@ -117,7 +115,7 @@ export function resolveMcpServers(mcp, logger) {
                 });
         }
         const source = readMcpSourceLabel(s.name, s.source);
-        const facesRead = readMcpToolFaces(s.toolFaces);
+        const facesRead = readToolFaces(s.toolFaces);
         if (!facesRead.ok) {
             logger?.warn("web_admin_mcp_tool_faces_invalid", {
                 server: s.name,
@@ -150,11 +148,11 @@ export function resolveMcpServers(mcp, logger) {
             const headers = resolveRefs(s.transport.headerRefs, s.name, "header", logger);
             if (headers === null)
                 continue;
-            if (s.transport.assertionHeader !== undefined)
+            if (withholdsMcpAssertionHeader(s.transport.assertionHeader))
                 noteMcpAssertionHeaderNotSent(logger, s.name);
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces, ...toolAxes },
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}), ...sentMcpAssertionHeaderMember(s.transport.assertionHeader) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces, ...toolAxes },
             });
         }
     }

package/dist/web-admin-client/types.d.ts

@@ -147,7 +147,7 @@ export interface CenterMcpServer {
      *
      * 🔴 类型是 `unknown` 而不是那个结构,**刻意的**:本类型是两条 center 腿的**承载形**(本地 config.d 经
      * settings-schema 的 `z.unknown()` 解析透明地过来、远端 /effective 是直读 JSON),判据与坏形处置的单一
-     * 属主是 `mcp-tool-faces.ts` 的 `readMcpToolFaces`(`resolveMcpServers` 在铸 spec 那一刻调它)。在承载
+     * 属主是引擎根导出的 `readToolFaces`(`resolveMcpServers` 在铸 spec 那一刻调它)。在承载
      * 形上先写一个结构,等于把同一张判据表抄成两份(而其中一份没有执行力)。
      */
     toolFaces?: unknown;

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -20,7 +20,8 @@ dials the device, so the device needs no inbound port, no public address and no
 (this deployment has no device lane) or an object `{ enabled: true, protocolVersion, maxInflightPerDevice,
 wsPath, management }`. Read `wsPath` from there rather than hardcoding it: the path is part of the wire
 contract and reading it means a future path change is not a cross-repo break. `protocolVersion` tells you
-which version the server speaks before you spend a handshake finding out.
+which protocol **revision** the server speaks before you spend a handshake finding out (§2.1: the revision decides
+which `errorCode` words the server accepts from you).
 
 ---
 
@@ -144,6 +145,13 @@ The server sends `challenge` immediately on open. From the moment the socket ope
 the handshake completes, **frames are capped at `maxPreAuthFrameBytes` (4096 bytes)** and a malformed
 pre-auth frame closes the connection outright.
 
+**Which revision to declare.** `challenge.protocolVersion` is the highest protocol revision this server speaks
+(`DEVICE_MIN_PROTOCOL_VERSION` is the lowest it accepts, §2.1). Put the highest revision *you* implement that is
+not above `challenge.protocolVersion` into `hello.protocolVersion` — the same integer you sign (§1.3) — and emit
+only the `errorCode` words of that revision (the revision table in §2.1). Nothing is renegotiated after `hello`:
+the revision you declared is the contract for the whole connection. If the highest revision you implement is below
+`DEVICE_MIN_PROTOCOL_VERSION`, the server answers `helloReject: protocol_version_unsupported` (§1.4).
+
 ### 1.3 The `hello` signature (byte-exact — do not improvise)
 
 Sign with the device private key over exactly these bytes:
@@ -245,18 +253,32 @@ backoff, exponential to a 60 s ceiling, jittered — except for `revoked`, which
 
 `helloAck` carries:
 
+<!-- closed-set: DEVICE_HELLO_ACK_BOUNDS -->
+
 | Field | Form | Meaning |
 |---|---|---|
 | `ok` | always `true` | — |
-| `heartbeatIntervalMs` | integer ms | how often you should send `heartbeat` (deployment default 15000) |
-| `maxInflight` | integer | how many instructions the server will have outstanding on this device at once (deployment default 4) |
+| `heartbeatIntervalMs` | `integer ms ≥ 1` | how often you should send `heartbeat` (deployment default 15000) |
+| `maxInflight` | `integer ≥ 1` | how many instructions the server will have outstanding on this device at once (deployment default 4) |
 | `gen` | **canonical decimal string** (`"7"`, never `7`, never `"07"`) | the connection generation. Stamp it on every frame you send |
 | `pendingInstructions` | `string[]` | instruction ids the server still considers in flight for you — see §5 R2 |
 | `chunkWatermarks` | `{ [instructionId]: number }` | per instruction, the highest **contiguous** `streamSeq` the server has already accepted. `-1` means "nothing accepted yet" |
-| `reconnectGraceMs` | integer ms | the reconnect grace **in force on this server** (R4): how long in-flight work survives a dropped socket. Deployment-tunable, default 120000 |
-| `cancelGraceMs` | integer ms | the cancel grace in force (R11): how long after a `cancel` is delivered the server waits for your terminal `result`. Default 10000 |
-| `chunkGapTimeoutMs` | integer ms | the chunk-gap timeout in force (R8): how long the server waits for a missing `streamSeq` before failing the instruction. Default 30000 |
-| `executionCeilingGraceMs` | integer ms | the grace added to an instruction's `timeoutMs` before the server gives up and settles it as outcome-unknown (R12: the ceiling is `timeoutMs + executionCeilingGraceMs`). Default 30000 |
+| `reconnectGraceMs` | `integer ms ≥ 0` | the reconnect grace **in force on this server** (R4): how long in-flight work survives a dropped socket. Deployment-tunable, default 120000 |
+| `cancelGraceMs` | `integer ms ≥ 0` | the cancel grace in force (R11): how long after a `cancel` is delivered the server waits for your terminal `result`. Default 10000 |
+| `chunkGapTimeoutMs` | `integer ms ≥ 0` | the chunk-gap timeout in force (R8): how long the server waits for a missing `streamSeq` before failing the instruction. Default 30000 |
+| `executionCeilingGraceMs` | `integer ms ≥ 0` | the grace added to an instruction's `timeoutMs` before the server gives up and settles it as outcome-unknown (R12: the ceiling is `timeoutMs + executionCeilingGraceMs`). Default 30000 |
+
+**Bounds.** The six numeric fields above are validated by the server when it starts: a deployment whose knob (or
+embedding option) is outside its row's range refuses to boot — the value is never clamped and never replaced by a
+default — so a `helloAck` on the wire is always in range, and every number in it is the value the server's own
+timers and slot counts are armed with. Every `ms` field is also at most `2147483647` (the largest delay a
+timer can hold; a larger value would be silently collapsed to 1 ms); `maxInflight` has no ceiling beyond an
+integer JSON represents exactly (at most `9007199254740991`). A `0` grace means "no grace": that timer
+fires at once. An executor that reads a value outside its row's range must treat it as a protocol violation — the executor-side twin
+of the server's `bad_shape` refusal (§2.4): close the connection and reconnect with backoff — and must **not** read the
+out-of-range value as the default.
+`deviceHelloAckNumberFlaw` (from `@sema-agent/server/device-protocol`) is the same check the server applies.
+The *absence* of one of the four grace fields is a different case, described below, and still means "not told".
 
 The four grace fields are the values the server's own timers are armed with — not documentation defaults. Size
 your reconnect backoff ceiling, your `cancel` answer deadline, your retransmission cadence and your own
@@ -314,8 +336,8 @@ base64 inside JSON fields.
 | Constant | Value | Meaning |
 |---|---|---|
 | `DEVICE_WS_PATH` | `/v1/device/ws` | the upgrade path (prefer the `wsPath` from `/v1/capabilities`) |
-| `DEVICE_PROTOCOL_VERSION` | `1` | the version this server speaks |
-| `DEVICE_MIN_PROTOCOL_VERSION` | `1` | the lowest version it accepts; below it, a loud `helloReject` — never a silent downgrade |
+| `DEVICE_PROTOCOL_VERSION` | `2` | the protocol revision this server speaks (the highest it accepts) |
+| `DEVICE_MIN_PROTOCOL_VERSION` | `1` | the lowest revision it accepts; below it (or above the highest), a loud `helloReject` — never a silent downgrade |
 | `DEVICE_HELLO_DOMAIN_TAG` | `sema.device.hello.v1` | the handshake signature domain tag (§1.3) |
 
 <!-- closed-set: DEVICE_WS_LIMITS -->
@@ -330,6 +352,29 @@ base64 inside JSON fields.
 Note the asymmetry: the transport cap is 1 MiB, and the 4096-byte pre-auth cap is applied **after** the
 frame has been reassembled. Keep `hello` small; it is not a place for long `supports` prose.
 
+#### Protocol revisions and the `errorCode` set
+
+The protocol revision is the only thing an executor can read *before* it sends `hello` (the `challenge` frame
+carries it), so the set of `errorCode` words the server accepts from you is a function of the revision, not a
+separate list. The table gives, per revision, the words **added** at that revision; the set at revision *N* is
+the union of the rows up to *N*, and the full set at the current revision is the §3.3 table.
+
+<!-- closed-set: DEVICE_OUTCOME_ERROR_CODES_BY_REVISION -->
+
+| Revision | `errorCode` words added at this revision |
+|---|---|
+| `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` |
+| `2` | `liveness_no_output` |
+
+Rules: adding a frame or a field is additive and does not raise the revision; adding a word to a closed set the
+server *accepts from you* (today: the `errorCode` set) raises `DEVICE_PROTOCOL_VERSION` and adds a row here; a
+released row never changes. Declare a revision as §1.2 says and send only the words of that revision: an executor
+that declared revision 1 never sends `liveness_no_output` (the server does not police this per connection — it
+decodes every connection against the current revision's full set — but a word above your declared revision is outside
+your contract). The same sets are importable:
+`DEVICE_OUTCOME_ERROR_CODES_BY_REVISION` and `deviceOutcomeErrorCodesAt(revision)` from
+`@sema-agent/server/device-protocol`.
+
 ### 2.2 Device → server frames
 
 <!-- closed-set: DEVICE_FRAME_TYPES -->
@@ -515,6 +560,9 @@ a moment ago. If you omit `created`, the consumer reports the weaker of the two
 
 `message` is required on the failure arm and is shown to the model — make it specific.
 
+This is the full set at the current revision (`2`); the revision table in §2.1 says which revision each word arrived
+with, and an executor sends only the words of the revision it declared (§1.2).
+
 <!-- closed-set: DEVICE_OUTCOME_ERROR_CODES -->
 
 | `errorCode` | Use it when |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.132.0",
+  "version": "7.134.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -18,6 +18,10 @@
       "types": "./dist/device-protocol.d.ts",
       "default": "./dist/device-protocol.js"
     },
+    "./model-route-env": {
+      "types": "./dist/model-route-env.d.ts",
+      "default": "./dist/model-route-env.js"
+    },
     "./package.json": "./package.json",
     "./deploy/sema-up/lanes.json": "./deploy/sema-up/lib/lanes.json"
   },
@@ -64,8 +68,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.53.0",
-    "@sema-agent/settings-schema": "14.0.0",
+    "@sema-agent/core": "7.54.1",
+    "@sema-agent/settings-schema": "14.2.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -80,7 +84,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "23.1.0",
+    "@sema-agent/sdk": "24.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",

package/scripts/drain-check-local.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * 换钉前的**排空检查 —— `DB_BACKEND=local`(File 店)车道**,只读。随 npm 包出(`scripts/drain-check-local.mjs`)。
- * 一次跑**八条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
+ * 一次跑**九条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
  * 每条判据一段、段首标记 `-- drain-check:<判据名>:<后端>`,判据名与本表的 `name` 同一个词):
  *  · `skill-grants-rollback`(**回滚**到 7.115.x 前,即引擎从 7.41 退回 7.40):四样任一 ——
  *    ① pending 行带 `state.skillGrants`(本次 run 冻结在行上的技能授予行:模型激活 / 子代捕获写下的放行与禁止);
@@ -31,6 +31,7 @@
  *    `dist/orchestration/workflow-agent-session-index.js` 取 —— 本脚本只按 runId 折叠;读不出的行计入 `corrupt`(rc 2:读不出的那一行可能正是点名某张待批卡的那一份);
  *    窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
  *  · `parked-tool-lists`(升级到 7.132.0 前)/ `own-tool-lists-rollback`(从 7.132.0 回滚前):停驻行记下的工具名清单 / 7.52 写下的 `ownToolLists`(判据与出路见判据表那两条的注);
+ *  · `sealed-credentials-rollback`(从 7.134.0 回滚前):续跑上下文的凭据位上带封签的 pending 行(7.133.x 读不懂封签,续跑时把这些位当没有;判据与出路见判据表那一条的注);
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
  *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
  *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
@@ -74,6 +75,7 @@
  *    `SKILL-DENY-INERT-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
  *    `WORKFLOW-PARK-ROW token=<token> sessionId=<id> createdAt=<ms> runId=<点名它的 run,逗号连接>` /
  *    `PARKED-TOOL-LISTS-ROW token=<token> sessionId=<id> createdAt=<ms> member=<toolCeiling|constraintChain|boundGrantDigest>` / `OWN-TOOL-LISTS-ROW token=<token> sessionId=<id> createdAt=<ms>` /
+ *    `SEALED-CREDENTIALS-ROW token=<token> sessionId=<id> createdAt=<ms> field=<第一处带封签的凭据位>|runId=<workflow 子代卡:点它的 run>` /
  *    `ALLOW-LIST-ROW token=<token> sessionId=<id> createdAt=<ms>` / `RETIRED-ROW token=<token> sessionId=<id> createdAt=<ms> member=<成员>`;
  *  · 每条判据一行末行(表序;`RETIRED-MODE-SEED` 那一行恒在最后,7.113.0 起读「最后一行」的下游不受影响;`PERMISSIONS-ALLOW-LIST` 仍是倒数第二行):
  *    `SKILL-GRANTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
@@ -82,6 +84,7 @@
  *    `WORKFLOW-PARK-HOLDER rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PARKED-TOOL-LISTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `OWN-TOOL-LISTS-ROLLBACK rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
+ *    `SEALED-CREDENTIALS-ROLLBACK rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PERMISSIONS-ALLOW-LIST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-MODE-SEED rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`;
  *    `corrupt` = 共用扫描的坏记录 + 这条判据自己读不懂的旁路输入(`permissions-allow-list`:读不懂的 ctx 档,文件名进 stderr —— 一份读不懂的 ctx 可能正是某条 pending 行带 `allow` 的那一份;
@@ -97,7 +100,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** 从脚本隔壁的编译产物取来的服务判据(脚本不持第二份实现)。
- * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined, readAgentSessionLedgerLine: (v: unknown) => { runId: string, rows: Array<{ sessionId: string }> } | undefined }} ServiceCriteria */
+ * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, sealedCredentialFieldOf: (ctx: unknown) => string | undefined, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined, readAgentSessionLedgerLine: (v: unknown) => { runId: string, rows: Array<{ sessionId: string }> } | undefined }} ServiceCriteria */
 
 /** 读期间文件在变时的有界重读次数(含第一次)。 */
 const STABLE_READ_ATTEMPTS = 3;
@@ -460,6 +463,34 @@ export const DRAIN_CRITERIA = [
     load: () => ({ input: undefined, corrupt: 0, unreadable: [] }),
     judge: (row) => (isObject(row.state) && Object.hasOwn(/** @type {Record<string, unknown>} */ (row.state), "ownToolLists") ? "" : undefined),
   },
+  {
+    // 从 7.134.0 回滚到 7.133.x 之前:pending 行所在会话的续跑上下文里,提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+    // 上带封签 —— 7.134.0 封好才落盘,7.133.x 读不懂封签、续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(随包 `MIGRATION.md` 7.134.0 节)。
+    // 判据函数是服务里那一只(`sealedCredentialFieldOf`,经编译产物 `dist/http/checkpoint-ctx.js` 取;走法与封口 / 开口 / 一次性迁移同一只),本脚本不写第二份;
+    // 命中行点名第一处凭据位(`field=`,键名;值从不出来);读不懂的 ctx 档 / 索引账本行计入 `corrupt`(rc 2)。
+    // 读哪一份续跑上下文与续跑腿同:workflow 子代卡(子会话被 park 索引点名)续跑读**发起会话**那一份,而发起会话记在引擎的 run 账里(引擎自己的账本格式,本脚本不重抄)
+    // ⇒ 子代卡数的是真超集:自己那一份带封签,或数据根里任一份 ctx 带封签,即记为候选并点名点它的 run(`runId=`)—— 与随包 SQL 孪生同为超集,不漏。
+    // 表序在 `permissions-allow-list` 之前 —— 那一条仍倒数第二、`RETIRED-MODE-SEED` 仍最后。
+    name: "sealed-credentials-rollback",
+    tail: "SEALED-CREDENTIALS-ROLLBACK",
+    hit: "SEALED-CREDENTIALS-ROW",
+    load: (root, service) => {
+      const idx = readCtxIndex(root);
+      const parks = readParkIndex(root, service.readAgentSessionLedgerLine);
+      const fieldOf = service.sealedCredentialFieldOf;
+      const anySealed = [...idx.bySession.values()].some((ctx) => fieldOf(ctx) !== undefined);
+      return { input: { bySession: idx.bySession, fieldOf, parkedBy: parks.bySession, anySealed }, corrupt: idx.corrupt + parks.corrupt, unreadable: [...idx.unreadable, ...parks.unreadable] };
+    },
+    judge: (row, input) => {
+      const { bySession, fieldOf, parkedBy, anySealed } = /** @type {{ bySession: Map<string, Record<string, unknown>>, fieldOf: ServiceCriteria["sealedCredentialFieldOf"], parkedBy: Map<string, string[]>, anySealed: boolean }} */ (input);
+      if (typeof row.sessionId !== "string") return undefined;
+      const ctx = bySession.get(row.sessionId);
+      const field = ctx === undefined ? undefined : fieldOf(ctx);
+      if (field !== undefined) return ` field=${field}`;
+      const runs = parkedBy.get(row.sessionId);
+      return runs !== undefined && anySealed ? ` runId=${runs.join(",")}` : undefined;
+    },
+  },
   {
     name: "permissions-allow-list",
     tail: "PERMISSIONS-ALLOW-LIST",
@@ -503,6 +534,7 @@ async function loadServiceCriteria(rootEcho) {
   /** @type {Array<[string, () => Promise<Record<string, unknown>>, string]>} 〔产物相对路径(报告用), 取模块, 导出名〕 */
   const wanted = [
     ["dist/http/checkpoint-ctx.js", () => import("../dist/http/checkpoint-ctx.js"), "allowListReadingUnstated"],
+    ["dist/http/checkpoint-ctx.js", () => import("../dist/http/checkpoint-ctx.js"), "sealedCredentialFieldOf"],
     ["dist/http/retired-skill-manifest.js", () => import("../dist/http/retired-skill-manifest.js"), "retiredSkillManifestLayerOf"],
     ["dist/rule-entry-list.js", () => import("../dist/rule-entry-list.js"), "skillDenyInertEntryOf"],
     ["dist/orchestration/workflow-agent-session-index.js", () => import("../dist/orchestration/workflow-agent-session-index.js"), "readAgentSessionLedgerLine"],

package/scripts/drain-check.mysql.sql

@@ -8,15 +8,16 @@
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。以 hit_rows 为准:这一列被会话变量 group_concat_max_len(缺省 1024 字节)截断时,列出的会话数会少于 hit_rows ——
 --              先处理列出的再跑一次,或先在同一个会话里 SET SESSION group_concat_max_len = 1048576; 再跑本文件(本文件自己只含 SELECT)。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,八条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,九条判据同名。
 --
--- 八条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 九条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x 之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -115,6 +116,23 @@ FROM checkpoint k
 WHERE k.status = 'pending'
   AND JSON_CONTAINS_PATH(k.checkpoint, 'one', '$.state.ownToolLists');
 
+-- drain-check:sealed-credentials-rollback:mysql —— 期望 hit_rows = 0;每一行 = 一条**候选**:从 7.134.0 回滚到 7.133.x 后续跑会丢掉请求凭据的停驻行。
+-- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+-- 封成封签(对象,格式词 "checkpoint-ctx-sealedbox-v1")才落盘;7.133.x 读不懂封签,续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(见随包 MIGRATION.md 7.134.0 节)。
+-- 读哪一份续跑上下文:与续跑腿同(连接形与 permissions-allow-list 段逐字同,理由见该段注)。SQL 不走凭据位闭集 ⇒ 数的是**真超集**:提交体里任何一处有一个
+-- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
+SELECT 'sealed-credentials-rollback' AS criterion, COUNT(*) AS hit_rows,
+       COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND EXISTS (SELECT 1
+              FROM checkpoint kk
+              LEFT JOIN workflow_agent_session w ON w.session_id = kk.session_id
+              LEFT JOIN workflow_run r ON r.id = w.run_id
+              JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), kk.session_id)
+              WHERE kk.token = k.token
+                AND LOCATE('"checkpoint-ctx-sealedbox-v1"', CAST(JSON_EXTRACT(c.ctx, '$.body') AS CHAR)) > 0);
+
 -- drain-check:permissions-allow-list:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
 -- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是

package/scripts/drain-check.pg.sql

@@ -7,15 +7,16 @@
 --   hit_rows   命中的停驻行数(pending 行里算命中的那些);**全部为 0 才算排空**,非 0 ⇒ 逐条答完或取消(各判据对应的升级 / 回滚说明见随包 MIGRATION.md);
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,八条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,九条判据同名。
 --
--- 八条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 九条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
 --   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   parked-tool-lists       升级到 7.132.0 之前:停驻行记着子代工具天花板 / 冻结的父约束链 / Skill 卡的清单绑定(7.52 在认领前按规范拼写读它们)的**候选**(见该段注)。
 --   own-tool-lists-rollback 从 7.132.0 回滚到 7.131.x 之前:7.132.0 停驻、带 state.ownToolLists 的行(7.131.x 读不了)。
+--   sealed-credentials-rollback 从 7.134.0 回滚到 7.133.x 之前:停驻、续跑上下文里提交体的凭据位上带封签的行(7.133.x 读不懂封签,续跑时把这些位当没有)的**候选**(见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -123,6 +124,23 @@ FROM checkpoint k
 WHERE k.status = 'pending'
   AND (k.checkpoint -> 'state') ? 'ownToolLists';
 
+-- drain-check:sealed-credentials-rollback:pg —— 期望 hit_rows = 0;每一行 = 一条**候选**:从 7.134.0 回滚到 7.133.x 后续跑会丢掉请求凭据的停驻行。
+-- 在**回滚之前**、对 7.134.0 的数据跑:7.134.0 把续跑上下文里提交体的凭据位(MCP / A2A 请求头与 env、settings.env、settings.webSearch.apiKey、http hook 请求头)
+-- 封成封签(对象,格式词 "checkpoint-ctx-sealedbox-v1")才落盘;7.133.x 读不懂封签,续跑时把这些位当作没有(无凭据照跑、不报错)。出路:回滚前把它们决掉或取消(见随包 MIGRATION.md 7.134.0 节)。
+-- 读哪一份续跑上下文:与续跑腿同(连接形与 permissions-allow-list 段逐字同,理由见该段注)。SQL 不走凭据位闭集 ⇒ 数的是**真超集**:提交体里任何一处有一个
+-- JSON 串值恰为这个格式词即数(封签只落在凭据位上;体里别处恰好写着这个词的串值也会被数到 —— 多数,不漏)。本地脚本同名判据走服务里那一只凭据位走法(精确)。
+SELECT 'sealed-credentials-rollback' AS criterion, count(*) AS hit_rows,
+       coalesce(string_agg(k.session_id, ',' ORDER BY k.created_at_ms DESC), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND EXISTS (SELECT 1
+              FROM checkpoint kk
+              LEFT JOIN workflow_agent_session w ON w.session_id = kk.session_id
+              LEFT JOIN workflow_run r ON r.id = w.run_id
+              JOIN checkpoint_ctx c ON c.session_id = COALESCE(r.run::json->>'originatingSessionId', kk.session_id)
+              WHERE kk.token = k.token
+                AND strpos((c.ctx -> 'body')::text, '"checkpoint-ctx-sealedbox-v1"') > 0);
+
 -- drain-check:permissions-allow-list:pg —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
 -- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是

package/dist/mcp-tool-faces.d.ts

@@ -1,69 +0,0 @@
-/**
- * `McpServerSpec.toolFaces` —— MCP 工具的**面覆盖层**(core 7.8.0 [ref] §1.1/§2.7;声明面
- * settings-schema 1.9.0)。一条规则、三条腿共用(请求腿 `task-mcp.ts normalizeServer` / center 腿
- * `web-admin-client/skills-mcp.ts resolveMcpServers` / 本地 config.d 腿 `config-provider.ts` 只做承载),
- * 与 {@link import("./mcp-source-label.js").readMcpSourceLabel} 同一个「判据单点、三腿一致」的形。
- *
- * ## 分工(为什么本层**不**复述 core 的那张表)
- * 覆盖层的**语义**校验属 core 的摄入侧,而且只有它做得了:`pathTarget.param` 是不是这只工具**物化后
- * schema** 的顶层属性、审批卡要的键在不在、`ruleFace` 指的是不是标量键 —— 三件都要看远端 server 真发
- * 回来的 schema,本层手里根本没有。core 的处置也已经定死:不合 ⇒ **这只工具在这条腿上不挂**,并通告
- * 一次 `config.tool_face_invalid`(亲读 `dist/core/runner/tool-face-overlay.js` 的 `return undefined` 臂 ——
- * 该文件 d.ts 头注里那句「the tool mounts BARE」是**过期**的,以实现为准)。
- *
- * 本层因此只做 core 的校验器**假定成立**的那一件事:**JSON 结构合不合 TS 型**。理由是硬的 —— core 的
- * `toolFaceProblem` 是按 TS 型写的,`renderHints.summaryParams` 是个字符串时它会 `.find is not a function`
- * 地把 prepare 整条炸掉,`ruleFace.params` 是个数字时 `for...of` 直接抛。原样透传一份任意 JSON 不是
- * 「解析透明」,是把类型错误变成运行期崩溃。
- *
- * 闭词(`family` / `pathTarget.access` / `renderHints.approvalCard`)判据**取自 core 的导出常量**
- * (`TOOL_FAMILIES` / `TOOL_PATH_ACCESSES` / `TOOL_APPROVAL_CARDS`),本仓一个词都不枚举 —— 与
- * `MCP_DELIVERY_VERDICTS` 的消费姿势同款:词表单一属主在 core,抄一遍就是抄了一张会漂的表。
- *
- * ## 坏形的方向:**整条 server 不进**(fail-closed)
- * 🔴 这一条被 codex 对抗复审 r1 的 [high] **翻正过一次**,把翻正的理由留在这里,因为它是本模块最容易
- * 想错的一格:初版按 `contentOrigin` 的先例判「丢声明、留 server + 留痕」,而那条先例管的是**放宽**键
- * (丢它 ⇒ 回落到过度标记 = fail-closed 的那一侧)。`toolFaces` 是**收窄**声明:它声明的 `pathTarget`
- * 正是敏感路径策略、写围栏、编辑跟踪读的那一格 —— 丢掉它,那只工具就**无面挂载**,运维声明的保护
- * 静默失效。codex 实测(同一只 MCP 写工具、同一个 `/work/.env` 目标,仅把 `renderHints.summaryParams`
- * 从数组写成字符串):`createSensitivePathPolicy` 从 deny 变成 allow。一条 warn 补偿不了这个方向。
- *
- * 所以判据回到本仓对**收窄键**已经成文的那一条(`task-mcp.ts` 的 `allowTools`,[ref] / [ref] codex F1):
- * **一个键在场就必须合法,否则这条 server 整条不进**。三问逐条:
- *  ① 谁需要 —— 在部署侧给 MCP 工具声明写围栏 / 审批卡 / 显示名的运维;
- *  ② 谁受伤 —— 覆盖层写错的那台 server:它**整条**不挂(请求腿进 `dropped` 并点名上报,center 腿跳过
- *     该条、兄弟 server 照挂)。代价是真的(少一套工具),但它**响亮且立刻**;反方向的代价是一条
- *     **静默失效的安全声明**,而后者按 [ref] 不许存在于安全轴上;
- *  ③ 拿什么补偿 —— 报出来的名字本身:请求腿 `mcp_injection_dropped{dropped:[name]}`、center 腿
- *     `web_admin_mcp_tool_faces_invalid{server,problem,note}` 一条点名 warn(`problem` 里带工具名与哪一段不合;运维照着改那一行即可)。
- * 每只工具的面是**整只**判(core 明写 "applied whole or not at all");而**任一只**判不出形 ⇒ 整条 server
- * 不进 —— 「留下好的那几只」同样是让坏的那一只无面挂载,与整张丢没有区别。
- */
-import { type McpServerSpec } from "@sema-agent/core";
-type ToolFaces = NonNullable<McpServerSpec["toolFaces"]>;
-/**
- * 一条 server 条目的 `toolFaces` 判形结果:
- *  · `{ ok: true, faces }` —— 合形(`faces` 缺席 = 这台 server 没有覆盖层,或声明了一个**空**覆盖层:
- *    两者对 core 同义,都不铸键);
- *  · `{ ok: false, problem }` —— 判不出形,**整条 server 不进**(方向与理由见模块头注),`problem` 是
- *    给运维的一句点名(只带工具名与哪一段不合,不带面的值)。
- */
-export type McpToolFacesRead = {
-    ok: true;
-    faces?: ToolFaces;
-} | {
-    ok: false;
-    problem: string;
-};
-/**
- * 从任一腿的原始条目里读出 `toolFaces` —— **三条腿共用的唯一判据点**。
- * 缺席 ⇒ 合形无覆盖层;整只不是对象 / **任一只**工具的面判不出形 ⇒ `ok:false`(调用方整条 server 不收)。
- *
- * 🔴 工具名是 `__proto__` ⇒ 同样判不出形,**响亮拒**:按名存面的记录装不下它 —— JSON 的自有键 `"__proto__"` 写进记录那一步走的是原型的设置器,
- * 键从结果里消失而判官答 `ok`,那条 server 照挂、收窄面叠层被无声丢掉。方向与本模块头注同(收窄声明在场就必须原样可用)。
- * 只拒这一个名字:`constructor` / `toString` 等其余根原型成员名写进记录是普通自有键、不丢,引擎按名查面也取得到 —— 拒它们是给重放存量 body 的腿
- * 新添一条「整条 server 不进」,不是修这个病。
- */
-export declare function readMcpToolFaces(v: unknown): McpToolFacesRead;
-export {};
-//# sourceMappingURL=mcp-tool-faces.d.ts.map