@sema-agent/server 7.137.0 → 7.138.0

package/dist/trace/wire-projection-faces.d.ts

@@ -100,7 +100,7 @@ export type DeclaredKey = ManifestShape & {
  */
 export declare const FRAME_ENVELOPE_KEYS: readonly ["type", "sourceTaskId", "bgAgentId"];
 /** 探针文件要从 `@sema-agent/core` 具名导入的类型(`coreType` 表达式里用到的全部名字)。 */
-export declare const WIRE_PROJECTION_CORE_IMPORTS: readonly ["TaskEvent", "TaskNotificationPayload", "WiringManifest", "EngineNotice", "MemoryImportReport", "OriginClearanceRow", "OriginClearanceEvent", "MemoryEntryOrigin", "TraceEvent", "PromptManifestIdentity", "PromptIdentityLayers", "PromptManifestSelectors", "PromptManifestSection", "PromptChainLink", "SupersededOverlay", "ToolDisclosureManifest"];
+export declare const WIRE_PROJECTION_CORE_IMPORTS: readonly ["TaskEvent", "BrainStatus", "TaskNotificationPayload", "WiringManifest", "EngineNotice", "MemoryImportReport", "OriginClearanceRow", "OriginClearanceEvent", "MemoryEntryOrigin", "TraceEvent", "PromptManifestIdentity", "PromptIdentityLayers", "PromptManifestSelectors", "PromptManifestSection", "PromptChainLink", "SupersededOverlay", "ToolDisclosureManifest"];
 /**
  * `wiring_manifest` 的 **operator 面多投的那几段**(`wiringManifestOperatorEventData` 在租户形之上加的段)。
  * operator 行的 `excluded` = 租户行减本常量(派生);四段各自的受众裁定在 `core-keyset-guard.ts` ⑥b。
@@ -129,13 +129,13 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly tool_start: {
         readonly projector: "toolStartEventData";
         readonly coreType: string;
-        readonly excluded: readonly ["requestedBy"];
+        readonly excluded: readonly [];
         readonly minted: readonly [];
     };
     readonly tool_end: {
         readonly projector: "toolEndEventData";
         readonly coreType: string;
-        readonly excluded: readonly ["requestedBy", "answeredBy"];
+        readonly excluded: readonly [];
         readonly minted: readonly [];
     };
     readonly tool_progress: {
@@ -171,12 +171,12 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly workspace_changed: {
         readonly projector: "workspaceChangedEventData";
         readonly coreType: string;
-        readonly excluded: readonly [];
+        readonly excluded: readonly ["root", "remote", "entered", "project"];
         readonly minted: readonly [];
     };
     readonly status: {
         readonly projector: "brainStatusEventData";
-        readonly coreType: string;
+        readonly coreType: `BrainStatus & ${string}`;
         readonly excluded: readonly [];
         readonly minted: readonly [];
     };
@@ -213,7 +213,7 @@ export declare const WIRE_PROJECTION_FACES: {
     readonly human_input: {
         readonly projector: "humanInputEventData";
         readonly coreType: string;
-        readonly excluded: readonly ["principal"];
+        readonly excluded: readonly ["principal", "runOrigin"];
         readonly minted: readonly [];
     };
     readonly task_notification: {

package/dist/trace/wire-projection-faces.js

@@ -1,6 +1,7 @@
 export const FRAME_ENVELOPE_KEYS = ["type", "sourceTaskId", "bgAgentId"];
 export const WIRE_PROJECTION_CORE_IMPORTS = [
     "TaskEvent",
+    "BrainStatus",
     "TaskNotificationPayload",
     "WiringManifest",
     "EngineNotice",
@@ -26,21 +27,21 @@ function withoutSections(all, drop) {
 export const WIRE_PROJECTION_FACES = {
     task_progress: { projector: "taskProgressEventData", coreType: arm("task_progress"), excluded: [], minted: [] },
     task_started: { projector: "taskStartedEventData", coreType: arm("task_started"), excluded: [], minted: [] },
-    tool_start: { projector: "toolStartEventData", coreType: arm("tool_start"), excluded: ["requestedBy"], minted: [] },
-    tool_end: { projector: "toolEndEventData", coreType: arm("tool_end"), excluded: ["requestedBy", "answeredBy"], minted: [] },
+    tool_start: { projector: "toolStartEventData", coreType: arm("tool_start"), excluded: [], minted: [] },
+    tool_end: { projector: "toolEndEventData", coreType: arm("tool_end"), excluded: [], minted: [] },
     tool_progress: { projector: "toolProgressEventData", coreType: arm("tool_progress"), excluded: [], minted: [] },
     tool_disclosure: { projector: "toolDisclosureEventData", coreType: arm("tool_disclosure"), excluded: [], minted: [] },
     tool_roster_delta: { projector: "toolRosterDeltaEventData", coreType: arm("tool_roster_delta"), excluded: [], minted: [] },
     diagnostics: { projector: "diagnosticsEventData", coreType: arm("diagnostics"), excluded: [], minted: [] },
     steering_injected: { projector: "steeringInjectedEventData", coreType: arm("steering_injected"), excluded: [], minted: [] },
-    workspace_changed: { projector: "workspaceChangedEventData", coreType: arm("workspace_changed"), excluded: [], minted: [] },
-    status: { projector: "brainStatusEventData", coreType: arm("status"), excluded: [], minted: [] },
+    workspace_changed: { projector: "workspaceChangedEventData", coreType: arm("workspace_changed"), excluded: ["root", "remote", "entered", "project"], minted: [] },
+    status: { projector: "brainStatusEventData", coreType: `BrainStatus & ${arm("status")}`, excluded: [], minted: [] },
     compacted: { projector: "compactedEventData", coreType: arm("compacted"), excluded: [], minted: [] },
     context_usage: { projector: "contextUsageEventData", coreType: arm("context_usage"), excluded: [], minted: [] },
     turn_end: { projector: "turnEndEventData", coreType: arm("turn_end"), excluded: [], minted: [] },
     compaction_outcome: { projector: "compactionOutcomeEventData", coreType: arm("compaction_outcome"), excluded: [], minted: [] },
     compaction_started: { projector: "compactionStartedEventData", coreType: arm("compaction_started"), excluded: [], minted: [] },
-    human_input: { projector: "humanInputEventData", coreType: arm("human_input"), excluded: ["principal"], minted: [] },
+    human_input: { projector: "humanInputEventData", coreType: arm("human_input"), excluded: ["principal", "runOrigin"], minted: [] },
     task_notification: {
         projector: "taskNotificationEventData",
         coreType: `TaskNotificationPayload & ${arm("task_notification")}`,

package/dist/user-authored-text.d.ts

@@ -1,5 +1,5 @@
-/** 非用户正文块的闭集标签(引擎 / 壳注入)。加一个标签 = 改这里一处:下面的正则由本表生成。 */
-export declare const INJECTED_BLOCK_TAGS: readonly ["system-reminder", "task-notification", "attachment"];
+/** 非用户正文块的闭集标签(引擎 / 壳注入)。加一个标签 = 改这里一处:下面的正则由本表生成(分支组的序 = 本表的序)。 */
+export declare const INJECTED_BLOCK_TAGS: readonly ["system-reminder", "task-notification", "attachment", "command-name", "command-message", "command-args", "local-command-stdout", "local-command-stderr", "local-command-caveat", "bash-input", "bash-stdout", "bash-stderr", "bash-exit-code", "user-memory-input"];
 /**
  * 注入块的唯一一只正则(由 {@link INJECTED_BLOCK_TAGS} 生成)。**只配 `String.prototype.replace` 使用**(带 `g`,
  * `lastIndex` 有状态,拿去 `.test` / `.exec` 会读到上一次的位置)。

package/dist/user-authored-text.js

@@ -1,5 +1,20 @@
 import { redactSecrets } from "./trace/redact.js";
-export const INJECTED_BLOCK_TAGS = ["system-reminder", "task-notification", "attachment"];
+export const INJECTED_BLOCK_TAGS = [
+    "system-reminder",
+    "task-notification",
+    "attachment",
+    "command-name",
+    "command-message",
+    "command-args",
+    "local-command-stdout",
+    "local-command-stderr",
+    "local-command-caveat",
+    "bash-input",
+    "bash-stdout",
+    "bash-stderr",
+    "bash-exit-code",
+    "user-memory-input",
+];
 export const INJECTED_BLOCK_RE = new RegExp(`<(${INJECTED_BLOCK_TAGS.join("|")})(?:\\s(?:[^<>"']|"[^"<]*"|'[^'<]*')*?)?(?:\\/>|>[\\s\\S]*?(?:<\\/\\1>|$))\\s*`, "g");
 export function stripInjectedBlocks(text) {
     return text.replace(INJECTED_BLOCK_RE, "");

package/dist/web-admin-client/center-request.d.ts

@@ -82,8 +82,9 @@ export interface CenterRequestInit {
 }
 /**
  * 「后面要拼路径的基址」的拒句 —— 中心基址三席(`SEMA_WEB_ADMIN_URL` / `SEMA_WEB_ADMIN_LIVE_URL` / `SEMA_WEB_ADMIN_WEB_URL`)与本实例的
- * 公告地址(`FLEET_ADVERTISE_ADDRESS`,中心往它后面拼 `/v1/...`)同读。判官是 settings-schema 的 `httpUrlFlaws`(层级式 http(s) URL;Node 的 fetch
- * 认 `file://` / `data:`,配错的地址不许变成读本地文件),本函数只声明这一席禁哪几件({@link PATH_BASE_FORBIDS})。起服时 `config.ts` 判
+ * 公告地址(`FLEET_ADVERTISE_ADDRESS`,中心往它后面拼 `/v1/...`)同读。判官是 settings-schema 的 `pathBaseUrlFlaws`(14.7.0 起:这一座位的禁用集
+ * userinfo / query / fragment 与判官都在契约包,= `httpUrlFlaws` 配那一集;层级式 http(s) URL,Node 的 fetch 认 `file://` / `data:`,配错的地址不许变成
+ * 读本地文件),本仓零禁用集副本,编排器渲染公告地址 env 的一方调的是同一只。起服时 `config.ts` 判
  * (拒启),请求期 {@link centerFetch} 对同一份基址再判一次(自拼 `ServiceConfig` 的嵌入方也吃同一条规则)。合格 ⇒ `undefined`;否则交回
  * `<subject> <规则词>; got "<展示面安全形>"` —— 拒句里没有从值里解析出来的任何记号(scheme / userinfo / 主机名),捕获点照原样落日志即可。
  */

package/dist/web-admin-client/center-request.js

@@ -2,7 +2,7 @@ import settingsSchemaPackage from "@sema-agent/settings-schema/package.json" wit
 import { AUTH_V1_PATHS } from "@sema-agent/settings-schema/api/auth";
 import { FLEET_LIVE_PATHS, FLEET_PATHS } from "@sema-agent/settings-schema/fleet";
 import { CenterCredentialUnavailableError } from "../center-credential.js";
-import { WEB_ADMIN_ENV, httpUrlFlaws } from "@sema-agent/settings-schema";
+import { WEB_ADMIN_ENV, httpUrlFlaws, pathBaseUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal } from "../url-refusal.js";
 import { egressRedirectRefusal } from "../egress-redirect.js";
 export const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
@@ -82,9 +82,8 @@ async function sendToCenter(fix, url, wire) {
         throw new CenterRedirectRefusedError(res.status, `web-admin center request: ${refusal}`);
     return res;
 }
-const PATH_BASE_FORBIDS = ["userinfo", "query", "fragment"];
 export function pathBaseUrlRefusal(subject, raw) {
-    const flaws = httpUrlFlaws(raw, PATH_BASE_FORBIDS);
+    const flaws = pathBaseUrlFlaws(raw);
     return flaws.length === 0 ? undefined : buildHttpUrlRefusal(subject, raw, flaws);
 }
 function assertPathBaseUrl(raw, what) {

package/dist/web-admin-client/skills-mcp.d.ts

@@ -1,6 +1,7 @@
 import { type A2aServerSpec, type McpServerSpec, type SkillSpec } from "@sema-agent/core";
 import type { CenterMcp, ScopedA2aPeer } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
+import { type PeerDesk, type PeerLease } from "../peer-seat.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import type { ConfigProvider } from "../config-provider.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
@@ -53,14 +54,16 @@ export declare function applySkillsManifest(baseline: LoadedSkill[], manifest: {
 }, bodies: SkillBodySource, logger?: Logger): Promise<LoadedSkill[]>;
 /**
  * Resolve center MCP servers (`/effective.mcp`) into core `McpServerSpec`s + the scenarios each applies to.
- * env-NAME refs → real values from THIS service's env (secret boundary unchanged); a server with any missing
+ * env-NAME refs → real values from THIS service's env (secret boundary unchanged), registered on `desk` under `rosterLease`
+ * (the desk's one minting point `mintDeclaration`, called only for an entry that mounts — after every judge below has passed, so a skipped
+ * entry never holds a registration): the spec carries the minted reference, never the values. A server with any missing
  * ref is skipped (`resolveRefs` → null). `enabled:false` skipped. A server whose `toolFaces` / `toolAxes` declaration is
  * malformed is skipped whole (both are trust-root declarations — the engine's `readToolFaces` / `readMcpToolAxes` judge them). Restart-to-apply
  * (filtered per scenario in `resolveSpec` via `mcpForScenario`).
  */
 export declare function resolveMcpServers(mcp: {
     servers: CenterMcpServer[];
-}, logger?: Logger): CenterMcp;
+}, desk: Pick<PeerDesk, "declare">, rosterLease: PeerLease, logger?: Logger): CenterMcp;
 /** The MCP servers applicable to a scenario: tagged with it, or untagged (global). undefined when none.
  *  [ref]:alias 窗撤销,单键命中(同 `skillsForScenario`)。 */
 export declare function mcpForScenario(center: CenterMcp | undefined, scenario: string): McpServerSpec[] | undefined;
@@ -68,7 +71,8 @@ export declare function mcpForScenario(center: CenterMcp | undefined, scenario:
  * DESIGN-269 §2.1 —— resolve center A2A peers (`/effective.a2a`) into core `A2aServerSpec`s + the scenarios
  * each applies to. Exact sibling of {@link resolveMcpServers}, same three rules:
  *   · header-NAME refs → real values from THIS service's env (the secret boundary is unchanged — the center
- *     never holds the bearer). A peer with ANY missing ref is SKIPPED wholesale (`resolveRefs` → null):
+ *     never holds the bearer), registered on `desk` under `rosterLease` (`mintDeclaration`, only for a peer that mounts); the spec carries the minted
+ *     reference, never the values. A peer with ANY missing ref is SKIPPED wholesale (`resolveRefs` → null):
  *     dialing a remote AGENT with half the credentials is the wrong failure direction.
  *   · `enabled:false` skipped.
  *   · restart-to-apply (filtered per scenario in `resolveSpec` via {@link a2aForScenario}).
@@ -83,7 +87,7 @@ export declare function mcpForScenario(center: CenterMcp | undefined, scenario:
  */
 export declare function resolveA2aPeers(a2a: {
     peers: CenterA2aPeer[];
-}, logger?: Logger): ScopedA2aPeer[];
+}, desk: Pick<PeerDesk, "declare">, rosterLease: PeerLease, logger?: Logger): ScopedA2aPeer[];
 /** The A2A peers applicable to a scenario: tagged with it, or untagged (global). undefined when none.
  *  Twin of {@link mcpForScenario} — `undefined` (not `[]`) is load-bearing: an empty array would put an
  *  `a2a: []` key on the spec, i.e. "this deployment declares an empty peer set", where absence means

package/dist/web-admin-client/skills-mcp.js

@@ -1,8 +1,9 @@
 import { readMcpSourceLabel } from "../mcp-source-label.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
-import { readMcpToolAxes, readToolFaces } from "@sema-agent/core";
+import { judgeSessionMetaKey, readMcpToolAxes, readToolFaces } from "@sema-agent/core";
 import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, isContentOriginWord, isUsableWireName } from "@sema-agent/settings-schema";
-import { noteMcpAssertionHeaderNotSent, sentMcpAssertionHeaderMember, withholdsMcpAssertionHeader } from "../mcp-assertion-header.js";
+import { noteMcpAssertionHeaderNotSent, withholdsMcpAssertionHeader } from "../mcp-assertion-header.js";
+import { mintDeclaration, peerSentence } from "../peer-seat.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 export function skillToolListsOf(source) {
     return {
@@ -115,7 +116,7 @@ function resolveRefs(refs, server, kind, logger, event = "web_admin_mcp_env_miss
     }
     return out;
 }
-export function resolveMcpServers(mcp, logger) {
+export function resolveMcpServers(mcp, desk, rosterLease, logger) {
     const out = [];
     const reservedNames = (mcp.servers ?? []).map((s) => s.name);
     for (const s of mcp.servers ?? []) {
@@ -147,7 +148,7 @@ export function resolveMcpServers(mcp, logger) {
         if (!facesRead.ok) {
             logger?.warn("web_admin_mcp_tool_faces_invalid", {
                 server: s.name,
-                problem: facesRead.problem,
+                problem: peerSentence(facesRead.problem),
                 note: "server SKIPPED — a toolFaces overlay is a NARROWING declaration (its pathTarget is what the sensitive-path / write fences read); mounting the server without it would silently drop the protection you declared. Fix the entry and republish.",
             });
             continue;
@@ -157,20 +158,31 @@ export function resolveMcpServers(mcp, logger) {
         if (!axesRead.ok) {
             logger?.warn("web_admin_mcp_tool_axes_invalid", {
                 server: s.name,
-                problem: axesRead.problem,
+                problem: peerSentence(axesRead.problem),
                 note: "server SKIPPED — a toolAxes declaration is a TRUST-ROOT declaration (it can lower an effect so a call skips the approval fence, or raise one); mounting the server without it, or with a half of it, would silently change what you declared. Fix the entry and republish.",
             });
             continue;
         }
         const toolAxes = axesRead.toolAxes === undefined ? {} : { toolAxes: axesRead.toolAxes };
+        const metaKey = judgeSessionMetaKey(s.sessionMetaKey);
+        if ("problem" in metaKey) {
+            logger?.warn("web_admin_mcp_session_meta_key_invalid", {
+                server: s.name,
+                problem: peerSentence(metaKey.problem),
+                note: "server SKIPPED — its sessionMetaKey cannot ride (the engine's judge refused it); mounting the server without the key would silently drop the session id it declared it needs. Fix the entry and republish.",
+            });
+            continue;
+        }
+        const sessionMetaKey = metaKey.key === undefined ? {} : { sessionMetaKey: metaKey.key };
         if (s.transport.kind === "stdio") {
             const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
             if (env === null)
                 continue;
-            out.push({
-                scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces, ...toolAxes },
-            });
+            const draft = {
+                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces, ...toolAxes, ...sessionMetaKey },
+                pieces: env,
+            };
+            out.push({ scenarios: s.scenarios ?? [], spec: mintDeclaration(desk, draft, rosterLease) });
         }
         else {
             const headers = resolveRefs(s.transport.headerRefs, s.name, "header", logger);
@@ -178,10 +190,11 @@ export function resolveMcpServers(mcp, logger) {
                 continue;
             if (withholdsMcpAssertionHeader(s.transport.assertionHeader))
                 noteMcpAssertionHeaderNotSent(logger, s.name);
-            out.push({
-                scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}), ...sentMcpAssertionHeaderMember(s.transport.assertionHeader) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces, ...toolAxes },
-            });
+            const draft = {
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source, ...toolFaces, ...toolAxes, ...sessionMetaKey },
+                pieces: headers,
+            };
+            out.push({ scenarios: s.scenarios ?? [], spec: mintDeclaration(desk, draft, rosterLease) });
         }
     }
     if (out.length > 0)
@@ -195,7 +208,7 @@ export function mcpForScenario(center, scenario) {
     const hit = servers.filter((s) => s.scenarios.length === 0 || s.scenarios.includes(scenario)).map((s) => s.spec);
     return hit.length > 0 ? hit : undefined;
 }
-export function resolveA2aPeers(a2a, logger) {
+export function resolveA2aPeers(a2a, desk, rosterLease, logger) {
     const out = [];
     for (const p of a2a.peers ?? []) {
         if (p.enabled === false)
@@ -210,17 +223,17 @@ export function resolveA2aPeers(a2a, logger) {
         const headers = resolveRefs(p.headerRefs, p.name, "header", logger, "web_admin_a2a_env_missing", "skipping this A2A peer — referenced env var is unset in this service");
         if (headers === null)
             continue;
-        out.push({
-            scenarios: p.scenarios ?? [],
+        const draft = {
             spec: {
                 name: p.name,
                 url: p.url,
                 ...(p.cardUrl ? { cardUrl: p.cardUrl } : {}),
-                ...(Object.keys(headers).length ? { headers } : {}),
                 ...(p.principalHeader ? { principalHeader: p.principalHeader } : {}),
                 ...(p.allowSkills && p.allowSkills.length > 0 ? { allowSkills: p.allowSkills } : {}),
             },
-        });
+            pieces: headers,
+        };
+        out.push({ scenarios: p.scenarios ?? [], spec: mintDeclaration(desk, draft, rosterLease) });
     }
     if (out.length > 0)
         logger?.info("web_admin_a2a", { peers: out.map((p) => p.spec.name) });

package/dist/web-admin-client/types.d.ts

@@ -170,6 +170,11 @@ export interface CenterMcpServer {
      * (同批解析透明键 `authForm` / `entryKind` 的语义归连接器,本层仍只承载。)
      */
     toolAxes?: unknown;
+    /**
+     * core 7.58.0 `McpServerSpec.sessionMetaKey` —— 声明了它的服务器,引擎在每次 `tools/call` 的 `_meta` 下以这把键放这条腿的会话 id。
+     * 承载形 `unknown`(与 {@link CenterMcpServer.toolAxes} 同姿):判官只有引擎根导出的 `judgeSessionMetaKey`(`resolveMcpServers` 在铸 spec 那一刻问它;坏形整条 server 不进)。
+     */
+    sessionMetaKey?: unknown;
     transport: {
         kind: "stdio";
         command: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.137.0",
+  "version": "7.138.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -69,8 +69,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.56.0",
-    "@sema-agent/settings-schema": "14.5.0",
+    "@sema-agent/core": "7.59.0",
+    "@sema-agent/settings-schema": "14.7.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",