@sema-agent/server 7.137.0 → 7.139.0

package/dist/task-cwd.d.ts

@@ -87,8 +87,13 @@ export declare function parseAdditionalDirectories(raw: unknown): string[] | und
  *      per-session choice always wins;
  *   2. the TRUSTED `ctx.parentCwd` (core threads the PARENT task's working root via `RunInternals` when this
  *      task is a delegated child — never a TaskSpec field), UNLESS the child asked for `isolation:"worktree"`
- *      (core contract: worktree wins — an isolated fan-out child must not share the parent's mutable dir);
+ *      (an isolated fan-out child must not share the parent's mutable dir) — then `undefined`;
  *   3. undefined → the factory's ephemeral per-task dir (top-level task with no registered cwd).
+ * The `isolation:"worktree"` ⇒ `undefined` rule is this function's own and holds by itself (the child never inherits the
+ * parent's dir). It is NOT what answers a worktree ask on the host lane: `boot/execution-env.ts` never reaches here with one —
+ * the worktree wrapper (one layer out) mints the tree and does not call the base factory, and without the wrapper the base
+ * factory REFUSES (`isolation.unavailable`) instead of minting the empty ephemeral dir rule 3 would give. That refusal arm is
+ * revoked when engine 7.61.0 refuses by itself; this function's rule then goes on keeping the child off the parent's dir.
  * CC parity: a Task sub-agent inherits the main session's cwd. Trust: `parentCwd` comes from core's trusted
  * run-internals channel (same posture as `isolation`), so no tenancy gate is needed here — but the HOST lane
  * itself is single-user by deployment shape, and container lanes (k8s/e2b/local-docker) never consult this.

package/dist/task-mcp.d.ts

@@ -24,7 +24,8 @@
  */
 import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 import { type McpIdentityHeadersIssue, type RequestMcpServerSpec } from "./mcp-assertion-header.js";
-import { type DeclarationRefusal } from "./request-declaration-refusal.js";
+import { type McpDraft, type PeerDesk, type PeerLease } from "./peer-seat.js";
+import { type DeclarationKeyIssue, type DeclarationRefusal } from "./request-declaration-refusal.js";
 import type { StoredToolAxesRereadM19 } from "./stored-request-tool-axes-m19.js";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
@@ -52,11 +53,11 @@ export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
  * 再写一份就是一份手抄投影([ref]:任何仓第一排查点),而两份哪天分岔,窄的那一份会把**合法**的键当成
  * 拼写错误 400 掉。
  *
- * ## 🔴 两向钉在 core 的 `McpServerSpec` 上(不是手抄)
- * 下面六道编译期门:型上多一个键而表没跟 ⇒ 红;表里写一个型上没有的词(改名 / 拼错 / 删键后的残条目)
- * ⇒ 也红。于是这三张表是从 core 的型**派生**出来的数据,而不是誰记得去同步的清单。
- * (唯一一格不在 core 型上的键 = http 传输的 `assertionHeader`:引擎尚无座,本仓承载 —— 那一支的门钉在
- * `mcp-assertion-header.ts` 的 {@link RequestMcpServerSpec} 上,引擎一旦长出同名座,那里的退役门当场红。)
+ * ## 🔴 两向钉在请求面条目形上(不是手抄)
+ * 条目层:下面四道编译期门两向钉在请求面条目形 {@link RequestMcpServerSpec}(条目层 = 引擎 `McpServerSpec` 的条目层)上:型上多一个键而表没跟 ⇒ 红;表里写一个型上没有的词
+ * (改名 / 拼错 / 删键后的残条目)⇒ 也红。传输层:两张键表**就是**两臂处置表的键(`mcp-assertion-header.ts` 的 {@link MCP_STDIO_TRANSPORT_DISPOSITION} /
+ * {@link MCP_HTTP_TRANSPORT_DISPOSITION}),处置表对契约包的请求传输形两向钉、对引擎的传输形再钉两道 —— 一张表同时说「收哪些键」与「每个键去哪」。
+ * 于是这几张表是从型**派生**出来的数据,而不是谁记得去同步的清单。
  *
  * ## 一个回答者,两扇门;读器另算
  * 「这份声明能不能原样用」只有 {@link requestMcpDeclarationRefusal} 一只回答者:词表外的键(条目层 / 本形 `transport` 层)⇒ `400 request.body_shape` 带 `unknownKeys`,
@@ -66,12 +67,11 @@ export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
  * ## 受理键的判官表也钉在这张表上
  * 逐键判官表 {@link ENTRY_KEY_JUDGES} 是 `{ [K in 本表的键]: 判官 }` 的映射型 —— 本表多一个键而没写判官 ⇒ 编译红,不会出现「这个键写坏了却被悄悄受理」的新键。
  */
-export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
-/** `transport.kind:"stdio"` 的键闭集(两向钉在 core 那一支上)。 */
-export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ["args", "command", "env", "kind"];
-/** `transport.kind:"http"` 的键闭集(同上)。`assertionHeader` 是本仓承载、引擎尚无座的一格(见 {@link RequestMcpServerSpec}):
- *  表两向钉在**请求面的 http 传输型**上 = 引擎的键 ∪ 这一格;引擎一旦长出同名座,`mcp-assertion-header.ts` 的退役门当场红。 */
-export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ["assertionHeader", "headers", "kind", "principalHeader", "url"];
+export declare const MCP_SERVER_ENTRY_KEYS: readonly ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
+/** `transport.kind:"stdio"` 的键闭集 = stdio 臂处置表的键(`env` 是件,其余进声明)。 */
+export declare const STDIO_MCP_TRANSPORT_KEYS: readonly ("env" | "kind" | "args" | "command")[];
+/** `transport.kind:"http"` 的键闭集 = http 臂处置表的键(`headers` 是件,`assertionHeader` 承载不发送,其余进声明)。 */
+export declare const HTTP_MCP_TRANSPORT_KEYS: readonly ("headers" | "kind" | "principalHeader" | "url" | "assertionHeader")[];
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (deployment-shape row `multiTenant` does not hold) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -157,9 +157,10 @@ export declare function requestEntryIdentityIssue(entry: unknown): McpIdentityHe
  *     `startupTimeoutMs` = 引擎根导出的 `mcpStartupTimeoutMs`(坏值抛 `config.mcp_startup_timeout_invalid`,本门把那一句作原因句);`contentOrigin` = `isContentOriginWord`;`source` = `isMcpSourceLabel`;
  *     `name` = `isUsableWireName`;`allowTools` / `transport.args` = {@link isStringArray};`transport.env` / `headers` = 契约包读器 {@link readRequestMcpTransport} 的纯数据记录读法;`elicitation` = {@link isElicitationFlag};
  *     `transport` 的硬字段(`kind` / `command` / `url`)与软字段(`args` / `env` / `headers` / `principalHeader`)= {@link readRequestMcpTransport}(读器投影 transport 的那一只函数,门读它报的 `lost`;读器在契约包,本仓只据 `lost[0]` 拒、据 `lost` 在重放腿逐处点名);
- *     读器交回的 http `url` 再问「带不带凭据」= 契约包根的 `findUrlCredential`([ref];拒体另带机读 `field` + `reason`,见 {@link transportUrlCredentialIssue})。
+ *     读器交回的 http `url` 再问「带不带凭据」= 契约包根的 `findUrlCredential`([ref];拒体另带机读 `field` + `reason`,见 {@link transportUrlCredentialIssue});
+ *     http `principalHeader` 再问「这个名有没有别的属主」= 引擎包根的 `headerOwnershipCollision`(见 {@link principalHeaderOwnershipIssue})。
  * 于是判官受理的条目,读器({@link normalizeServer})交回的就是申报本身(只差判官自己的合法归一:空容器 / `skillScopeEligible:false` 折成缺席、`toolAxes` 取引擎的拷贝)——
- * 探测口拨的那一份因此就是提交腿会挂的那一份,不另比一遍(另比就是第二只回答者)。唯一按门分的后果是「声明了 `assertionHeader`」这一个事实(引擎尚无座,
+ * 探测口拨的那一份因此就是提交腿会挂的那一份,不另比一遍(另比就是第二只回答者)。唯一按门分的后果是「声明了 `assertionHeader`」这一个事实(本部署不发送断言,
  * 承载、不发送):新提交照挂 + 运维 info,探测口整条拒 —— 判据是同一只谓词 `specWithholdsMcpAssertionHeader`(开关 `MCP_ASSERTION_HEADER_SENT` 假时「声明了」即「被扣下」),不是第二份判法(见 `readMcpProbeBody`)。
  *
  * ## 射程
@@ -184,6 +185,14 @@ export declare function requestMcpDeclarationRefusal(list: unknown): Declaration
  * 交出去的剔掉 `__proto__` 名成员),server 照挂,运维 warn `mcp_transport_members_dropped` 逐处点名 —— 续跑重放腿不静默丢声明。
  */
 export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
+/**
+ * `principalHeader` 的**名**有没有别的属主:判官是引擎包根的 `headerOwnershipCollision`(拨号时判同一条的那一只;这里只问身份头这一个名,件头名由引擎在发送时判)——
+ * 名(任何大小写)是这一协议的传输自己写的头(MCP:`mcp-session-id` · `mcp-protocol-version` · `content-type` · `accept` · `last-event-id`;A2A 没有),或是引擎的断言头
+ * (`connector-assertion`)⇒ 这一台拨号时必被拒,新提交在门上按名拒。原因句只点名**属主的拼写**(引擎固定表里的规范化小写头名),不回显调用方写的原串 / 大小写形(调用方写的恰是小写时,句里的名与所写相同)。
+ * 新提交腿上按名 400(MCP 门表的 `transport`、A2A 判官表的 `principalHeader`)。续跑重放腿不 4xx:MCP 的读器不问它 —— 存量体里这一形照挂,由引擎在拨号时拒那一台、兄弟照挂;
+ * A2A 的读器问同一张判官表 —— 这一条对端整条不进、`a2a_injection_dropped` 点名原因(引擎物化时同样拒那一台;结局同,原因说在本仓这一行)。
+ */
+export declare function principalHeaderOwnershipIssue(principalHeader: string | undefined, protocol: "mcp" | "a2a", path: string): DeclarationKeyIssue | undefined;
 /**
  * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
  * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
@@ -194,12 +203,14 @@ export declare function assertRequestMcpEntries(bodyMcp: unknown): void;
  */
 export declare function deploymentClosedMcpNames(baseline: McpServerSpec[] | undefined, reservedNames: readonly string[]): ReadonlySet<string>;
 /**
- * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). Names closed by the deployment
- * ({@link deploymentClosedMcpNames}) are dropped from `gated`. `reservedNames` has NO default: a security predicate's
- * input is never implied — a caller with no deployment declaration passes `[]` and says so. Returns the baseline unchanged
- * when nothing is added.
+ * Merge GATED per-request MCP drafts OVER the deployment baseline (center/config): **select first, then mint**. Names closed by the deployment
+ * ({@link deploymentClosedMcpNames}) are dropped from `drafts` before anything is registered — a draft that loses to the deployment never
+ * reaches the desk; each winner is minted once on `desk` under `lease` (`peer-seat.ts` `mintDeclaration`: the reference on its transport, zero
+ * piece values). `desk` / `lease` = the process's peer desk and this leg's host lease (`boot/resolve-spec.ts` passes `peerDesk` and `opts.lease`).
+ * `reservedNames` has NO default: a security predicate's input is never implied — a caller with no deployment declaration passes `[]` and says so.
+ * Returns the baseline unchanged when nothing is added.
  */
-export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[], reservedNames: readonly string[]): McpServerSpec[] | undefined;
+export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, drafts: readonly McpDraft[], reservedNames: readonly string[], desk: Pick<PeerDesk, "declare">, lease: PeerLease): McpServerSpec[] | undefined;
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
@@ -216,7 +227,9 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
     mcpServers?: {
         reservedNames: readonly string[];
     };
-}, logger?: {
+}, 
+/** 对端座的 desk 与本腿的宿主租约(必填):胜出草稿在它下面铸成带引用的声明 —— 一条腿交给引擎的请求面声明只经它带引用。 */
+desk: Pick<PeerDesk, "declare">, lease: PeerLease, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
 }, 

package/dist/task-mcp.js

@@ -1,19 +1,21 @@
-import { mcpInjectionDroppedNotice, mcpStartupTimeoutMs, readToolFaces, resolveComplianceDenies } from "@sema-agent/core";
+import { MCP_ASSERTION_HEADER, headerOwnershipCollision, judgeSessionMetaKey, mcpInjectionDroppedNotice, mcpStartupTimeoutMs, readToolFaces, resolveComplianceDenies } from "@sema-agent/core";
 import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeNotStringArray, describeValueShape, findUrlCredential, isContentOriginWord, isStringArray, isUsableWireName, readRequestMcpTransport, stripControlAndBidi, } from "@sema-agent/settings-schema";
 import { HttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
-import { describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
+import { MCP_HTTP_TRANSPORT_DISPOSITION, MCP_STDIO_TRANSPORT_DISPOSITION, describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toMcpDraft, } from "./mcp-assertion-header.js";
+import { declarationKeys } from "./plain-string-record.js";
+import { mintDeclaration, peerSentence } from "./peer-seat.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { readRequestToolAxes } from "./request-tool-axes.js";
 import { urlCredentialHeaderExit, urlCredentialRefusalReason } from "./url-credential-refusal.js";
 import { MALFORMED_NAME, declarationFieldRefusal, declarationNameIssue, declaredName, judgeDeclarationKeys, requestDeclarationRefusal, throwDeclarationRefusal, } from "./request-declaration-refusal.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
-export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
-export const STDIO_MCP_TRANSPORT_KEYS = ["args", "command", "env", "kind"];
-export const HTTP_MCP_TRANSPORT_KEYS = ["assertionHeader", "headers", "kind", "principalHeader", "url"];
+export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "sessionMetaKey", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
+export const STDIO_MCP_TRANSPORT_KEYS = declarationKeys(MCP_STDIO_TRANSPORT_DISPOSITION);
+export const HTTP_MCP_TRANSPORT_KEYS = declarationKeys(MCP_HTTP_TRANSPORT_DISPOSITION);
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;
@@ -52,7 +54,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
         const again = readRequestToolAxes(storedToolAxes.mcp(o.toolAxes), "mcp");
         if (again.ok) {
             judged = again;
-            toolAxesReread = stripControlAndBidi(axes.problem);
+            toolAxesReread = peerSentence(stripControlAndBidi(axes.problem));
         }
     }
     if (!judged.ok)
@@ -73,6 +75,11 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
         return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
+    const metaKey = judgeSessionMetaKey(o.sessionMetaKey);
+    if ("problem" in metaKey)
+        return bad("sessionMetaKey");
+    if (metaKey.key !== undefined)
+        spec.sessionMetaKey = metaKey.key;
     return { ok: true, spec, ...(toolAxesReread !== undefined ? { toolAxesReread } : {}), transportLost: read.lost };
 }
 export function validateRequestMcp(raw) {
@@ -92,7 +99,7 @@ function validateRequestMcpEntries(raw, storedToolAxes) {
         if (v.ok) {
             ok.push(v.spec);
             if (v.toolAxesReread !== undefined)
-                toolAxesReread.push({ server: v.spec.name, problem: v.toolAxesReread });
+                toolAxesReread.push({ server: v.spec.name, sentence: v.toolAxesReread });
             if (v.transportLost.length > 0)
                 transportLost.push({ server: v.spec.name, lost: v.transportLost.map((i) => i.path) });
         }
@@ -164,6 +171,17 @@ function transportUrlCredentialIssue(url) {
         return undefined;
     return { path: "transport.url", reason: urlCredentialRefusalReason(found, urlCredentialHeaderExit("transport.headers")), credential: found };
 }
+export function principalHeaderOwnershipIssue(principalHeader, protocol, path) {
+    if (principalHeader === undefined)
+        return undefined;
+    const collision = headerOwnershipCollision({ principalHeader }, protocol);
+    if (collision === undefined)
+        return undefined;
+    return {
+        path,
+        reason: `names the header "${collision.first}" (header names are case-insensitive), which is not the principal header's to own — it is ${protocol === "mcp" && collision.first !== MCP_ASSERTION_HEADER ? "a header the MCP transport writes itself" : "the engine's connector assertion header"}; name the principal header something of its own`,
+    };
+}
 const ENTRY_KEY_JUDGES = {
     allowTools: (o) => o.allowTools === undefined || isStringArray(o.allowTools)
         ? undefined
@@ -177,6 +195,10 @@ const ENTRY_KEY_JUDGES = {
         },
     elicitation: (o) => (o.elicitation === undefined || isElicitationFlag(o.elicitation) ? undefined : { path: "elicitation", reason: `must be a boolean — got ${describeValueShape(o.elicitation)}` }),
     name: declarationNameIssue,
+    sessionMetaKey: (o) => {
+        const read = judgeSessionMetaKey(o.sessionMetaKey);
+        return "problem" in read ? { path: "sessionMetaKey", reason: peerSentence(read.problem) } : undefined;
+    },
     source: (o) => o.source === undefined || isMcpSourceLabel(o.source)
         ? undefined
         : { path: "source", reason: `must be a non-empty string of at most ${MCP_SOURCE_LABEL_MAX} characters (a display label) — got ${describeValueShape(o.source)}` },
@@ -190,16 +212,16 @@ const ENTRY_KEY_JUDGES = {
         catch (e) {
             if (e.code !== "config.mcp_startup_timeout_invalid")
                 throw e;
-            return { path: "startupTimeoutMs", reason: e instanceof Error ? e.message : String(e) };
+            return { path: "startupTimeoutMs", reason: peerSentence(e instanceof Error ? e.message : String(e)) };
         }
     },
     toolAxes: (o) => {
         const read = readRequestToolAxes(o.toolAxes, "mcp");
-        return read.ok ? undefined : { path: "toolAxes", reason: read.problem };
+        return read.ok ? undefined : { path: "toolAxes", reason: peerSentence(read.problem) };
     },
     toolFaces: (o) => {
         const read = readToolFaces(o.toolFaces);
-        return read.ok ? undefined : { path: "toolFaces", reason: read.problem };
+        return read.ok ? undefined : { path: "toolFaces", reason: peerSentence(read.problem) };
     },
     transport: (o) => {
         const read = readRequestMcpTransport(o.transport);
@@ -207,7 +229,9 @@ const ENTRY_KEY_JUDGES = {
             return read.issue;
         if (read.lost[0] !== undefined)
             return read.lost[0];
-        return read.transport.kind === "http" ? transportUrlCredentialIssue(read.transport.url) : undefined;
+        if (read.transport.kind !== "http")
+            return undefined;
+        return transportUrlCredentialIssue(read.transport.url) ?? principalHeaderOwnershipIssue(read.transport.principalHeader, "mcp", "transport.principalHeader");
     },
 };
 function requestEntryRefusal(entry, at) {
@@ -229,27 +253,27 @@ function requestEntryRefusal(entry, at) {
 export function deploymentClosedMcpNames(baseline, reservedNames) {
     return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
 }
-export function mergeRequestMcp(baseline, gated, reservedNames) {
-    if (gated.length === 0)
+export function mergeRequestMcp(baseline, drafts, reservedNames, desk, lease) {
+    if (drafts.length === 0)
         return baseline;
     const closed = deploymentClosedMcpNames(baseline, reservedNames);
-    const add = gated.filter((s) => !closed.has(s.name));
-    return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
+    const winners = drafts.filter((d) => !closed.has(d.spec.name));
+    return winners.length === 0 ? baseline : [...(baseline ?? []), ...winners.map((d) => mintDeclaration(desk, d, lease))];
 }
-export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice, storedToolAxes) {
+export function resolveRequestMcp(baseline, bodyMcp, config, desk, lease, logger, notice, storedToolAxes) {
     if (bodyMcp === undefined || bodyMcp === null)
         return baseline;
-    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes);
+    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, desk, lease, logger, storedToolAxes);
     mintInjectionDropNotices(drops, notice);
     return mcp;
 }
-function classifyRequestMcp(baseline, bodyMcp, config, logger, storedToolAxes) {
+function classifyRequestMcp(baseline, bodyMcp, config, desk, lease, logger, storedToolAxes) {
     if (bodyMcp !== undefined && bodyMcp !== null && !Array.isArray(bodyMcp)) {
         logger?.warn("mcp_injection_ignored", { reason: "mcpServers not an array" });
         return { mcp: baseline, drops: [] };
     }
     const entries = Array.isArray(bodyMcp) ? bodyMcp : [];
-    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger, storedToolAxes) : classifyGateClosed(baseline, entries);
+    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, desk, lease, logger, storedToolAxes) : classifyGateClosed(baseline, entries);
     if (outcome.drops.length > 0)
         logger?.warn("mcp_injection_dropped", { dropped: outcome.drops, droppedTotal: outcome.droppedTotal });
     return { mcp: outcome.mcp, drops: outcome.drops };
@@ -261,7 +285,7 @@ function classifyGateClosed(baseline, entries) {
         droppedTotal: entries.length,
     };
 }
-function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
+function classifyHonored(baseline, entries, config, desk, lease, logger, storedToolAxes) {
     const v = validateRequestMcpEntries(entries, storedToolAxes);
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
@@ -288,7 +312,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
         logger?.warn("mcp_tool_axes_read_as_before_upgrade", {
             server: r.server,
             migration: "M19",
-            problem: r.problem,
+            problem: r.sentence,
             note: "this replayed request was stored before the upgrade and its toolAxes declaration does not pass the engine's reader; while one-time migration M19 is open it is read the way the pre-upgrade server read it (members that did not fit are dropped, a declaration that is not an object counts as none) and the server stays mounted — once the window closes the same request leaves this server unmounted",
         });
     }
@@ -305,7 +329,7 @@ function classifyHonored(baseline, entries, config, logger, storedToolAxes) {
         });
     }
     return {
-        mcp: mergeRequestMcp(baseline, v.ok.map(toCoreMcpServerSpec), reservedNames),
+        mcp: mergeRequestMcp(baseline, v.ok.map(toMcpDraft), reservedNames, desk, lease),
         drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],
         droppedTotal: v.droppedTotal + blocked.length,
     };

package/dist/tool-approval.d.ts

@@ -1,3 +1,4 @@
+import type { ExecutionLane } from "./execution-lane-caps.js";
 import { type ApprovalDecidedBy, type HostSettledBy, type RetiredDecisionKeyFacts } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
 import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundGrantAbsence, type BoundSkillGrants, type ToolApprovalCard, type ReopenReason } from "@sema-agent/core";
@@ -10,8 +11,9 @@ import { type AskRowEndingCause, type SettleCause, type SettleOutcome } from "./
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
-import { type GrantBinding, type StandingAnswerCall } from "./standing-answer-grant.js";
+import { type GrantBinding, type StandingAnswerCard } from "./standing-answer-grant.js";
 import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.js";
+import { type ExtensionRequesterFace } from "./trace/extension-call-face.js";
 /** {@link ToolApprovalCoordinator.adoptOpenAsks} 的读数(装配点进启动日志)。 */
 interface OpenAskAdoption {
     /** 本次接管进活集合的问数。 */
@@ -214,10 +216,10 @@ export declare function carriesDeploymentListQuestion(deploymentListAsks: boolea
  * (`task-settings.ts`,`false`)—— 它们在交出这一问之前先读按工具名记的耐久豁免店(「本会话不再询问」在本层兑现,继承链上的同一问才够得着;审批席依约不退役
  * 继承问),而**能不能读**与审批席 / 回决写侧是同一只判据({@link standingAnswerDurablyRecordable}):记得下的才代答,记不下的(带授予绑定的问 ……)不代答,
  * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link noGateFacts},调用坐标取 `req`);`requiresRealApproval` /
- * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**调用**(`callGrantBindingOf` —— 本层手里还没有引擎铸的卡,core 7.51.0 不在
- * `ToolCallRequest` 上盖绑定词,[ref] 载体问题见 `standing-answer-grant.ts` 头注)。
+ * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**请求上引擎的词**(core 7.59.0 起 Runner 交给策略的 `ToolCallRequest`
+ * 带与卡同一组词;宿主不经 Runner 自建的请求两者都不说 ⇒ `unreadable` ⇒ 不读店,fail-closed —— 见 `standing-answer-grant.ts` 头注)。
  */
-export declare function policyAskStandingAnswerFacts(req: StandingAnswerCall & {
+export declare function policyAskStandingAnswerFacts(req: StandingAnswerCard & {
     readonly toolCallId: string;
     readonly toolName: string;
 }, ask: Extract<PermissionResult, {
@@ -242,8 +244,8 @@ export interface StandingAnswerFacts {
     readonly mandated: boolean;
     /** 这一问的应答**授不授予**这一次调用之外的东西、授予的话绑定是什么(批准引擎的 `Skill` = 激活技能 + 本 run 内清单免问)。
      *  `bound` ⇒ 站着的答案按「工具 + 绑定」记、只代答绑定相同的问(core 7.43.0 [ref] / [ref]:活的问与停驻行同带 `boundGrantDigest`);
-     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 折这一位:载体由问的属主定(`questionGrantBindingOf`)——
-     *  引擎铸的问读卡上引擎的词(`grantBindingOf`),部署名单自己的问与策略层的调用读 `callGrantBindingOf`([ref])。 */
+     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 的唯一读口 `grantBindingOf` 折这一位:只读载体上引擎的词,
+     *  载体不论(卡、停驻行、队列行、策略层的请求)。 */
     readonly grantBinding: GrantBinding;
     /** 引擎盖在这一问上的**类集**(`AskRequest.classes` / 停驻行孪生座;经 core 的屏 `screenAskClassMembers` 读)。`undefined` = 卡上没有类
      *  (老引擎 / 不盖类的站)或屏拒 —— 读不出的类不是「无类」。 */
@@ -474,6 +476,14 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
+    /**
+     * **ADDITIVE,`"tool_approval"` only** —— 这一问的调用是**一张扩展注册自己发起**的(`$.tool.call`,core 7.56.0 `AskRequest.requestedBy`):
+     * `{ kind: "extension", name }`,卡上「扩展 X 想跑 …」那一行的出处。模型消息带来的调用上缺席。display 事实,不是裁决输入。
+     * 读法与 `tool_start` / `tool_end` 上的同名键是同一只(`trace/extension-call-face.ts`:注册名过注册方文本的出口纪律,与 `wiring_manifest.mods[]` 的 `name`
+     * 逐字节同;形不对 ⇒ 丢 + 计一次)。呈卡腿上它是 `approval_request` 顶层的卡外座之一(`APPROVAL_REQUEST_LIVE_FACT_KEYS`,同一只帧对象的值);
+     * ⚠️ `card_json` 卡面不带本键(卡的键集属主在契约包),断连重放帧上它恒缺席(与其余卡外座同)。
+     */
+    requestedBy?: ExtensionRequesterFace;
     /**
      * **[ref] ②(core 7.37.0 [ref];ADDITIVE,`"tool_approval"` only)** —— 这一问的**类**:`classes` 的首员(core `ASK_CLASSES` 序),
      * `MODE_ARBITRATION` 的行键(权限模式读的就是它 / 它们)。引擎在每一个铸 `origin` 的站盖章(策略自报的值在盖章处被替换),本仓经
@@ -499,7 +509,7 @@ export interface ToolApprovalFrame {
     /** [ref](core 7.51.0 [ref],**ADDITIVE**,`"tool_approval"` only):这张卡为什么没有 {@link boundGrantDigest} —— 引擎铸的每张卡恰带两者之一:
      *  `not_bindable`(这一问不是引擎 `Skill` 工具的激活,不绑任何授予 ⇒ 应答可按工具记)/ `unreadable`(绑着却读不出;活卡上引擎恒给摘要,这一词
      *  只出现在读存量行的面上)。闭集经 `readClosedWordSeat(req, "boundGrantAbsence")` 窄读(筛 = core `BOUND_GRANT_ABSENCES`),集外 ⇒ 缺席 + 计一次。
-     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定(引擎铸的问那一家;部署名单自己的问读调用口)读它(`standing-answer-grant.ts` `grantBindingOf`)。display。 */
+     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定读它(`standing-answer-grant.ts` `grantBindingOf`,问是谁的都同读)。display。 */
     boundGrantAbsence?: BoundGrantAbsence;
     /** core 7.43.0 [ref]:分类器没给判词的成因词(`error` / `timeout` / `parse_error`;只在类 `classifier_no_ruling` 的卡上)。闭集经 core 的
      *  `readClosedWordSeat(req, "classifierNoRuling")` 窄读(筛 = core `isAutoModeFallbackCause`),集外 ⇒ 缺席 + 计一次。display:本仓不按它裁决。 */
@@ -863,6 +873,8 @@ interface ToolApprovalRunContextBase {
     taskId: string;
     sessionId?: string;
     owner: string | null;
+    /** 这条腿的执行车道 —— 装配点写所在边界执行上下文的 `ctx.lane`(`http/execution-context.ts`)。出处带车道:这只席造的问在铸行时记下它。 */
+    executionLane: ExecutionLane;
     abortSignal?: AbortSignal;
     /** [ref]([ref] §3.1 askId 派生的腿轴;车3 刀 3a 换轴:原 `leg?: number` → `legKey?: string`)。
      *  = `sha256(resume checkpoint token)` 的 hex,**首腿缺席折空串**(空串是首腿的真值,不是「未知」)。
@@ -1601,7 +1613,7 @@ export declare class ToolApprovalCoordinator {
      *    ⇒ 截一个字就恒 `rule_not_offered`,所以**绝不截**;真超尺(= core 放宽了自己的 512 或本仓与 core
      *    版本不同步)⇒ **整条车道撤回**(返回 `undefined`),与本文件既有的治理撤回 / 漂移撤回逐字同形:
      *    少渲一格是安全方向,渲一格按不动的才是 wire 谎言。今天这条臂不可达(每个座都是解析器产物),
-     *    它守的是版本不同步那一形 —— 与 `isSupportedRuleMatch` 的运行期 `default` 同族。
+     *    它守的是版本不同步那一形 —— 与 `isCommandRuleMatch` 的运行期 `default` 同族。
      *
      * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
      * 已截素材,而不是两处各截一遍。
@@ -1611,7 +1623,22 @@ export declare class ToolApprovalCoordinator {
     private static ruleOfferTextsOverSize;
     /** codex r1 [high]([ref]):offer 的自称座与 `parseRuleText(rule, "allow")` 派生的三元组逐字一致?(理由见调用点) */
     private static ruleOfferDerivedFactsAgree;
+    /**
+     * 一只 single 候选的工具与它的匹配词对得上吗(卡上的 single 只有两族):命令形(exact / prefix / wildcard / pattern)⇒ 规则是 shell 的;
+     * 整工具(`tool`,core 7.57.0:没有规则词替它说话的工具的卡铸「这只工具不再问」)⇒ 工具必须是一键整工具同意落得下的那一族
+     * ({@link cardTakesWholeToolConsent}:没有自己的规则文法、不在 shell 面上 —— 一张 shell 卡上的整工具候选 = 一键放行每一个程序,引擎不铸,兑付时也兑不动)。
+     * 其余匹配词(路径 / 名字 / 主机)不是本服务卡面的 single 候选 ⇒ 丢(那些卡今天没有本服务的规则车道)。穷举 `switch`:core 给匹配词加员时这里编译红。
+     */
+    private static singleOfferToolAgrees;
     private static boundRuleOfferTexts;
+    /**
+     * 这张卡的**绑定值**(`prepareCardApproval` 的 `command`,也是耐久行的 `rule_command`)= 引擎为这张卡铸的候选所说的那一形(core 只按卡的规则形铸候选):
+     *  · 候选全是整工具候选(`match: "tool"`,core 7.57.0;至少一只)⇒ `""` —— 整只工具不绑任何值;core 恰在 `command` 是 `""` 时为这类工具铸卡;
+     *  · 其余(命令形候选,或读者把候选丢光了)⇒ 被裁决的命令原字节 `args.command`(非空串;读不出 ⇒ 没有素材)。空候选表不说「整工具」:
+     *    它什么形都没说,绑定值回到调用自己的命令(编辑面兑的就是它)。
+     * 两形混在一张卡上 = 不是 core 铸得出的卡 ⇒ 没有素材(整条车道撤回,与本文件其余撤回臂同形)。`req.args` 窄读,禁裸 as-cast。
+     */
+    private static cardBindingOf;
     private buildRuleLaneMaterial;
     /** [ref]([ref]/[ref] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。
      *  匹配键=`ctxTaskId`(wire run id)。该字段的顶注说它「不是清扫判据」——那是因为清扫要判**连接**的
@@ -1746,6 +1773,7 @@ export declare class ToolApprovalCoordinator {
         owner: string | null;
         taskId: string;
         sessionId?: string;
+        executionLane: ExecutionLane;
     }, why: LegUnattended) => ((req: AskRequest) => Promise<AskOutcome>);
     /**
      * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据;[ref] / SN-C1 换读口)。
@@ -1944,6 +1972,8 @@ export declare class ToolApprovalCoordinator {
         /** [ref] 车3 刀 3b(§7.3):本腿的 walltime deadline —— 与 `legKey` 同源同理由,随**出处**走
          *  (子代经继承链拿到的是宿主腿的闭包,窗必须按宿主腿的剩余 walltime 算)。 */
         legDeadlineMonotonic?: number;
+        /** 宿主腿的执行车道(装配点写执行上下文的 `ctx.lane`);子代经继承链冻同一闭包 ⇒ 子代的问记宿主腿的车道。 */
+        executionLane: ExecutionLane;
     }) => ((req: AskRequest, signal?: AbortSignal) => Promise<AskOutcome>);
     /** 广播版裁决路径——`ask()`(ALS,恒单元素数组)与 `boundAsk`([ref]四多活集合,可能多元素)共用。
      *  全体 `ctxs` 保证同一 (owner, sessionId)(streamKey 分组不变式;单元素数组平凡成立)。