@sema-agent/server 7.141.0 → 7.143.0

package/dist/web-admin-client/apply-effective.js

@@ -1,8 +1,8 @@
 import { expandTiers, modelOriginOf, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
-import { CATALOG_REPLACES_ENV_MODELS_CODE, WEB_ADMIN_ENV, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
+import { CATALOG_REPLACES_ENV_MODELS_CODE, SandboxGitConfig, WEB_ADMIN_ENV, envModelsDecisionTag, formatConfigPath, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel, sanitizeZodError } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
-import { buildEnvModelIdNotServedNotice, mintCapabilityKeys, readAtMention, servedModelTableLeg } from "../model-select.js";
-import { applyAutoCompactWindow, buildModelCostKey, ownCredentialHitsInForce, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
+import { DEFAULT_MODEL_REF, buildEnvModelIdNotServedNotice, mintCapabilityKeys, readAtMention, servedModelTableLeg } from "../model-select.js";
+import { applyAutoCompactWindow, buildModelCostKey, isRosterGateArmed, ownCredentialHitsInForce, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
 import { NAME_TABLE_BEHAVIOR } from "../namespaced-rule-name.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
@@ -17,6 +17,7 @@ import { gateIntentUnserviceableReason } from "../approval.js";
 import { refusedGroups } from "./apply-ledger.js";
 import { judgeConfigCandidate } from "./candidate-gate.js";
 import { declareServerWithheldEnv, withdrawServerWithheldEnv } from "../server-secret-env.js";
+import { MODEL_ROUTE_ENV_KEYS } from "../model-route-gap.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
 function envDerivedModel(config) {
     const m = config.envModel;
@@ -65,6 +66,35 @@ export function mutateInPlace(target, source) {
 }
 const appliedGeneration = new WeakMap();
 const envModelPlane = new WeakMap();
+function envModelTableOf(config) {
+    const table = envModelPlaneOf(config).models;
+    const mainId = envDerivedModel(config).id;
+    const out = [];
+    if (mainId !== "" && Object.hasOwn(table, mainId))
+        out.push({ id: mainId, slot: "main", env: MODEL_ROUTE_ENV_KEYS.mainId });
+    for (const key of Object.keys(table))
+        if (key !== DEFAULT_MODEL_REF && key !== mainId)
+            out.push({ id: key, slot: "cheap", env: MODEL_ROUTE_ENV_KEYS.cheapId });
+    return out;
+}
+const unreadableDecisionsSaid = new WeakMap();
+function warnUnreadableEnvModelsDecision(config, source, logger) {
+    const decision = source.envModels;
+    if (decision.kind !== "unreadable" || logger === undefined)
+        return;
+    const said = unreadableDecisionsSaid.get(config) ?? new Set();
+    unreadableDecisionsSaid.set(config, said);
+    const tag = envModelsDecisionTag(decision);
+    if (said.has(tag))
+        return;
+    said.add(tag);
+    logger.warn("config_env_models_unreadable", {
+        dir: source.root,
+        reason: decision.reason,
+        ...(decision.reason === "io" ? { errno: decision.errno } : { digest: decision.digest }),
+        note: "the config root's env-model-table decision does not read — it is never read as a confirmation, so a local catalog that manages the model plane does not replace the declared env model table; fix or rewrite the file (a supported writer overwrites it whole), said once per content",
+    });
+}
 function envModelPlaneOf(config) {
     let snap = envModelPlane.get(config);
     if (snap === undefined) {
@@ -135,6 +165,7 @@ export function applyEffective(config, eff, logger, opts) {
         }
     }
     const servedBefore = servedModelTableLeg(config);
+    const sandboxGitBefore = config.sandboxGit;
     commitStaged(config, staged);
     if (ordered)
         appliedGeneration.set(config, gen);
@@ -163,12 +194,16 @@ export function applyEffective(config, eff, logger, opts) {
         if (notServed !== undefined)
             logger?.warn(notServed.event, notServed.fields);
     }
+    if (mp !== undefined)
+        warnDanglingEnvBindings(config, staged.modelPlaneGroup.envBindingsDangling ?? [], logger);
     if (staged.approvalGate.next !== undefined)
         logger?.info("web_admin_runtime", { version: staged.version, approvalRequire: staged.approvalGate.next });
     if (Object.keys(staged.hot.infoLine).length > 0)
         logger?.info("web_admin_runtime_hot", staged.hot.infoLine);
     if (Object.keys(staged.projects).length > 0)
         logger?.info("web_admin_projects", { projects: Object.keys(staged.projects) });
+    if (JSON.stringify(sandboxGitBefore) !== JSON.stringify(staged.sandboxGit))
+        logger?.info("web_admin_sandbox_git", { version: staged.version, origins: staged.sandboxGit?.origins.map((e) => e.origin) ?? null });
     return true;
 }
 function declareCandidateWithheldEnv(seats, modelApiKeyEnv, version) {
@@ -216,6 +251,10 @@ function commitStaged(config, staged) {
     if (staged.hot.setCommandPolicy)
         config.commandPolicy = staged.hot.commandPolicyNext;
     mutateInPlace(config.projects, staged.projects);
+    if (staged.sandboxGit !== undefined)
+        config.sandboxGit = staged.sandboxGit;
+    else
+        delete config.sandboxGit;
 }
 export const MODEL_PLANE_DOMAINS = ["models"];
 const MODEL_PLANE_SURFACES = {
@@ -247,8 +286,8 @@ export const PLANE_REFUSAL_INVARIANT_OF = {
     "config.model_refused_name_minted": "refused-names-not-minted",
     "config.model_route_endpoint_missing": "model-route-endpoint",
     "config.gateway_fallback_without_primary": "model-route-endpoint",
+    [CATALOG_REPLACES_ENV_MODELS_CODE]: "env-table-replacement-acknowledged",
 };
-export const ENGINE_MINTED_PLANE_REFUSAL_CODES = [CATALOG_REPLACES_ENV_MODELS_CODE];
 function modelPlaneGroupReport(group) {
     return {
         applied: MODEL_PLANE_DOMAINS.flatMap((d) => (group.stages[d] !== undefined ? MODEL_PLANE_SURFACES[d] : [])),
@@ -256,6 +295,46 @@ function modelPlaneGroupReport(group) {
     };
 }
 const ROLE_BINDING_UNAVAILABLE_HINT = "alias/tier expansion cannot mint this name, so the engine does not hold it: a strict seat (default, classifier) refuses the task loud; any other role reads as unset and falls back along its own chain with a model.role_defaulted notice (refused only when nothing on that chain resolves) — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
+function danglingEnvBindingsOf(envRoles, centerRoles, envTable, served) {
+    const out = [];
+    for (const [role, spec] of Object.entries(envRoles)) {
+        if (Object.hasOwn(centerRoles, role))
+            continue;
+        const name = typeof spec === "string" ? spec : spec !== null && typeof spec === "object" && "model" in spec && typeof spec.model === "string" ? spec.model : undefined;
+        if (name === undefined || Object.hasOwn(served, name))
+            continue;
+        const entry = envTable.find((e) => e.id === name);
+        if (entry !== undefined)
+            out.push({ role, name, env: entry.env });
+    }
+    return out;
+}
+const ROLE_DEFAULTED_NOTICE = "model.role_defaulted";
+const danglingEnvNamesSaid = new WeakMap();
+function warnDanglingEnvBindings(config, dangling, logger) {
+    if (logger === undefined || dangling.length === 0)
+        return;
+    const said = danglingEnvNamesSaid.get(config) ?? new Set();
+    danglingEnvNamesSaid.set(config, said);
+    const byName = new Map();
+    for (const d of dangling) {
+        const row = byName.get(d.name) ?? { env: d.env, roles: [] };
+        row.roles.push(d.role);
+        byName.set(d.name, row);
+    }
+    for (const [name, row] of byName) {
+        if (said.has(name))
+            continue;
+        said.add(name);
+        logger.warn("config_env_role_binding_dangling", {
+            model: name,
+            env: row.env,
+            roles: row.roles,
+            engineNotice: ROLE_DEFAULTED_NOTICE,
+            note: `the env role base binds ${row.roles.join(", ")} to ${row.env} "${name}", but the adopted catalog serves no entry by that name (tier expansion included) — the engine reads ${row.roles.length > 1 ? "these roles" : "that role"} as unset and falls back along the role chain (each task says ${ROLE_DEFAULTED_NOTICE}); bind the role in the catalog's roles, or name a catalog entry "${name}" — said once per process`,
+        });
+    }
+}
 export const NO_CENTER_EFFECTIVE = deepFreeze({ version: 0, updatedAt: "", models: { models: [], roles: {} }, mcp: { servers: [] } });
 export const isNoCenterEffective = (eff) => eff === NO_CENTER_EFFECTIVE;
 function deepFreeze(v) {
@@ -285,7 +364,7 @@ function stageEnvModelPlane(config) {
         },
     };
 }
-function stageModelPlane(config, eff, logger, sealedKeys) {
+function stageModelPlane(config, eff, source, logger, sealedKeys) {
     if (isNoCenterEffective(eff))
         return stageEnvModelPlane(config);
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
@@ -306,6 +385,13 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             });
             return { stages: {}, rejected: { keys: MODEL_PLANE_GROUP_KEYS, reason, invariant, code }, refused: verdict.refused };
         };
+        const envTable = envModelTableOf(config);
+        const envTableRefusal = crossInvariant("env-table-replacement-acknowledged").check({ live: config, next: config, candidate: { envTable, envTableIsPlaceholder: isRosterGateArmed(config.webAdmin), source } });
+        if (envTableRefusal !== undefined) {
+            if (source.kind === "local")
+                warnUnreadableEnvModelsDecision(config, source, logger);
+            return refuse(CATALOG_REPLACES_ENV_MODELS_CODE, envTableRefusal, { ...(source.kind === "local" ? { decision: source.envModels.kind } : {}), envModels: envTable.map((e) => ({ id: e.id, env: e.env })) });
+        }
         if (verdict.malformed.length > 0)
             return refuse(REFUSED_NAME_MINTED_CODE, malformedDroppedCarrierRefusal(verdict.malformed), { entries: [...verdict.malformed] });
         const usable = verdict.usable;
@@ -422,6 +508,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
         }
         const atMention = stageAtMention(eff.models?.atMention, new Set(usable.map((m) => m.name)), logger);
         const defaultModel = models.default;
+        const envBindingsDangling = danglingEnvBindingsOf(envPlane.roles, centerRoles, envModelTableOf(config), expandTiers(models, activeTiers) ?? models);
         const plane = {
             models,
             model: defaultModel,
@@ -435,7 +522,7 @@ function stageModelPlane(config, eff, logger, sealedKeys) {
             atMention,
             infoLine: { count: usable.length, ...(Object.keys(verdict.refused).length > 0 ? refusedNamesLogFields("unavailable", Object.keys(verdict.refused)) : {}), default: defaultModel.id, defaultSource: picked.source, roles: Object.keys(roles), tiers: Object.keys(activeTiers), atMention: atMention.mode, sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length },
         };
-        return { stages: { models: plane }, defaultName: picked.name, refused: verdict.refused };
+        return { stages: { models: plane }, defaultName: picked.name, refused: verdict.refused, ...(envBindingsDangling.length > 0 ? { envBindingsDangling } : {}) };
     }
 }
 export function collabTemplatesNotExecuted(eff) {
@@ -449,7 +536,7 @@ function stageEffective(config, eff, logger, opts) {
             note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
         });
     }
-    const modelPlaneGroup = stageModelPlane(config, eff, logger, opts.sealedKeys);
+    const modelPlaneGroup = stageModelPlane(config, eff, opts.catalogSource, logger, opts.sealedKeys);
     const notExecuted = collabTemplatesNotExecuted(eff);
     if (notExecuted.length > 0)
         logger?.warn("web_admin_collab_not_executed", { version: eff.version, templates: notExecuted, note: COLLAB_NOT_EXECUTED_NOTE });
@@ -472,6 +559,7 @@ function stageEffective(config, eff, logger, opts) {
             ...(Array.isArray(r.defaultScopes) ? { defaultScopes: r.defaultScopes.filter((x) => typeof x === "string") } : {}),
         };
     }
+    const sandboxGit = stageSandboxGit(eff, logger);
     return {
         version: typeof eff.version === "number" && Number.isFinite(eff.version) ? eff.version : 0,
         modelPlaneGroup,
@@ -479,8 +567,20 @@ function stageEffective(config, eff, logger, opts) {
         limits,
         hot,
         projects,
+        sandboxGit,
     };
 }
+const SANDBOX_GIT_REFUSED_EFFECT = "the block is read as routing no git origins (the live plane reading stays no_caller_credential — no_origins is the plane's last premise and is never reached while the caller credential is absent; no new sandbox pod carries the credential broker) — the rest of this candidate applies; fix the block at the console (it is judged by the contract's SandboxGitConfig)";
+function stageSandboxGit(eff, logger) {
+    if (eff.sandboxGit === undefined)
+        return undefined;
+    const judged = SandboxGitConfig.safeParse(eff.sandboxGit);
+    if (judged.success)
+        return judged.data;
+    const issues = sanitizeZodError(judged.error).issues.map((i) => `${i.path.length === 0 ? "sandboxGit" : `sandboxGit.${formatConfigPath(i.path.map((seg) => (typeof seg === "number" ? seg : String(seg))))}`}: ${i.message}`);
+    logger?.warn("web_admin_sandbox_git_refused", { version: typeof eff.version === "number" ? eff.version : 0, issues, effect: SANDBOX_GIT_REFUSED_EFFECT });
+    return undefined;
+}
 export function centerManagedConfigKeys(eff) {
     const out = new Set();
     if (!eff)
@@ -649,9 +749,9 @@ function engineDefaultOfSelect(select, models, activeTiers) {
     const name = Object.keys(models).find((n) => models[n] === origin);
     return name !== undefined ? { name } : { unresolved: "the engine picked a model object that is not an entry of the usable catalog" };
 }
-export function logEffectiveDiff(config, eff, logger) {
+export function logEffectiveDiff(config, eff, catalogSource, logger) {
     const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    const plane = stageModelPlane(config, eff, undefined, undefined);
+    const plane = stageModelPlane(config, eff, catalogSource, undefined, undefined);
     const refused = plane.refused ?? {};
     const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
     const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));

package/dist/web-admin-client/effective-keys.js

@@ -13,6 +13,7 @@ const EFFECTIVE_CONFIG_KEY_TABLE = {
     plugins: true,
     readFace: true,
     prompts: true,
+    sandboxGit: true,
 };
 export const EFFECTIVE_CONFIG_KEYS = Object.keys(EFFECTIVE_CONFIG_KEY_TABLE);
 export const EFFECTIVE_ENVELOPE_KEYS = ["version", "updatedAt"];
@@ -25,6 +26,7 @@ export const GOVERNANCE_DOMAIN_KEYS = Object.keys(GOVERNANCE_DOMAIN_KEY_TABLE);
 export const NON_DOMAIN_EFFECTIVE_KEYS = {
     a2a: "R-15 裁开域([4384]),但 settings-schema 至 1.3.0 未开(DOMAINS 无 a2a)——S-31 件2 BLOCKED on schema:远端腿靠 readEffectiveWire 的 open-world verbatim 透传(DESIGN-269),本地腿不可达(FileConfigStore 只读 PORTABLE_DOMAINS)。schema 开域之日按墓碑流程收线。",
     readFace: "R-15 裁**暂不开域**([4384]:env 逐键恒赢语义下收益薄,⚪ 呈现制过渡)——#A4 的远端腿同靠 open-world 透传;本地腿四键由 env / 引擎默认独占。若来日改裁开域,同上墓碑机制。",
+    sandboxGit: "契约的 wire-only 键(settings-schema 14.7.0 `EffectiveWire.sandboxGit`):web-admin 按部署登记册投影,不是存储域 —— `buildEffective` 从不产它、`readEffectiveWire` 逐字承运;判它的唯一座位 `SandboxGitConfig` 在 stageEffective 调一次。本地腿不可达(`config.d` 只读便携域)⇒ 本地配置源恒缺席(沙箱 git 平面读 `no_origins`)。",
 };
 export const DOMAINS_NOT_CONSUMED_BY_SERVER = {
     rosters: "center 写面域:center 端 resolveEffectiveForWorker 把 roster 解析进 per-worker /effective 的 models 视图——server 消费的是解析产物,不读原始域。",

package/dist/web-admin-client/types.d.ts

@@ -392,6 +392,10 @@ export interface EffectiveConfig {
     /** prompts 域(中心层;wire 形只有一种 = 契约包 `EffectivePromptsWire` `{ schemaVersion: 2, artifact }`)—— 判法只在候选判官一处
      *  (`prompts-domain-validate.ts` 的 `judgePromptsWire`,经 `judgeConfigCandidate`),本 interface 只声明键位存在(unknown:判官是唯一解释者,这里不复刻形)。 */
     prompts?: unknown;
+    /** 沙箱 git 平面的有效配置块(契约 `EffectiveWire.sandboxGit`:wire-only 的非域顶层键,web-admin 按部署登记册投影,读腿逐字承运、不判)——
+     *  可选、无默认:缺席 = 这个部署没有投影这一块。本 interface 只声明键位(unknown:与 `prompts` 同形);判它的唯一座位是契约 `SandboxGitConfig`,
+     *  在 `stageEffective` 里调一次(判过 ⇒ `config.sandboxGit`;判不过 ⇒ 当作没有任何 origin + 一行 `web_admin_sandbox_git_refused`,契约 §12.8)。 */
+    sandboxGit?: unknown;
 }
 /** (stage7 P5,registry-core 0.8 `execution` 域): the center-resolved per-principal execution
  *  ruling riding the caps view. `required=false` / ruling absent = no enforcement (legacy). `allowedLanes` is

package/dist/workspace-space.d.ts

@@ -105,10 +105,26 @@ export declare const WORKSPACE_SNAPSHOT_EXCLUDE_INVALID = "config.workspace_snap
  * path pattern, never a secret, so it is echoed.
  */
 export declare function parseWorkspaceSnapshotExclude(raw: string | undefined): readonly string[];
-/** Mint one snapshot id: `kata-<owner>-<ts36>-<rand>` (see {@link SNAPSHOT_OWNER_NONE}). The time and random parts only keep ids unique; nothing reads them back. */
-export declare function mintSnapshotId(incarnation: string | undefined): string;
+/**
+ * What one snapshot id names — a closed set, spelled by the id's first segment (its family), written only by {@link mintSnapshotId} and read
+ * only by {@link snapshotIdHolds}:
+ *  - `archive` — an archive was packed and put under this id (`kata-…`): a restore of it asks the store for that object, and an object that is
+ *    not there is a dangling restore point. Every id minted before the family said more than this is one;
+ *  - `nothing` — nothing was packed: the env held no pod when it parked (nothing had touched its hand), so no object is ever put under this id
+ *    (`nopack-…`): there is no workspace of the park to restore, and a resume of it is a new connect (`plugins/remote-env-k8s.ts`, `resumeVM`).
+ * The id never reaches the wire: it lives in the engine's checkpoint and in operator lines.
+ */
+export type SnapshotHolds = "archive" | "nothing";
+/** Mint one snapshot id: `<family>-<owner>-<ts36>-<rand>` — the family says what the id names ({@link SnapshotHolds}), the owner who wrote it
+ *  (see {@link SNAPSHOT_OWNER_NONE}). The time and random parts only keep ids unique; nothing reads them back. */
+export declare function mintSnapshotId(incarnation: string | undefined, holds: SnapshotHolds): string;
+/** What a snapshot id names ({@link SnapshotHolds}) — the ONE reading of the family {@link mintSnapshotId} wrote. Only an id of exactly the minted
+ *  `nothing` form reads as `nothing`; every other id — this adapter's archives, ids minted before the family said what they name, anything else (a
+ *  malformed `nopack-…` included) — names an archive, so its restore goes through the one key-segment judge (an id that is not a plain key segment
+ *  is refused before any pod or request) and then asks the store and judges what comes back. */
+export declare function snapshotIdHolds(id: string): SnapshotHolds;
 /** Whether an object name in the park partition (`<snapshotId>.tar.gz`, or any single-segment name) carries the mark of THIS occupant incarnation.
- *  An empty incarnation owns nothing; `none` and unmarked names are never owned (fail closed). */
+ *  An empty incarnation owns nothing; `none` and unmarked names are never owned (fail closed). Only an archive's id names an object. */
 export declare function snapshotNameOwnedBy(name: string, incarnation: string): boolean;
 /** One ended space, as the reclaim seat is told of it: the session whose space ended (its park lane's partition) and the space key
  *  (the occupant's incarnation — the `space/` partition, the cache volume's label and, through {@link snapshotNameOwnedBy}, the owner mark of

package/dist/workspace-space.js

@@ -67,18 +67,22 @@ function snapshotExcludeItemProblem(item) {
 }
 const SNAPSHOT_OWNER_NONE = "none";
 const SNAPSHOT_OWNER_HEX_LENGTH = 16;
-const SNAPSHOT_ID_FAMILY = "kata";
+const SNAPSHOT_ID_FAMILY = { archive: "kata", nothing: "nopack" };
 function snapshotOwnerOf(incarnation) {
     if (incarnation === undefined || incarnation === "")
         return SNAPSHOT_OWNER_NONE;
     return createHash("sha256").update(incarnation).digest("hex").slice(0, SNAPSHOT_OWNER_HEX_LENGTH);
 }
-export function mintSnapshotId(incarnation) {
-    return `${SNAPSHOT_ID_FAMILY}-${snapshotOwnerOf(incarnation)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+export function mintSnapshotId(incarnation, holds) {
+    return `${SNAPSHOT_ID_FAMILY[holds]}-${snapshotOwnerOf(incarnation)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+const NOTHING_ID_FORM = new RegExp(`^${SNAPSHOT_ID_FAMILY.nothing}-(?:${SNAPSHOT_OWNER_NONE}|[0-9a-f]{${SNAPSHOT_OWNER_HEX_LENGTH}})-[0-9a-z]+-[0-9a-z]*$`);
+export function snapshotIdHolds(id) {
+    return NOTHING_ID_FORM.test(id) ? "nothing" : "archive";
 }
 export function snapshotNameOwnedBy(name, incarnation) {
     if (incarnation === "")
         return false;
-    return name.startsWith(`${SNAPSHOT_ID_FAMILY}-${snapshotOwnerOf(incarnation)}-`);
+    return name.startsWith(`${SNAPSHOT_ID_FAMILY.archive}-${snapshotOwnerOf(incarnation)}-`);
 }
 //# sourceMappingURL=workspace-space.js.map

package/docs/DEVICE-EXECUTOR-PROTOCOL.md

@@ -341,7 +341,7 @@ base64 inside JSON fields.
 | Constant | Value | Meaning |
 |---|---|---|
 | `DEVICE_WS_PATH` | `/v1/device/ws` | the upgrade path (prefer the `wsPath` from `/v1/capabilities`) |
-| `DEVICE_PROTOCOL_VERSION` | `3` | the protocol revision this server speaks (the highest it accepts) |
+| `DEVICE_PROTOCOL_VERSION` | `4` | the protocol revision this server speaks (the highest it accepts) |
 | `DEVICE_MIN_PROTOCOL_VERSION` | `1` | the lowest revision it accepts; below it (or above the highest), a loud `helloReject` — never a silent downgrade |
 | `DEVICE_HELLO_DOMAIN_TAG` | `sema.device.hello.v1` | the handshake signature domain tag (§1.3) |
 
@@ -371,6 +371,7 @@ the union of the rows up to *N*, and the full set at the current revision is the
 | `1` | `aborted`, `already_exists`, `auth_failed`, `callback_error`, `invalid`, `is_directory`, `not_directory`, `not_found`, `not_supported`, `outcome_unknown`, `permission_denied`, `precondition_failed`, `shell_unavailable`, `spawn_error`, `suspended`, `target_unavailable`, `timeout`, `transport_lost`, `unknown` |
 | `2` | `liveness_no_output` |
 | `3` | `name_too_long` |
+| `4` | `symlink_loop` |
 
 Rules: adding a frame or a field is additive and does not raise the revision; adding a word to a closed set the
 server *accepts from you* (today: the `errorCode` set) raises `DEVICE_PROTOCOL_VERSION` and adds a row here; a
@@ -590,6 +591,7 @@ with, and an executor sends only the words of the revision it declared (§1.2).
 | `shell_unavailable` | no shell / the executable could not be resolved — the command **never started** |
 | `spawn_error` | the process could not be spawned |
 | `suspended` | the work was suspended rather than completed |
+| `symlink_loop` | the path runs into a looping chain of symbolic links (a link to itself, a cycle of links, or a chain past the platform's follow limit; POSIX `ELOOP`). It is not an absence: upstream a directory probe reads it as "this path leads to no directory", and a check of where a path lands reads it as unresolved, like `unknown`. A device that cannot tell a loop apart keeps answering `unknown`. On an exec instruction it is a protocol violation and the server reads it as `unknown` |
 | `target_unavailable` | the target could not be reached; the work **never started** |
 | `timeout` | **you** enforced `timeoutMs`, killed the work, and are reporting it |
 | `transport_lost` | a transport the device itself depends on went away |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.141.0",
+  "version": "7.143.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -69,7 +69,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.60.0",
+    "@modelcontextprotocol/server": "2.4.0",
+    "@sema-agent/core": "7.61.0",
     "@sema-agent/settings-schema": "16.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",