@sema-agent/server 7.38.0 → 7.39.0

package/USAGE.md

@@ -424,6 +424,15 @@ READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitiv
   ⚠️ 本地 `config.d/` 车道今天**接不上**这一域(registry-core 的可移植域表里没有它),只有
   `CONFIG_PROVIDER=remote` 的部署走得通。
 
+- **MCP 撤销腿(7.39 起,core design/338)**:MCP 服务器 mount 仍是 restart-to-apply(新增/改址要
+  restart 才生效),但**从 enabled 集删除一个服务器即时生效**——refresh 拍收货后,被删服务器的
+  MCP 调用当场按 coded 拒绝 `mcp.server_revoked` 结算(known-not-executed,引擎每次派发前探询
+  台账,不缓存)。因此 `/health` 的 `restart.reasons` 对**纯删除向**不再报 `mcp`(签了就是为一个
+  已生效的变更滚动重启 fleet);删除+新增/改址混合拍照签。重新把服务器加回 enabled 集=解除撤销。
+  当前被撤名单可从 `GET /v1/diagnostics/wiring` 的 `mcpRevocations.revoked` 读(`null`=本进程无
+  配置管道);`GET /v1/sessions/:id/mcp` 面板与执行面同一台账(被撤服务器的工具不再展示)。
+  纯 env 配置的 `MCP_SERVERS` 部署无中心撤销语义,行为逐字不变。
+
 **可选 — MCP 入站表单(elicitation,E23):默认关**
 
 ```bash

package/deploy/sema-up/chart/values.yaml

@@ -77,7 +77,8 @@ registry:
   nodePort: 30300
   storageSize: 2Gi
   storageClass: ""     # 空=集群默认 SC
-  adminUser: zhaoheran
+  # [4824] S10 P1:默认管理员名必须是中性值——个人标识串作生产默认值=内部标识外溢(cli 点名案)。
+  adminUser: admin
   adminPassword: ""    # REQUIRED(kube-up 注入)
   sessionSecret: ""    # REQUIRED
   pullToken: ""        # REQUIRED

package/dist/boot/config-center.d.ts

@@ -55,6 +55,14 @@ export interface ConfigCenterRuntime {
     }): void;
     /** #131-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。 */
     stopRefreshLoop(): void;
+    /** #324(core 5.50 design/338):mid-turn MCP 撤销台账读口,喂 `RunnerDeps.mcpRevocations` 席。
+     *  **取走即声明接线**——调用本方法后,restart 信号的 mcp 片对纯删除向豁免(台账即时承接);
+     *  不取 ⇒ 旧 restart 语义逐字保留(fail-closed)。 */
+    takeMcpRevocations(): import("../config-center/mcp-revocation.js").McpRevocationLedger;
+    /** #324 诊断投影:当前被撤销的 MCP 服务器名单;纯 env 部署(无配置管道)= undefined(additive 纪律)。 */
+    mcpRevocationState(): {
+        revoked: string[];
+    } | undefined;
     /** 晚绑取值:refresh 热应用会整个换引用(hook LLM / resolveSpec 每次现取)。 */
     getKeyResolver(): ((model: ModelKeyRef) => Promise<{
         apiKey: string;

package/dist/boot/config-center.js

@@ -47,6 +47,7 @@ import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../con
 import { createKeyResolver } from "../key-resolver.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "../config-center/facade.js";
+import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { createConfigApplyLedger } from "../config-center/apply-ledger.js"; // #322 世代账
 export async function createConfigCenterRuntime(ctx) {
@@ -550,16 +551,31 @@ export async function createConfigCenterRuntime(ctx) {
     // (MODEL_DEGRADE_TO / MODEL_DEGRADE_REACTIVE)开关,而它焊死的是 CENTER 目录里那条模型的路由面。读成
     // 函数而非常量:`config.degrade` 今天由 env 独占(applyEffective 不写它),但若哪天中心接管这面,这里
     // 自动跟着走,不会退化成 boot 期快照。车道关(默认)⇒ ctx 空 ⇒ 该片恒 null ⇒ 零行为变化。
+    // #324(core 5.50 design/338):mid-turn MCP 撤销台账。铸在这里(写路径归本 runtime:boot bake 铸
+    // baseline、refresh commit 喂 diff),读口经 `takeMcpRevocations()` 外借给 RunnerDeps 席。
+    // ⚠️ **取走即声明接线**:restart 豁免(纯删除向不签 mcp)只在 `mcpRevocationWired` 后生效——把豁免与
+    // 承接绑在同一动作上,main 若哪天删了接线行,豁免自动关回旧 restart 语义(fail-closed,#157;
+    // 反例=独立布尔,两处各写一遍必漂移,漂移方向正是「没人承接删除却不再签 restart」的静默 fail-open)。
+    const mcpRevocations = createMcpRevocationLedger((ev) => logger.info("mcp_revocation_ledger", { ...(ev.revoked.length > 0 ? { revoked: ev.revoked } : {}), ...(ev.restored.length > 0 ? { restored: ev.restored } : {}) }));
+    let mcpRevocationWired = false;
     const restartCtx = () => ({
         ...(config.degrade?.reactive ? { reactiveDegradeTo: config.degrade.to } : {}),
         // #A4:env 占住的 readFace 键(boot 期一次性事实,env 不会在进程内变)。
         ...(readFaceEnvHeld.length > 0 ? { readFaceEnvHeld } : {}),
+        // codex F2 双门:席被取走(wired)**且** boot bake 真铸过 baseline(mount 真身在案)才豁免——
+        // boot 超时/纯 env 形的 mount 不是中心集,撤销腿承接不了删除,豁免必须关死走旧 restart 语义。
+        ...(mcpRevocationWired && mcpRevocations.hasBaseline() ? { mcpRevocationLive: true } : {}),
     });
     // #131-2:60s 刷新环的句柄提到 runtime 闭包层——stopRefreshLoop(hardShutdown 收尾链)要能清它。
     let ccTimer;
     return {
         providerKind: configProvider?.kind,
         promptSource,
+        takeMcpRevocations: () => {
+            mcpRevocationWired = true; // 取走即声明接线(见铸造点注)——restart 豁免从此拍起生效
+            return mcpRevocations;
+        },
+        mcpRevocationState: () => (configProvider ? mcpRevocations.view() : undefined), // 纯 env 形没有中心撤销语义 ⇒ 诚实缺席
         getKeyResolver: () => keyResolver,
         getCenterPrompts: () => centerPrompts,
         modelReady: () => modelReadyState.ready,
@@ -696,6 +712,11 @@ export async function createConfigCenterRuntime(ctx) {
             }
             if (effective?.mcp)
                 config.mcpServers = resolveMcpServers(effective.mcp, logger);
+            // #324:撤销台账的 baseline 拍 = boot bake 的 enabled 条目表(mount 真身与台账「此前」同源单点;
+            // codex F1 修:带指纹,重加同名不同形不解除撤销)。域缺席/boot 超时 ⇒ null ⇒ 台账不铸 baseline
+            // (env 型 mcpServers 部署没有中心撤销语义)——此时 hasBaseline()=false,restart 豁免关死
+            // (codex F2 修:迟到 boot 采用的候选集≠mount 真身,**刻意不喂**,该形走旧 restart 语义收敛)。
+            mcpRevocations.applyEnabledEntries(enabledMcpEntries(effective?.mcp), { isBaseline: true });
             // DESIGN-269 车1 件1:A2A peers ride the SAME restart-to-apply line as MCP (one center pull, one
             // resolution, no hot swap). Absent `a2a` domain ⇒ the key is never written ⇒ the leg does not exist.
             if (effective?.a2a)
@@ -903,6 +924,12 @@ export async function createConfigCenterRuntime(ctx) {
                                 mutateInPlace(pricing, buildPricing(config.models)); // hot: cost/model changes; Runner reads this.deps.pricing live
                                 keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys); // hot: per-model key add/remove/change (env-ref + sealed)
                                 limitSync?.sync(); // #322 批1:限额座与 config 成对换代(同一条「派生件紧贴 commit」纪律)
+                                // #324:撤销台账拍(commit 接受即喂,与上面三件派生同族)。删除向由此**即时**生效
+                                // (core 每次 MCP dispatch 前探 isRevoked)——design/338 要消的「撤销等 restart」窗。
+                                // 放在 fullyApplied 判之前:mcp 域不在 limits 组,某组被整拒不构成扣住撤销的理由
+                                // (撤销是收紧向,宁早不晚)。baseline 未铸(boot 超时形)时这一喂只推 seen 集,
+                                // 恢复判据与 restart 豁免都被 hasBaseline 门关死(codex F2)。
+                                mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLedger.applied(tickGen, r.effective.version);
                                 if (planeDeferred) {
                                     logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner: the changed model plane (models/roles/tiers/default) is NOT hot-applied — admission stays on the Runner's generation; restart applies the new plane (models-tiers restart signal rides /health)" });

package/dist/boot/runner-deps.d.ts

@@ -92,6 +92,11 @@ export interface RunnerDepsCtx {
     /** #154 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleSuggestions` 不铸(诚实缺席)。 */
     permissionRuleStore: RunnerDeps["permissionRuleStore"];
+    /** #324(core 5.50 design/338):mid-turn MCP 撤销台账席 —— core 每次 MCP dispatch 前同步探
+     *  `isRevoked(serverName)`,被撤服务器的调用结算为 coded 拒绝 `mcp.server_revoked`(known-not-executed)。
+     *  来源=configCenter.takeMcpRevocations()(取走即声明接线,restart 豁免与承接绑同一动作)。
+     *  缺席=undefined=pre-338 语义(纯 env 部署无中心撤销面)。 */
+    mcpRevocations: RunnerDeps["mcpRevocations"];
     /**
      * 交接件⑤ —— commit 尾注的署名座(`RunnerDeps.hands.commitCoAuthor`)。
      *
@@ -121,7 +126,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "delegationEntryCaps" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "delegationEntryCaps" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -150,7 +155,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations">;
 /**
  * core `EngineNotice` → 结构化 `engine_notice` 行的**唯一**转发体(#240②)。
  *

package/dist/boot/runner-deps.js

@@ -184,6 +184,12 @@ export function createSharedRunnerDeps(ctx) {
         compliancePostureResolver: ctx.governanceSeams.compliancePostureResolver,
         lockedConfig: ctx.governanceSeams.lockedConfig,
         retentionPolicy: ctx.governanceSeams.retentionPolicy,
+        // #324(core 5.50 design/338):撤销台账席进**共享基座** —— core 每次 MCP dispatch 前探
+        // isRevoked,委托子代跑在另一只 Runner 上,漏挂 subRunner = 子代平面绕过撤销([1543]§三族A 形,
+        // 且这条轴的绕过方向是 fail-OPEN:被中心撤掉的服务器在子代腿继续可调)。leader lane 零 MCP mount
+        // (`src/leader/wire.ts` 无 MCP 面)⇒ 席不达 leader 结构性零影响(memoryDelegationEvidence 同款登记)。
+        // 缺席=undefined=pre-338 语义(纯 env 部署,restart-signal 的删除向豁免也不生效——同一动作绑定)。
+        mcpRevocations: ctx.mcpRevocations ? ctx.mcpRevocations : undefined,
     };
     return shared;
 }

package/dist/config-center/mcp-revocation.d.ts

@@ -0,0 +1,57 @@
+/**
+ * #324(core 5.50 design/338 提货件)—— mid-turn MCP 撤销台账:`RunnerDeps.mcpRevocations` 席的宿主实现。
+ *
+ * 语义(与 core 契约对表,types.d.ts `RunnerDeps.mcpRevocations` 注):
+ *  · 权威单点在宿主 —— core 每次 MCP dispatch 前**同步**探 `isRevoked(serverName)`,从不缓存答案。
+ *  · 本台账记「中心**曾发布为 enabled、后从 enabled 集移除**」的服务器名。MCP mount 是 boot-baked
+ *    (`resolveMcpServers` 只在启动期跑),所以**删除向**在 5.50 前只能等 restart 才生效——这正是
+ *    design/338 要消的窗:治理面最要紧的动作(撤销一条对外通道)现在即时生效,restart 信号的
+ *    删除向豁免见 `restart-signal.ts` 的 mcp 特判(`mcpRevocationLive` 前提,fail-closed:席没接线
+ *    的部署保持旧的 restart 语义)。
+ *  · **重现恢复是指纹判,不是名字判**(codex F1,confirmed):被撤的名字回到 enabled 集时,只有当
+ *    它的条目指纹与 **baseline(boot mount 真身)逐字相同**才解除撤销——重加同名**不同址/不同配置**
+ *    的条目,复活的会是 boot-frozen 的旧 mount(新配置要 restart 才装上),那是把已撤下的旧端点在
+ *    restart 窗口内重新放行(fail-open)。指纹不匹配 ⇒ 名字保持 revoked 直到 restart 收敛。
+ *  · **baseline 只由 boot bake 拍铸**(codex F2,confirmed):它必须是「实际 mount 的集合」——迟到
+ *    boot 采用/refresh 拍的候选集都不是 mount 真身,不得铸 baseline。`hasBaseline()` 是 restart 豁免
+ *    的第二道门(boot 超时形:mount=env 集,中心撤销语义整个不适用,豁免必须关死走旧 restart 语义)。
+ *  · **域缺席(null)不动**:中心停止发布 mcp 域 ≠ 逐服务器撤销指令(fingerprint 上 null↔非 null
+ *    自会签 restart);域在场但 `servers: []` 是明确的「清空」指令 ⇒ 全撤。
+ *  · baseline 之后新增再删除的名字照 revoke(它从未 mount,isRevoked=true 无 mount 可拒=无害,
+ *    fail-closed 向);这类名字重加时因无 baseline 指纹**不解除**——同样无害,restart 收敛。
+ *
+ * 纯内存、同步、无 I/O —— 每副本各自持有(mount 也是副本各自的,天然同界)。进程重启即清零:
+ * 重启后按新配置 mount,台账语义自洽。
+ */
+/** `RunnerDeps.mcpRevocations` 的结构超集(isRevoked 同签名,core 结构类型直接受用)。 */
+export interface McpRevocationLedger {
+    /** core 每次 MCP dispatch 前同步探询;true = 该服务器已被中心从 enabled 集移除(或改形候 restart)。 */
+    isRevoked(serverName: string): boolean;
+    /** 配置拍喂当拍 ENABLED 服务器条目(name→指纹,插入序=发布序);`null` = mcp 域未发布(不动)。
+     *  `isBaseline: true` 只允许 boot bake 拍传——铸 mount 真身;已铸后再传按普通拍处理(幂等防误用)。 */
+    applyEnabledEntries(entries: ReadonlyMap<string, string> | null, opts?: {
+        isBaseline?: boolean;
+    }): void;
+    /** true = boot bake 拍真铸过 baseline(mount 真身在案)。restart 豁免的第二道门:false 时豁免必须
+     *  关死(boot 超时/纯 env 形:中心集≠mount 集,撤销腿承接不了删除)。 */
+    hasBaseline(): boolean;
+    /** 诊断投影:当前被撤销名单(字典序)。 */
+    view(): {
+        revoked: string[];
+    };
+}
+export declare function createMcpRevocationLedger(onChange?: (ev: {
+    revoked: string[];
+    restored: string[];
+}) => void): McpRevocationLedger;
+/** 一拍 EffectiveConfig 的 ENABLED MCP 服务器条目表(`resolveMcpServers` 同判据:`enabled !== false`;
+ *  值=整条目的 key 排序 JSON 指纹,Map 插入序=发布序);mcp 域缺席 ⇒ `null`(台账不动)。
+ *  指纹口径与 restart-signal 的 stableStringify 同精神(key 序归一),但**刻意独立实现**:两处指纹
+ *  只在各自域内自比,不跨域比对,无同源约束。 */
+export declare function enabledMcpEntries(mcp: {
+    servers: Array<{
+        name: string;
+        enabled?: boolean;
+    }>;
+} | undefined): ReadonlyMap<string, string> | null;
+//# sourceMappingURL=mcp-revocation.d.ts.map

package/dist/config-center/mcp-revocation.js

@@ -0,0 +1,90 @@
+/**
+ * #324(core 5.50 design/338 提货件)—— mid-turn MCP 撤销台账:`RunnerDeps.mcpRevocations` 席的宿主实现。
+ *
+ * 语义(与 core 契约对表,types.d.ts `RunnerDeps.mcpRevocations` 注):
+ *  · 权威单点在宿主 —— core 每次 MCP dispatch 前**同步**探 `isRevoked(serverName)`,从不缓存答案。
+ *  · 本台账记「中心**曾发布为 enabled、后从 enabled 集移除**」的服务器名。MCP mount 是 boot-baked
+ *    (`resolveMcpServers` 只在启动期跑),所以**删除向**在 5.50 前只能等 restart 才生效——这正是
+ *    design/338 要消的窗:治理面最要紧的动作(撤销一条对外通道)现在即时生效,restart 信号的
+ *    删除向豁免见 `restart-signal.ts` 的 mcp 特判(`mcpRevocationLive` 前提,fail-closed:席没接线
+ *    的部署保持旧的 restart 语义)。
+ *  · **重现恢复是指纹判,不是名字判**(codex F1,confirmed):被撤的名字回到 enabled 集时,只有当
+ *    它的条目指纹与 **baseline(boot mount 真身)逐字相同**才解除撤销——重加同名**不同址/不同配置**
+ *    的条目,复活的会是 boot-frozen 的旧 mount(新配置要 restart 才装上),那是把已撤下的旧端点在
+ *    restart 窗口内重新放行(fail-open)。指纹不匹配 ⇒ 名字保持 revoked 直到 restart 收敛。
+ *  · **baseline 只由 boot bake 拍铸**(codex F2,confirmed):它必须是「实际 mount 的集合」——迟到
+ *    boot 采用/refresh 拍的候选集都不是 mount 真身,不得铸 baseline。`hasBaseline()` 是 restart 豁免
+ *    的第二道门(boot 超时形:mount=env 集,中心撤销语义整个不适用,豁免必须关死走旧 restart 语义)。
+ *  · **域缺席(null)不动**:中心停止发布 mcp 域 ≠ 逐服务器撤销指令(fingerprint 上 null↔非 null
+ *    自会签 restart);域在场但 `servers: []` 是明确的「清空」指令 ⇒ 全撤。
+ *  · baseline 之后新增再删除的名字照 revoke(它从未 mount,isRevoked=true 无 mount 可拒=无害,
+ *    fail-closed 向);这类名字重加时因无 baseline 指纹**不解除**——同样无害,restart 收敛。
+ *
+ * 纯内存、同步、无 I/O —— 每副本各自持有(mount 也是副本各自的,天然同界)。进程重启即清零:
+ * 重启后按新配置 mount,台账语义自洽。
+ */
+export function createMcpRevocationLedger(onChange) {
+    /** boot mount 真身(name→指纹);undefined = baseline 未铸(hasBaseline=false)。铸后不变。 */
+    let baseline;
+    let seen; // 上一拍 enabled 名集;undefined = 还没见过任何一拍
+    const revoked = new Set();
+    return {
+        isRevoked: (serverName) => revoked.has(serverName),
+        hasBaseline: () => baseline !== undefined,
+        applyEnabledEntries: (entries, opts) => {
+            if (entries === null)
+                return; // 域未发布 ≠ 撤销指令(成文见文件头)
+            if (opts?.isBaseline === true && baseline === undefined)
+                baseline = new Map(entries);
+            const restored = [];
+            for (const [n, fp] of entries) {
+                // codex F1:恢复=指纹判——只有回归到 baseline(mount 真身)的逐字同形才解除;
+                // 同名不同形(改址/改配置)保持 revoked,新配置候 restart 装上(fail-closed)。
+                if (revoked.has(n) && baseline?.get(n) === fp) {
+                    revoked.delete(n);
+                    restored.push(n);
+                }
+            }
+            const names = new Set(entries.keys());
+            const newlyRevoked = [];
+            if (seen !== undefined) {
+                for (const n of seen) {
+                    if (!names.has(n) && !revoked.has(n)) {
+                        revoked.add(n);
+                        newlyRevoked.push(n);
+                    }
+                }
+            }
+            seen = names;
+            if (onChange && (newlyRevoked.length > 0 || restored.length > 0))
+                onChange({ revoked: newlyRevoked, restored });
+        },
+        view: () => ({ revoked: [...revoked].sort() }),
+    };
+}
+/** 一拍 EffectiveConfig 的 ENABLED MCP 服务器条目表(`resolveMcpServers` 同判据:`enabled !== false`;
+ *  值=整条目的 key 排序 JSON 指纹,Map 插入序=发布序);mcp 域缺席 ⇒ `null`(台账不动)。
+ *  指纹口径与 restart-signal 的 stableStringify 同精神(key 序归一),但**刻意独立实现**:两处指纹
+ *  只在各自域内自比,不跨域比对,无同源约束。 */
+export function enabledMcpEntries(mcp) {
+    if (!mcp)
+        return null;
+    const out = new Map();
+    for (const s of mcp.servers) {
+        if (s.enabled !== false)
+            out.set(s.name, fingerprintOf(s));
+    }
+    return out;
+}
+function fingerprintOf(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(fingerprintOf).join(",")}]`;
+    const obj = v;
+    return `{${Object.keys(obj)
+        .sort()
+        .map((k) => `${JSON.stringify(k)}:${fingerprintOf(obj[k])}`)
+        .join(",")}}`;
+}
+//# sourceMappingURL=mcp-revocation.js.map

package/dist/config-center/restart-signal.d.ts

@@ -12,6 +12,12 @@ export interface RestartSliceCtx {
      *  所以它们的变化不该产生 restart 理由 —— 否则 center 改一个本机用不上的键,整片 fleet 会为一次
      *  对自己毫无影响的发布滚动重启一遍。缺席 = 没有 env 覆盖 ⇒ 整域都算数(与旧行为一致)。 */
     readFaceEnvHeld?: readonly ("face" | "denyPatterns" | "denyBuiltinTiers" | "denyBuiltinExclude")[];
+    /** #324(core 5.50 design/338):撤销台账腿已接线(`RunnerDeps.mcpRevocations` 席在场且 refresh 拍在喂)。
+     *  true ⇒ mcp 片的**纯删除向**(current 的 enabled 集是 boot 集的逐字子集)不再签 restart —— 删除已被
+     *  台账即时承接(core 每次 dispatch 前探 isRevoked),再签就是为一个已生效的变更滚动重启 fleet。
+     *  新增/改址/域整体出现或消失仍签(新 mount / 改址只能 restart 才生效)。缺席/false = 旧语义照签
+     *  (fail-closed:没接席的部署里删除向没人承接,restart 是它唯一的生效路径)。 */
+    mcpRevocationLive?: boolean;
 }
 /** Structured restart signal an orchestrator consumes (GET /health → `restart`). Change-detected against the
  *  process's BOOT config, NOT presence — so it stays absent when nothing baked-at-boot changed (presence would

package/dist/config-center/restart-signal.js

@@ -137,7 +137,31 @@ function restartSliceValue(eff, slice, ctx) {
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always
  *  against boot (a refresh that re-fires the same diff is idempotent, not a fresh trigger). */
 export function restartReasons(boot, current, ctx) {
-    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s, ctx)) !== stableStringify(restartSliceValue(current, s, ctx)));
+    return RESTART_SLICES.filter((s) => {
+        const b = restartSliceValue(boot, s, ctx);
+        const c = restartSliceValue(current, s, ctx);
+        if (stableStringify(b) === stableStringify(c))
+            return false;
+        // #324:撤销台账腿在场时,mcp 片的**纯删除向**不签 —— 删除已被台账即时承接(core 每次 dispatch 前
+        // 探 isRevoked),签了就是为一个已生效的变更滚动重启 fleet。判据=**保序严格子序列**(codex F3,
+        // confirmed:旧判据用 Set 成员测,[A,B]→[B,A] 纯重排两侧指纹不等、每条又都在 boot 集 ⇒ 被误豁免,
+        // 而服务器顺序是 mount 语义〔工具串接序〕,重排只能 restart 生效;删除+重排混合同理——存留条目的
+        // 相对顺序必须与 boot 逐字一致才是「纯删除」)。任何新增/改形/重排照签;域整体出现/消失(null↔数组)
+        // 不是删除向,保守照签。ctx 键缺席 = 席没接线 ⇒ 旧语义照签(fail-closed,#157)。
+        if (s === "mcp" && ctx?.mcpRevocationLive === true && Array.isArray(b) && Array.isArray(c) && c.length < b.length) {
+            const bootFps = b.map(stableStringify);
+            let bi = 0;
+            const pureRemoval = c.every((row) => {
+                const fp = stableStringify(row);
+                while (bi < bootFps.length && bootFps[bi] !== fp)
+                    bi++;
+                return bi < bootFps.length ? (bi++, true) : false;
+            });
+            if (pureRemoval)
+                return false;
+        }
+        return true;
+    });
 }
 /** codex R10 (models-tiers 窗收口): TRUE when the MODEL PLANE (enabled models + active tier table + resolved
  *  default) of `next` differs from the last-APPLIED plane `prev`. Under a tier-frozen Runner (tiers non-empty at

package/dist/http/routes/diagnostics.js

@@ -166,6 +166,8 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
             // 只有键名与判据文案,值从不进读面)。/health 那三键是同一份读数的窄投影,两面不可能各说各话。
             // 缺席 ⇒ 显式 `null`(与 memoryPosture 同姿势:「这个进程说不出来」,不铸空壳)。
             configApply: deps.configApplyState?.() ?? null,
+            // #324:mid-turn MCP 撤销名单(design/338)。null=本进程没有配置管道(说不出来),与上两键同姿势。
+            mcpRevocations: deps.mcpRevocationState?.() ?? null,
             serverGates: buildServerWiringGates({
                 toolApprovalEnabled: deps.toolApproval !== undefined,
                 streamApprovalEnabled: deps.config.streamApproval?.enabled === true,

package/dist/http/routes/sessions.js

@@ -125,7 +125,9 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 const panel = (async () => {
                     // Bound the connect/list so a hanging MCP server can't pin the request; dispose the late resolver if it
                     // eventually completes after the timeout (no connection leak). materializeMcpTools is fail-open per server.
-                    const matP = materializeMcpTools(specs, principal);
+                    // #324:第 6 参接撤销台账 —— 展示面与引擎执行面同一权威(被撤服务器不再进面板;core 契约:
+                    // probe 抛错 fail-open + onProbeFailure 回调,这里缺席=沿 core 的 once-per-materialization notice)。
+                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations);
                     let timer;
                     const mat = await Promise.race([matP.catch(() => null), new Promise((r) => { timer = setTimeout(() => r(null), MCP_MATERIALIZE_TIMEOUT_MS); })]);
                     if (timer)

package/dist/http/routes/workflows.js

@@ -1,7 +1,6 @@
 import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { HEARTBEAT_MS } from "../../runs.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 const WORKFLOWS_RE = /^\/v1\/workflows(?:\/([^/]+)(\/stream|\/journal)?)?$/; // S8 self-orchestration runs: list / detail / live SSE
@@ -130,6 +129,9 @@ async function handleWorkflowsReadBody(req, res, url, ctx, miss) {
                     }
                     : {}),
                 ...(r.stats ? { tokens: r.stats.tokens, turns: r.stats.turns } : {}),
+                // core 5.51 #210:status:"completed" 但停在人拒的唯一判别位——白名单不投它,journal 消费者
+                // 会把「用户拒了、在等指示」读成「自然跑完」(契约明写的误读形)。additive:自然结束不挂键。
+                ...(r.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}),
             });
             const js = deps.workflowJournalStore;
             let projected;

package/dist/http/server.d.ts

@@ -463,6 +463,16 @@ export interface ServiceDeploymentDeps {
     /** #322 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
      *  缺席 / 回 `"not-wired"` = 本部署没有配置管道 ⇒ 该口诚实 4xx(绝不吞成 200)。 */
     configRefreshNow?: () => Promise<"triggered" | "not-wired" | "failed">;
+    /** #324(core 5.50 design/338):mid-turn MCP 撤销台账读口 —— GET /v1/sessions/:id/mcp 的展示面与
+     *  引擎执行面同一权威(被撤服务器的工具不再进面板)。缺席 = 无中心撤销面(pre-338 展示语义)。 */
+    mcpRevocations?: {
+        isRevoked(serverName: string): boolean;
+    };
+    /** #324 诊断投影:当前被撤销的 MCP 服务器名单(`GET /v1/diagnostics/wiring` 的 mcpRevocations 段)。
+     *  缺席/返回 undefined = 无配置管道 ⇒ 读面报 null(additive,不铸空壳)。 */
+    mcpRevocationState?: () => {
+        revoked: string[];
+    } | undefined;
     /** codex R18 (models-tiers deferral): the persistent "deferred WITHOUT a next-boot handoff" state — set when a
      *  changed model plane could not hot-apply (tier-frozen Runner / tiered candidate) AND no restart-surviving LKG
      *  exists to justify forcing a restart. Surfaced on /health (`modelPlaneDeferred`) so the stuck-degraded state

package/dist/main.js

@@ -1,4 +1,4 @@
-import { readFileSync, realpathSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { Runner, InMemoryToolResultStore, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
@@ -351,8 +351,12 @@ async function main() {
         retentionExecutorWired: config.retentionSweep.intervalSec > 0 && retentionExecutor !== undefined && retentionLaneStore !== undefined,
     });
     // design/158 A10:RunnerDeps 装配段搬到 src/boot/runner-deps.ts(逐字;runStore 晚绑改取值,见该文件头注)。
+    // #324:撤销台账席取一次、两处(主 runnerDeps + subRunner 共享基座)同一引用。takeMcpRevocations 的
+    // 取走动作同时打开 restart-signal 的删除向豁免(承接与豁免绑定,见 config-center 的方法注)。
+    const mcpRevocations = configCenter.takeMcpRevocations();
     const runnerDeps = createRunnerDeps({
         hands: commitHands,
+        mcpRevocations,
         config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         memorySyncRunner, toolResultStore: runnerOffloadStore, sessionPolicyStore, runtimeCapsResolver, fileSnapshotStore,
@@ -529,6 +533,7 @@ async function main() {
             config,
             logger, // #240②:onNotice 席落共享基座 ⇒ 两 Runner 同源(EngineNotice→logger.warn)
             hands: commitHands, // 交接件⑤:与主 runner 同一个值(基座保证同源)
+            mcpRevocations, // #324:与主 runner 同一台账实例(委托子代腿的 MCP 撤销同源生效)
             brain,
             pricing,
             tracer,
@@ -1202,6 +1207,8 @@ async function main() {
         restartState: () => configCenter.restartState(),
         planeDeferredState: () => configCenter.planeDeferredState(), // codex R18: /health.modelPlaneDeferred (stuck-deferred plane, no handoff)
         configApplyState: () => configCenter.configApplyState(), // #322 世代账:/health 三键 + 诊断 configApply 段(同一份读数)
+        mcpRevocations, // #324:GET /v1/sessions/:id/mcp 展示面与引擎执行面同一台账
+        mcpRevocationState: () => configCenter.mcpRevocationState(), // #324:诊断端点撤销名单投影
         configRefreshNow: () => configCenter.refreshNow(), // #322 追加件:POST /v1/admin/config/refresh(触发既有拍,在飞则 join)
         // shared drain state — SIGTERM flips `draining`, createServer assigns `inflight`, /health mirrors it.
         drainState,

package/dist/question.d.ts

@@ -14,6 +14,14 @@ export interface QuestionFrame {
     /** Server-signed emit timestamp (additive, [2805]§五→[2806]). Server-minted side-frame ⇒ no core-stream
      *  `eventId` to carry (absence is honest); this is the frame's own time coordinate. */
     serverNowMs?: number;
+    /** "question" only ([4851]③, additive, the `tool_approval` window-trio precedent from #288): the
+     *  coordinator's OWN answer window (`QUESTION_TTL_MS`, default 5min) — at expiry the ask releases
+     *  UNAVAILABLE ("unanswered") and core adjudicates park-vs-continue. Minted from the SAME `ttlMs` the
+     *  `setTimeout` below actually arms (single source; a shell countdown rendered from these can never
+     *  disagree with the release). Relative + absolute + `serverNowMs` above = clock-skew-proof trio. */
+    expiresInMs?: number;
+    /** "question" only: `serverNowMs + expiresInMs` — absolute deadline on the server's clock. */
+    expiresAtMs?: number;
 }
 /** The per-run context `onQuestion` recovers via ALS. `emit` delivers a frame to the run's live stream; `abortSignal`
  *  (the run's own cancel signal) releases a question parked awaiting a human when the run aborts. */

package/dist/question.js

@@ -180,7 +180,11 @@ export class QuestionCoordinator {
         // (the settlement is still pending there, so the emit is still fully awaited).
         // The loser of the race keeps its own handlers — an emit that rejects AFTER the race must not surface as an
         // unhandled rejection.
-        const emitted = (async () => ctx.emit({ type: "question", questionId: id, questions, serverNowMs: Date.now() }))()
+        const emitted = (async () => {
+            // [4851]③ 窗三键与上面 setTimeout 用同一个 ttlMs 铸(单源;壳倒计时永不与真释放口径分歧)。
+            const now = Date.now();
+            return ctx.emit({ type: "question", questionId: id, questions, serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs });
+        })()
             .then(() => "ok", () => "failed");
         const delivery = await Promise.race([emitted, answerP.then(() => "stalled")]);
         if (delivery === "ok") {

package/dist/run-local.js

@@ -657,6 +657,8 @@ export async function runLocal(argv, deps = {}) {
         usageWindowStore: config.usageWindows ? fileBackend.usageWindowStore : undefined,
         orgMemoryAdmission,
         sharedMemoryStores: undefined,
+        // #324:run-local 无 configCenter runtime = 无中心撤销面 ⇒ 席诚实缺席(pre-338 语义)。
+        mcpRevocations: undefined,
     });
     const runnerDeps = {
         ...sharedRunnerDeps,

package/dist/trace/project.d.ts

@@ -13,6 +13,7 @@
  * each content event, additive / tolerate-absent.
  */
 import type { ApprovalSettledBy, TaskResult } from "@sema-agent/core";
+import { type AskDenyResolution } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
 import type { LedgerEventType } from "./ledger-events.js";
@@ -94,6 +95,7 @@ export type TraceBlock = {
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    resolution?: AskDenyResolution;
     approver?: string;
     eventId?: string;
     parentToolCallId?: string;
@@ -137,6 +139,7 @@ export declare function toolEndEventData(ev: {
     structured?: unknown;
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
+    resolution?: AskDenyResolution;
     approver?: string;
     eventId?: string;
     parentToolCallId?: string;

package/dist/trace/project.js

@@ -1,6 +1,7 @@
-// 值导入(非 `import type`):`settledBy` 的闭集判据必须**复用 core 的谓词**——本仓抄一份三元词表
-// 就是值拷贝漂移源(上游加员时两处静默不同步)。core 5.18.1 #187 导出的单一属主。
-import { isApprovalSettledBy } from "@sema-agent/core";
+// 值导入(非 `import type`):`settledBy`/`resolution` 的闭集判据必须**复用 core 的谓词**——本仓抄
+// 一份词表就是值拷贝漂移源(上游加员时两处静默不同步)。settledBy=core 5.18.1 #187;
+// resolution 三席=core 5.52.0 根导出([4819] 应诺兑现,[4820] 预挂的闭集换装即此)。
+import { isApprovalSettledBy, isAskDenyResolution } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./redact.js";
 /** E8 (shell-host): drain the per-task model-usage accumulator into an append-only `model_usage` DELTA event.
  *  Shared by BOTH durable-write legs (runInBackground + the resume leg) so the persisted shape never drifts; the
@@ -176,6 +177,14 @@ export function toolEndEventData(ev) {
         //     一律不铸键 —— 既不折 "human" 也不折 null,把「不知道」如实表达成「没有这个键」。
         // 值是引擎铸的枚举短串、非用户内容 ⇒ 不脱敏。
         ...(isApprovalSettledBy(ev.settledBy) ? { settledBy: ev.settledBy } : {}),
+        // core 5.51.0 #127([4816] 提货单件①):`resolution` = ask 解析席**拒绝臂**的分类(九码闭集
+        // `AskDenyResolution`)——比 settledBy 更细(那个只说结算是什么种类,这个说拒绝走了哪条臂),
+        // 铸点在 resolveAsk 的组臂处、经引擎结算 sideband 逐字携带,**不可由 tool/policy 自declare**——
+        // core 契约逐字:「an out-of-vocabulary or self-declared word is dropped at the screens」,即
+        // **筛点单点在 core**。判据=闭集谓词 `isAskDenyResolution`(core 5.52.0 三席根导出到货,
+        // [4819]/[4820] 过渡形〔string 非空+≤64〕退役,单一属主纪律不抄词表)。
+        // 缺席不是语义(执行了的调用/policy 直拒/durable 腿都不带)。
+        ...(isAskDenyResolution(ev.resolution) ? { resolution: ev.resolution } : {}),
         // core 5.35.0 design/252 G-7(#263 提货批,[4022] G3):`approver` = 这次结算**是谁的**——审批通道
         // 自报的结算方标识串,core `screenApproverAttribution` 筛形后逐字转录在 `settledBy` 旁,两键**合读**
         // (`settledBy:"timeout"` + approver = 超时的那条队列名,不是拒绝的人)。与 settledBy 同族三条纪律:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.38.0",
+  "version": "7.39.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.50.0",
+    "@sema-agent/core": "^5.52.0",
     "@sema-agent/registry-core": "^0.19.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",