@sema-agent/server 7.58.0 → 7.60.0

package/dist/runs.d.ts

@@ -136,6 +136,19 @@ export declare function isSessionConflictResult(result: {
  * would not survive to a resume replica) → 409 — the request is well-formed, the deployment's state
  * conflicts with it, the `config.refresh_unavailable` family shape ("change the deployment, not the request").
  * Status choices are pinned by the `config.`/`memory.` family status sets in error-code-catalog-live.test.ts.
+ *
+ * S-125 件⑥(core 7.4.0 [ref]):`rewind.child_scope_unsupported` —— 这条腿是一个**委派子代**,它的文件编辑
+ * 记在**根 session** 的文件历史里,所以「把文件还原到某个 entry」是根 session 的动作、不是子代的;core 在
+ * prepare 期响亮拒(零计费,文件一个字节没动)。映射 **422**:请求形式合法、语义上找错了执行者 —— 与
+ * `resume_at.*` 的「调用方指错了锚」同一族同一档,而不是 404(目标在,只是不归你)也不是 409(部署状态没冲突)。
+ * ⚠️ **前缀不吞**:本码前缀是 `rewind.`,与下面那条 `resume_at.` **开集前缀臂**不同族 —— 它不会被那一臂顺手
+ * 兜走(兜走会把一条「找错执行者」的拒答成「锚解析不了」),也不是 `rewind_snapshot.`(那是「快照找不到」)。
+ * 三个前缀各自成族,逐码对表见 `test/resume-anchor.test.ts` 的 S-125 `rewind.` 族格。
+ * 🔴 **可达性如实**:本仓的 HTTP 面**今天铸不出**这条腿 —— 子代由 core 内部的 Agent 工具派生,
+ * `fileHistoryLineage` 是 core prepare 的 internals(不在 `TaskSpec` 上),server 从不直接 prepare 一条带
+ * lineage 的子代腿。本臂是**分诊面的完备性**(core 说 X ⇒ wire 形是 Y),不是一条今天在跑的路;将来的
+ * 委派入口接线那天零改动即生效。同族其余五码今天**仍落 200-with-failed-body**,那是本批**之前**就存在的
+ * 缺口(不是本批回归),已在上述对表格里逐码显式登记为债务,并由那道门看住不许陈腐。
  */
 export declare function resumeAtHttpStatus(result: {
     status: string;

package/dist/runs.js

@@ -72,6 +72,8 @@ export function resumeAtHttpStatus(result) {
         return 404;
     if (result.errorCode === "rewind_snapshot.unresolvable")
         return 422;
+    if (result.errorCode === "rewind.child_scope_unsupported")
+        return 422;
     if (result.errorCode === "memory.admission_denied")
         return 403;
     if (result.errorCode === "memory.admission_required")

package/dist/sql-engine-posture.d.ts

@@ -0,0 +1,49 @@
+/**
+ * S-131 —— SQL **引擎姿态**的运维读面(单一推导点,同 `memory-posture.ts` 的形制)。
+ *
+ * ## 病
+ *
+ * 「这台 worker 的事务读语义到底是什么」此前**任何读面都答不出来**:隔离级是服务器/会话变量,TiDB 的
+ * 事务模式是集群配置,而本仓每一条 `SELECT … FOR UPDATE` 的判据都以「加锁读是当前读」为前提。运维要
+ * 排查一次「为什么并发结果不对」,只能去登服务器读变量 —— 而那读的是**服务器**,不是**本仓的连接**。
+ *
+ * ## 药
+ *
+ * `sql-driver.ts` 的连接初始化在**每条池连接**上钉死这两件事并**回读复核**(`@contract txn.read-semantics`)。
+ * 本模块把那份读数拿出来,一次推导两个读面:operator 面(`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段,
+ * 全量)与消费端面(`GET /v1/capabilities` 的 `sql` 位,窄投影)。两面同源 —— 「诊断页说悲观、能力位说
+ * 乐观」在结构上不可能。
+ *
+ * ## 两条诚实纪律(与 memory-posture 同源)
+ *
+ * ① **取实例真值,不按配置推断**:`facts` 是驱动在真连接上 `SET` 完之后**回读**的值,不是 env 里写了什么。
+ * ② **缺席就是缺席**:没有 SQL 后端(env-only / local 文件后端)⇒ `null`,不铸一个看起来像答案的空壳。
+ *
+ * ## 拒启在哪一头
+ *
+ * 不在这里 —— 在 `sql-driver.ts` 的连接初始化里(TiDB 乐观模式设不成悲观 / 隔离级复核不符 ⇒ 响亮抛)。
+ * 本模块在 boot 期借一条连接**触发**那次初始化,于是那句拒绝落在启动期而不是第一次业务写上。
+ */
+import { type SqlEngineFacts } from "./plugins/sql-driver.js";
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+/** 消费端窄投影(`GET /v1/capabilities` 的 `sql` 位)。`null` = 本部署没有 SQL 后端。 */
+export interface SqlEngineCapability {
+    engine: SqlEngineFacts["engine"];
+    isolation: string;
+    txnMode: SqlEngineFacts["txnMode"];
+}
+/**
+ * Boot 期建立引擎事实:借一条池连接(初始化随之跑),再原样归还。返回一个 **live getter** —— 事实由
+ * 驱动持有,重连后它会被下一次初始化刷新,快照会说谎。
+ *
+ * 抛出 = 拒启:连接初始化拒绝了这个后端(TiDB 乐观模式设不成悲观、隔离级复核不符、服务器太旧读不出
+ * `@@transaction_isolation`)。这条错**刻意不吞** —— 本仓所有 `FOR UPDATE` 判据都以它为前提。
+ */
+export declare function establishSqlEnginePosture(pools: {
+    mysqlPool?: MySqlPool | undefined;
+    pgPool?: PgPool | undefined;
+}): Promise<(() => SqlEngineFacts | null) | undefined>;
+/** operator 面 → 消费端面的窄投影(`version` 是运维料,刻意不进能力位:它只对排障有意义)。 */
+export declare function projectSqlEngineCapability(facts: SqlEngineFacts | null | undefined): SqlEngineCapability | null;
+//# sourceMappingURL=sql-engine-posture.d.ts.map

package/dist/sql-engine-posture.js

@@ -0,0 +1,13 @@
+import { mysqlDriver, pgDriver } from "./plugins/sql-driver.js";
+export async function establishSqlEnginePosture(pools) {
+    const driver = pools.mysqlPool ? mysqlDriver(pools.mysqlPool) : pools.pgPool ? pgDriver(pools.pgPool) : undefined;
+    if (driver === undefined)
+        return undefined;
+    const conn = await driver.connect();
+    conn.release();
+    return () => driver.facts;
+}
+export function projectSqlEngineCapability(facts) {
+    return facts == null ? null : { engine: facts.engine, isolation: facts.isolation, txnMode: facts.txnMode };
+}
+//# sourceMappingURL=sql-engine-posture.js.map

package/dist/task-settings.d.ts

@@ -186,9 +186,19 @@ export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
 export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
 export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
-/** CC/SDK 合约里合法、本 service **不接线**的顶层键(出处 = `@sema-agent/sdk` `SemaSettings` 尾注逐字点名的
- *  三个 deferred CC 键)。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响文案,不影响判决。 */
-export declare const TASK_SETTINGS_UNSUPPORTED_KEYS: readonly ["apiKeyHelper", "sandbox", "statusLine"];
+/** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响
+ *  文案,不影响判决。前三个的出处 = `@sema-agent/sdk` `SemaSettings` 尾注逐字点名的 deferred CC 键。
+ *
+ *  🔴 `crossSessionInbound` / `dialogExpiry`(S-111)为什么在**这一列**而不是受理列:它们是**每会话**的
+ *  保护型设置(`refuse` = 本会话退出入站跨会话车道),而引擎只给了**部署级**座位(一个 Runner 单例,
+ *  getter 无会话上下文)。受理它们只能做到「解析 + 记一行运维日志」——调用方拿到 202、以为自己的
+ *  opt-out 生效了,而实际没有任何 per-session 生效点。**在保护型配置上,「受理但不执行」比「响亮拒」
+ *  危险得多**:前者是静默的假安全,后者是调用方当场看得见的事实(400 体的 `unsupportedKeys` 逐字列名,
+ *  机器可读)。所以本版按 `statusLine` 族同姿势明拒。
+ *  部署层的同名治理**照常可用**,走部署旋钮(`cross-session-settings.ts` 的 managed 层);等引擎开出
+ *  每任务座、或本仓 per-run 上下文覆盖到每一条 run 腿,这两个键**移到上面的受理列**即可(一行),
+ *  那一刻它们才真的有生效点。 */
+export declare const TASK_SETTINGS_UNSUPPORTED_KEYS: readonly ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 /** 同上,`settings.permissions` 子层(出处 = SDK `SettingsPermissions` 的三个声明键)。
  *  `additionalDirectories` 有**同请求替代面**:顶层 `body.additionalDirectories`([ref],resolve-spec 真消费)。 */
 export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["additionalDirectories", "disableBypassPermissionsMode"];

package/dist/task-settings.js

@@ -74,7 +74,7 @@ function cleanStringArray(v) {
 }
 export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
-export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "sandbox", "statusLine"];
+export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
 export const MAX_SETTINGS_KEY_ECHO = 20;
 const MAX_SETTINGS_KEY_ECHO_CHARS = 64;

package/dist/tool-approval.d.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage } from "node:http";
 import { type AskRequest, type AskOutcome, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
-import { type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
+import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
@@ -124,6 +124,24 @@ export interface ToolApprovalFrame {
      *  本键让 live-only 部署(店缺席、帧无卡)也能读到出身位;安全类标记不得依赖店在场([ref] 结构性
      *  缺口成文)。消费语义(cli 挂点已预埋):在场 ⇒ 一切自动放行让位(含记住的规则与 bypass 姿态)。 */
     requiresRealApproval?: true;
+    /**
+     * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` 八员 content_question / unresolvable / org_unavailable /
+     * org_rule / hook / ask_rule / denial_limit_fallback / policy)。引擎在门上盖章(core d.ts:
+     * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
+     *
+     * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
+     * **不许**据本键自铸第二张资格表 —— 那是同一语义面两个写者(源头修复纪律),与
+     * `denialLimitFallback` 顶注那条「不据 autoDenyAfterMs 自铸第二只定时器」同一条禁令。
+     *
+     * 🔴 **不枚举词表**(`string` 而不是本仓自铸的联合):词表单一属主在 core,在这里抄一份会把 core 加的
+     * 新词吞成缺席 —— 与 `wiring_manifest.autoMode.reason` 的透传纪律逐字同规。缺席 = 老引擎 / 非 ask 路径。
+     *
+     * ⚠️ 与 {@link governanceForced} **不是**一回事,别互相顶替:本键答「哪一类权威提的问」,那一键答
+     * 「**本部署运维治理层**是不是这只 ask 的门」。`origin: "policy"` 覆盖的是「任何部署 ToolPolicy 的
+     * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
+     */
+    origin?: string;
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
      * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。
@@ -211,6 +229,28 @@ export interface ToolApprovalFrame {
      * **同一个**函数 ⇒ 两面同值),词表外的值=形不合=不铸键([ref] 闭集纪律,绝不透传未知词)。
      */
     ruleOffersAbsence?: RuleOffersAbsence;
+    /**
+     * S-114(core 7.4.0 [ref];**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 是 auto 模式分类器的**限额
+     * 回落卡**:分类器连续(缺省 3)或累计(缺省 20)拒到限额的**那一次**调用不再静默 deny,而是落成一张
+     * 必须真人批的卡(同一次铸造同时盖 `requiresRealApproval`,两键是孪生)。
+     * `{consecutive, total, limit:"consecutive"|"total", autoDenyAfterMs}` —— 触限时的两个计数、哪一道界
+     * 触了、以及**这张卡自己**的自动拒窗(ms;`0` = 不武装)。
+     *
+     * 🔴 **additive echo-only,server 零消费**(`ruleOffers` 先例逐字):窗的执行全在 core 的 `resolveAsk`
+     * ([ref] 的引擎自有 deadline —— 窗到即 deny 且盖 `settledBy:"timeout"` / `resolution:"window_expired"` /
+     * `autoDenied:true`)。本仓**不得**据 `autoDenyAfterMs` 自铸第二只定时器:那会与上游的窗构成同一语义面
+     * 的两个写者,而两只窗的重叠比原缺陷更坏且静默(源头修复纪律)。
+     *
+     * 值经 `approval-card.ts` 的 `readDenialLimitFallback` 窄读(`.strict()` 形校验;与 `card_json`
+     * **同一个**函数 ⇒ 两面同值),形不合/闭集外 ⇒ 不铸整键。四成员皆机器数/闭词、非内容族 ⇒ 零 redact。
+     * **缺席不是断言**:绝大多数 ask 根本不是回落卡,消费端只读在场。
+     *
+     * ⚠️ 耐久腿(park 行)今天**不携**本键 —— core 7.4.0 的 `PendingAction` 上没有这一位(亲读
+     * `dist/core/checkpoint-store.d.ts`,零命中);core [ref] 预告在 7.4.x,本仓**只登记不预铸**。
+     * 卡面那一份(`ApprovalCardSchema.denialLimitFallback`)走的是 `card_json`,与 park 行的 `pendingAction`
+     * 是两条腿,别混。
+     */
+    denialLimitFallback?: DenialLimitFallback;
     /**
      * [ref] 件 G1(core 5.33.0 backlog [ref],判据帖 [ref] G1;**ADDITIVE**,`"tool_approval"` only)——
      * 这次 ask **为什么**被收紧的**结构化**因由(`AskRequest.probeCause`:工具的 `reversibilityProbe`

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
@@ -837,11 +837,13 @@ export class ToolApprovalCoordinator {
             message: typeof req.message === "string" ? redactDeep(req.message) : "",
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(typeof req.origin === "string" && req.origin.length > 0 ? { origin: req.origin } : {}),
             ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
                 : {}),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
+            ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
@@ -925,6 +927,10 @@ export class ToolApprovalCoordinator {
                     frame.inputHasBidi = true;
                 else
                     delete frame.inputHasBidi;
+                if (cardForFrame.denialLimitFallback !== undefined)
+                    frame.denialLimitFallback = cardForFrame.denialLimitFallback;
+                else
+                    delete frame.denialLimitFallback;
                 if (cardForFrame.governanceForced === true && !effectiveGovernanceForced) {
                     effectiveGovernanceForced = true;
                     ruleLaneMaterial = undefined;

package/dist/trace/core-keyset-guard.d.ts

@@ -21,14 +21,14 @@ import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskReq
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
-type NotificationExcluded = "peer" | "crossSessionMessage";
+type NotificationExcluded = "peer" | "crossSessionMessage" | "crossSessionNotice";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
@@ -45,14 +45,14 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
-type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "status" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "blockedReason" | "checkpointId" | "checkpointGate" | "workspaceRestoreMode" | "remoteEnvFailures" | "errorMessage" | "errorCode" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveMemoryScopes" | "stats";
+type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "status" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "blockedReason" | "checkpointId" | "checkpointGate" | "workspaceRestoreMode" | "remoteEnvFailures" | "errorMessage" | "errorCode" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveMemoryScopes" | "stats" | "editedFiles";
 type TaskResultStripped = "checkpointToken";
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -17,6 +17,9 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "task.late_approval",
     "config.durable_gate_unavailable",
     "peer.inbound_disposition",
+    "peer.held_settled",
+    "peer.idle_subscription",
+    "classifier.denial_limit",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/project.d.ts

@@ -97,6 +97,7 @@ export type TraceBlock = {
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
     resolution?: AskDenyResolution;
+    autoDenied?: true;
     approver?: string;
     gatedCallId?: string;
     eventId?: string;
@@ -142,6 +143,7 @@ export declare function toolEndEventData(ev: {
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
     resolution?: AskDenyResolution;
+    autoDenied?: true;
     approver?: string;
     gatedCallId?: string;
     eventId?: string;
@@ -379,6 +381,29 @@ export declare function workspaceChangedEventData(ev: {
  *       抛)。账本回放/第三方 producer 送来的矛盾对若原样上 wire,按 `armed` 读与按 `reason` 读的消费端会得到
  *       **相反**的答案 —— 这条轴上(@cli `sema doctor permissions` 正读它)两个答案比没答案更坏 ⇒ 整段不铸。
  *       这不是改语义:它与本函数「畸形值一律按缺席」是同一条规则,而这条不变量是 core 自己写的段内契约。
+ *  · `mcp[]`(`WiringManifestMcpEntry[]`;core 7.5.0 [ref],S-124 提货件)—— **裁:租户可见,逐条目挑键,
+ *    `error` 一格不投**。
+ *    ① **同主体同受众**:它是 per-leg 的读面「我这条腿申报的每台 MCP 服务器,连上了没有、挂了是哪一类、
+ *       挂上来几个工具」。同一主体(调用方自己的 run)、同一条轴上,本仓早已把**更粗**的同类事实投给
+ *       租户:`GET /v1/sessions/:id/mcp` 的 `connected|failed` 二态。⚠️ 两者**不合并**、也不互相校验 ——
+ *       那条端点的真源是 server 自己的部署面台账(server 自铸的二态),本段的真源是 core 这条腿
+ *       materialize 的连接时快照;同名不同源,合并只会造出一个「哪个才算数」的新问题。
+ *    ② **值的形**:`name`(spec 声明名)/ `source`(声明方自述的层级标签,core 已 single-line + 长度封顶
+ *       逐字回显)/ `status`(三词闭集)/ `errorCode`(core `MCP_FAILURE_CODES` 十词闭集 + `http_<status>`)/
+ *       `toolCount`(有限数)—— 全是引擎或**声明方**产的闭形值,非用户内容 ⇒ 不脱敏、逐字。
+ *       ⚠️ `errorCode` **不是纯闭集**:十个具名词之外还有 `http_<status>` 形(core 自陈)⇒ 本仓既不枚举
+ *       那十个词、也不给它套形正则(词的单一属主在 core;抄一份会把 core 加的新词与新形一起吞成缺席),
+ *       只判非空串,消费端按具名词写的 switch 必须带 default 臂。
+ *    ③ 🔴 **`error` 有意不投**:它是本投影面上唯一的**远端作者自由文本**。判据与代价逐字在
+ *       `core-keyset-guard.ts` ⑥b 的 `WiringMcpExcluded` 一行(要点:进来会同时破本段「无自由文本 ⇒
+ *       不脱敏」的段内不变量,和 core 7.5.0 [ref] 把远端 MCP 错误文本秘密脱敏收敛成**一个**铸点的单铸律
+ *       —— server 再脱一遍就是同一语义面的第二个写者)。可操作的因由在 `errorCode`,那正是 core 为这条
+ *       消费面造闭集的理由。**带触发条件的裁定**,消费端提真需求时连同 bound/中和归属一起裁一次再翻。
+ *    ④ **不是 governance 侧信道**:五键描述的是本腿的 MCP 连接尝试,与 lockedConfig/compliance/
+ *       memoryAdmission/retention 四位无函数关系;core 自己也把它排除在 `configFingerprint` 之外
+ *       (「connection state is a fact about this leg's attempt, not about the assembly」)。
+ *    ⚠️ 空数组 ≠ 缺席:core 顶注逐字「an empty array is "this leg declared no servers", absence is an older
+ *       mint or an external derivation」⇒ 空数组照铸,别折成缺席。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
  * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格

package/dist/trace/project.js

@@ -96,6 +96,7 @@ export function toolEndEventData(ev) {
         ...(typeof ev.errorCode === "string" && ev.errorCode.length <= 128 ? { errorCode: ev.errorCode } : {}),
         ...(isApprovalSettledBy(ev.settledBy) ? { settledBy: ev.settledBy } : {}),
         ...(isAskDenyResolution(ev.resolution) ? { resolution: ev.resolution } : {}),
+        ...(ev.autoDenied === true ? { autoDenied: true } : {}),
         ...(typeof ev.approver === "string" && ev.approver !== "" ? { approver: redactSecrets(ev.approver) } : {}),
         ...(typeof ev.gatedCallId === "string" && ev.gatedCallId !== "" ? { gatedCallId: ev.gatedCallId } : {}),
         ...identityFields(ev),
@@ -269,6 +270,29 @@ export function wiringManifestEventData(ev) {
             return undefined;
         return armed === (reason === "armed") ? { armed, reason } : undefined;
     })();
+    const mcpIn = m.mcp;
+    const mcp = (() => {
+        if (!Array.isArray(mcpIn))
+            return undefined;
+        const rows = [];
+        for (const raw of mcpIn) {
+            const e = sec(raw);
+            if (e === undefined)
+                continue;
+            const name = str(e.name);
+            const status = str(e.status);
+            if (name === undefined || status === undefined)
+                continue;
+            rows.push({
+                name,
+                status,
+                ...(num(e.toolCount) !== undefined ? { toolCount: e.toolCount } : {}),
+                ...(str(e.source) !== undefined ? { source: e.source } : {}),
+                ...(str(e.errorCode) !== undefined ? { errorCode: e.errorCode } : {}),
+            });
+        }
+        return rows;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
@@ -282,6 +306,7 @@ export function wiringManifestEventData(ev) {
         ...(permissionRules !== undefined ? { permissionRules } : {}),
         ...(modelGate !== undefined ? { modelGate } : {}),
         ...(autoMode !== undefined ? { autoMode } : {}),
+        ...(mcp !== undefined ? { mcp } : {}),
         ...identityFields(ev),
     };
 }
@@ -432,6 +457,7 @@ export function toolResultFieldsOf(d) {
         ...(isApprovalSettledBy(d.settledBy) ? { settledBy: d.settledBy } : {}),
         ...(typeof d.approver === "string" && d.approver !== "" ? { approver: d.approver } : {}),
         ...(isAskDenyResolution(d.resolution) ? { resolution: d.resolution } : {}),
+        ...(d.autoDenied === true ? { autoDenied: true } : {}),
         ...(typeof d.gatedCallId === "string" && d.gatedCallId !== "" ? { gatedCallId: d.gatedCallId } : {}),
         ...identityFields(d),
     };

package/dist/trace/sema-provenance.d.ts

@@ -19,8 +19,14 @@ export declare const SEMA_PROVENANCE_KINDS: readonly ["agent_message"];
  *  · `cross_session_message` —— core fc52b4d4 [ref] §4.1(session-box drain 铸;`from` 是对端**地址**、`peerMeta`
  *    携 typed peer 记录)。[ref] 候:本仓不可达(`RunnerDeps.peerDirectory` 零声明点)+ 注入帧渲染形候 [ref] @server③
  *    表态;与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,接线时三处同翻。
+ *  · `cross_session_notice` —— core 7.4.0 [ref] §4.4/§5.2(片4;本闭集 2026-09-05 真红出它)。**同一条车道的
+ *    第二个载体**,不是新判据:同一个 session-box drain 铸(`agents/peer-session-drain.js` 的 notice 臂),同一个
+ *    `RunnerDeps.peerDirectory` 座前提 ⇒ 本仓同样不可达;渲染形与它的载体 `crossSessionNotice`(core-keyset-guard.ts
+ *    ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的裁定而不是新增特判:
+ *    车道没接线时放行一个 lane 词,等于替 [ref] 预先声明一种 cli 渲染形。[ref] 接线那天三处(本簿、载体键、
+ *    ①-nested 的 `peerMeta`)同批翻。
  */
-export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message"];
+export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message", "cross_session_notice"];
 /** 本仓两条腿入参的**形**(不是 core 类型:入参是运行期载荷,`kind` 先当 string 收、经闭集才成 typed)。 */
 export interface SemaProvenanceInput {
     kind: string;

package/dist/trace/sema-provenance.js

@@ -1,5 +1,5 @@
 export const SEMA_PROVENANCE_KINDS = ["agent_message"];
-export const SEMA_PROVENANCE_KINDS_EXCLUDED = ["cross_session_message"];
+export const SEMA_PROVENANCE_KINDS_EXCLUDED = ["cross_session_message", "cross_session_notice"];
 const _semaProvenanceExhaustive = true;
 void _semaProvenanceExhaustive;
 const _semaProvenanceNoDoubleBook = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.58.0",
+  "version": "7.60.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.3.1",
-    "@sema-agent/settings-schema": "1.5.0",
+    "@sema-agent/core": "7.5.0",
+    "@sema-agent/settings-schema": "1.6.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",