@sema-agent/server 7.59.0 → 7.60.0

package/dist/rules-consent.d.ts

@@ -1,16 +1,13 @@
-import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedAllowRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
-import type { PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
+import { type RuleOwner, type ImportPreview, type RedeemedBatchMember, type ImportedSettingsLayer, type PersistedAllowRule, type EffectivePermissionRule, type RemoveResult, type EditedRuleTextPrecheck, type RuleScope, type RuleOffer } from "@sema-agent/core";
+import type { DurableRulePartitionProvider, PermissionRuleStoreProvider, RuleApprovalRecordStore } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./plugins/permission-rule-store-sql.js";
 /**
- * 本车道**真正**依赖的三面(**结构**接口,不是 SQL 类)。
- *
- * 🔴 为什么不直接吃 `PermissionRuleStores`(SQL 束):同意车道是**纯协议逻辑**,它对「行躺在 MySQL 还是
- * PG 还是别处」一无所知也不该知道。吃结构接口有两个真收益:①单元测试能用 core 自己的
- * `InMemoryPermissionRuleStore` / `InMemoryRuleApprovalRecordStore` 驱动**同一段**代码(而不是为了测协议
- * 去拉一个数据库);②将来若真出了 File 形规则店,本文件一个字不用改。SQL 束结构上满足本接口。
+ * 规则分区**之外**的两只记录面 —— 它们是 server 自铸的(审批记录的 SQL/File 形、CC 导入票),
+ * 与 [ref] 的分区族不是同一件东西,所以在这里单列一次:一个 backend 交出来的束
+ * ({@link PermissionRuleStoreBundle})与同意车道消费的束({@link RuleConsentStores})都含这两面,
+ * 差的只是规则那一格躺的是 **durable 分区后端**还是**合成好的统一店**。
  */
-export interface RuleConsentStores {
-    provider: PermissionRuleStoreProvider;
+export interface RuleConsentRecordStores {
     /** core 的记录店面 + 一个**可选**的加项:`discardPendingRecord`(超帽拒绝时收掉 `prepareCcImport`
      *  已经落盘的那一条 pending 记录)。没有这个加项的后端只是留一条孤儿行,不影响任何判决
      *  (语义与「已确认的记录永不被收」的硬条款见 SQL 侧同名方法)。 */
@@ -51,6 +48,22 @@ export interface RuleConsentStores {
         reclaim(ticketId: string, principal: string, purpose: RuleTicketPurpose, minClaimAgeMs: number): Promise<RuleTicketReclaimResult>;
     };
 }
+/**
+ * 本车道**真正**依赖的三面(**结构**接口,不是 SQL 类)。
+ *
+ * 🔴 为什么不直接吃 `PermissionRuleStores`(SQL 束):同意车道是**纯协议逻辑**,它对「行躺在 MySQL 还是
+ * PG 还是别处」一无所知也不该知道。吃结构接口有两个真收益:①单元测试能用 core 自己的
+ * `InMemoryDurableRulePartition` / `InMemoryRuleApprovalRecordStore` 驱动**同一段**代码(而不是为了测协议
+ * 去拉一个数据库);②将来若真出了 File 形规则店,本文件一个字不用改。SQL 束结构上满足本接口。
+ *
+ * 🔴 `provider` 是 [ref] **合成后**的统一店(`createPermissionRuleStoreProvider` 的产物),不是
+ * backend 交出来的 durable 分区 —— core 的 `removePersistedRule` / `RuleConsentDeps.provider` 两口收的
+ * 都是它,而合成点只有 `main.ts` 一处:引擎接缝(`RunnerDeps.permissionRuleStore`)与本车道读的必须是
+ * **同一只**对象,否则「卡上给的候选」与「引擎放行时看到的规则」会分别站在两只店上。
+ */
+export interface RuleConsentStores extends RuleConsentRecordStores {
+    provider: PermissionRuleStoreProvider;
+}
 /**
  * 一个 backend 交出来的**完整**规则店束 = 同意车道要的三面 + boot 期审计要的窄读口。
  *
@@ -59,7 +72,13 @@ export interface RuleConsentStores {
  * 结构接口是这条 seam 唯一站得住的形——两个实现各自满足它,消费点(main 装配 / 同意车道 / 撤销面
  * 路由)一个字都不用知道行躺在哪里。
  */
-export interface PermissionRuleStoreBundle extends RuleConsentStores {
+export interface PermissionRuleStoreBundle extends RuleConsentRecordStores {
+    /** [ref] 的 **durable 分区后端**(`user` + `project` 两源)。**不是**引擎接缝本身:
+     *  `RunnerDeps.permissionRuleStore` 与 {@link RuleConsentStores.provider} 是
+     *  `createPermissionRuleStoreProvider({ durable })` 合成出来的统一店,合成在 `main.ts` 一处发生一次。
+     *  分区构成(接不接 org / session)是**部署**决定,不是 backend 决定 —— 让 backend 各自合成,等于
+     *  日后接 org 分区时要挨个改后端,而两个后端合成得不一样时没有任何人看得出来。 */
+    durable: DurableRulePartitionProvider;
     /** [ref] §3:库里已有几只规则桶(一 owner 一桶)。boot 期休眠行审计的**唯一**依赖;
      *  为什么数桶不数规则、以及读失败必须响亮,见 `boot/permission-rules-audit.ts` 与两个实现处的注。 */
     countBuckets(): Promise<number>;
@@ -491,7 +510,30 @@ export interface PersistedRuleWireRow {
     /** 去规范化的命令(core 的匹配器信的就是它 + `match`,不是重新解析 `rule`)。 */
     command: string;
     adds: PersistedAllowRule["adds"];
+    /** [ref](core 7.5.0):这一行来自哪个源。**由 `scope` 派生**(`global`⟺`user`、`project`⟺
+     *  `project`、`session`⟺`session`),不是行上另存的第二个字节 —— core 的 `ruleSourceOf` 是整条映射。
+     *  今天本部署只接 durable 一格分区 ⇒ 值域实为 `user | project`。
+     *
+     *  🔴 为什么上 wire 而不是丢掉:统一读把这一格**交到手里了**,治理列举知道而不说 = 一次 wire 谎言的
+     *  反面(客户端只能自己去 decode `scope` 猜),而 org 分区接线的那天它会立刻变得承重。 */
+    source: EffectivePermissionRule["source"];
+    /** [ref]:这一行的**站位** —— `live` 或 `shadowed-by-org`(org deny 盖到它的命令模式上)。
+     *  今天无 org 分区 ⇒ 恒 `live`;这一格正是「接了 org 分区之后治理面必须看得见的那件事」。 */
+    status: EffectivePermissionRule["status"];
 }
+/**
+ * 一条**可导入**的规则行 = 列举行**减去两格派生键**。
+ *
+ * 🔴 为什么导入输入面不收 `source`/`status`:两格都是**派生**的 —— `source` 由 `scope` 派生
+ * (core 的 `ruleSourceOf` 是整条映射,d.ts 逐字「A row never carries a second source byte that could
+ * drift from its scope」),`status` 由 org 分区的遮蔽判据派生。一个调用方递进来的 `source` 只会与它
+ * 自己的 `scope` 漂,而漂的落点是治理面上「这行到底归谁管」。同族纪律 core 自己在卡面投影上也写过
+ * (「derived HERE, at projection time … never accepted from a caller」)。
+ *
+ * 这不是两份平行形状:`Omit` 让「导入面 = 列举面 − 派生键」是一条**机器判据**,列举行加员时导入面
+ * 自动跟随、`LOCAL_IMPORT_ROW_SHAPE_PIN`(路由侧)当场编译红。
+ */
+export type ImportableRuleRow = Omit<PersistedRuleWireRow, "source" | "status">;
 /** 列举结果。`rev` = 这只桶的 OCC 版本,游标绑它(见路由侧的游标注)。 */
 export interface PersistedRuleListing {
     rows: PersistedRuleWireRow[];
@@ -531,7 +573,7 @@ export interface RuleConsentLane {
     /** 导入道:原子消费票 → confirm → redeemRuleBatch。 */
     redeemImport(principal: string, ticket: string): Promise<RuleImportRedeemed>;
     /** [ref] A7 直通道:逐行校验 → 预览 + pending 记录 + 票(零可导入行 ⇒ 无票)。 */
-    prepareLocalImport(principal: string, rows: readonly PersistedRuleWireRow[]): Promise<LocalImportPrepared>;
+    prepareLocalImport(principal: string, rows: readonly ImportableRuleRow[]): Promise<LocalImportPrepared>;
     /** [ref] A7 直通道:三态兑付(首兑 / 逐字回放 / 崩溃窗重驱),终局落进票行。 */
     redeemLocalImport(principal: string, ticket: string): Promise<LocalImportRedeemed>;
     /**

package/dist/rules-consent.js

@@ -4,7 +4,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
 import { MAX_CWD_CHARS } from "./task-cwd.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
-import { confirmRuleApproval, parseAllowRuleText, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, } from "@sema-agent/core";
+import { confirmRuleApproval, parseAllowRuleText, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, removePersistedRule, effectiveOrThrow, } from "@sema-agent/core";
 import { buildRulePayloadHash } from "./plugins/permission-rule-store-sql.js";
 export const RULE_IMPORT_TICKET_TTL_MS = 10 * 60_000;
 export const RULE_IMPORT_RETRY_AFTER_SEC = 2;
@@ -682,10 +682,10 @@ export function createRuleConsentLane(stores, opts) {
             }
         },
         async listRules(bucket) {
-            const stored = await storeForBucket(stores.provider, bucket).list();
-            const rows = stored.rules.map((r) => ({ rule: r.rule, scope: serializeRuleScope(r.scope), tool: r.tool, match: r.match, command: r.command, adds: r.adds }));
+            const view = await effectiveOrThrow(storeForBucket(stores.provider, bucket));
+            const rows = view.rules.map((r) => ({ rule: r.rule, scope: serializeRuleScope(r.scope), tool: r.tool, match: r.match, command: r.command, adds: r.adds, source: r.source, status: r.status }));
             rows.sort((a, b) => (a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0));
-            return { rows, rev: stored.rev };
+            return { rows, rev: view.rev };
         },
         async removeRule(input) {
             return await removePersistedRule({ rule: input.rule, scope: input.scope, principal: input.principal, provider: stores.provider });

package/dist/sql-engine-posture.d.ts

@@ -0,0 +1,49 @@
+/**
+ * S-131 —— SQL **引擎姿态**的运维读面(单一推导点,同 `memory-posture.ts` 的形制)。
+ *
+ * ## 病
+ *
+ * 「这台 worker 的事务读语义到底是什么」此前**任何读面都答不出来**:隔离级是服务器/会话变量,TiDB 的
+ * 事务模式是集群配置,而本仓每一条 `SELECT … FOR UPDATE` 的判据都以「加锁读是当前读」为前提。运维要
+ * 排查一次「为什么并发结果不对」,只能去登服务器读变量 —— 而那读的是**服务器**,不是**本仓的连接**。
+ *
+ * ## 药
+ *
+ * `sql-driver.ts` 的连接初始化在**每条池连接**上钉死这两件事并**回读复核**(`@contract txn.read-semantics`)。
+ * 本模块把那份读数拿出来,一次推导两个读面:operator 面(`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段,
+ * 全量)与消费端面(`GET /v1/capabilities` 的 `sql` 位,窄投影)。两面同源 —— 「诊断页说悲观、能力位说
+ * 乐观」在结构上不可能。
+ *
+ * ## 两条诚实纪律(与 memory-posture 同源)
+ *
+ * ① **取实例真值,不按配置推断**:`facts` 是驱动在真连接上 `SET` 完之后**回读**的值,不是 env 里写了什么。
+ * ② **缺席就是缺席**:没有 SQL 后端(env-only / local 文件后端)⇒ `null`,不铸一个看起来像答案的空壳。
+ *
+ * ## 拒启在哪一头
+ *
+ * 不在这里 —— 在 `sql-driver.ts` 的连接初始化里(TiDB 乐观模式设不成悲观 / 隔离级复核不符 ⇒ 响亮抛)。
+ * 本模块在 boot 期借一条连接**触发**那次初始化,于是那句拒绝落在启动期而不是第一次业务写上。
+ */
+import { type SqlEngineFacts } from "./plugins/sql-driver.js";
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+/** 消费端窄投影(`GET /v1/capabilities` 的 `sql` 位)。`null` = 本部署没有 SQL 后端。 */
+export interface SqlEngineCapability {
+    engine: SqlEngineFacts["engine"];
+    isolation: string;
+    txnMode: SqlEngineFacts["txnMode"];
+}
+/**
+ * Boot 期建立引擎事实:借一条池连接(初始化随之跑),再原样归还。返回一个 **live getter** —— 事实由
+ * 驱动持有,重连后它会被下一次初始化刷新,快照会说谎。
+ *
+ * 抛出 = 拒启:连接初始化拒绝了这个后端(TiDB 乐观模式设不成悲观、隔离级复核不符、服务器太旧读不出
+ * `@@transaction_isolation`)。这条错**刻意不吞** —— 本仓所有 `FOR UPDATE` 判据都以它为前提。
+ */
+export declare function establishSqlEnginePosture(pools: {
+    mysqlPool?: MySqlPool | undefined;
+    pgPool?: PgPool | undefined;
+}): Promise<(() => SqlEngineFacts | null) | undefined>;
+/** operator 面 → 消费端面的窄投影(`version` 是运维料,刻意不进能力位:它只对排障有意义)。 */
+export declare function projectSqlEngineCapability(facts: SqlEngineFacts | null | undefined): SqlEngineCapability | null;
+//# sourceMappingURL=sql-engine-posture.d.ts.map

package/dist/sql-engine-posture.js

@@ -0,0 +1,13 @@
+import { mysqlDriver, pgDriver } from "./plugins/sql-driver.js";
+export async function establishSqlEnginePosture(pools) {
+    const driver = pools.mysqlPool ? mysqlDriver(pools.mysqlPool) : pools.pgPool ? pgDriver(pools.pgPool) : undefined;
+    if (driver === undefined)
+        return undefined;
+    const conn = await driver.connect();
+    conn.release();
+    return () => driver.facts;
+}
+export function projectSqlEngineCapability(facts) {
+    return facts == null ? null : { engine: facts.engine, isolation: facts.isolation, txnMode: facts.txnMode };
+}
+//# sourceMappingURL=sql-engine-posture.js.map

package/dist/tool-approval.d.ts

@@ -124,6 +124,24 @@ export interface ToolApprovalFrame {
      *  本键让 live-only 部署(店缺席、帧无卡)也能读到出身位;安全类标记不得依赖店在场([ref] 结构性
      *  缺口成文)。消费语义(cli 挂点已预埋):在场 ⇒ 一切自动放行让位(含记住的规则与 bypass 姿态)。 */
     requiresRealApproval?: true;
+    /**
+     * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` 八员 content_question / unresolvable / org_unavailable /
+     * org_rule / hook / ask_rule / denial_limit_fallback / policy)。引擎在门上盖章(core d.ts:
+     * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
+     *
+     * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
+     * **不许**据本键自铸第二张资格表 —— 那是同一语义面两个写者(源头修复纪律),与
+     * `denialLimitFallback` 顶注那条「不据 autoDenyAfterMs 自铸第二只定时器」同一条禁令。
+     *
+     * 🔴 **不枚举词表**(`string` 而不是本仓自铸的联合):词表单一属主在 core,在这里抄一份会把 core 加的
+     * 新词吞成缺席 —— 与 `wiring_manifest.autoMode.reason` 的透传纪律逐字同规。缺席 = 老引擎 / 非 ask 路径。
+     *
+     * ⚠️ 与 {@link governanceForced} **不是**一回事,别互相顶替:本键答「哪一类权威提的问」,那一键答
+     * 「**本部署运维治理层**是不是这只 ask 的门」。`origin: "policy"` 覆盖的是「任何部署 ToolPolicy 的
+     * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
+     */
+    origin?: string;
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
      * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。

package/dist/tool-approval.js

@@ -837,6 +837,7 @@ export class ToolApprovalCoordinator {
             message: typeof req.message === "string" ? redactDeep(req.message) : "",
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(typeof req.origin === "string" && req.origin.length > 0 ? { origin: req.origin } : {}),
             ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
                 : {}),

package/dist/trace/core-keyset-guard.d.ts

@@ -28,7 +28,7 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
@@ -45,7 +45,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";

package/dist/trace/project.d.ts

@@ -97,6 +97,7 @@ export type TraceBlock = {
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
     resolution?: AskDenyResolution;
+    autoDenied?: true;
     approver?: string;
     gatedCallId?: string;
     eventId?: string;
@@ -142,6 +143,7 @@ export declare function toolEndEventData(ev: {
     errorCode?: string;
     settledBy?: ApprovalSettledBy;
     resolution?: AskDenyResolution;
+    autoDenied?: true;
     approver?: string;
     gatedCallId?: string;
     eventId?: string;
@@ -379,6 +381,29 @@ export declare function workspaceChangedEventData(ev: {
  *       抛)。账本回放/第三方 producer 送来的矛盾对若原样上 wire,按 `armed` 读与按 `reason` 读的消费端会得到
  *       **相反**的答案 —— 这条轴上(@cli `sema doctor permissions` 正读它)两个答案比没答案更坏 ⇒ 整段不铸。
  *       这不是改语义:它与本函数「畸形值一律按缺席」是同一条规则,而这条不变量是 core 自己写的段内契约。
+ *  · `mcp[]`(`WiringManifestMcpEntry[]`;core 7.5.0 [ref],S-124 提货件)—— **裁:租户可见,逐条目挑键,
+ *    `error` 一格不投**。
+ *    ① **同主体同受众**:它是 per-leg 的读面「我这条腿申报的每台 MCP 服务器,连上了没有、挂了是哪一类、
+ *       挂上来几个工具」。同一主体(调用方自己的 run)、同一条轴上,本仓早已把**更粗**的同类事实投给
+ *       租户:`GET /v1/sessions/:id/mcp` 的 `connected|failed` 二态。⚠️ 两者**不合并**、也不互相校验 ——
+ *       那条端点的真源是 server 自己的部署面台账(server 自铸的二态),本段的真源是 core 这条腿
+ *       materialize 的连接时快照;同名不同源,合并只会造出一个「哪个才算数」的新问题。
+ *    ② **值的形**:`name`(spec 声明名)/ `source`(声明方自述的层级标签,core 已 single-line + 长度封顶
+ *       逐字回显)/ `status`(三词闭集)/ `errorCode`(core `MCP_FAILURE_CODES` 十词闭集 + `http_<status>`)/
+ *       `toolCount`(有限数)—— 全是引擎或**声明方**产的闭形值,非用户内容 ⇒ 不脱敏、逐字。
+ *       ⚠️ `errorCode` **不是纯闭集**:十个具名词之外还有 `http_<status>` 形(core 自陈)⇒ 本仓既不枚举
+ *       那十个词、也不给它套形正则(词的单一属主在 core;抄一份会把 core 加的新词与新形一起吞成缺席),
+ *       只判非空串,消费端按具名词写的 switch 必须带 default 臂。
+ *    ③ 🔴 **`error` 有意不投**:它是本投影面上唯一的**远端作者自由文本**。判据与代价逐字在
+ *       `core-keyset-guard.ts` ⑥b 的 `WiringMcpExcluded` 一行(要点:进来会同时破本段「无自由文本 ⇒
+ *       不脱敏」的段内不变量,和 core 7.5.0 [ref] 把远端 MCP 错误文本秘密脱敏收敛成**一个**铸点的单铸律
+ *       —— server 再脱一遍就是同一语义面的第二个写者)。可操作的因由在 `errorCode`,那正是 core 为这条
+ *       消费面造闭集的理由。**带触发条件的裁定**,消费端提真需求时连同 bound/中和归属一起裁一次再翻。
+ *    ④ **不是 governance 侧信道**:五键描述的是本腿的 MCP 连接尝试,与 lockedConfig/compliance/
+ *       memoryAdmission/retention 四位无函数关系;core 自己也把它排除在 `configFingerprint` 之外
+ *       (「connection state is a fact about this leg's attempt, not about the assembly」)。
+ *    ⚠️ 空数组 ≠ 缺席:core 顶注逐字「an empty array is "this leg declared no servers", absence is an older
+ *       mint or an external derivation」⇒ 空数组照铸,别折成缺席。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
  * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
  * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格

package/dist/trace/project.js

@@ -96,6 +96,7 @@ export function toolEndEventData(ev) {
         ...(typeof ev.errorCode === "string" && ev.errorCode.length <= 128 ? { errorCode: ev.errorCode } : {}),
         ...(isApprovalSettledBy(ev.settledBy) ? { settledBy: ev.settledBy } : {}),
         ...(isAskDenyResolution(ev.resolution) ? { resolution: ev.resolution } : {}),
+        ...(ev.autoDenied === true ? { autoDenied: true } : {}),
         ...(typeof ev.approver === "string" && ev.approver !== "" ? { approver: redactSecrets(ev.approver) } : {}),
         ...(typeof ev.gatedCallId === "string" && ev.gatedCallId !== "" ? { gatedCallId: ev.gatedCallId } : {}),
         ...identityFields(ev),
@@ -269,6 +270,29 @@ export function wiringManifestEventData(ev) {
             return undefined;
         return armed === (reason === "armed") ? { armed, reason } : undefined;
     })();
+    const mcpIn = m.mcp;
+    const mcp = (() => {
+        if (!Array.isArray(mcpIn))
+            return undefined;
+        const rows = [];
+        for (const raw of mcpIn) {
+            const e = sec(raw);
+            if (e === undefined)
+                continue;
+            const name = str(e.name);
+            const status = str(e.status);
+            if (name === undefined || status === undefined)
+                continue;
+            rows.push({
+                name,
+                status,
+                ...(num(e.toolCount) !== undefined ? { toolCount: e.toolCount } : {}),
+                ...(str(e.source) !== undefined ? { source: e.source } : {}),
+                ...(str(e.errorCode) !== undefined ? { errorCode: e.errorCode } : {}),
+            });
+        }
+        return rows;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
@@ -282,6 +306,7 @@ export function wiringManifestEventData(ev) {
         ...(permissionRules !== undefined ? { permissionRules } : {}),
         ...(modelGate !== undefined ? { modelGate } : {}),
         ...(autoMode !== undefined ? { autoMode } : {}),
+        ...(mcp !== undefined ? { mcp } : {}),
         ...identityFields(ev),
     };
 }
@@ -432,6 +457,7 @@ export function toolResultFieldsOf(d) {
         ...(isApprovalSettledBy(d.settledBy) ? { settledBy: d.settledBy } : {}),
         ...(typeof d.approver === "string" && d.approver !== "" ? { approver: d.approver } : {}),
         ...(isAskDenyResolution(d.resolution) ? { resolution: d.resolution } : {}),
+        ...(d.autoDenied === true ? { autoDenied: true } : {}),
         ...(typeof d.gatedCallId === "string" && d.gatedCallId !== "" ? { gatedCallId: d.gatedCallId } : {}),
         ...identityFields(d),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.59.0",
+  "version": "7.60.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.4.0",
+    "@sema-agent/core": "7.5.0",
     "@sema-agent/settings-schema": "1.6.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",