@sema-agent/server 7.61.0 → 7.62.0

package/dist/config-center/skills-mcp.js

@@ -1,3 +1,4 @@
+import { readMcpSourceLabel } from "../mcp-source-label.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
 import { fetchSkillContent } from "./http-client.js";
@@ -95,13 +96,14 @@ export function resolveMcpServers(mcp, logger) {
                     note: "declaration DROPPED — this server's tools keep the pre-378 default (external content, session gets marked). Fix the center entry; the server itself still mounts.",
                 });
         }
+        const source = readMcpSourceLabel(s.name, s.source);
         if (s.transport.kind === "stdio") {
             const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
             if (env === null)
                 continue;
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin },
+                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source },
             });
         }
         else {
@@ -110,7 +112,7 @@ export function resolveMcpServers(mcp, logger) {
                 continue;
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin },
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source },
             });
         }
     }

package/dist/config-center/types.d.ts

@@ -113,6 +113,9 @@ export interface CenterMcpServer {
      * 自动翻红逼销账。
      */
     contentOrigin?: ToolContentOrigin;
+    /** B-036 / S-143:声明方自述的分组标签(开集,非空 ≤80;settings-schema 1.7.0 `McpServerSpec.source`)——上 core
+     *  `McpServerSpec.source`,由 `wiring_manifest.mcp[].source` 逐字回显。显示用,不进信任轴。 */
+    source?: string;
     transport: {
         kind: "stdio";
         command: string;

package/dist/config-provider.js

@@ -1,3 +1,4 @@
+import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
@@ -142,6 +143,7 @@ export function mapToServiceEffective(eff, version) {
                     ...(s.allowTools !== undefined ? { allowTools: s.allowTools } : {}),
                     ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
                     ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
+                    ...readMcpSourceLabel(s.name, s.source),
                 };
                 if (s.transport.kind === "stdio") {
                     return {

package/dist/mcp-source-label.d.ts

@@ -0,0 +1,11 @@
+/** 与 core `mcpManifestEntries` 的 `inlineUntrusted(entry.source, 80)` 同数。 */
+export declare const MCP_SOURCE_LABEL_MAX = 80;
+export declare function isMcpSourceLabel(v: unknown): v is string;
+/**
+ * 从任一腿的原始条目里读出 `source`:合法 ⇒ `{ source }`(可直接 spread 进 spec);缺席 ⇒ `{}`;坏形 ⇒ `{}` +
+ * 留痕(`server` 与值的形进 detail,不进值本身——标签是 UNTRUSTED-for-display 的自由文本)。
+ */
+export declare function readMcpSourceLabel(server: string, v: unknown): {
+    source?: string;
+};
+//# sourceMappingURL=mcp-source-label.d.ts.map

package/dist/mcp-source-label.js

@@ -0,0 +1,14 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+export const MCP_SOURCE_LABEL_MAX = 80;
+export function isMcpSourceLabel(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= MCP_SOURCE_LABEL_MAX;
+}
+export function readMcpSourceLabel(server, v) {
+    if (v === undefined)
+        return {};
+    if (isMcpSourceLabel(v))
+        return { source: v };
+    recordFailOpen("server.task-mcp.source-label-dropped", `${server}: ${typeof v === "string" ? (v.length === 0 ? "empty string" : `string of ${v.length} chars (> ${MCP_SOURCE_LABEL_MAX})`) : typeof v}`);
+    return {};
+}
+//# sourceMappingURL=mcp-source-label.js.map

package/dist/observability/fail-open.d.ts

@@ -9,6 +9,10 @@ export interface FailOpenTagEntry {
 }
 /** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
 export declare const FAIL_OPEN_TAGS: {
+    readonly "server.task-mcp.source-label-dropped": {
+        readonly cls: "F";
+        readonly note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。";
+    };
     readonly "server.memory-optout-grant.onfault-hook-threw": {
         readonly cls: "F";
         readonly note: "design/383 S-1(applyMemoryOptOutGrant):本地 grant 腿故障时的**披露钩子**(onFault → warn 日志)自己抛了。钩子只是观测面:吞掉它保住的是「resolver 不因一行日志失败而 reject」(那会把一条腿的故障扩成整车故障 —— core 的 resolver-throw 降级臂作废同一次解析里 center 已答好的 allowWorkflows/allowFork);代价是**那一行披露丢了**,而 `allowMemoryOptOut` 键缺席这件事本身不受影响(fail-closed/fail-safe 极性由 core 按姿态判)。本计数让「披露钩子一直在炸」显形。";

package/dist/observability/fail-open.js

@@ -1,5 +1,9 @@
 import { appendFileSync } from "node:fs";
 export const FAIL_OPEN_TAGS = {
+    "server.task-mcp.source-label-dropped": {
+        cls: "F",
+        note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。",
+    },
     "server.memory-optout-grant.onfault-hook-threw": {
         cls: "F",
         note: "design/383 S-1(applyMemoryOptOutGrant):本地 grant 腿故障时的**披露钩子**(onFault → warn 日志)自己抛了。钩子只是观测面:吞掉它保住的是「resolver 不因一行日志失败而 reject」(那会把一条腿的故障扩成整车故障 —— core 的 resolver-throw 降级臂作废同一次解析里 center 已答好的 allowWorkflows/allowFork);代价是**那一行披露丢了**,而 `allowMemoryOptOut` 键缺席这件事本身不受影响(fail-closed/fail-safe 极性由 core 按姿态判)。本计数让「披露钩子一直在炸」显形。",

package/dist/task-mcp.js

@@ -1,6 +1,7 @@
 import { resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
+import { readMcpSourceLabel } from "./mcp-source-label.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
@@ -77,6 +78,7 @@ function normalizeServer(e, noteBadOrigin) {
         else
             noteBadOrigin(spec.name, o.contentOrigin);
     }
+    Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
     return spec;
 }
 export function validateRequestMcp(raw) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.61.0",
+  "version": "7.62.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.5.1",
-    "@sema-agent/settings-schema": "1.6.0",
+    "@sema-agent/core": "7.5.2",
+    "@sema-agent/settings-schema": "1.7.1",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",