@sema-agent/server 7.61.0 → 7.63.0

package/README.md

@@ -162,6 +162,8 @@ The server is configured entirely through environment variables. The most import
 | `DEFAULT_SCENARIO` | `code` | Default scenario when the request body names none |
 | `SANDBOX_PKG_SOURCE` | `global` | Package sources inside sandboxes: `global` (official upstreams) / `cn` (China mirrors) / `custom` / `none` |
 | `SENSITIVE_WRITE_PATTERNS` | core's recommended set | Sensitive-path write deny list; comma-separated value replaces the set, `off` **or an empty value** disables. Applied unconditionally at the governance layer (independent of client permission mode, lane or settings presence) — including on the `run-local` leg. A value that cannot compile into a guard set (e.g. `/`, a pattern with no path segment) refuses to start |
+| `WRITE_PROTECTED_EXTRA` | unset (engine default table) | **Adds** rows to core's write-protection table (the literal-name table whose hit demotes a surviving `allow` to `ask` on Write/Edit/NotebookEdit). Comma-separated bare names (a bare name matches ANY path segment; a name containing `/` matches a consecutive segment run) or a JSON array of `"name"` strings / `{name, kind}` rows (`kind`: `basename` \| `segment` \| `segment-run`). The value is composed as `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`, so **no default row can be lost**. Unset = no seat is wired = the engine's default table is in force (this server never copies that table). Form discrimination is by content, not by first character: a value containing any JSON structural character (`[ ] { } "`) is parsed as JSON and **must** be a top-level array (a missing pair of brackets refuses to start instead of being split into junk bare names). An empty value, a malformed entry (glob metacharacter, unknown kind, kind/name mismatch) or setting this together with `WRITE_PROTECTED_TABLE_REPLACE` **refuses to start**. Read faces: `GET /v1/capabilities` → `writeProtection.{armed,rows,replaced}`; `GET /v1/diagnostics/wiring` → `writeProtection.{rows,source,droppedDefaultRows}` (operator-only) |
+| `WRITE_PROTECTED_TABLE_REPLACE` | unset (engine default table) | **Replaces the whole** write-protection table (core's seat is whole-table by contract). JSON array only — deliberately no comma shorthand, because a slipped bare string would swap 51 default rows for one. `[]` = the explicit "no write-protection table at all" posture. Replacing logs one **loud** boot line naming every default row you dropped (`write_protection_table_replaced`; the empty posture logs `write_protection_table_disabled`) — use `WRITE_PROTECTED_EXTRA` when you meant to ADD. Same refuse-to-start conditions as its sibling, plus: both knobs set = two writers on one surface = refuses to start |
 | `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → no gate, core's `off` default). This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
 | `PERMISSIONS_DISABLE_AUTO_MODE` | `false` | Local mirror of CC `permissions.disableAutoMode` — the **org deny** bit for `permissionMode:"auto"` (paired with core's intent-arming rule). **Tighten-only**: `true` folds every principal's `runtimeCaps.autoMode` to `false` (a center grant cannot flip it back); unset leaves caps untouched, so on a center-less box a shell asking for `auto` **arms** the classifier once the paired core (intent-arming rule "requested ∧ classifier seat ∧ `autoMode !== false`" — absence is not a deny) is installed; on core 7.2.0 the engine still uses the old "org grant" rule (`permissionModeAuto.intentArming:false`), so the self-check answers `armed:true` only for a center-granted principal and `deployment_incapable` on a center-less box. Boolean word table; any other value refuses to start. Self-check: `GET /v1/capabilities?permissionMode=auto` → `permissionModeAuto.{armed, reason, model}` (USAGE §9.4) |
 | `SCRATCHPAD_SWEEP_TTL_MS` | 7 days | Idle-reap window for per-session scratchpad dirs (by dir mtime; `0` disables). The scratchpad is **ephemeral by contract**: replica-local disk, NOT part of the durable-suspend persistence set — a resume on a different replica, or after a sweep, starts with an empty dir (same two-track posture as the Agent SDK hosting doc: conversation persists, working-directory artifacts don't). Raise/disable only on single-replica deployments that park approvals for longer than the window |

package/README.zh-CN.md

@@ -148,6 +148,8 @@ curl -s localhost:8090/v1/tasks -H "Authorization: Bearer <SERVICE_AUTH_TOKEN>"
 | `DEFAULT_SCENARIO` | `code` | 请求体未指定场景时的缺省场景 |
 | `SANDBOX_PKG_SOURCE` | `global` | 沙箱内装包源:`global`(官方源)/ `cn`(国内镜像)/ `custom` / `none` |
 | `SENSITIVE_WRITE_PATTERNS` | core 推荐集 | 敏感路径写拒集;逗号分隔值为整体替换,`off` **或留空**关闭。在治理层无条件施加(与客户端权限模式/lane/settings 在场性无关),`run-local` 腿同样生效;编译不出守卫集的值(如 `/`)启动即拒 |
+| `WRITE_PROTECTED_EXTRA` | 未设(引擎缺省表) | 给 core 的**写保护名表**加行(字面名表:命中即把幸存的 `allow` 降级成 `ask`,作用于 Write/Edit/NotebookEdit)。逗号分隔裸名(裸名匹配**任意路径段**,含 `/` 的名匹配连续段)或 JSON 数组(`"name"` 串 / `{name, kind}` 行,`kind`:`basename` \| `segment` \| `segment-run`)。值按 `[...core 缺省表, …]` 组合,**丢不掉任何缺省行**。未设 = 不铸座 = 引擎缺省表在岗(本仓从不复制那张表)。两形按**内容**判而不是猜首字符:值里出现 JSON 结构字符(`[ ] { } "`)即按 JSON 解析,且顶层**必须是数组**(少写一对方括号 ⇒ 拒启,而不是被拆成垃圾裸名静默收下)。空值 / 坏值(通配符、未知 kind、kind 与名字段数矛盾)/ 与 `WRITE_PROTECTED_TABLE_REPLACE` 同时设置 ⇒ **启动即拒**。读面:`GET /v1/capabilities` 的 `writeProtection.{armed,rows,replaced}`;`GET /v1/diagnostics/wiring` 的 `writeProtection.{rows,source,droppedDefaultRows}`(operator-only) |
+| `WRITE_PROTECTED_TABLE_REPLACE` | 未设(引擎缺省表) | **整表替换**写保护名表(core 的座按契约就是整表)。只收 JSON 数组 —— 刻意不给逗号简写:一个手滑的裸串会把 51 行换成 1 行。`[]` = 显式「完全不要这张表」。替换时 boot 期发一条**响亮**日志逐名列出被丢的缺省行(`write_protection_table_replaced`;空表走 `write_protection_table_disabled`)—— 想「加两行」请用 `WRITE_PROTECTED_EXTRA`。拒启条件同姊妹键,外加:两根同写 = 一条语义面两个写者 ⇒ 拒启 |
 | `MODEL_CONNECT_TIMEOUT_MS` | `30000` | 网关连接超时 |
 | `MODEL_FIRST_TOKEN_TIMEOUT_MS` | `120000` | 首 token 超时 |
 | `MODEL_IDLE_TIMEOUT_MS` | `300000` | 流中 idle 超时(`0` 关) |

package/USAGE.md

@@ -563,6 +563,37 @@ UNATTENDED_APPROVAL_POLICY=park
   不是 server 的 ask 行,「有 durable 设施但没开协议」正是 R-13 要救的那类部署)。要回到旧的「窗满即拒」
   就配 `UNATTENDED_APPROVAL_POLICY=deny`。
 
+**可选 — 写保护名表(S-138;缺席=引擎缺省表在岗)**
+
+```bash
+WRITE_PROTECTED_EXTRA=.corp-deploy-key,team/secrets      # 加法:[...引擎缺省表, 这两行]
+WRITE_PROTECTED_TABLE_REPLACE='[{"name":".envrc","kind":"basename"}]'   # 整表替换(与上一根互斥)
+```
+- **这是什么**:core 的**字面名表**写保护 —— 一次落在表行上的可定路径写(Write/Edit/NotebookEdit)会把
+  幸存的 `allow` 降级成 `ask`(拒/问的裁决不受影响)。表的缺省内容是 CC 的
+  `DANGEROUS_FILES`/`DANGEROUS_DIRECTORIES`/`DANGEROUS_DIRECTORY_PATHS` 三形 + 两行 sema 自有行。
+  匹配是**字面**的(`kind`:`basename` = 末段同名 / `segment` = 任意路径段同名 / `segment-run` = 连续段序列),
+  裸名简写 = `segment`(更宽的那一档),含 `/` 的裸名 = `segment-run`。
+- **两根旋钮按意图分家**:core 的座是**整表替换**,所以「我想再保护两个文件」只能走 `WRITE_PROTECTED_EXTRA`
+  (它组合成 `[...缺省表, …]`,结构上丢不掉缺省行);真要换整张表才用 `WRITE_PROTECTED_TABLE_REPLACE`
+  (只收 JSON;`[]` = 显式「完全不要这张表」)。**两根同写 = 拒启**(一条语义面不许两个写者)。
+- **两形怎么判**:值里出现 JSON 结构字符(`[` `]` `{` `}` `"`)⇒ 当 JSON 判 —— 解析失败或顶层不是**数组**
+  一律拒启(`WRITE_PROTECTED_EXTRA='{"name":".x","kind":"basename"}'` 这种少写一对方括号的写法会被当场拒,
+  而不是被拆成两个垃圾裸名静默收下);否则走逗号裸名表。真有名字带引号/花括号的文件 ⇒ 走 JSON 形。
+- **响亮**:整表替换在 boot 期发一条日志**逐名**列出被丢的缺省行(`write_protection_table_replaced`),
+  `[]` 发 `write_protection_table_disabled`。空值 / 坏值(通配符、未知 kind、kind 与名字段数矛盾)一律
+  **启动期拒**,文案带引擎原话 + 出问题的 env 名。
+- **缺席 ≠ 没装**:不设这两根 ⇒ 座不铸 ⇒ **引擎的缺省表在岗**(server 不复制那张表)。要确认这台机器上
+  它到底在不在,读**读面**而不是猜:
+  - 租户面 `GET /v1/capabilities` → `writeProtection: {armed, rows, replaced}`(只给计数,不给行名);
+  - operator 面 `GET /v1/diagnostics/wiring` → `writeProtection: {rows[], source, droppedDefaultRows?}`
+    (`source`:`default` / `extra` / `replace` / `off`;逐行内容只在这一面)。
+- **与 `SENSITIVE_WRITE_PATTERNS` 并列、不合流**:那一根是**模式**(正则/glob)型 DENY 集,这一根是
+  字面名表的 `allow → ask` 降级。两套互不覆盖,读面也分开报 —— 一条路径被哪一套拦住,是两个不同的问题
+  (解法一个是改模式、一个是改名表)。
+- **leader 车道同席**:与其余部署姿态席同一个取值点(`buildDeploymentPostureSeats`),主 runner / subRunner /
+  run-local / leader 五只 Runner 同表。
+
 **可选 — READ 面姿态(readFace,7.18.0 起;缺席=引擎当家)**
 
 ```bash

package/dist/boot/runner-deps.d.ts

@@ -154,7 +154,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -260,7 +260,7 @@ export declare function createEngineNoticeSeat(logger: {
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */
-export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type DeploymentPostureSeats = Pick<RunnerDeps, "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths">;
 export declare function buildDeploymentPostureSeats(config: Pick<ServiceConfig, keyof DeploymentPostureSeats>): DeploymentPostureSeats;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;

package/dist/boot/runner-deps.js

@@ -46,6 +46,7 @@ export function buildDeploymentPostureSeats(config) {
         delegationEntryCaps: config.delegationEntryCaps ?? undefined,
         crossSessionInbound: Object.keys(crossSessionLayers).length > 0 ? crossSessionLayers : undefined,
         crossSessionDialogExpiry: crossSessionDialogExpiryOf(config),
+        writeProtectedPaths: config.writeProtectedPaths?.entries,
     };
     return seats;
 }

package/dist/config-catalog.js

@@ -440,6 +440,8 @@ export const CONFIG_CATALOG = [
     r("WORKTREE_BASE_COMMIT", "orchestration", "string", "worktree 基准 ref(缺省 core HEAD)"),
     r("WORKTREE_ISOLATION_ENABLED", "orchestration", "boolean", "git-worktree 隔离(与 REPO_ROOT 同在才开,半配保持 OFF)", { staticDefault: "false", danger: SEC }),
     r("WORKTREE_REPO_ROOT", "orchestration", "path", "worktree 隔离的受信 base repo"),
+    r("WRITE_PROTECTED_EXTRA", "approval", "csv", "写保护名表的**加法**(逗号裸名或 JSON [{name,kind}];组合 [...core 缺省表, …];空值拒启)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸座,core 缺省表(51 行)在岗" }),
+    r("WRITE_PROTECTED_TABLE_REPLACE", "approval", "json", "写保护名表的**整表替换**(JSON 数组;[]=显式无表;boot 期 loud 列出被丢的缺省行)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 不铸座,core 缺省表在岗;与 WRITE_PROTECTED_EXTRA 同写 ⇒ 拒启" }),
 ];
 function primitiveConfigValue(config, key) {
     const v = Reflect.get(config, key);

package/dist/config-center/skills-mcp.js

@@ -1,3 +1,4 @@
+import { readMcpSourceLabel } from "../mcp-source-label.js";
 import { skillContentHash } from "@sema-agent/settings-schema";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
 import { fetchSkillContent } from "./http-client.js";
@@ -95,13 +96,14 @@ export function resolveMcpServers(mcp, logger) {
                     note: "declaration DROPPED — this server's tools keep the pre-378 default (external content, session gets marked). Fix the center entry; the server itself still mounts.",
                 });
         }
+        const source = readMcpSourceLabel(s.name, s.source);
         if (s.transport.kind === "stdio") {
             const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
             if (env === null)
                 continue;
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin },
+                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source },
             });
         }
         else {
@@ -110,7 +112,7 @@ export function resolveMcpServers(mcp, logger) {
                 continue;
             out.push({
                 scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin },
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit, ...contentOrigin, ...source },
             });
         }
     }

package/dist/config-center/types.d.ts

@@ -113,6 +113,9 @@ export interface CenterMcpServer {
      * 自动翻红逼销账。
      */
     contentOrigin?: ToolContentOrigin;
+    /** B-036 / S-143:声明方自述的分组标签(开集,非空 ≤80;settings-schema 1.7.0 `McpServerSpec.source`)——上 core
+     *  `McpServerSpec.source`,由 `wiring_manifest.mcp[].source` 逐字回显。显示用,不进信任轴。 */
+    source?: string;
     transport: {
         kind: "stdio";
         command: string;

package/dist/config-provider.js

@@ -1,3 +1,4 @@
+import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
@@ -142,6 +143,7 @@ export function mapToServiceEffective(eff, version) {
                     ...(s.allowTools !== undefined ? { allowTools: s.allowTools } : {}),
                     ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
                     ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
+                    ...readMcpSourceLabel(s.name, s.source),
                 };
                 if (s.transport.kind === "stdio") {
                     return {

package/dist/config-types.d.ts

@@ -6,7 +6,7 @@
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
 import type { SealedKeyPoison } from "./sealed-key.js";
-import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
+import type { A2aServerSpec, CompliancePosture, CrossSessionDialogExpiry, CrossSessionInboundSetting, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy, WriteProtectedEntry } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
 import type { QuestionThrottle } from "./question.js";
@@ -1268,6 +1268,31 @@ export interface ServiceConfigFlat {
      *  已收口:守卫按 `ToolCallRequest.cwd` 解析写目标,两条 lane 同得。剩余射程边界(引擎未盖戳的直接
      *  调用形)成文在 `deployment-governance.ts` 的 `RelativeTargetLexicalEnv` 类注。 */
     sensitiveWritePatterns: string[];
+    /**
+     * S-138 —— core **写保护名表**(`RunnerDeps.writeProtectedPaths` 座)的部署决定。两根 env 旋钮
+     * 共铸这**一个**键(它们写的是同一条语义面,两根同写 ⇒ boot 拒启,见 config.ts 的解析点):
+     *  · `WRITE_PROTECTED_EXTRA` ⇒ `{knob:"extra", entries:[...WRITE_PROTECTED_DEFAULT_TABLE, …增量]}`;
+     *  · `WRITE_PROTECTED_TABLE_REPLACE` ⇒ `{knob:"replace", entries:<JSON 数组原样>}`(`[]` = 显式无表)。
+     *
+     * 🔴 **缺席 = 不铸键**(与 `readFace` 族同律):座缺席时 core 的 `resolveWriteProtectedTable` 返回它
+     * 自己的缺省 51 行 —— 本仓**不复制那张表**,上游改表之日起不会有第二份真源。「缺席 = 没装表」是
+     * B-023 F2 的那个误读,读面(`writeProtection` 两位)正是为了让它不可能再发生。
+     *
+     * 🔴 为什么带 `knob` 而不是只存数组:`extra` 与 `replace` 铸出的 `entries` 在**值**上分不出来
+     * (一份 `[...DEFAULT, 两行]` 既可能是加法、也可能是运维手抄的整表),而两者对运维的意义相反 ——
+     * 读面的 `source`/`replaced` 要回答的正是「运维动没动那张表」。从值反推 = 猜,故意存事实。
+     * 座席(纯数组)由 `buildDeploymentPostureSeats` 从本键**派生**(`crossSessionInbound` 同族形制:
+     * config 存决定、座席存引擎形)。
+     *
+     * ⚠️ 与 {@link sensitiveWritePatterns} 是**并列机制、不互相覆盖**(core d.ts 原话):那一套是模式
+     * (正则/glob)型 deny,这一套是字面名表的 `allow → ask` 降级。两个读面因此分开报。
+     */
+    writeProtectedPaths?: {
+        /** 哪根旋钮写的(闭集;读面 `source` / `replaced` 的唯一判据 —— 不从 entries 的值反推)。 */
+        readonly knob: "extra" | "replace";
+        /** 座席原样递给 core 的表项(裸名简写或 `{name,kind}` 行;坏值在 boot 期由 core 响亮拒)。 */
+        readonly entries: readonly WriteProtectedEntry[];
+    };
     /** [ref]§四 opt-in (cli[ref]② finding, core[ref] suggested mechanism): the CC manual-family permission
      *  modes (default/auto/acceptEdits) gate every fs WRITE hand tool (Write/Edit/NotebookEdit) but never touched
      *  Bash — a model can `echo -n '…' > file` straight past the write-approval card. `MANUAL_MODE_SHELL_GATE`
@@ -1638,7 +1663,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate" | "permissionsDisableAutoMode" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -10,6 +10,7 @@ import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
+import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
@@ -414,6 +415,85 @@ function assertReadDenyBuiltinsResolvable(tiers, exclude) {
     if (exclude !== undefined)
         check("READ_DENY_BUILTIN_EXCLUDE", { ...(tiers !== undefined ? { tiers } : {}), exclude });
 }
+const WRITE_PROTECTED_JSON_SHAPED = /[[\]{}"]/;
+function writeProtectedTableOrRefuse(name, raw, opts) {
+    const trimmed = raw.trim();
+    if (trimmed === "") {
+        throw new Error(`env ${name}="" is empty — refusing to start rather than guessing which of the two meanings you wanted. ` +
+            `An unexpanded compose variable and a deliberate posture must not look alike on a protection knob: unset the variable to keep the engine's default table, ` +
+            `or write WRITE_PROTECTED_TABLE_REPLACE=[] for the explicit "no write-protection table at all" posture.`);
+    }
+    let list;
+    if (WRITE_PROTECTED_JSON_SHAPED.test(trimmed)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (e) {
+            throw new Error(`env ${name} is not valid JSON: ${e instanceof Error ? e.message : String(e)} — expected a JSON ARRAY of "name" strings or {name, kind} rows.`);
+        }
+        if (!Array.isArray(parsed)) {
+            throw new Error(`env ${name} must be a JSON ARRAY of "name" strings or {name, kind} rows — got ${typeof parsed === "object" && parsed !== null ? "a JSON object" : `the JSON scalar ${JSON.stringify(parsed)}`}. ` +
+                `A single row still needs its brackets: [${trimmed}].`);
+        }
+        list = parsed;
+    }
+    else if (!opts.bareNames) {
+        throw new Error(`env ${name} must be a JSON array — the whole-table REPLACEMENT knob deliberately has no comma shorthand: ` +
+            `a slipped bare string there would swap the engine's whole table for one row. Write ["${trimmed.split(",")[0].trim()}"] if that is really what you mean, ` +
+            `or use WRITE_PROTECTED_EXTRA to ADD rows to the default table.`);
+    }
+    else {
+        const parts = trimmed.split(",").map((s) => s.trim());
+        const names = parts.filter((s) => s.length > 0);
+        if (names.length !== parts.length)
+            throw new Error(`env ${name}="${raw}" has an empty entry between commas — refusing to start rather than silently applying a half-parsed list (#157).`);
+        list = names;
+    }
+    try {
+        return resolveWriteProtectedTable([...(opts.prefix ?? []), ...list]);
+    }
+    catch (e) {
+        throw new Error(`env ${name}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+function parseWriteProtectedTableEnv(extraRaw, replaceRaw) {
+    if (extraRaw !== undefined && replaceRaw !== undefined) {
+        throw new Error(`env WRITE_PROTECTED_EXTRA and WRITE_PROTECTED_TABLE_REPLACE are both set — two writers on ONE semantic surface (the engine's write-protection table). ` +
+            `There is no honest composition of "add to the default table" and "replace the table wholesale", so this refuses to boot instead of picking one: ` +
+            `keep WRITE_PROTECTED_EXTRA for additions, or fold your additions into WRITE_PROTECTED_TABLE_REPLACE and unset the other.`);
+    }
+    if (extraRaw !== undefined) {
+        return { knob: "extra", entries: writeProtectedTableOrRefuse("WRITE_PROTECTED_EXTRA", extraRaw, { bareNames: true, prefix: WRITE_PROTECTED_DEFAULT_TABLE }) };
+    }
+    if (replaceRaw === undefined)
+        return undefined;
+    const decision = { knob: "replace", entries: writeProtectedTableOrRefuse("WRITE_PROTECTED_TABLE_REPLACE", replaceRaw, { bareNames: false }) };
+    const posture = buildWriteProtectionPosture({ writeProtectedPaths: decision });
+    const dropped = posture.droppedDefaultRows ?? [];
+    CONFIG_NOTICES.push(posture.source === "off"
+        ? {
+            event: "write_protection_table_disabled",
+            fields: {
+                env: "WRITE_PROTECTED_TABLE_REPLACE",
+                raw: "[]",
+                droppedCount: String(dropped.length),
+                effect: `the engine's write-protection table is now EMPTY — all ${String(dropped.length)} default rows are gone and a write to any of them ` +
+                    `(.zshrc / .ssh / .git / …) no longer gets the allow→ask demotion. This is a legal, explicit posture; it is logged loudly so it can never be a silent one`,
+            },
+        }
+        : {
+            event: "write_protection_table_replaced",
+            fields: {
+                env: "WRITE_PROTECTED_TABLE_REPLACE",
+                rows: String(posture.rows.length),
+                droppedCount: String(dropped.length),
+                droppedDefaultRows: dropped.join(","),
+                effect: "whole-table replacement: the default rows listed above are NO LONGER protected (use WRITE_PROTECTED_EXTRA if you meant to ADD rows to the default table)",
+            },
+        });
+    return decision;
+}
 function enumEnv(name, fallback, allowed) {
     const v = (process.env[name] ?? fallback);
     if (!allowed.includes(v))
@@ -966,6 +1046,7 @@ function parseApprovalDomain(ctx) {
                 return [];
             return trimmed.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
         })(process.env.SENSITIVE_WRITE_PATTERNS),
+        ...((decision) => (decision === undefined ? {} : { writeProtectedPaths: decision }))(parseWriteProtectedTableEnv(process.env.WRITE_PROTECTED_EXTRA, process.env.WRITE_PROTECTED_TABLE_REPLACE)),
         ...((raw) => {
             const trimmed = (raw ?? "").trim();
             if (trimmed === "always" || trimmed === "classify")
@@ -1803,7 +1884,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
+    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/http/principal-gate.d.ts

@@ -11,6 +11,15 @@ export declare function systemFor(req: IncomingMessage, config: ServiceConfig):
 /** "presented credentials must verify":Authorization 带 Bearer/token scheme 且三路全验不过 → true。
  *  其他 scheme(Basic 等,非我方凭证空间)不管——由原有门语义处置,避免误伤未知代理注头。 */
 export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
+/** loopback 三形(IPv4 / IPv6 / IPv4-mapped)—— 一处定义,diagnostics 门与任何「本机自用」判据同吃。缺席 ⇒ false(fail-closed)。 */
+export declare function isLoopbackAddress(addr: string | undefined): boolean;
+/**
+ * 这次请求的身份是不是**密码学验过**的(而不是调用方自述的 header):`sso` = registry JWT(入口预认证的签名真源)/
+ * `direct_door_jwt` = direct-door principal JWT 验过 / `service_token` = 出示了单一或 per-system service token。
+ * 缺席 = 只有自述头或什么都没有。一处判定(7.63.0 codex [high]+[medium]):off-box 读 operator 面的门用它——名单只在
+ * 有可验身份时才是身份,零凭据下它只是谁都能写的字符串;而 JWT 身份不依赖静态 token 的在场。
+ */
+export declare function verifiedIdentitySource(req: IncomingMessage, config: ServiceConfig): "sso" | "direct_door_jwt" | "service_token" | undefined;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
  *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty

package/dist/http/principal-gate.js

@@ -33,6 +33,18 @@ export function bearerPresentedButUnverified(req, config) {
         return false;
     return true;
 }
+export function isLoopbackAddress(addr) {
+    return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+export function verifiedIdentitySource(req, config) {
+    if (ssoVerifiedPrincipal(req))
+        return "sso";
+    if (systemFor(req, config) !== undefined)
+        return "service_token";
+    if (config.directDoorActive && verifiedPrincipal(req, config) !== undefined)
+        return "direct_door_jwt";
+    return undefined;
+}
 export function gatedPrincipal(req, config) {
     if (bearerPresentedButUnverified(req, config))
         return undefined;

package/dist/http/routes/capabilities.js

@@ -9,6 +9,7 @@ import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
+import { projectWriteProtectionCapability } from "../../write-protection.js";
 import { projectSqlEngineCapability } from "../../sql-engine-posture.js";
 import { workflowModelAllowlistFor, selfOrchestrationDenial } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
@@ -114,6 +115,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
                 ...autoMode,
             },
             readFace: deps.config.readFace ?? null,
+            writeProtection: projectWriteProtectionCapability(deps.writeProtection),
             appendSystemPrompt: true,
             compactionModel: true,
             subagentOutput: Boolean(deps.subagentTaskOutput) && Boolean(deps.runStore),

package/dist/http/routes/diagnostics.js

@@ -1,6 +1,6 @@
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, verifiedIdentitySource } from "../principal-gate.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
@@ -56,9 +56,7 @@ export function zeroCredentialLoopbackDenied(remoteAddress, config) {
     const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
     if (anyServiceAuth)
         return false;
-    const addr = remoteAddress ?? "";
-    const isLoopback = addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
-    return !isLoopback;
+    return !isLoopbackAddress(remoteAddress);
 }
 export async function handleDiagnostics(req, res, url, ctx) {
     const miss = { fell: false };
@@ -74,6 +72,10 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
                 sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only on a multi-tenant worker");
                 return;
             }
+            if (!isLoopbackAddress(req.socket.remoteAddress) && verifiedIdentitySource(req, deps.config) === undefined) {
+                sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
+                return;
+            }
         }
         else if (zeroCredentialLoopbackDenied(req.socket.remoteAddress, deps.config)) {
             sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
@@ -87,6 +89,7 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
             static: deps.staticWiring,
             memoryPosture: deps.memoryPosture ?? null,
             sqlEngine: deps.sqlEngineFacts?.() ?? null,
+            writeProtection: deps.writeProtection ?? null,
             configApply: deps.configApplyState?.() ?? null,
             mcpRevocations: deps.mcpRevocationState?.() ?? null,
             serverGates: buildServerWiringGates({

package/dist/http/server.d.ts

@@ -660,6 +660,13 @@ export interface ServiceDeploymentDeps {
      *  的 `sql` 位(窄投影)。getter 而不是快照:池重连后驱动会重新初始化并刷新事实,快照会说谎。
      *  缺席 / 返回 null = 本部署没有 SQL 后端(env-only worker、local 文件后端)—— 诚实缺席,不铸空壳。 */
     sqlEngineFacts?: () => import("../plugins/sql-driver.js").SqlEngineFacts | null;
+    /** S-138:**写保护名表**的姿态(`write-protection.ts` 的 boot 期单一推导点 —— 与递给每只 Runner 的
+     *  `writeProtectedPaths` 座同一份 config 决定)。两个读面共用:`GET /v1/diagnostics/wiring` 的
+     *  `writeProtection` 段(operator-only,**逐行**表 + 来源 + 被丢的缺省行名)与 `GET /v1/capabilities`
+     *  的 `writeProtection` 位(窄投影 `{armed, rows, replaced}`,**不含行内容**)。
+     *  boot 期算一次的**存活对象**(纯 config 派生,运行期不变;core 座没有热改腿)。
+     *  缺席 = 这个进程不是由 composition root 装起来的(测试夹具形)⇒ 诊断面报 null、能力位报 null。 */
+    writeProtection?: import("../write-protection.js").WriteProtectionPosture;
     /** ① core ruling — SPLIT: `capabilities.workflows` = the ENGINE-CAN axis, boot-computed from core's own
      *  `workflowsCapability(deps)` (hardened script runner ∧ governance), NOT the `Boolean(workflowRunStore)` store
      *  proxy. Orthogonal to `workflowsList` (the durable-list axis = `workflowRunStore`). Falls back to the store

package/dist/main.js

@@ -8,6 +8,7 @@ import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js
 import { subagentSendUserFileExtraTools } from "./capabilities/send-user-file-tool.js";
 import { brainSummary } from "./brain.js";
 import { loadConfig, logConfigDiagnostics, resolveBindHost, splitLocalRoots, parseCapEnv, parseNumOrFailNonNegative } from "./config.js";
+import { buildWriteProtectionPosture } from "./write-protection.js";
 import { cardRuleScopeRoot } from "./task-cwd.js";
 import { isPricingConfigured } from "./budget.js";
 import { drainNumEnvWarnings } from "./plugins/remote-shell.js";
@@ -701,6 +702,7 @@ async function main() {
         staticWiring,
         memoryPosture,
         sqlEngineFacts,
+        writeProtection: buildWriteProtectionPosture(config),
         instanceId,
         capabilities: {
             version: serviceVersion(),

package/dist/mcp-source-label.d.ts

@@ -0,0 +1,11 @@
+/** 与 core `mcpManifestEntries` 的 `inlineUntrusted(entry.source, 80)` 同数。 */
+export declare const MCP_SOURCE_LABEL_MAX = 80;
+export declare function isMcpSourceLabel(v: unknown): v is string;
+/**
+ * 从任一腿的原始条目里读出 `source`:合法 ⇒ `{ source }`(可直接 spread 进 spec);缺席 ⇒ `{}`;坏形 ⇒ `{}` +
+ * 留痕(`server` 与值的形进 detail,不进值本身——标签是 UNTRUSTED-for-display 的自由文本)。
+ */
+export declare function readMcpSourceLabel(server: string, v: unknown): {
+    source?: string;
+};
+//# sourceMappingURL=mcp-source-label.d.ts.map

package/dist/mcp-source-label.js

@@ -0,0 +1,14 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+export const MCP_SOURCE_LABEL_MAX = 80;
+export function isMcpSourceLabel(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= MCP_SOURCE_LABEL_MAX;
+}
+export function readMcpSourceLabel(server, v) {
+    if (v === undefined)
+        return {};
+    if (isMcpSourceLabel(v))
+        return { source: v };
+    recordFailOpen("server.task-mcp.source-label-dropped", `${server}: ${typeof v === "string" ? (v.length === 0 ? "empty string" : `string of ${v.length} chars (> ${MCP_SOURCE_LABEL_MAX})`) : typeof v}`);
+    return {};
+}
+//# sourceMappingURL=mcp-source-label.js.map

package/dist/observability/fail-open.d.ts

@@ -9,6 +9,10 @@ export interface FailOpenTagEntry {
 }
 /** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
 export declare const FAIL_OPEN_TAGS: {
+    readonly "server.task-mcp.source-label-dropped": {
+        readonly cls: "F";
+        readonly note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。";
+    };
     readonly "server.memory-optout-grant.onfault-hook-threw": {
         readonly cls: "F";
         readonly note: "design/383 S-1(applyMemoryOptOutGrant):本地 grant 腿故障时的**披露钩子**(onFault → warn 日志)自己抛了。钩子只是观测面:吞掉它保住的是「resolver 不因一行日志失败而 reject」(那会把一条腿的故障扩成整车故障 —— core 的 resolver-throw 降级臂作废同一次解析里 center 已答好的 allowWorkflows/allowFork);代价是**那一行披露丢了**,而 `allowMemoryOptOut` 键缺席这件事本身不受影响(fail-closed/fail-safe 极性由 core 按姿态判)。本计数让「披露钩子一直在炸」显形。";

package/dist/observability/fail-open.js

@@ -1,5 +1,9 @@
 import { appendFileSync } from "node:fs";
 export const FAIL_OPEN_TAGS = {
+    "server.task-mcp.source-label-dropped": {
+        cls: "F",
+        note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。",
+    },
     "server.memory-optout-grant.onfault-hook-threw": {
         cls: "F",
         note: "design/383 S-1(applyMemoryOptOutGrant):本地 grant 腿故障时的**披露钩子**(onFault → warn 日志)自己抛了。钩子只是观测面:吞掉它保住的是「resolver 不因一行日志失败而 reject」(那会把一条腿的故障扩成整车故障 —— core 的 resolver-throw 降级臂作废同一次解析里 center 已答好的 allowWorkflows/allowFork);代价是**那一行披露丢了**,而 `allowMemoryOptOut` 键缺席这件事本身不受影响(fail-closed/fail-safe 极性由 core 按姿态判)。本计数让「披露钩子一直在炸」显形。",

package/dist/task-mcp.js

@@ -1,6 +1,7 @@
 import { resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
+import { readMcpSourceLabel } from "./mcp-source-label.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
@@ -77,6 +78,7 @@ function normalizeServer(e, noteBadOrigin) {
         else
             noteBadOrigin(spec.name, o.contentOrigin);
     }
+    Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
     return spec;
 }
 export function validateRequestMcp(raw) {

package/dist/write-protection.d.ts

@@ -0,0 +1,80 @@
+/**
+ * S-138 —— **写保护表**(core `RunnerDeps.writeProtectedPaths` 座)的姿态推导点(形制照
+ * `memory-posture.ts` / `sql-engine-posture.ts`:一次推导,两个读面)。
+ *
+ * ## 病(B-023 F2 的根)
+ *
+ * core 的写保护表是**字面名表**(CC `DANGEROUS_FILES` / `DANGEROUS_DIRECTORIES` /
+ * `DANGEROUS_DIRECTORY_PATHS` 三形对位):一次落在表行上的可定路径写(Write/Edit/NotebookEdit)会把
+ * 幸存的 `allow` 降级成 `ask`。座**缺席 = 缺省表在岗**(不是「没装」)。可是本仓此前没有任何读面能
+ * 回答「这台部署的写保护表在不在、有几行」—— 邻仓因此只能用「`writeProtectedPaths` 键名 grep 零命中」
+ * 去推断「表未装配」,推错了(座缺席正是缺省表在岗的姿势),而**读面缺席让这个错误无法被证否**。
+ *
+ * ## 药
+ *
+ * 一次推导,两个读面:
+ *  · operator 面(`GET /v1/diagnostics/wiring` 的 `writeProtection` 段)—— **逐行**表 + 来源 + 被丢的缺省行名;
+ *  · 租户面(`GET /v1/capabilities` 的 `writeProtection` 位)—— `{armed, rows, replaced}` 三项,**不含行内容**。
+ *
+ * ## 三条诚实纪律
+ *
+ * ① **表由 core 解析,本仓零重算**:`rows` 逐字来自 `compileWriteProtection().rows`(core 自己的
+ *    「disclosure face」),连行的**身份折叠**(大小写 + ı/ſ 两个易混字)都借 core 的
+ *    `resolveWriteProtectedTable` 去判(见 {@link defaultRowsMissingFrom})—— 本仓不铸第二套判定语义,
+ *    也**不复制缺省 51 行**(单一属主在 core;上游改表之日起本仓不会成为第二份真源)。
+ * ② **两项刻意不合成一个布尔**(`permissionModeAuto` 同判据):`armed`(表非空)与 `replaced`(整表
+ *    替换座被写)回答的是两件事 —— 一个「引擎会不会对这类路径弹卡」,一个「运维有没有动过那张表」。
+ *    合成之后,「缺省表在岗」与「运维自定义了一张同样非空的表」得到同一个 true,而壳/运维对这两种
+ *    要做的事不同。
+ * ③ **行内容只上 operator 面**:缺省 51 行是 CC 公开表(零增量信息),但**部署自定义行**可能含内部
+ *    路径名(`.corp-deploy-key` 之类)⇒ 逐行披露给租户面等于告诉想绕过的人「哪些名字不受保护」。
+ *
+ * ## 与 `SENSITIVE_WRITE_PATTERNS` 的关系(**并列,不合流**)
+ *
+ * 本仓另有一套**模式型**(正则/glob)写 deny 集(`createSensitivePathPolicy`,旋钮
+ * `SENSITIVE_WRITE_PATTERNS`,经 deployment-governance 无条件施加)。两套按 core 的 d.ts 是并列机制、
+ * 互不覆盖,所以两个读面**分开报**:合成一个 `writeProtected: true` 会让壳答不出「这条路径是被哪一套
+ * 拦的」,而两套的解法完全不同(一套改模式,一套改名表)。
+ */
+import { type WriteProtectedRow } from "@sema-agent/core";
+import type { ServiceConfig } from "./config-types.js";
+/** 表的来源(闭集;`switch` 穷尽 —— 新增词 = 编译红,[ref] 词表纪律)。 */
+export declare const WRITE_PROTECTION_SOURCES: readonly ["default", "extra", "replace", "off"];
+export type WriteProtectionSource = (typeof WRITE_PROTECTION_SOURCES)[number];
+/** operator 面(`GET /v1/diagnostics/wiring` 的 `writeProtection` 段)。 */
+export interface WriteProtectionPosture {
+    /** 生效表的**逐行**内容,逐字来自 core `compileWriteProtection().rows`(空 = 显式无表)。 */
+    readonly rows: readonly WriteProtectedRow[];
+    /** `default` = 两根旋钮都没写(引擎缺省表在岗);`extra` = 缺省表 + 增量;`replace` = 整表替换;
+     *  `off` = 整表替换成空表(合法但响亮的姿势)。 */
+    readonly source: WriteProtectionSource;
+    /** 整表替换**丢掉**的缺省行名(替换族才在场;`extra`/`default` 结构上丢不掉任何行)。 */
+    readonly droppedDefaultRows?: readonly string[];
+}
+/** 租户面窄投影(`GET /v1/capabilities` 的 `writeProtection` 位)。**不含行内容**(见顶注纪律③)。 */
+export interface WriteProtectionCapability {
+    /** 生效表非空 = 引擎真会对表行弹卡。 */
+    readonly armed: boolean;
+    /** 生效表的**行数**(内容不上租户面)。 */
+    readonly rows: number;
+    /** 整表替换座被写(缺省表不再原样在岗)。与 `armed` 刻意不合成(顶注纪律②)。 */
+    readonly replaced: boolean;
+}
+/** 本模块读的 config 面(取型而非重述 —— 键名/形永不与真配置漂)。 */
+export type WriteProtectionConfigView = Pick<ServiceConfig, "writeProtectedPaths">;
+/**
+ * boot 期算一次的姿态(纯函数、零 I/O)。**同一只解析器**:`rows` 是 core 编译判子时用的那份表,不是
+ * 本仓照着 config 又算了一遍的复述 —— 「诊断页说 51 行、引擎按 2 行判」在结构上不可能。
+ *
+ * `compileWriteProtection` 对**空表**返回 `undefined`(core 契约:没有表就不挂 tighten)⇒ 本函数把它
+ * 读成 `rows: []`,那是 `off` 姿势的诚实形,不是「读不出来」。
+ */
+export declare function buildWriteProtectionPosture(config: WriteProtectionConfigView): WriteProtectionPosture;
+/**
+ * operator 面 → 租户面的窄投影。
+ *
+ * `null` = **这个进程说不出来**(不是 composition root 装起来的测试夹具形)—— 与 `sql` / `memoryPosture`
+ * 两位同姿势:不铸一个看起来像答案的空壳(那会让壳把夹具形读成「本部署无表」)。
+ */
+export declare function projectWriteProtectionCapability(posture: WriteProtectionPosture | undefined): WriteProtectionCapability | null;
+//# sourceMappingURL=write-protection.d.ts.map

package/dist/write-protection.js

@@ -0,0 +1,30 @@
+import { WRITE_PROTECTED_DEFAULT_TABLE, compileWriteProtection, resolveWriteProtectedTable } from "@sema-agent/core";
+export const WRITE_PROTECTION_SOURCES = ["default", "extra", "replace", "off"];
+function defaultRowsMissingFrom(rows) {
+    return WRITE_PROTECTED_DEFAULT_TABLE.filter((row) => resolveWriteProtectedTable([...rows, row]).length !== rows.length).map((row) => row.name);
+}
+export function buildWriteProtectionPosture(config) {
+    const decision = config.writeProtectedPaths;
+    const rows = compileWriteProtection(decision?.entries)?.rows ?? [];
+    if (decision === undefined)
+        return { rows, source: "default" };
+    if (decision.knob === "extra")
+        return { rows, source: "extra" };
+    return { rows, source: rows.length === 0 ? "off" : "replace", droppedDefaultRows: defaultRowsMissingFrom(rows) };
+}
+export function projectWriteProtectionCapability(posture) {
+    if (posture === undefined)
+        return null;
+    return { armed: posture.rows.length > 0, rows: posture.rows.length, replaced: replacedOf(posture.source) };
+}
+function replacedOf(source) {
+    switch (source) {
+        case "default":
+        case "extra":
+            return false;
+        case "replace":
+        case "off":
+            return true;
+    }
+}
+//# sourceMappingURL=write-protection.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.61.0",
+  "version": "7.63.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.5.1",
-    "@sema-agent/settings-schema": "1.6.0",
+    "@sema-agent/core": "7.5.2",
+    "@sema-agent/settings-schema": "1.7.2",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",