@sema-agent/server 7.64.0 → 7.66.0

package/dist/plugins/local-checkpoint-store.d.ts

@@ -1,4 +1,4 @@
-import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ExecutionOutcomeRecordWord, type GateOutcome, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
 import { type DecidedApprovalRecord, type PendingCheckpoint, type PendingRowBinding } from "./checkpoint-store-sql.js";
 export interface LocalCheckpointStoreOptions {
     /** taskId join for the pending card (the local FileRunStore's `getActiveTaskId`). Absent ⇒ `taskId: null`. */
@@ -40,6 +40,20 @@ export declare class LocalCheckpointStore {
     readonly redecision: {
         readonly reopen: true;
     };
+    /**
+     * `CheckpointStore.execution` 声明(core 7.7.0 [ref];S-160)——**必填**,与上面三格同一条判据:**如实
+     * 按内核判**。内核 core `FileCheckpointStore` 自己声明 `{ outcome: true }`,并把执行记录落成 ledger 的
+     * 一个新事件种类(`execution`,与 resolve 同款「先 append+fsync 再翻内存」的崩溃序),
+     * {@link LocalCheckpointStore.recordExecutionOutcome} 与 {@link LocalCheckpointStore.reopen} 都是纯委派
+     * ⇒ 抄内核的读数是诚实的。包装类**不继承**被包装者的声明(委派不是子类),所以这一格必须自己写。
+     *
+     * ⚠️ 升级序的诚实披露(DEPLOY-PREREQS 同句):ledger 里一旦出现 `execution` 事件,**7.7.0 之前的
+     * binary 会拒绝重放这个目录**(响亮,不是静默跳过);而压缩把事件折进快照行之后,那个旧 binary 读到
+     * 一个它不认识的字段、且它的 `reopen` 不认这条记录 —— 跨记录行回滚不受支持。
+     */
+    readonly execution: {
+        readonly outcome: true;
+    };
     private readonly inner;
     private readonly scopesPath;
     private readonly sessionTokensPath;
@@ -63,6 +77,10 @@ export declare class LocalCheckpointStore {
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
+    /** core 7.7.0 [ref](S-160):执行判词的 CAS —— 语义、四词、幂等的结构相等与冲突抛全在被包的内核里
+     *  (它自己走 core 的共享判词 `executionRecordDisposition`,ledger 事件 `execution` 是它的 commit 半场),
+     *  本 wrapper 只做转发。服务扩展面(运维队列/会话索引)与这条记录无关:它不改 status,也不新增可枚举行。 */
+    recordExecutionOutcome(token: CheckpointToken, scope: string, gate: GateOutcome): Promise<ExecutionOutcomeRecordWord>;
     /** core 5.14.0([ref]):入参是 `PendingSteerInput`(text/trusted + 可选 actor/inputId/priority),不是
      *  两键单座 —— 形参窄成 `{text,trusted}` 会**静默丢掉**署名与幂等键(TS 的方法参数是双变的,窄形不
      *  报错,只是把三个可选键从类型上抹掉,调用点再也传不进来)。队列语义与边界全在被包的 core

package/dist/plugins/local-checkpoint-store.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isApprovalGateKind } from "../tool-approval.js";
-import { FileCheckpointStore, atomicWriteFile, sanitizePathComponent, } from "@sema-agent/core";
+import { FileCheckpointStore, atomicWriteFile, executionVerdict, sanitizePathComponent, } from "@sema-agent/core";
 import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingRowPrecedes, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
 function terminalAtOf(cp) {
@@ -17,6 +17,7 @@ export class LocalCheckpointStore {
     durability = "durable";
     fidelity = "json";
     redecision = { reopen: true };
+    execution = { outcome: true };
     inner;
     scopesPath;
     sessionTokensPath;
@@ -95,6 +96,9 @@ export class LocalCheckpointStore {
     reopen(token, scope, reason) {
         return this.inner.reopen(token, scope, reason);
     }
+    recordExecutionOutcome(token, scope, gate) {
+        return this.inner.recordExecutionOutcome(token, scope, gate);
+    }
     setPendingSteer(token, scope, steer) {
         return this.inner.setPendingSteer(token, scope, steer);
     }
@@ -227,6 +231,7 @@ export class LocalCheckpointStore {
                 boundInputHash: pa?.boundInputHash ?? null,
                 decision: approvalDecisionOfWinner(cp.resolvedOutcome, boundCallId),
                 payloadFp: cp.resolvedOutcome === undefined ? null : approvalPayloadFingerprint(cp.resolvedOutcome),
+                ...((v) => ({ executionOutcome: v.kind === "executed" ? v.gate : null }))(executionVerdict(cp)),
             });
         }
         return out;

package/dist/plugins/pg-pool.js

@@ -95,6 +95,11 @@ export const PG_SCHEMA_STATEMENTS = [
      -- has_bidi_controls(S-30① / #356②):bidi 在场位,语义与「1 或 NULL、恒不写 0」见 MySQL 孪生同名列的
      -- 行内注。clay 批 TINYINT(1) 归一先例:PG 侧统一 SMALLINT。
      has_bidi_controls SMALLINT,
+     -- execution_outcome / execution_at_ms(S-160;core 7.7.0 #602):语义、两轴的分工、CAS 与冲突的
+     -- 「记录物理不可变」由来见 MySQL 孪生(tidb-pool.ts 同两列的行内注)。载荷是 core 的 GateOutcome
+     -- JSON ⇒ 与同表 outcome 列同取 JSONB(协议信封无损,IS NULL 谓词两方言同义)。
+     execution_outcome JSONB,
+     execution_at_ms   BIGINT,
      PRIMARY KEY (token)
    )`,
     `CREATE INDEX IF NOT EXISTS idx_checkpoint_status_deadline ON checkpoint (status, deadline)`,

package/dist/plugins/tidb-pool.js

@@ -266,6 +266,17 @@ export const SCHEMA_STATEMENTS = [
      -- (缺席 = 没检出 ≠ 干净),一个 0 会把「没检出」谎成「已确认干净」。老行(本列诞生前 park 的)
      -- NULL ⇒ 读口省键。clay 批 2026-07-26 TINYINT(1) 归一先例:布尔列 TiDB 侧 TINYINT(1)。
      has_bidi_controls TINYINT(1) NULL,
+     -- execution_outcome / execution_at_ms(S-160;core 7.7.0 #602 的耐久半场):**决定被怎么处置了**的
+     -- 结算记录 —— resume 腿上那次调用的 tool_end 帧携带的 GateOutcome,与 outcome 列(决定本身,不可变)
+     -- 是两个轴:一个人批了(outcome 里 disposition=allowed),部署自己的复核在 post-CAS 否了他改过的参数
+     -- (execution_outcome 里 denied/policy)—— 流断了之后从行重建这条 run 的消费者,此前只读得到前半句。
+     -- 写口是 recordExecutionOutcome 的 CAS(status='resolved' AND execution_outcome IS NULL),**恰好一次**;
+     -- 第二次写同一份记录是幂等,写不同的一份是 checkpoint.execution_outcome_conflict(记录物理不可变 ——
+     -- 两份不同的执行记录意味着同一个已决动作被结算了两次,那是引擎缺陷,不是店可以吸收的条件)。
+     -- 缺席只有一个含义:**未知**,绝不是「放行过」(读面单口 core executionVerdict(cp))。
+     -- 两列同生同灭(stamp 在场 ⇔ 记录在场);reopen 见到记录即拒(已结算的动作不可重开)。
+     execution_outcome JSON   NULL,
+     execution_at_ms   BIGINT NULL,
      PRIMARY KEY (token),
      KEY idx_checkpoint_status_deadline (status, deadline),
      KEY idx_checkpoint_session_status (session_id, status)

package/dist/read-face-posture.d.ts

@@ -0,0 +1,52 @@
+/**
+ * S-167(clay 裁定 2,[ref] 转达 / [ref] ②)—— **READ 容纳面档位的来源**(单一属主)。
+ *
+ * ## 它解决的问题
+ *
+ * `READ_FACE` 此前只有「显式设了就铸、缺席就不铸」两态,而**缺席**这一态里其实塞了两件完全不同的事:
+ *  · 单机 turnkey(`REQUIRE_PRINCIPAL` 未设,CC 的信任模型:一台机器一个可信主人)—— 运维没表态是因为
+ *    他压根不认为工作区外的读需要围栏;引擎默认的 `roots` 于是成了一道**没人要求过**的墙(clay 裁:
+ *    「工作区外读默认放行(单机形)」)。
+ *  · 多租户 —— 缺席就是缺席,引擎默认 `roots` 正是想要的收敛姿态。
+ *
+ * 于是本模块把「档位」与「档位是谁定的」拆成两个字段:值仍是 `open | roots | 缺席`,来源是本文件的
+ * **四词闭集**。来源不是装饰:
+ *  ① `config-center/read-face.ts` 的 **env 恒赢**判据此前用的是「`config.readFace` 键在不在场」这个
+ *     **代理**;posture 会铸键,代理当场失真(center 的 face 会被一台从没设过 env 的机器挡掉)。
+ *     换成读来源之后判据说的就是它真正想说的那件事:**这台机器的 env 显式占住了这个键吗**。
+ *  ② 运维面:`GET /v1/diagnostics/wiring` 报 `{face, source, note}`,「为什么这台机器是 open」有答案
+ *     (裁定的补偿项:升级即放开,得让运维看得见并知道怎么钉回)。
+ *
+ * ## 优先序(三态,与 `config.ts` 的 `postureOn` 同形)
+ * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `config-center/read-face.ts`
+ * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
+ *
+ * ## 定界
+ * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
+ * `readDenyBuiltinExclude`)一个字节不动 —— 放开容纳面不等于放开凭证/shell 历史/钱包那几档 deny,
+ * 两者在 core 里是并列机制(deny 表在 open 面上照样拦)。core 的 `config.read_face_deployment_clamped`
+ * (只读挂载钳制)同样不受本件影响。
+ */
+/** 档位来源的闭集词表(顺序 = 优先序:env > center > posture > 引擎默认)。 */
+export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
+/** 档位的来源(闭集四词)。加词 ⇒ {@link readFaceSourceNote} 的穷举 switch 编译红。 */
+export type ReadFaceSource = (typeof READ_FACE_SOURCE_WORDS)[number];
+/** 一台 worker 的 READ 面档位事实(值 + 来源)。`ServiceConfigFlat` 结构上满足本形。 */
+export interface ReadFacePostureFacts {
+    readonly readFace?: "open" | "roots" | undefined;
+    readonly readFaceSource: ReadFaceSource;
+}
+/**
+ * 缺席 `READ_FACE` 时的 posture 派生(`config.ts` 的铸点调用;显式值不经此口)。
+ * 单用户 turnkey ⇒ `open`;多租户 ⇒ 不铸(引擎默认 `roots`,server 不复制上游默认)。
+ */
+export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
+/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+export declare function readFaceSourceNote(source: ReadFaceSource): string;
+/** operator 诊断面的投影(`GET /v1/diagnostics/wiring`)。`face:null` = 本部署没钉档,引擎默认接管。 */
+export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
+    face: "open" | "roots" | null;
+    source: ReadFaceSource;
+    note: string;
+};
+//# sourceMappingURL=read-face-posture.d.ts.map

package/dist/read-face-posture.js

@@ -0,0 +1,20 @@
+export const READ_FACE_SOURCE_WORDS = ["env", "center", "posture", "engine-default"];
+export function readFaceForPosture(singleUserTurnkey) {
+    return singleUserTurnkey ? { readFace: "open", readFaceSource: "posture" } : { readFaceSource: "engine-default" };
+}
+export function readFaceSourceNote(source) {
+    switch (source) {
+        case "env":
+            return "pinned by this machine's READ_FACE env var (deployment sovereignty — it wins over any published readFace domain)";
+        case "center":
+            return "applied from the config-center readFace domain (restart-to-apply); set READ_FACE on this machine to take the key back";
+        case "posture":
+            return "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back";
+        case "engine-default":
+            return "not pinned by this deployment — the engine's own default (roots) is in force";
+    }
+}
+export function buildReadFaceWiring(facts) {
+    return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };
+}
+//# sourceMappingURL=read-face-posture.js.map

package/dist/task-mcp.d.ts

@@ -110,11 +110,21 @@ export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: R
  */
 export declare function assertRequestMcpContentOrigin(bodyMcp: unknown): void;
 /**
- * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). The baseline WINS on a name
- * clash — a caller can ADD servers but can never SHADOW a configured one (the security baseline is authoritative,
- * same posture as `mergeUserSkills`). Returns the baseline unchanged when there is nothing to add.
+ * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
+ * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
+ * A caller can ADD servers but can never SHADOW or REFILL a deployment-declared one: a center entry that was skipped
+ * (disabled / missing env ref / malformed `toolFaces`) still occupies its name, otherwise "skipped" would silently
+ * mean "free for the caller to remount without the operator's `allowTools` / `toolFaces`" (车CF codex r2 [high]).
+ * Same posture as `mergeUserSkills`.
  */
-export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[]): McpServerSpec[] | undefined;
+export declare function deploymentClosedMcpNames(baseline: McpServerSpec[] | undefined, reservedNames: readonly string[]): ReadonlySet<string>;
+/**
+ * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). Names closed by the deployment
+ * ({@link deploymentClosedMcpNames}) are dropped from `gated`. `reservedNames` has NO default: a security predicate's
+ * input is never implied — a caller with no deployment declaration passes `[]` and says so. Returns the baseline unchanged
+ * when nothing is added.
+ */
+export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[], reservedNames: readonly string[]): McpServerSpec[] | undefined;
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
@@ -127,6 +137,10 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
     };
     requirePrincipal?: boolean;
     lockedConfigKeys?: readonly LockedKey[];
+    /** The deployment's declared-name set rides on the same config object the gate reads (one owner, no second arg). */
+    mcpServers?: {
+        reservedNames: readonly string[];
+    };
 }, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;

package/dist/task-mcp.js

@@ -2,6 +2,7 @@ import { resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
+import { readMcpToolFaces } from "./mcp-tool-faces.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
@@ -79,6 +80,11 @@ function normalizeServer(e, noteBadOrigin) {
             noteBadOrigin(spec.name, o.contentOrigin);
     }
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
+    const faces = readMcpToolFaces(o.toolFaces);
+    if (!faces.ok)
+        return null;
+    if (faces.faces !== undefined)
+        spec.toolFaces = faces.faces;
     return spec;
 }
 export function validateRequestMcp(raw) {
@@ -124,11 +130,14 @@ export function assertRequestMcpContentOrigin(bodyMcp) {
             ` (omit the key entirely for the default: this server's tools classify as external content)`, { code: "request.field_invalid" });
     }
 }
-export function mergeRequestMcp(baseline, gated) {
+export function deploymentClosedMcpNames(baseline, reservedNames) {
+    return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
+}
+export function mergeRequestMcp(baseline, gated, reservedNames) {
     if (gated.length === 0)
         return baseline;
-    const taken = new Set((baseline ?? []).map((s) => s.name));
-    const add = gated.filter((s) => !taken.has(s.name));
+    const closed = deploymentClosedMcpNames(baseline, reservedNames);
+    const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
 export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
@@ -153,6 +162,16 @@ export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
             note: "declaration DROPPED — these servers keep the pre-378 default (external content, session gets marked); the servers themselves still mount",
         });
     }
-    return mergeRequestMcp(baseline, v.ok);
+    const reservedNames = config.mcpServers?.reservedNames ?? [];
+    const closed = deploymentClosedMcpNames(baseline, reservedNames);
+    const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
+    if (blocked.length > 0) {
+        logger?.warn("mcp_injection_dropped", {
+            reason: "name_reserved_by_deployment",
+            dropped: blocked,
+            note: "these names are declared by the deployment (center/config) — mounted or skipped, a caller can neither shadow nor refill them; rename the request-side server",
+        });
+    }
+    return mergeRequestMcp(baseline, v.ok, reservedNames);
 }
 //# sourceMappingURL=task-mcp.js.map

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -69,7 +69,7 @@ class ApprovalStoreDeadlineError extends Error {
         this.name = "ApprovalStoreDeadlineError";
     }
 }
-const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
+const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }

package/dist/trace/core-keyset-guard.d.ts

@@ -31,7 +31,7 @@ type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjec
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
@@ -49,7 +49,7 @@ type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "seve
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveMemoryScopes" | "stats" | "editedFiles";

package/dist/trace/project.d.ts

@@ -407,6 +407,27 @@ export declare function workspaceChangedEventData(ev: {
  * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
  * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
+/**
+ * `tool_roster_delta`(core 7.8.0 [ref] ⑪ 新 `TaskEvent` 臂)—— **运行期**名册变更:整只变更后名册
+ * (`delta.roster`)+ 一段只有持有 `fromDigest` 的消费者才用得上的摘要。
+ *
+ * 契约里唯一的硬话是失败方向:`fromDigest` 对不上**不是拒绝** —— 携带的整只名册无论如何都是新状态,
+ * 消费端记一次 skew 后按快照重同步。所以本构造器**不**替消费端判 digest,只判「这一帧的载荷是不是
+ * core 说的那个形」。
+ *
+ * 判形与 {@link wiringManifestEventData} 的 `tools` 段同一条姿势(理由逐字见那里):属主是 core 的
+ * typebox schema `ToolRosterDelta`,过了整只透传,没过 ⇒ **整帧不发** + F 类留痕。半张名册变更帧比
+ * 不发更坏:消费端会据它把没读到的行当成「这只工具被卸了」。
+ *
+ * ⚠️ **如实披露(core 7.8.0 自述)**:7.8.0 的 runtask **还没有**推这条帧([ref] S3 才接线),座位与
+ * 类型先到货。本臂因此是**前瞻接线**:core 开始推的那一版,server 这一侧零改动即到达消费端;在那之前
+ * 它永不触发。消费端在那一版之前**不得**依赖本帧(core 契约原文)。
+ */
+export declare function toolRosterDeltaEventData(ev: {
+    delta?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown> | undefined;
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
     eventId?: unknown;

package/dist/trace/project.js

@@ -1,5 +1,6 @@
 import { redactErrorMessage } from "../observability/run-terminal-log.js";
-import { MCP_DELIVERY_VERDICTS, screenGateOutcome } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta } from "@sema-agent/core";
+import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
@@ -94,6 +95,15 @@ export function screenedGate(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
         return undefined;
     }
+    const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
+        (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
+        (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
+        (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
+        undefined;
+    if (shapeDefect !== undefined) {
+        recordFailOpen("server.trace.gate-outcome-defective", shapeDefect);
+        return undefined;
+    }
     const defects = screenGateOutcome(g);
     if (defects.length > 0) {
         recordFailOpen("server.trace.gate-outcome-defective", defects.join("; "));
@@ -250,6 +260,13 @@ export function workspaceChangedEventData(ev) {
         ...identityFields(ev),
     };
 }
+export function toolRosterDeltaEventData(ev) {
+    if (!Value.Check(ToolRosterDelta, ev.delta)) {
+        recordFailOpen("server.trace.tool-roster-malformed", "tool_roster_delta.delta did not fit core ToolRosterDelta");
+        return undefined;
+    }
+    return { delta: ev.delta, ...identityFields(ev) };
+}
 export function wiringManifestEventData(ev) {
     const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
     const bool = (v) => (typeof v === "boolean" ? v : undefined);
@@ -314,6 +331,8 @@ export function wiringManifestEventData(ev) {
             return undefined;
         return armed === (reason === "armed") ? { armed, reason } : undefined;
     })();
+    const toolsIn = m.tools;
+    const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -352,6 +371,7 @@ export function wiringManifestEventData(ev) {
         ...(permissionRules !== undefined ? { permissionRules } : {}),
         ...(modelGate !== undefined ? { modelGate } : {}),
         ...(autoMode !== undefined ? { autoMode } : {}),
+        ...(tools !== undefined ? { tools } : {}),
         ...(mcp !== undefined ? { mcp } : {}),
         ...identityFields(ev),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.64.0",
+  "version": "7.66.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.6.2",
-    "@sema-agent/settings-schema": "1.8.0",
+    "@sema-agent/core": "7.8.0",
+    "@sema-agent/settings-schema": "1.9.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.4.0",
+    "@sema-agent/sdk": "8.5.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",