@sema-agent/server 7.65.0 → 7.67.0

package/dist/session-titler.js

@@ -1,10 +1,10 @@
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 export const TITLE_MAX_CHARS = 80;
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
 const FAIL_CAUSE_KEY_CHARS = 80;
-const FAIL_CAUSE_CAP = 100;
 const SEEN_CAP = 10_000;
 export function sanitizeTitle(raw) {
     const oneLine = raw.replace(/[\r\n]+/g, " ").replace(CONTROL_AND_BIDI_STRIP_RE, "").trim();
@@ -22,18 +22,9 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const warnedCauses = new Set();
     const logFailure = (sessionId, error) => {
-        const cause = error.slice(0, FAIL_CAUSE_KEY_CHARS);
-        const meta = { sessionId, error: error.slice(0, 200) };
-        if (warnedCauses.has(cause)) {
-            deps.logger?.debug?.("session_title_failed", meta);
-            return;
-        }
-        if (warnedCauses.size >= FAIL_CAUSE_CAP)
-            warnedCauses.clear();
-        warnedCauses.add(cause);
-        deps.logger?.warn?.("session_title_failed", { ...meta, note: "同 cause 后续降为 debug 级" });
+        deps.logger?.debug?.("session_title_failed", { sessionId, error: error.slice(0, 200) });
+        recordFailOpen("server.session-titler.gateway-unreachable", error.slice(0, FAIL_CAUSE_KEY_CHARS));
     };
     return {
         maybeTitle(sessionId, objective, model) {

package/dist/task-mcp.d.ts

@@ -110,11 +110,21 @@ export declare function assertRequestMcpUnlocked(bodyMcp: unknown, lockedKeys: R
  */
 export declare function assertRequestMcpContentOrigin(bodyMcp: unknown): void;
 /**
- * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). The baseline WINS on a name
- * clash — a caller can ADD servers but can never SHADOW a configured one (the security baseline is authoritative,
- * same posture as `mergeUserSkills`). Returns the baseline unchanged when there is nothing to add.
+ * The ONE predicate for "this MCP server name belongs to the deployment": the scenario baseline (what mounted for
+ * this scenario) ∪ every name the deployment DECLARED (`CenterMcp.reservedNames` — mounted or not, any scenario).
+ * A caller can ADD servers but can never SHADOW or REFILL a deployment-declared one: a center entry that was skipped
+ * (disabled / missing env ref / malformed `toolFaces`) still occupies its name, otherwise "skipped" would silently
+ * mean "free for the caller to remount without the operator's `allowTools` / `toolFaces`" (车CF codex r2 [high]).
+ * Same posture as `mergeUserSkills`.
  */
-export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[]): McpServerSpec[] | undefined;
+export declare function deploymentClosedMcpNames(baseline: McpServerSpec[] | undefined, reservedNames: readonly string[]): ReadonlySet<string>;
+/**
+ * Merge GATED per-request MCP servers OVER the deployment baseline (center/config). Names closed by the deployment
+ * ({@link deploymentClosedMcpNames}) are dropped from `gated`. `reservedNames` has NO default: a security predicate's
+ * input is never implied — a caller with no deployment declaration passes `[]` and says so. Returns the baseline unchanged
+ * when nothing is added.
+ */
+export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, gated: McpServerSpec[], reservedNames: readonly string[]): McpServerSpec[] | undefined;
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
@@ -127,6 +137,10 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
     };
     requirePrincipal?: boolean;
     lockedConfigKeys?: readonly LockedKey[];
+    /** The deployment's declared-name set rides on the same config object the gate reads (one owner, no second arg). */
+    mcpServers?: {
+        reservedNames: readonly string[];
+    };
 }, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;

package/dist/task-mcp.js

@@ -2,6 +2,7 @@ import { resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
+import { readMcpToolFaces } from "./mcp-tool-faces.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
@@ -79,6 +80,11 @@ function normalizeServer(e, noteBadOrigin) {
             noteBadOrigin(spec.name, o.contentOrigin);
     }
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
+    const faces = readMcpToolFaces(o.toolFaces);
+    if (!faces.ok)
+        return null;
+    if (faces.faces !== undefined)
+        spec.toolFaces = faces.faces;
     return spec;
 }
 export function validateRequestMcp(raw) {
@@ -124,11 +130,14 @@ export function assertRequestMcpContentOrigin(bodyMcp) {
             ` (omit the key entirely for the default: this server's tools classify as external content)`, { code: "request.field_invalid" });
     }
 }
-export function mergeRequestMcp(baseline, gated) {
+export function deploymentClosedMcpNames(baseline, reservedNames) {
+    return new Set([...(baseline ?? []).map((s) => s.name), ...reservedNames]);
+}
+export function mergeRequestMcp(baseline, gated, reservedNames) {
     if (gated.length === 0)
         return baseline;
-    const taken = new Set((baseline ?? []).map((s) => s.name));
-    const add = gated.filter((s) => !taken.has(s.name));
+    const closed = deploymentClosedMcpNames(baseline, reservedNames);
+    const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
 export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
@@ -153,6 +162,16 @@ export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
             note: "declaration DROPPED — these servers keep the pre-378 default (external content, session gets marked); the servers themselves still mount",
         });
     }
-    return mergeRequestMcp(baseline, v.ok);
+    const reservedNames = config.mcpServers?.reservedNames ?? [];
+    const closed = deploymentClosedMcpNames(baseline, reservedNames);
+    const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
+    if (blocked.length > 0) {
+        logger?.warn("mcp_injection_dropped", {
+            reason: "name_reserved_by_deployment",
+            dropped: blocked,
+            note: "these names are declared by the deployment (center/config) — mounted or skipped, a caller can neither shadow nor refill them; rename the request-side server",
+        });
+    }
+    return mergeRequestMcp(baseline, v.ok, reservedNames);
 }
 //# sourceMappingURL=task-mcp.js.map

package/dist/task-settings.d.ts

@@ -293,6 +293,36 @@ export interface FsWriteGateWiring {
      *  (⇒ ask) and `acceptEdits` degrades to the `default` arm — the same fail-safe direction as the host lane's
      *  never-created sentinel dir (resolve-spec 修5). */
     cwd?: string;
+    /**
+     * 🔴 S-177 / codex r1 [high](验真后修)—— **权限规则**的路径基,与上面那个 `cwd` **刻意分成两个字段**。
+     *
+     * 两者在 host 腿上常常同值,但它们回答的不是同一个问题,而混用一个字段会让其中一个静默失效:
+     *  · `cwd` 是**写门**的基。它在「有 remoteExec 但这条 session 还没登记工作目录」时取的是一个
+     *    **永不创建的哨兵目录**(`resolve-spec` 的 `fs-write-gate-unrooted`)。对写门那是 fail-SAFE 的:
+     *    相对目标在哨兵下解析不出真身 ⇒ 落 ask。
+     *  · `taskRoot` 是**规则模式**的基(core `PathRuleBases.root`)。规则编译器按**词法**匹配,不问目录
+     *    存不存在 ⇒ 把哨兵递给它,`deny Edit(src/**)` 会编译成功、指向一个谁也不会写的目录,对真实工作区
+     *    的 `<工作区>/src/secret.ts` 这类目标判 allow —— 一条运维亲手写下的收紧规则**静默失效**,方向与写门那条正相反。
+     *
+     * ⇒ 本字段**只在真任务根已知时**在场。缺席 ⇒ 规则编译器拿不到 `pathBases.root` ⇒ 需要该基的拼法
+     * (`Edit(src/**)` / `Edit(/etc/**)`)被 core 以 `unsupported.path_base` **整表拒**(→ 422,fail-loud),
+     * 而不是编成一条够不着任何东西的规则。绝对形(`//abs`)与 `~/` 形不需要基,两种部署形都照常编得出。
+     */
+    taskRoot?: string;
+    /**
+     * 🔴 S-177 / codex r2 [high](验真后修)—— **执行环境的 home**(core `PathRuleBases.home`,`~/…` 形的基)。
+     *
+     * core 对缺席的 `home` 回落 `os.homedir()` —— 那是**这个 server 进程**的 home。引擎与执行同机时它就是
+     * 对的;**远端车道**(SSH / 容器 / 沙箱)上执行用户的 home 与 server 的 home 是两个目录,于是
+     * `deny Edit(~/.sema/**)` 编译成功、却拿 server 的 home 去匹配远端的目标 ⇒ 一条收紧规则**静默失效**
+     * (与 `taskRoot` 那条哨兵病同族、同方向)。
+     *
+     * ⇒ 本字段只在 home **真知道**时在场(引擎与执行同机)。缺席时,`~/` 形的规则由
+     * {@link rejectUnmatchableSettingsNames} **响亮拒**(422),绝不回落到 server 的 home。
+     * ⚠️ 上游缺口如实登记:core 今天没有「这条规则需要哪些 base」的查询口,也不把 `home` 当必答项 ——
+     * 所以「这条规则用了 `~/` 吗」由本仓读**core 自己解析出的规范 command**(`~/` 前缀)来判,不自铸文法。
+     */
+    taskHome?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */
     scratchpadDir?: string;
     /** [ref]① / core 1.294 exemption seam: the session "don't ask again" probe (approvalExemptionStore.has),

package/dist/task-settings.js

@@ -1,5 +1,5 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, } from "@sema-agent/core";
-import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, ruleToolGrammarOf, } from "@sema-agent/core";
+import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
@@ -225,17 +225,18 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
     }
     return v;
 }
-const ASK_RULE_SOURCE = "settings.permissions.ask";
-function createAskListPolicy(askNames) {
+const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
+function createRuleListPolicy(names, behavior, pathBases) {
     try {
-        return createPermissionRulePolicy(askNames.map((name) => ({ rule: name, behavior: "ask", source: ASK_RULE_SOURCE })), {
+        return createPermissionRulePolicy(names.map((name) => ({ rule: name, behavior, source: RULE_SOURCE_BY_BEHAVIOR[behavior] })), {
             defaultAction: "allow",
             caps: { maxRules: MAX_SETTINGS_PERMISSION_RULES },
+            ...(pathBases !== undefined ? { pathBases } : {}),
         });
     }
     catch (e) {
         const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-        throw new Error(`permissions.ask has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
+        throw new Error(`${RULE_SOURCE_BY_BEHAVIOR[behavior].replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
@@ -267,31 +268,51 @@ function createWorkflowPlanDenyPolicy() {
         nameSets: [{ deny: WORKFLOW_ASK_NAMES }],
     };
 }
-function rejectUnmatchableSettingsNames(perms) {
-    for (const [field, names] of [["permissions.ask", perms.ask], ["permissions.deny", perms.deny]]) {
+function rejectUnmatchableSettingsNames(perms, pathBases) {
+    if (pathBases?.home === undefined) {
+        for (const [field, names, behavior] of [
+            ["permissions.ask", perms.ask, "ask"],
+            ["permissions.deny", perms.deny, "deny"],
+            ["permissions.allow", perms.allow, "allow"],
+        ]) {
+            for (const name of names ?? []) {
+                const parsed = parseRuleText(name, behavior);
+                if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
+                    throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
+                        `on a remote lane the engine's own home is a different user's directory, so the rule would compile and then match nothing that runs. ` +
+                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), or run the task on a lane whose home this worker knows.`);
+                }
+            }
+        }
+    }
+    for (const [field, names, behavior, consumer] of [
+        ["permissions.ask", perms.ask, "ask", "rule-policy"],
+        ["permissions.deny", perms.deny, "deny", "rule-policy"],
+        ["permissions.allow", perms.allow, "allow", "tool-name-table"],
+    ]) {
         if (!names)
             continue;
-        const bad = findUnmatchableToolNames(names);
+        const bad = findUnmatchableToolNames(names, { consumer, behavior, ...(pathBases !== undefined ? { pathBases } : {}) });
         if (bad.length > 0)
             throw new Error(formatUnmatchableToolNames(field, bad));
     }
-    if (perms.allow) {
-        const bad = findCcRuleFormNames(perms.allow);
-        if (bad.length > 0)
-            throw new Error(formatUnmatchableToolNames("permissions.allow", bad));
-    }
 }
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)
         return {};
     const { allow, deny, ask, defaultMode } = perms;
-    rejectUnmatchableSettingsNames(perms);
+    const pathBases = gate?.taskRoot !== undefined || gate?.taskHome !== undefined
+        ? { ...(gate.taskRoot !== undefined ? { root: gate.taskRoot } : {}), ...(gate.taskHome !== undefined ? { home: gate.taskHome } : {}) }
+        : undefined;
+    rejectUnmatchableSettingsNames(perms, pathBases);
     const policies = [];
-    if (allow || deny)
-        policies.push(createAllowDenyPolicy({ ...(allow ? { allow } : {}), ...(deny ? { deny } : {}) }));
+    if (allow)
+        policies.push(createAllowDenyPolicy({ allow }));
+    if (deny)
+        policies.push(createRuleListPolicy(deny, "deny", pathBases));
     if (ask)
-        policies.push(createAskListPolicy(ask));
+        policies.push(createRuleListPolicy(ask, "ask", pathBases));
     const fsWriteGate = (acceptCwd) => {
         if (!gate)
             return undefined;

package/dist/tool-approval.d.ts

@@ -126,8 +126,9 @@ export interface ToolApprovalFrame {
     requiresRealApproval?: true;
     /**
      * **S-125③/[ref]**(core 7.5.0;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**出身**:
-     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` 八员 content_question / unresolvable / org_unavailable /
-     * org_rule / hook / ask_rule / denial_limit_fallback / policy)。引擎在门上盖章(core d.ts:
+     * 谁提的这一问,一个 core 闭集词(`ASK_ORIGINS` **11 员**,core 7.9.0 现值:content_question /
+     * unresolvable / org_unavailable / org_rule / rule_store_unavailable / hook / ask_rule /
+     * denial_limit_fallback / shell_gate_tighten / safety_tighten / policy)。引擎在门上盖章(core d.ts:
      * 「engine-stamped at the gate, never a policy's claim」),`AskRequest.origin` 逐字透传。
      *
      * 🔴 **echo-only,零消费**:自动车道的资格判据全在 core(`classifierMayAnswer` 的闭表),server
@@ -864,7 +865,7 @@ export declare class ToolApprovalCoordinator {
      * [ref] / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
      *
      * 🔴 病灶(真复现,`npm run build --flag=<700 字> && git status`):`batch` 成员的 `segment` 是复合命令
-     * 那一段的**原字节**,它**不经** `parseAllowRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
+     * 那一段的**原字节**,它**不经** `parseRuleText`,所以 core 的 `MAX_RULE_TEXT_CHARS` 对它一个字
      * 都不管;而卡的 `ApprovalCardSchema` 对四个文本座一律 `.max(MAX_RULE_TEXT_CHARS)`。逐字拷进卡 ⇒
      * `card_json` 落库 ⇒ `ensureAsk` 当场回读 `safeParse` 判假 ⇒ `persisted-row-unusable` ⇒ **整只 ask 走
      * park**,重放腿一并跳过该行。与「重扫二轮 §基数帽」是**同一条悬崖的另一条边**(那次是 offer 条数
@@ -885,7 +886,7 @@ export declare class ToolApprovalCoordinator {
     /** 兑付侧座(single 的 rule/command、command 成员的 rule/command、directoryRead 成员的 rule/directory)任一超尺?
      *  `segment` 与 `uncoveredDetail[].segment` 是纯渲染座,不在此列(截长是诚实省略)。 */
     private static ruleOfferTextsOverSize;
-    /** codex r1 [high]([ref]):offer 的自称座与 `parseAllowRuleText(rule)` 派生的三元组逐字一致?(理由见调用点) */
+    /** codex r1 [high]([ref]):offer 的自称座与 `parseRuleText(rule, "allow")` 派生的三元组逐字一致?(理由见调用点) */
     private static ruleOfferDerivedFactsAgree;
     private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;

package/dist/tool-approval.js

@@ -1,6 +1,6 @@
 import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, parseAllowRuleText } from "@sema-agent/core";
+import { uuidv7, MAX_RULE_TEXT_CHARS, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -69,7 +69,7 @@ class ApprovalStoreDeadlineError extends Error {
         this.name = "ApprovalStoreDeadlineError";
     }
 }
-const FS_WRITE_TOOLS = new Set(["Write", "Edit", "NotebookEdit"]);
+const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
@@ -381,7 +381,7 @@ export class ToolApprovalCoordinator {
     }
     static ruleOfferDerivedFactsAgree(offer) {
         const derive = (rule) => {
-            const p = parseAllowRuleText(rule);
+            const p = parseRuleText(rule, "allow");
             return "rule" in p ? p.rule : undefined;
         };
         if (offer.kind === "single") {

package/dist/trace/core-keyset-guard.d.ts

@@ -31,7 +31,7 @@ type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjec
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
@@ -49,7 +49,7 @@ type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "seve
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveMemoryScopes" | "stats" | "editedFiles";

package/dist/trace/project.d.ts

@@ -407,6 +407,28 @@ export declare function workspaceChangedEventData(ev: {
  * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
  * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
+/**
+ * `tool_roster_delta`(core 7.8.0 [ref] ⑪ 新 `TaskEvent` 臂)—— **运行期**名册变更:整只变更后名册
+ * (`delta.roster`)+ 一段只有持有 `fromDigest` 的消费者才用得上的摘要。
+ *
+ * 契约里唯一的硬话是失败方向:`fromDigest` 对不上**不是拒绝** —— 携带的整只名册无论如何都是新状态,
+ * 消费端记一次 skew 后按快照重同步。所以本构造器**不**替消费端判 digest,只判「这一帧的载荷是不是
+ * core 说的那个形」。
+ *
+ * 判形与 {@link wiringManifestEventData} 的 `tools` 段同一条姿势(理由逐字见那里):属主是 core 的
+ * typebox schema `ToolRosterDelta`,过了整只透传,没过 ⇒ **整帧不发** + F 类留痕。半张名册变更帧比
+ * 不发更坏:消费端会据它把没读到的行当成「这只工具被卸了」。
+ *
+ * ✅ **已转正(core 7.9.0 / [ref] S3)**:引擎自 7.9.0 起**真推**这条帧 —— 驱动在推 `wiring_manifest`
+ * 的那一点订阅腿的名册增量座,一次改变名册的 refresh ⇒ **恰一帧**(序在 manifest 之后、那次 refresh 自己的
+ * `tool_end` 之前),`delta.fromDigest` = 消费端手上那份名册的 digest。7.66.0 写下的「前瞻接线」披露随本版
+ * 退役:本臂现在会真的触发,消费端可以依赖它了。
+ */
+export declare function toolRosterDeltaEventData(ev: {
+    delta?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown> | undefined;
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
     eventId?: unknown;

package/dist/trace/project.js

@@ -1,5 +1,6 @@
 import { redactErrorMessage } from "../observability/run-terminal-log.js";
-import { MCP_DELIVERY_VERDICTS, screenGateOutcome } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, screenGateOutcome, ToolRoster, ToolRosterDelta } from "@sema-agent/core";
+import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
@@ -94,6 +95,15 @@ export function screenedGate(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
         return undefined;
     }
+    const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
+        (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
+        (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
+        (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
+        undefined;
+    if (shapeDefect !== undefined) {
+        recordFailOpen("server.trace.gate-outcome-defective", shapeDefect);
+        return undefined;
+    }
     const defects = screenGateOutcome(g);
     if (defects.length > 0) {
         recordFailOpen("server.trace.gate-outcome-defective", defects.join("; "));
@@ -250,6 +260,13 @@ export function workspaceChangedEventData(ev) {
         ...identityFields(ev),
     };
 }
+export function toolRosterDeltaEventData(ev) {
+    if (!Value.Check(ToolRosterDelta, ev.delta)) {
+        recordFailOpen("server.trace.tool-roster-malformed", "tool_roster_delta.delta did not fit core ToolRosterDelta");
+        return undefined;
+    }
+    return { delta: ev.delta, ...identityFields(ev) };
+}
 export function wiringManifestEventData(ev) {
     const str = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
     const bool = (v) => (typeof v === "boolean" ? v : undefined);
@@ -314,6 +331,8 @@ export function wiringManifestEventData(ev) {
             return undefined;
         return armed === (reason === "armed") ? { armed, reason } : undefined;
     })();
+    const toolsIn = m.tools;
+    const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -352,6 +371,7 @@ export function wiringManifestEventData(ev) {
         ...(permissionRules !== undefined ? { permissionRules } : {}),
         ...(modelGate !== undefined ? { modelGate } : {}),
         ...(autoMode !== undefined ? { autoMode } : {}),
+        ...(tools !== undefined ? { tools } : {}),
         ...(mcp !== undefined ? { mcp } : {}),
         ...identityFields(ev),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.65.0",
+  "version": "7.67.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.6.2",
-    "@sema-agent/settings-schema": "1.8.0",
+    "@sema-agent/core": "7.9.0",
+    "@sema-agent/settings-schema": "1.9.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.4.0",
+    "@sema-agent/sdk": "8.6.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",