@sema-agent/server 7.67.0 → 7.68.0

package/dist/boot/resolve-spec.js

@@ -367,7 +367,7 @@ export function createResolveSpec(ctx) {
                 return merged && config.toolDeferLongtail ? applyLongtailDefer(merged, true) : merged;
             })(cap.tools),
             skills: mergeUserSkills(cap.skills, body.skills, logger),
-            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger),
+            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined),
             a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger),
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled

package/dist/http/route-ctx.d.ts

@@ -16,7 +16,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { HostDecision } from "../host-decision.js";
-import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
+import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner, EngineNotice } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
 import type { IdempotencyCache } from "./idempotency.js";
@@ -122,6 +122,10 @@ export interface PreparedTaskSubmission {
     cascade?: boolean;
     jobId?: string;
     body: TaskRequestBody;
+    /** L-167:**装配期**铸下的、这条会话的用户面 `EngineNotice`(今天只有请求腿 MCP 注入被丢弃一族)。
+     *  装配跑在这条腿的通告口开张之前,所以铸点交不出去 —— 由腿在 `registerEngineNoticeLeg` 那一拍
+     *  经 `pending` 一起投(投递单点仍是那一只注册助手,不新开第二条机制)。缺席 = 本次装配没铸下任何通告。 */
+    engineNotices?: readonly EngineNotice[];
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {

package/dist/http/routes/runs.js

@@ -1609,7 +1609,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
                 windowMs: deps.config.streamApproval?.windowMs,
                 windowMarginMs: deps.config.streamAskWindowMarginMs,
             }
-            : undefined, deps.checkpointStore);
+            : undefined, deps.checkpointStore, prepared.engineNotices);
         return { status: 202, body: { taskId, sessionId, status: "running" } };
     }, (r) => r.status === 202);
     return resp;

package/dist/http/routes/tasks.js

@@ -299,6 +299,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 const noticeLedger = ledgerSink;
                 const unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId: prepared.spec.sessionId,
+                    ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
                     live: (row) => {
                         if (res.writableEnded || res.destroyed) {
                             recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");

package/dist/http/server.d.ts

@@ -1,6 +1,6 @@
 import http from "node:http";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain } from "@sema-agent/core";
+import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type EntryProvenanceAccount, type MemoryErasureAttestation, type MemoryEntryOrigin, type OriginClearanceRow, type SessionMemoryStatus, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
@@ -92,9 +92,14 @@ export interface ServiceCoreDeps {
      *  `boot/resolve-spec.ts` 的 `declaresInteractivePosture`)。缺席/false ⇒ 无人腿,不声明 posture ——
      *  bg(`POST /v1/runs`)、A2A、resume、cron/wake 一律走这一侧,行为字节不变。
      *  ⚠️ 它是**腿身份**不是能力表态:绝不从请求体读,只由路由装配点按 URL 定(客户端说了不算)。 */
+    /** `opts.onNotice` (L-167, core 7.9.1):装配期铸下的、**这条会话**的用户面通告(今天只有一族:请求腿
+     *  MCP 注入被丢弃)。装配跑在通告腿开口**之前**(`prepareSpec` → 路由注册 `registerEngineNoticeLeg`),
+     *  所以它不能在铸点直接 `route()` ——收下来交给调用腿,由腿在开口那一拍连同 `pending` 一起投。
+     *  缺席(桩、resume 家族)⇒ 只走结构化日志终点,行为逐字不变。 */
     resolveSpec: (body: TaskRequestBody, req: IncomingMessage | undefined, auth?: RequestAuth, opts?: {
         leg?: "fresh" | "resume";
         liveStream?: boolean;
+        onNotice?: (notice: EngineNotice) => void;
     }) => TaskSpec | Promise<TaskSpec>;
     /**
      * [ref] 场景 hands lane 选路:按 `resolveSpec` 刚产出的 TaskSpec 取本任务的执行 Runner。

package/dist/http/server.js

@@ -2,7 +2,7 @@ import http from "node:http";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
@@ -24,7 +24,6 @@ import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import { HANDS_BAND_TOOL_NAMES } from "../capabilities/hands-lane.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
@@ -119,7 +118,6 @@ const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 const MAX_BODY = 8 * 1024 * 1024;
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
-const HAND_TOOL_NAMES = HANDS_BAND_TOOL_NAMES;
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
     return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
@@ -999,8 +997,9 @@ export function createHttpServer(rawDeps) {
         }
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}) });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body };
+            const engineNotices = [];
+            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body, ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {
@@ -1224,22 +1223,6 @@ export function createHttpServer(rawDeps) {
             throw e;
         }
         const pendingTool = cp.pendingAction.toolName;
-        const pendingToolCanon = pendingTool;
-        const availableTools = new Set((spec.tools ?? []).map((t) => t.name));
-        if (deps.config.remoteExec)
-            for (const name of HAND_TOOL_NAMES)
-                availableTools.add(name);
-        if (deps.checkpointStore)
-            availableTools.add("AskUserQuestion");
-        if (spec.selfOrchestration === true && deps.config.selfOrchestrationEnabled) {
-            availableTools.add(RUN_WORKFLOW_TOOL_NAME);
-        }
-        if (decision === "approve" && pendingToolCanon && !availableTools.has(pendingToolCanon)) {
-            return {
-                status: 422,
-                body: { error: `pending action no longer satisfiable: tool "${pendingToolCanon}" is not in the current task config (scenario changed since suspend)`, errorCode: "conflict.pending_action_unsatisfiable" },
-            };
-        }
         if (decision === "approve" && pendingTool === "AskUserQuestion" && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
         }

package/dist/mcp-tool-faces.js

@@ -1,4 +1,4 @@
-import { TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ACCESSES } from "@sema-agent/core";
+import { TOOL_APPROVAL_CARDS, TOOL_FAMILIES, TOOL_PATH_ABSENCES, TOOL_PATH_ACCESSES, TOOL_PATH_BASES } from "@sema-agent/core";
 function isRecord(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -26,17 +26,26 @@ function readOneFace(raw) {
         const pt = raw.pathTarget;
         if (!isRecord(pt) || typeof pt.param !== "string" || !memberOf(TOOL_PATH_ACCESSES, pt.access))
             return undefined;
-        if (!onlyKeys(pt, ["param", "access", "aliases", "skillScopeEligible"]))
+        if (!onlyKeys(pt, ["param", "access", "aliases", "skillScopeEligible", "base", "absent", "patternParam"]))
             return undefined;
         if (pt.aliases !== undefined && !isStringArray(pt.aliases))
             return undefined;
         if (pt.skillScopeEligible !== undefined && typeof pt.skillScopeEligible !== "boolean")
             return undefined;
+        if (pt.base !== undefined && !memberOf(TOOL_PATH_BASES, pt.base))
+            return undefined;
+        if (pt.absent !== undefined && !memberOf(TOOL_PATH_ABSENCES, pt.absent))
+            return undefined;
+        if (pt.patternParam !== undefined && typeof pt.patternParam !== "string")
+            return undefined;
         out.pathTarget = {
             param: pt.param,
             access: pt.access,
             ...(pt.aliases !== undefined ? { aliases: pt.aliases } : {}),
             ...(pt.skillScopeEligible === true ? { skillScopeEligible: true } : {}),
+            ...(pt.base !== undefined ? { base: pt.base } : {}),
+            ...(pt.absent !== undefined ? { absent: pt.absent } : {}),
+            ...(pt.patternParam !== undefined ? { patternParam: pt.patternParam } : {}),
         };
     }
     if (raw.renderHints !== undefined) {

package/dist/runs.d.ts

@@ -324,7 +324,16 @@ parkCheckpointReader?: {
             toolCallId?: unknown;
         };
     } | null>;
-}): Promise<void>;
+}, 
+/** L-167:装配期(`prepareSpec` → `resolveSpec`)铸下的用户面通告 —— 那一刻本腿的通告口还没开,
+ *  所以由本腿在 `registerEngineNoticeLeg` 那一拍连同 `pending` 一起投(投递单点仍是 `route()`)。
+ *  缺席 ⇒ 一个字节不投(既有调用方逐字不变)。 */
+pendingEngineNotices?: readonly {
+    code: string;
+    message: string;
+    detail?: Record<string, unknown>;
+    sessionId?: unknown;
+}[]): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -153,7 +153,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -248,6 +248,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     };
     const unregisterEngineNotice = registerEngineNoticeLeg({
         sessionId: spec.sessionId,
+        ...(pendingEngineNotices !== undefined ? { pending: pendingEngineNotices } : {}),
         durable: (row) => void append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`)),
     });
     try {

package/dist/task-mcp.d.ts

@@ -22,9 +22,25 @@
  *     `runtimeCapsResolver`) is a DEFERRED v2.
  * When the gate is closed, a sent `mcpServers` is IGNORED (advertised via `capabilities.mcpInjection`).
  */
-import { type CompliancePosture, type LockedKey, type McpServerSpec } from "@sema-agent/core";
+import { type CompliancePosture, type EngineNotice, type LockedKey, type McpInjectionDropReason, type McpServerSpec } from "@sema-agent/core";
 /** Bound on caller-supplied servers (anti-DoS; a real local `.mcp.json` has a handful). */
 export declare const MAX_REQUEST_MCP_SERVERS = 32;
+/**
+ * 🔴 **一类丢弃至多点名多少条**(codex 对抗复审 r1 [high],验真后采纳)—— 与挂载上限**同一个数**,
+ * 刻意不新造一个可调旋钮:点名的量级本就该与挂载的量级同阶。
+ *
+ * 病(本批引入,不是既有形):`MAX_REQUEST_MCP_SERVERS` 管的是「挂几台」,管不住「你发了几台」——
+ * HTTP 体上限 8 MiB 装得下十万个名字,而 `gate_closed`(整只列表被忽略)与 `over_cap`(上限之后的尾项)
+ * 两臂原本逐条点名,于是一条已认证请求就能造出十万条事实、十万条通告,逐条排进本腿的**串行账本写链**
+ * ——同一条链上后续的正常事件全部排在它们后面。修前的名字数组把超上限折成**一条**聚合串,所以无界的
+ * 是本批新写的那两个循环。
+ *
+ * 为什么不改成「数组太长就 400」(codex 的另一条建议,**未采纳**):今天 33 台的请求是**照常受理、挂前
+ * 32 台**的,加一条新的拒绝面为了一个资源边界去改受理语义,爆炸半径比病本身大(而且 resume 腿重放存量
+ * body 会当场砖死一批已 park 的任务——本仓 `opts.leg` 三处先例逐字写着「砖死 resume 比降级糟」)。
+ * 有界点名两头都占:该说的仍然说得出,量级钉死在与挂载同阶。
+ */
+export declare const MAX_REQUEST_MCP_DROP_NAMES = 32;
 /**
  * Does THIS deployment honor caller-supplied per-request MCP servers? TRUE for a SINGLE-USER deployment
  * (`requirePrincipal !== true`) — the requester is the super-admin of their own worker, so their `.mcp.json` is
@@ -37,19 +53,42 @@ export declare function mcpInjectionHonored(config: {
     lockedConfigKeys?: readonly LockedKey[];
     compliancePosture?: CompliancePosture;
 }): boolean;
+/**
+ * L-167(core 7.9.1)—— 一条**没有被挂上**的请求腿 MCP 条目的**事实**。宿主报事实,core 铸词:
+ * `reason` 的词表属主是 core(`McpInjectionDropReason` = malformed_entry / name_reserved_by_deployment /
+ * gate_closed / over_cap),本仓一个词都不枚举,通告的码/受众/句子一个字都不拼。
+ *
+ * `sessionId` **不在**这个形上:它是通告的**路由半场**,在铸点(`mintInjectionDropNotices`)才补 ——
+ * 一条丢弃事实在没有会话语境的调用方(桩、单测、未来的非 HTTP 腿)那里同样成立,而通告不成立。
+ */
+export interface McpInjectionDrop {
+    readonly server: string;
+    readonly reason: McpInjectionDropReason;
+    /** `malformed_entry` 专用:**哪个键**判不出形。结构性给出(读器在拒的那一行就知道),不从文案里 parse。 */
+    readonly field?: string;
+}
+/** L-167:本条腿的用户面通告席。`sessionId` = 路由半场(`auth.sessionId`,与 `spec.sessionId` 同源);
+ *  `emit` = 收下 core 铸好的 `EngineNotice`。**本模块不知道**它最后落在 SSE、账本还是日志上 —— 那是
+ *  投递腿的事,本模块只负责「事实 → core 工厂 → 一条通告」。 */
+export interface McpInjectionDropSeat {
+    readonly sessionId: string | undefined;
+    readonly emit: (notice: EngineNotice) => void;
+}
 /**
  * Shape-check the raw `body.mcpServers`. `null` → a non-array (caller error; the route may 400). Otherwise the
  * valid subset + the names of dropped (malformed/over-cap) entries + [ref]'s `badContentOrigin`
  * (**降级**掉的内容出处声明,与 `dropped` 是两回事:那条 server **留着**,丢的只是它的声明)。
  */
-export declare function validateRequestMcp(raw: unknown): {
+export declare function validateRequestMcp(raw: unknown): ValidatedRequestMcp | null;
+type ValidatedRequestMcp = {
     ok: McpServerSpec[];
-    dropped: string[];
+    dropped: McpInjectionDrop[];
+    droppedTotal: number;
     badContentOrigin: Array<{
         server: string;
         value: string;
     }>;
-} | null;
+};
 /**
  * [ref] 件C §4.3 —— **同步**拒面:部署锁了 `mcp` 而请求仍带 `mcpServers` ⇒ 400 `config.locked_key`。
  *
@@ -128,7 +167,7 @@ export declare function mergeRequestMcp(baseline: McpServerSpec[] | undefined, g
 /**
  * The single entry point the spec-builder calls: compute the effective `TaskSpec.mcp` = deployment baseline + the
  * caller's gated per-request servers. Off the honored lane (or with no caller servers) returns the baseline
- * unchanged. Logs an `mcp_injection_ignored` when a caller SENT servers a closed gate dropped (so the shell never
+ * unchanged. Logs an `mcp_injection_dropped` (reason `gate_closed`) when a caller SENT servers a closed gate dropped (so the shell never
  * silently believes its `.mcp.json` took effect — it also reads `capabilities.mcpInjection`).
  */
 export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined, bodyMcp: unknown, config: {
@@ -144,5 +183,10 @@ export declare function resolveRequestMcp(baseline: McpServerSpec[] | undefined,
 }, logger?: {
     info?(m: string, meta?: unknown): void;
     warn(m: string, meta?: unknown): void;
-}): McpServerSpec[] | undefined;
+}, 
+/** L-167:本条腿的**用户面**投递口。`sessionId` = 通告的路由半场(缺席 ⇒ 一条都不铸,见
+ *  {@link mintInjectionDropNotices});`emit` 收下 core 铸好的通告,由调用腿决定投到哪(见 `boot/resolve-spec.ts`)。
+ *  整段缺席(桩、单测、非 HTTP 腿)⇒ 只走日志终点,行为逐字与本件之前相同。 */
+notice?: McpInjectionDropSeat): McpServerSpec[] | undefined;
+export {};
 //# sourceMappingURL=task-mcp.d.ts.map

package/dist/task-mcp.js

@@ -1,9 +1,10 @@
-import { resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { readMcpToolFaces } from "./mcp-tool-faces.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
+export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export function mcpInjectionHonored(config) {
     if (config.lockedConfigKeys?.includes("mcp") === true)
         return false;
@@ -14,20 +15,27 @@ export function mcpInjectionHonored(config) {
 function isStringRecord(v) {
     return !!v && typeof v === "object" && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string");
 }
+const bad = (field) => ({ ok: false, field });
+const MALFORMED_NAME = "<malformed>";
+function declaredName(e) {
+    return e && typeof e === "object" && typeof e.name === "string" && e.name !== ""
+        ? String(e.name)
+        : MALFORMED_NAME;
+}
 function normalizeServer(e, noteBadOrigin) {
     if (!e || typeof e !== "object")
-        return null;
+        return bad("entry");
     const o = e;
     if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 128)
-        return null;
+        return bad("name");
     const t = o.transport;
     if (!t || typeof t !== "object")
-        return null;
+        return bad("transport");
     const tr = t;
     let transport;
     if (tr.kind === "stdio") {
         if (typeof tr.command !== "string" || tr.command.length === 0)
-            return null;
+            return bad("transport.command");
         transport = {
             kind: "stdio",
             command: tr.command,
@@ -37,7 +45,7 @@ function normalizeServer(e, noteBadOrigin) {
     }
     else if (tr.kind === "http") {
         if (typeof tr.url !== "string" || !/^https?:\/\//i.test(tr.url))
-            return null;
+            return bad("transport.url");
         transport = {
             kind: "http",
             url: tr.url,
@@ -46,12 +54,12 @@ function normalizeServer(e, noteBadOrigin) {
         };
     }
     else {
-        return null;
+        return bad("transport.kind");
     }
     const spec = { name: o.name, transport };
     if (o.allowTools !== undefined) {
         if (!Array.isArray(o.allowTools) || !o.allowTools.every((a) => typeof a === "string"))
-            return null;
+            return bad("allowTools");
         spec.allowTools = o.allowTools;
     }
     if (typeof o.elicitation === "boolean")
@@ -82,29 +90,32 @@ function normalizeServer(e, noteBadOrigin) {
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
     const faces = readMcpToolFaces(o.toolFaces);
     if (!faces.ok)
-        return null;
+        return bad("toolFaces");
     if (faces.faces !== undefined)
         spec.toolFaces = faces.faces;
-    return spec;
+    return { ok: true, spec };
 }
 export function validateRequestMcp(raw) {
     if (raw === undefined || raw === null)
-        return { ok: [], dropped: [], badContentOrigin: [] };
+        return validateRequestMcpEntries([]);
     if (!Array.isArray(raw))
         return null;
+    return validateRequestMcpEntries(raw);
+}
+function validateRequestMcpEntries(raw) {
     const ok = [];
     const dropped = [];
     const badContentOrigin = [];
     for (const e of raw.slice(0, MAX_REQUEST_MCP_SERVERS)) {
         const v = normalizeServer(e, (server, value) => badContentOrigin.push({ server, value: describeBadContentOrigin(value) }));
-        if (v)
-            ok.push(v);
+        if (v.ok)
+            ok.push(v.spec);
         else
-            dropped.push(e && typeof e === "object" && typeof e.name === "string" ? String(e.name) : "<malformed>");
+            dropped.push({ server: declaredName(e), reason: "malformed_entry", field: v.field });
     }
-    if (raw.length > MAX_REQUEST_MCP_SERVERS)
-        dropped.push(`(+${raw.length - MAX_REQUEST_MCP_SERVERS} over cap of ${MAX_REQUEST_MCP_SERVERS})`);
-    return { ok, dropped, badContentOrigin };
+    for (const e of raw.slice(MAX_REQUEST_MCP_SERVERS, MAX_REQUEST_MCP_SERVERS + MAX_REQUEST_MCP_DROP_NAMES))
+        dropped.push({ server: declaredName(e), reason: "over_cap" });
+    return { ok, dropped, droppedTotal: Math.max(0, raw.length - ok.length), badContentOrigin };
 }
 export function assertRequestMcpUnlocked(bodyMcp, lockedKeys) {
     if (!lockedKeys.has("mcp"))
@@ -140,21 +151,33 @@ export function mergeRequestMcp(baseline, gated, reservedNames) {
     const add = gated.filter((s) => !closed.has(s.name));
     return add.length === 0 ? baseline : [...(baseline ?? []), ...add];
 }
-export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
+export function resolveRequestMcp(baseline, bodyMcp, config, logger, notice) {
     if (bodyMcp === undefined || bodyMcp === null)
         return baseline;
-    const honored = mcpInjectionHonored(config);
-    if (!honored) {
-        logger?.warn("mcp_injection_ignored", { reason: "gate_closed (per-request MCP honored only on single-user host lane)" });
-        return baseline;
-    }
-    const v = validateRequestMcp(bodyMcp);
-    if (v === null) {
+    const { mcp, drops } = classifyRequestMcp(baseline, bodyMcp, config, logger);
+    mintInjectionDropNotices(drops, notice);
+    return mcp;
+}
+function classifyRequestMcp(baseline, bodyMcp, config, logger) {
+    if (bodyMcp !== undefined && bodyMcp !== null && !Array.isArray(bodyMcp)) {
         logger?.warn("mcp_injection_ignored", { reason: "mcpServers not an array" });
-        return baseline;
+        return { mcp: baseline, drops: [] };
     }
-    if (v.dropped.length > 0)
-        logger?.warn("mcp_injection_dropped", { dropped: v.dropped });
+    const entries = Array.isArray(bodyMcp) ? bodyMcp : [];
+    const outcome = mcpInjectionHonored(config) ? classifyHonored(baseline, entries, config, logger) : classifyGateClosed(baseline, entries);
+    if (outcome.drops.length > 0)
+        logger?.warn("mcp_injection_dropped", { dropped: outcome.drops, droppedTotal: outcome.droppedTotal });
+    return { mcp: outcome.mcp, drops: outcome.drops };
+}
+function classifyGateClosed(baseline, entries) {
+    return {
+        mcp: baseline,
+        drops: entries.slice(0, MAX_REQUEST_MCP_DROP_NAMES).map((e) => ({ server: declaredName(e), reason: "gate_closed" })),
+        droppedTotal: entries.length,
+    };
+}
+function classifyHonored(baseline, entries, config, logger) {
+    const v = validateRequestMcpEntries(entries);
     if (v.badContentOrigin.length > 0) {
         logger?.warn("mcp_content_class_dropped", {
             entries: v.badContentOrigin,
@@ -165,13 +188,26 @@ export function resolveRequestMcp(baseline, bodyMcp, config, logger) {
     const reservedNames = config.mcpServers?.reservedNames ?? [];
     const closed = deploymentClosedMcpNames(baseline, reservedNames);
     const blocked = v.ok.filter((s) => closed.has(s.name)).map((s) => s.name);
-    if (blocked.length > 0) {
-        logger?.warn("mcp_injection_dropped", {
-            reason: "name_reserved_by_deployment",
-            dropped: blocked,
-            note: "these names are declared by the deployment (center/config) — mounted or skipped, a caller can neither shadow nor refill them; rename the request-side server",
-        });
+    return {
+        mcp: mergeRequestMcp(baseline, v.ok, reservedNames),
+        drops: [...v.dropped, ...blocked.map((server) => ({ server, reason: "name_reserved_by_deployment" }))],
+        droppedTotal: v.droppedTotal + blocked.length,
+    };
+}
+function mintInjectionDropNotices(drops, notice) {
+    if (notice === undefined || drops.length === 0)
+        return;
+    const sessionId = notice.sessionId;
+    if (typeof sessionId !== "string" || sessionId.length === 0)
+        return;
+    const said = new Set();
+    for (const d of drops) {
+        if (d.server !== MALFORMED_NAME) {
+            if (said.has(d.server))
+                continue;
+            said.add(d.server);
+        }
+        notice.emit(mcpInjectionDroppedNotice({ sessionId, server: d.server, reason: d.reason, ...(d.field !== undefined ? { field: d.field } : {}) }));
     }
-    return mergeRequestMcp(baseline, v.ok, reservedNames);
 }
 //# sourceMappingURL=task-mcp.js.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -136,5 +136,21 @@ export declare function registerEngineNoticeLeg(opts: {
     live?: EngineNoticeWireSink;
     durable?: EngineNoticeWireSink;
     router?: EngineNoticeRouter;
+    /**
+     * L-167 —— **腿开张之前**就已经铸好的通告(装配期 `resolveSpec` 的产物,经
+     * `PreparedTaskSubmission.engineNotices` 递过来)。注册完口**立刻**经同一只 {@link EngineNoticeRouter.route}
+     * 投出:白名单、归属键、消毒、隔离四件判据一个都不绕,**不是**第二条投递机制 —— 只是把 `route()` 挪到
+     * 「这条会话已经有口在听」的那一拍。
+     *
+     * 🔴 为什么不让铸点自己 `route()`:装配(`prepareSpec`)跑在本函数**之前**,那一刻这条会话一只口都没有,
+     * `route()` 恒返 0 —— 一条结构上永远投不出去的用户面披露,就是本仓 `task.user_steer_undrained` 陈腐明拒
+     * 那一族的病。缺席/空数组 ⇒ 一个字节不投(既有腿逐字不变)。
+     */
+    pending?: readonly {
+        code: string;
+        message: string;
+        detail?: Record<string, unknown>;
+        sessionId?: unknown;
+    }[];
 }): () => void;
 //# sourceMappingURL=engine-notice-wire.d.ts.map

package/dist/trace/engine-notice-wire.js

@@ -20,6 +20,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "peer.held_settled",
     "peer.idle_subscription",
     "classifier.denial_limit",
+    "mcp.injection_dropped",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -150,6 +151,10 @@ export function registerEngineNoticeLeg(opts) {
     const sinks = [...(live ? [live] : []), ...(durable ? [durable] : [])];
     if (sinks.length === 0)
         return () => undefined;
-    return (opts.router ?? defaultEngineNoticeRouter).registerLeg(sessionId, sinks);
+    const router = opts.router ?? defaultEngineNoticeRouter;
+    const unregister = router.registerLeg(sessionId, sinks);
+    for (const notice of opts.pending ?? [])
+        router.route(notice);
+    return unregister;
 }
 //# sourceMappingURL=engine-notice-wire.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.67.0",
+  "version": "7.68.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.9.0",
+    "@sema-agent/core": "7.9.2",
     "@sema-agent/settings-schema": "1.9.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "8.6.0",
+    "@sema-agent/sdk": "8.8.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",