@sema-agent/settings-schema 1.6.0 → 1.7.1

package/CHANGELOG.md

@@ -6,6 +6,26 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 1.7.1 — 2026-09-06 — `source` 改**只管类型**(撤回 1.7.0 的 min/max 解析拒;patch)
+
+- 1.7.0 把标签规则(非空 ≤80)写进 zod ⇒ 本域整域 all-or-nothing 解析下,**一个**空/超长标签让整套 `mcp.servers`
+  在解析处整域默认(每台 server 消失),消费方 boot 期还容忍空目录——一个显示标签不该有这种爆炸半径
+  (消费方 codex 对抗复审 [high],真库复现:一坏一好两条 server 双双消失)。1.7.1 起 `source: z.string().optional()`,
+  规则单点留在消费方投影层(坏形丢键留 server、留痕)。非字符串仍在解析处拒(那是 JSON 类型错,与任何字段同类)。
+- 顺带如实记:本域 all-or-nothing 解析 + 消费方 boot 容忍空目录,对 `contentOrigin` 闭表等一切解析拒的键**早已**是
+  同一爆炸半径(类病,先于本键存在)——归消费方与本包另立单据处置(逐条目拒而不是整域拒),不在本 patch 射程。
+
+## 1.7.0 — 2026-09-06 — `mcp.servers[].source` 分组标签(sema-server B-036 / S-143 源头修的声明面半场;新键=minor)
+
+- **`McpServerSpec.source?: string`**(非空、≤80 字;`.optional()` 无默认):声明方自述的层级标签,1:1 对应引擎
+  `McpServerSpec.source`(core ≥7.5.0 在 `wiring_manifest.mcp[].source` 逐字回显、single-line + 80 字封顶)。
+  **开集**——`plugin`/`user`/`project`/`local` 是 CC 惯用词不是词表,部署自己的分组词同样合法,故刻意不做闭词表
+  (信任轴仍是 `contentOrigin` 的闭表)。空串/超长/非字符串在解析处拒;缺席保持缺席。
+- 病:本包 default-strip 对象没有这个键 ⇒ `config.d/mcp.json` 写的 `source` 在本地腿与 wire 腿都被剥掉,引擎读到缺席
+  ——与 1.4.0 前的 `contentOrigin` 同形。消费方 sema-server 的投影半场(请求腿 `normalizeServer` + center 腿
+  `resolveMcpServers`)随 server 7.62.0。红先:`test/mcp-source-label.test.ts` 五格(①保留 ②缺席 ③坏形拒 ④本地腿
+  round-trip ⑤wire 腿)。
+
 ## 1.6.0 — 2026-09-05 — `settings.json` 跨会话两键 `crossSessionInbound` / `dialogExpiry`(新模块/新导出=minor)
 
 成案:跨终端会话设计稿(design/385 §4.4/§8)把这两个 settings 键的属主定在 worker 服务侧,而键的**格式契约**

package/dist/types.d.ts

@@ -7317,6 +7317,21 @@ export declare const McpServerSpec: z.ZodObject<{
      *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
      *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
     contentOrigin: z.ZodOptional<z.ZodEnum<["local", "execution", "external"]>>;
+    /** Declaration-plane GROUPING LABEL for this server — maps 1:1 onto the engine's `McpServerSpec.source`
+     *  (core ≥7.5.0 echoes it verbatim on `wiring_manifest.mcp[].source`, single-line + 80-char cap, so a
+     *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
+     *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
+     *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
+     *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+     *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+     *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+     *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+     *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+     *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+     *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+     *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+     *  (ticket B-036 / S-143), the projection half lives in the consumer. */
+    source: z.ZodOptional<z.ZodString>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
@@ -7338,6 +7353,7 @@ export declare const McpServerSpec: z.ZodObject<{
     notes?: string | undefined;
     allowTools?: string[] | undefined;
     contentOrigin?: "local" | "execution" | "external" | undefined;
+    source?: string | undefined;
 }, {
     name: string;
     transport: {
@@ -7358,6 +7374,7 @@ export declare const McpServerSpec: z.ZodObject<{
     allowTools?: string[] | undefined;
     elicitation?: boolean | undefined;
     contentOrigin?: "local" | "execution" | "external" | undefined;
+    source?: string | undefined;
 }>;
 export type McpServerSpec = z.infer<typeof McpServerSpec>;
 export declare const McpConfig: z.ZodEffects<z.ZodObject<{
@@ -7429,6 +7446,21 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
          *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
          *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
         contentOrigin: z.ZodOptional<z.ZodEnum<["local", "execution", "external"]>>;
+        /** Declaration-plane GROUPING LABEL for this server — maps 1:1 onto the engine's `McpServerSpec.source`
+         *  (core ≥7.5.0 echoes it verbatim on `wiring_manifest.mcp[].source`, single-line + 80-char cap, so a
+         *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
+         *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
+         *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
+         *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+         *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+         *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+         *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+         *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+         *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+         *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+         *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+         *  (ticket B-036 / S-143), the projection half lives in the consumer. */
+        source: z.ZodOptional<z.ZodString>;
         notes: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         name: string;
@@ -7450,6 +7482,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         notes?: string | undefined;
         allowTools?: string[] | undefined;
         contentOrigin?: "local" | "execution" | "external" | undefined;
+        source?: string | undefined;
     }, {
         name: string;
         transport: {
@@ -7470,6 +7503,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         allowTools?: string[] | undefined;
         elicitation?: boolean | undefined;
         contentOrigin?: "local" | "execution" | "external" | undefined;
+        source?: string | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     servers: {
@@ -7492,6 +7526,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         notes?: string | undefined;
         allowTools?: string[] | undefined;
         contentOrigin?: "local" | "execution" | "external" | undefined;
+        source?: string | undefined;
     }[];
 }, {
     servers?: {
@@ -7514,6 +7549,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         allowTools?: string[] | undefined;
         elicitation?: boolean | undefined;
         contentOrigin?: "local" | "execution" | "external" | undefined;
+        source?: string | undefined;
     }[] | undefined;
 }>, {
     servers: {
@@ -7536,6 +7572,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         notes?: string | undefined;
         allowTools?: string[] | undefined;
         contentOrigin?: "local" | "execution" | "external" | undefined;
+        source?: string | undefined;
     }[];
 }, {
     servers?: {
@@ -7558,6 +7595,7 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
         allowTools?: string[] | undefined;
         elicitation?: boolean | undefined;
         contentOrigin?: "local" | "execution" | "external" | undefined;
+        source?: string | undefined;
     }[] | undefined;
 }>;
 export type McpConfig = z.infer<typeof McpConfig>;
@@ -10079,6 +10117,21 @@ export declare const DOMAIN_SCHEMAS: {
              *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
              *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
             contentOrigin: z.ZodOptional<z.ZodEnum<["local", "execution", "external"]>>;
+            /** Declaration-plane GROUPING LABEL for this server — maps 1:1 onto the engine's `McpServerSpec.source`
+             *  (core ≥7.5.0 echoes it verbatim on `wiring_manifest.mcp[].source`, single-line + 80-char cap, so a
+             *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
+             *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
+             *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
+             *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+             *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+             *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+             *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+             *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+             *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+             *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+             *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+             *  (ticket B-036 / S-143), the projection half lives in the consumer. */
+            source: z.ZodOptional<z.ZodString>;
             notes: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             name: string;
@@ -10100,6 +10153,7 @@ export declare const DOMAIN_SCHEMAS: {
             notes?: string | undefined;
             allowTools?: string[] | undefined;
             contentOrigin?: "local" | "execution" | "external" | undefined;
+            source?: string | undefined;
         }, {
             name: string;
             transport: {
@@ -10120,6 +10174,7 @@ export declare const DOMAIN_SCHEMAS: {
             allowTools?: string[] | undefined;
             elicitation?: boolean | undefined;
             contentOrigin?: "local" | "execution" | "external" | undefined;
+            source?: string | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
         servers: {
@@ -10142,6 +10197,7 @@ export declare const DOMAIN_SCHEMAS: {
             notes?: string | undefined;
             allowTools?: string[] | undefined;
             contentOrigin?: "local" | "execution" | "external" | undefined;
+            source?: string | undefined;
         }[];
     }, {
         servers?: {
@@ -10164,6 +10220,7 @@ export declare const DOMAIN_SCHEMAS: {
             allowTools?: string[] | undefined;
             elicitation?: boolean | undefined;
             contentOrigin?: "local" | "execution" | "external" | undefined;
+            source?: string | undefined;
         }[] | undefined;
     }>, {
         servers: {
@@ -10186,6 +10243,7 @@ export declare const DOMAIN_SCHEMAS: {
             notes?: string | undefined;
             allowTools?: string[] | undefined;
             contentOrigin?: "local" | "execution" | "external" | undefined;
+            source?: string | undefined;
         }[];
     }, {
         servers?: {
@@ -10208,6 +10266,7 @@ export declare const DOMAIN_SCHEMAS: {
             allowTools?: string[] | undefined;
             elicitation?: boolean | undefined;
             contentOrigin?: "local" | "execution" | "external" | undefined;
+            source?: string | undefined;
         }[] | undefined;
     }>;
     readonly plugins: z.ZodEffects<z.ZodObject<{

package/dist/types.js

@@ -1798,7 +1798,7 @@ export const SkillsManifestSchema = z.object({
 });
 // ── Domain: mcp (MCP server 注册表 — docs/MCP-SKILLS.md, Roadmap B1) ────────────
 // sema-registry = an MCP-server REGISTRY: a scenario mounts a subset by `scenarios[]`. Maps onto core's
-// `McpServerSpec = { name, transport: {kind:"stdio",command,args?,env?} | {kind:"http",url,headers?}, allowTools?, contentOrigin? }`.
+// `McpServerSpec = { name, transport: {kind:"stdio",command,args?,env?} | {kind:"http",url,headers?}, allowTools?, contentOrigin?, source? }`.
 // SECRET BOUNDARY (§3.1, design/15): a transport's env/header VALUES may be secret → the center stores only
 // env-NAME references (`envRefs`/`headerRefs`: target-key → an ENV_NAME in the SERVICE's env). The service's
 // `resolveSpec` reads the real values from its own environment — this DB never holds a credential. Like
@@ -1888,6 +1888,21 @@ export const McpServerSpec = z.object({
      *  declared `"local"`, the engine read ABSENT. A value outside the table is REJECTED at parse — a mistyped trust
      *  word must never be read as a legal one (the consumer's gate is equally severe: no case-folding). */
     contentOrigin: z.enum(MCP_CONTENT_ORIGINS).optional(),
+    /** Declaration-plane GROUPING LABEL for this server — maps 1:1 onto the engine's `McpServerSpec.source`
+     *  (core ≥7.5.0 echoes it verbatim on `wiring_manifest.mcp[].source`, single-line + 80-char cap, so a
+     *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
+     *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
+     *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
+     *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+     *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+     *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+     *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+     *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+     *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+     *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+     *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+     *  (ticket B-036 / S-143), the projection half lives in the consumer. */
+    source: z.string().optional(),
     notes: z.string().optional(),
 });
 export const McpConfig = z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",