@sema-agent/settings-schema 1.7.0 → 1.7.1

package/CHANGELOG.md

@@ -6,6 +6,15 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 1.7.1 — 2026-09-06 — `source` 改**只管类型**(撤回 1.7.0 的 min/max 解析拒;patch)
+
+- 1.7.0 把标签规则(非空 ≤80)写进 zod ⇒ 本域整域 all-or-nothing 解析下,**一个**空/超长标签让整套 `mcp.servers`
+  在解析处整域默认(每台 server 消失),消费方 boot 期还容忍空目录——一个显示标签不该有这种爆炸半径
+  (消费方 codex 对抗复审 [high],真库复现:一坏一好两条 server 双双消失)。1.7.1 起 `source: z.string().optional()`,
+  规则单点留在消费方投影层(坏形丢键留 server、留痕)。非字符串仍在解析处拒(那是 JSON 类型错,与任何字段同类)。
+- 顺带如实记:本域 all-or-nothing 解析 + 消费方 boot 容忍空目录,对 `contentOrigin` 闭表等一切解析拒的键**早已**是
+  同一爆炸半径(类病,先于本键存在)——归消费方与本包另立单据处置(逐条目拒而不是整域拒),不在本 patch 射程。
+
 ## 1.7.0 — 2026-09-06 — `mcp.servers[].source` 分组标签(sema-server B-036 / S-143 源头修的声明面半场;新键=minor)
 
 - **`McpServerSpec.source?: string`**(非空、≤80 字;`.optional()` 无默认):声明方自述的层级标签,1:1 对应引擎

package/dist/types.d.ts

@@ -7322,11 +7322,15 @@ export declare const McpServerSpec: z.ZodObject<{
      *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
      *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
      *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
-     *  no label (`.optional()`, no default — a label has no default tier). Empty / over-cap / non-string is
-     *  REJECTED at parse: a malformed label must not enter the ledger silently. Display-only: no gate /
-     *  policy / trust effect (the trust axis is `contentOrigin` above, which stays a closed table).
-     *  Before this key existed both legs stripped it (default-strip object); this is the declaration half of
-     *  the consumer-side fix (ticket B-036 / S-143), the projection half lives in the consumer. */
+     *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+     *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+     *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+     *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+     *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+     *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+     *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+     *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+     *  (ticket B-036 / S-143), the projection half lives in the consumer. */
     source: z.ZodOptional<z.ZodString>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
@@ -7447,11 +7451,15 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
          *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
          *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
          *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
-         *  no label (`.optional()`, no default — a label has no default tier). Empty / over-cap / non-string is
-         *  REJECTED at parse: a malformed label must not enter the ledger silently. Display-only: no gate /
-         *  policy / trust effect (the trust axis is `contentOrigin` above, which stays a closed table).
-         *  Before this key existed both legs stripped it (default-strip object); this is the declaration half of
-         *  the consumer-side fix (ticket B-036 / S-143), the projection half lives in the consumer. */
+         *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+         *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+         *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+         *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+         *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+         *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+         *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+         *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+         *  (ticket B-036 / S-143), the projection half lives in the consumer. */
         source: z.ZodOptional<z.ZodString>;
         notes: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
@@ -10114,11 +10122,15 @@ export declare const DOMAIN_SCHEMAS: {
              *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
              *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
              *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
-             *  no label (`.optional()`, no default — a label has no default tier). Empty / over-cap / non-string is
-             *  REJECTED at parse: a malformed label must not enter the ledger silently. Display-only: no gate /
-             *  policy / trust effect (the trust axis is `contentOrigin` above, which stays a closed table).
-             *  Before this key existed both legs stripped it (default-strip object); this is the declaration half of
-             *  the consumer-side fix (ticket B-036 / S-143), the projection half lives in the consumer. */
+             *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+             *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+             *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+             *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+             *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+             *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+             *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+             *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+             *  (ticket B-036 / S-143), the projection half lives in the consumer. */
             source: z.ZodOptional<z.ZodString>;
             notes: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {

package/dist/types.js

@@ -1893,12 +1893,16 @@ export const McpServerSpec = z.object({
      *  consumer can group servers by where they were declared). An OPEN set: CC's `plugin` / `user` /
      *  `project` / `local` are conventions, not a vocabulary — a deployment's own word is equally legal, so
      *  no closed table here (a closed table would reject the operator's grouping word at parse). ABSENT =
-     *  no label (`.optional()`, no default — a label has no default tier). Empty / over-cap / non-string is
-     *  REJECTED at parse: a malformed label must not enter the ledger silently. Display-only: no gate /
-     *  policy / trust effect (the trust axis is `contentOrigin` above, which stays a closed table).
-     *  Before this key existed both legs stripped it (default-strip object); this is the declaration half of
-     *  the consumer-side fix (ticket B-036 / S-143), the projection half lives in the consumer. */
-    source: z.string().min(1).max(80).optional(),
+     *  no label (`.optional()`, no default — a label has no default tier). 🔴 TYPE-ONLY here (any string):
+     *  the label RULE (non-empty, ≤80 chars) lives in ONE place — the consumer's projection helper, which
+     *  drops a malformed label's KEY, keeps the server and records the drop. It deliberately does NOT live
+     *  here: this domain parses all-or-nothing, so a `min(1)`/`max(80)` at parse would let one empty label
+     *  default the ENTIRE mcp domain (every server gone) — a blast radius a display label must never have
+     *  (1.7.0 shipped that shape for a few hours; 1.7.1 retracts it). Display-only: no gate / policy / trust
+     *  effect (the trust axis is `contentOrigin` above, which stays a closed table). Before this key existed
+     *  both legs stripped it (default-strip object); this is the declaration half of the consumer-side fix
+     *  (ticket B-036 / S-143), the projection half lives in the consumer. */
+    source: z.string().optional(),
     notes: z.string().optional(),
 });
 export const McpConfig = z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",