@stigmer/runner 3.11.0 → 3.12.0

package/src/shared/checkpointer/http-saver.ts

@@ -14,9 +14,9 @@
  * The Java proxy calls Document.parse(json) which handles $binary
  * natively, and doc.toJson() emits the same format on reads.
  *
- * Every request runs through {@link HttpCheckpointSaver.fetchWithRetry}:
- * bounded exponential backoff on transient failures (classified by
- * http-retry.ts) with a per-request abort timeout. This loop is the ONLY
+ * Every request runs through the shared bounded-backoff loop
+ * (http-retry.ts's fetchWithRetry, with this saver's policy: transient
+ * classification + a per-request abort timeout). That loop is the ONLY
  * retry layer between an agent execution and its checkpoints — the deep
  * agent activity is deliberately non-retryable at the Temporal level
  * (maximumAttempts: 1; replaying a whole agent run is not safe), so before
@@ -39,7 +39,7 @@ import {
 } from "@langchain/langgraph-checkpoint";
 import type { CheckpointMetadata, PendingWrite } from "@langchain/langgraph-checkpoint";
 import type { RetryOptions } from "../grpc-retry.js";
-import { isRetryableFetchError, isRetryableHttpStatus } from "../http-retry.js";
+import { fetchWithRetry, type FetchRetryPolicy } from "../http-retry.js";
 
 function encodeB64(data: Uint8Array): string {
   if (typeof Buffer !== "undefined") {
@@ -117,18 +117,10 @@ const DEFAULT_RETRY = {
   requestTimeoutMs: 30_000,
 } as const;
 
-function defaultDelay(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 export class HttpCheckpointSaver extends BaseCheckpointSaver {
   private readonly baseUrl: string;
   private readonly headers: Record<string, string>;
-  private readonly baseDelayMs: number;
-  private readonly backoffFactor: number;
-  private readonly maxRetries: number;
-  private readonly requestTimeoutMs: number;
-  private readonly delay: (ms: number) => Promise<void>;
+  private readonly retryPolicy: FetchRetryPolicy;
 
   constructor(
     proxyEndpoint: string,
@@ -141,55 +133,18 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
       Authorization: `Bearer ${authToken}`,
       "Content-Type": "application/json",
     };
-    this.baseDelayMs = options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs;
-    this.backoffFactor = options.backoffFactor ?? DEFAULT_RETRY.backoffFactor;
-    this.maxRetries = options.maxRetries ?? DEFAULT_RETRY.maxRetries;
-    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs;
-    this.delay = options.delayFn ?? defaultDelay;
-  }
-
-  /**
-   * `fetch` with bounded exponential backoff on transient failures and a
-   * per-request abort timeout.
-   *
-   * Composition contract: on a non-retryable status — or when the budget is
-   * exhausted on a retryable one — the last `Response` is RETURNED, so every
-   * call site keeps its own `resp.ok` / 404 handling unchanged; this wrapper
-   * changes when a response arrives, never what call sites do with it. It
-   * throws only what `fetch` itself throws: a network-level rejection that is
-   * non-retryable or has exhausted the budget.
-   */
-  private async fetchWithRetry(url: string, init?: RequestInit): Promise<Response> {
-    for (let attempt = 0; ; attempt++) {
-      const canRetry = attempt < this.maxRetries;
-      let resp: Response;
-      try {
-        resp = await fetch(url, {
-          ...init,
-          signal: AbortSignal.timeout(this.requestTimeoutMs),
-        });
-      } catch (err) {
-        if (canRetry && isRetryableFetchError(err)) {
-          await this.backOff(attempt, String(err));
-          continue;
-        }
-        throw err;
-      }
-      if (canRetry && isRetryableHttpStatus(resp.status)) {
-        await this.backOff(attempt, `HTTP ${resp.status} ${resp.statusText}`);
-        continue;
-      }
-      return resp;
-    }
+    this.retryPolicy = {
+      label: "HttpCheckpointSaver",
+      baseDelayMs: options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs,
+      backoffFactor: options.backoffFactor ?? DEFAULT_RETRY.backoffFactor,
+      maxRetries: options.maxRetries ?? DEFAULT_RETRY.maxRetries,
+      requestTimeoutMs: options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs,
+      delayFn: options.delayFn,
+    };
   }
 
-  private async backOff(attempt: number, reason: string): Promise<void> {
-    const delayMs = this.baseDelayMs * Math.pow(this.backoffFactor, attempt);
-    console.warn(
-      `[HttpCheckpointSaver] retryable failure ` +
-      `(attempt ${attempt + 1}/${this.maxRetries + 1}, retry in ${delayMs}ms): ${reason}`,
-    );
-    await this.delay(delayMs);
+  private fetchWithRetry(url: string, init?: RequestInit): Promise<Response> {
+    return fetchWithRetry(url, init, this.retryPolicy);
   }
 
   private async serializeTyped(obj: unknown): Promise<[string, BinaryObj]> {

package/src/shared/conversation-attachment.ts

@@ -1,8 +1,7 @@
 /**
  * The runner-synthesized conversation participation attachment
- * (channel-conversations DD-008 D-c, A14) — the third synthesized
- * attachment, on the datastore module's shape (a cheap local predicate,
- * not the channel module's discovery machinery).
+ * (channel-conversations DD-008 D-c, A14) — a cheap local predicate,
+ * not the channel module's discovery machinery.
  *
  * When the session IS a live channel conversation, the runner
  * synthesizes ONE MCP attachment serving `escalate_to_human`, so the

package/src/shared/conversation-catchup.ts

@@ -1,8 +1,15 @@
 /**
  * Conversation catchup (cloud channel-conversations DD-006): what happened on
  * a live channel conversation that the agent has not seen — customer messages
- * handled by a human teammate, the teammate's replies, platform notices the
- * customer received, notes, and the agent's own earlier escalations.
+ * handled by a human teammate, the teammate's replies, platform notices,
+ * notes, and the agent's own earlier escalations. Since cloud#347 a line
+ * whose send is known-undelivered carries a `(not delivered)` speaker
+ * annotation and an in-flight one carries `(sending)` — the digest no longer
+ * implies every public-lane line reached the customer. Since cloud#352 the
+ * digest also closes the feedback loop on send OUTCOMES: the agent's own
+ * dead-lettered sends surface as `You (not delivered):` lines, and a send
+ * that failed only after an earlier digest already conveyed it surfaces as a
+ * `System:` delivery-failure notice at the moment the failure became known.
  *
  * The cloud composes the CONTENT (bare `Customer:` / `Teammate:` / `System:` /
  * `You escalated:` / `Note:` lines, oldest first) on the execution spec's
@@ -29,16 +36,42 @@ import type { ConversationCatchup } from "@stigmer/protos/ai/stigmer/agentic/age
  * drift between them. Deliberately takeover-neutral: a digest can exist with
  * no human handoff at all (a failed turn's re-composed window), so the
  * preamble asserts only what is always true (the A15/A20 honesty bar).
+ *
+ * The send-status annotations (cloud#347) get an explicit exception from the
+ * don't-re-answer contract: a `(not delivered)` teammate reply is words the
+ * customer never got, so treating it as settled history would silently
+ * abandon whatever it was meant to convey. The preamble defines the
+ * annotations — the DD-013 split puts model-facing meaning here, while the
+ * cloud composer owns which lines earn them.
+ *
+ * The send-outcome lines (cloud#352, cloud triage DD-009) extend the same
+ * exception to the agent's OWN sends: `You (not delivered):` lines and
+ * `System:` delivery-failure notices mean the customer never got those
+ * words. The behavioral contract is owner-ruled (DD-009 Q-4): treat the
+ * failure as unfinished conversation business — weigh what still needs
+ * saying and re-say it naturally in the next turn — but never resend the
+ * failed text verbatim: a multi-chunk send can partially land, and a
+ * word-for-word repeat risks the customer reading the same message twice.
  */
 const CONVERSATION_CATCHUP_PREAMBLE =
   "Below is activity from this conversation that you have not seen — " +
   "oldest first. It may include customer messages that were handled by a " +
-  "human teammate, the teammate's own replies, notices the customer " +
-  "received, internal notes, and escalations you raised earlier. Treat it " +
+  "human teammate, the teammate's own replies, notices sent to the " +
+  "customer, internal notes, and escalations you raised earlier. Treat it " +
   "as conversation history you already know: do not answer or re-answer " +
   "these messages, do not repeat or summarize them back, and do not " +
-  "mention any handoff unless asked. Continue from the customer's newest " +
-  "message.";
+  "mention any handoff unless asked. One exception: lines marked " +
+  "(not delivered) never reached the customer, and lines marked (sending) " +
+  "were still on their way when this summary was built — the customer may " +
+  "not have seen those words, so weigh that when deciding what still needs " +
+  "saying. That includes your own words: a line marked " +
+  "You (not delivered), or a System line reporting that a message was not " +
+  "delivered, means the customer never received it. Treat such a failure " +
+  "as unfinished business — if what it said still matters, work it " +
+  "naturally into your reply in your own words, but never resend the " +
+  "failed text word-for-word (part of it may have reached the customer, " +
+  "and an exact repeat reads as a duplicate). " +
+  "Continue from the customer's newest message.";
 
 /**
  * Read the catchup digest from an execution spec's `conversation_catchup`.

package/src/shared/grpc-retry.ts

@@ -6,7 +6,11 @@
  * `updateStatus` should back off and retry (transient transport errors) or
  * fail fast (deterministic errors). This module is intentionally just the
  * classification policy + its options type, kept small and separately tested;
- * the persist loop that consumes it lives with the rest of the persist logic.
+ * the persist loop that consumes it lives with the rest of the persist logic
+ * in status.ts — a single consumer whose loop is interwoven with persist
+ * semantics. (The HTTP twin, http-retry.ts, diverged there deliberately: with
+ * three fetch clients needing a byte-identical loop it hosts the shared
+ * fetchWithRetry too — see its module doc.)
  */
 
 import { ConnectError, Code } from "@connectrpc/connect";

package/src/shared/http-retry.ts

@@ -1,14 +1,17 @@
 /**
- * HTTP error classification for side-channel proxy retries.
+ * HTTP error classification AND the shared bounded-backoff loop for
+ * side-channel proxy retries.
  *
  * The runner reaches stigmer-service's Side-Channel Proxy (`/v1/proxy/...`)
- * over plain `fetch` from several clients — the checkpoint saver today;
- * artifact storage, the LLM proxy, and the registry endpoint are candidates
- * (stigmer/stigmer#468). This module is the one place that answers "is this
- * HTTP failure worth retrying?", the `fetch` twin of grpc-retry.ts: it holds
- * the classification policy only, kept small and separately tested. The
- * bounded-backoff loop that consumes it lives with each client (the
- * grpc-retry/status.ts split).
+ * over plain `fetch` from several clients: the checkpoint saver, artifact
+ * storage, and the model-registry fetches (stigmer/stigmer#468). This module
+ * is the one place that answers "is this HTTP failure worth retrying?" — the
+ * `fetch` twin of grpc-retry.ts — and, since #468, also owns the
+ * {@link fetchWithRetry} loop those clients share. That is a deliberate
+ * divergence from grpc-retry.ts's policy-only split: the gRPC side has a
+ * single consumer whose loop is interwoven with persist-specific logic
+ * (status.ts), while the HTTP side grew three consumers needing a
+ * byte-identical loop — per-client copies were the drift risk, not the seam.
  *
  * The policy is grounded in what the proxy actually emits, not HTTP folklore.
  * CheckpointerProxyController returns exactly four deterministic errors —
@@ -17,7 +20,10 @@
  * reach the runner only as 5xx (Spring's error handler, ingress 502-504),
  * 408/429 (infrastructure between runner and service), or as network-level
  * fetch rejections. 401/403 stay terminal deliberately: retrying cannot fix
- * an expired or rejected credential.
+ * an expired or rejected credential. The same classification holds for the
+ * presigned R2 URLs artifact storage talks to: their deterministic failures
+ * (403 expired signature, 404 missing object) are 4xx, their transient ones
+ * are 5xx/network.
  */
 
 /**
@@ -48,3 +54,86 @@ export function isRetryableFetchError(err: unknown): boolean {
   if (err instanceof TypeError) return true;
   return err instanceof Error && err.name === "TimeoutError";
 }
+
+/**
+ * A fully-resolved retry policy for {@link fetchWithRetry}. Every field is
+ * required on purpose: defaults differ per client (the checkpointer and the
+ * presign endpoints run 30 s requests, artifact transfers 120 s, registry
+ * fetches 10 s), so each client resolves its own defaults once and this
+ * module never guesses.
+ */
+export interface FetchRetryPolicy {
+  /** Client name for retry logs, e.g. "HttpCheckpointSaver". */
+  readonly label: string;
+  /** Delay before the first retry (ms); doubles per attempt via the factor. */
+  readonly baseDelayMs: number;
+  readonly backoffFactor: number;
+  /** Retry attempts after the initial one. */
+  readonly maxRetries: number;
+  /**
+   * Milliseconds before an in-flight request is aborted and the attempt is
+   * classified retryable. Without it a hung connection (the realistic
+   * unplanned-pod-kill symptom) stalls forever and the retry never engages.
+   */
+  readonly requestTimeoutMs: number;
+  /** Injectable delay for tests; defaults to a real setTimeout sleep. */
+  readonly delayFn?: (ms: number) => Promise<void>;
+}
+
+function defaultDelay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * `fetch` with bounded exponential backoff on transient failures and a
+ * per-request abort timeout.
+ *
+ * Composition contract: on a non-retryable status — or when the budget is
+ * exhausted on a retryable one — the last `Response` is RETURNED, so every
+ * call site keeps its own `resp.ok` / 404 handling unchanged; this wrapper
+ * changes when a response arrives, never what call sites do with it. It
+ * throws only what `fetch` itself throws: a network-level rejection that is
+ * non-retryable or has exhausted the budget.
+ */
+export async function fetchWithRetry(
+  url: string,
+  init: RequestInit | undefined,
+  policy: FetchRetryPolicy,
+): Promise<Response> {
+  const delay = policy.delayFn ?? defaultDelay;
+  for (let attempt = 0; ; attempt++) {
+    const canRetry = attempt < policy.maxRetries;
+    let resp: Response;
+    try {
+      resp = await fetch(url, {
+        ...init,
+        signal: AbortSignal.timeout(policy.requestTimeoutMs),
+      });
+    } catch (err) {
+      if (canRetry && isRetryableFetchError(err)) {
+        await backOff(policy, delay, attempt, String(err));
+        continue;
+      }
+      throw err;
+    }
+    if (canRetry && isRetryableHttpStatus(resp.status)) {
+      await backOff(policy, delay, attempt, `HTTP ${resp.status} ${resp.statusText}`);
+      continue;
+    }
+    return resp;
+  }
+}
+
+async function backOff(
+  policy: FetchRetryPolicy,
+  delay: (ms: number) => Promise<void>,
+  attempt: number,
+  reason: string,
+): Promise<void> {
+  const delayMs = policy.baseDelayMs * Math.pow(policy.backoffFactor, attempt);
+  console.warn(
+    `[${policy.label}] retryable failure ` +
+    `(attempt ${attempt + 1}/${policy.maxRetries + 1}, retry in ${delayMs}ms): ${reason}`,
+  );
+  await delay(delayMs);
+}

package/src/shared/mcp-manager.ts

@@ -4,6 +4,10 @@
  * Wraps @langchain/mcp-adapters MultiServerMCPClient with:
  * - Conversion from ResolvedMcpServer[] to the SDK's Connection config
  * - Proper async cleanup via close()
+ * - Input-schema sanitization of unicode-invalid regex patterns
+ *   (issue #420; semantics in shared/mcp-schema-sanitizer.ts) — a vendor
+ *   pattern that cannot compile under the /u flag must not leave its tool
+ *   permanently uncallable
  * - Tool filtering by each server's effective enabled_tools allow-list
  *   (issue #350; semantics in shared/mcp-enabled-tools.ts) — the model only
  *   ever sees the tools the agent's manifest enables
@@ -18,10 +22,10 @@
  * (HOME, LOGNAME, PATH, SHELL, TERM, USER — getDefaultEnvironment in
  * @modelcontextprotocol/sdk, merged under whatever we pass). The
  * runner's own process env is never passed: it carries runner-internal
- * credentials (STIGMER_TOKEN, STIGMER_RUNNER_HITL_SECRET,
- * CURSOR_API_KEY, LLM provider keys) that no third-party MCP subprocess
- * may see. A declared-empty env and an undeclared env are deliberately
- * equivalent — both yield the SDK base environment.
+ * credentials (enumerated in runner-credential-keys.ts) that no
+ * third-party MCP subprocess may see. A declared-empty env and an
+ * undeclared env are deliberately equivalent — both yield the SDK base
+ * environment.
  *
  * The Cursor execution path does NOT use this manager — it passes MCP
  * configs directly to the Cursor SDK via toCursorMcpConfig(). This
@@ -35,6 +39,7 @@ import type { Connection } from "@langchain/mcp-adapters";
 import type { DynamicStructuredTool } from "@langchain/core/tools";
 import type { ResolvedMcpServer } from "./mcp-resolver.js";
 import { filterToolsByEnabledTools } from "./mcp-enabled-tools.js";
+import { sanitizeSchemaPatterns } from "./mcp-schema-sanitizer.js";
 
 /**
  * Convert harness-agnostic ResolvedMcpServer[] into the
@@ -100,6 +105,32 @@ export async function connectMcpServers(
   const client = new MultiServerMCPClient(connectionConfig);
   const discoveredToolMap = await client.initializeConnections();
 
+  // Drop unicode-invalid regex patterns from every discovered tool's input
+  // schema BEFORE anything downstream holds a reference (issue #420):
+  // @langchain/core re-validates against tool.schema on every invocation,
+  // so one vendor pattern that cannot compile under the /u flag would
+  // otherwise make its tool permanently uncallable. Semantics and the
+  // loosen-never-tighten invariant live in shared/mcp-schema-sanitizer.ts.
+  for (const [slug, discovered] of Object.entries(discoveredToolMap)) {
+    for (const tool of discovered) {
+      const droppedPatterns = sanitizeSchemaPatterns(tool.schema);
+      if (droppedPatterns.length > 0) {
+        console.warn(
+          `[MCP] Server '${slug}' tool '${tool.name}': dropped ` +
+          `${droppedPatterns.length} regex pattern(s) that cannot compile ` +
+          `under the unicode flag — the tool stays callable, the server ` +
+          `still validates its own inputs (issue #420): ` +
+          droppedPatterns
+            .map((d) =>
+              `${d.location} ${JSON.stringify(d.pattern)}` +
+              (d.compilesWithoutUnicodeFlag ? "" : " (invalid without /u too)"),
+            )
+            .join(", "),
+        );
+      }
+    }
+  }
+
   // Enforce each server's effective enabled_tools allow-list (issue #350)
   // HERE, before anything downstream sees the tools: the parent tool list,
   // the approval gate's toolServerMap, and the sub-agent McpAccess filter

package/src/shared/mcp-schema-sanitizer.ts

@@ -0,0 +1,224 @@
+/**
+ * Unicode-flag regex sanitization for MCP tool input schemas (issue #420).
+ *
+ * Why this exists: real-world MCP servers ship JSON-schema `pattern` values
+ * that are legal as plain ECMAScript regexes but invalid under the unicode
+ * flag (PayPal's `^https\:\/\/` — `\:` is an invalid escape under /u).
+ * @langchain/core validates tool input on EVERY call with
+ * @cfworker/json-schema, which compiles patterns via `new RegExp(p, "u")`
+ * at exactly two uncaught sites: the `pattern` keyword and each
+ * `patternProperties` key. One bad vendor pattern therefore makes the tool
+ * permanently uncallable on the deep-agent path — every invocation dies
+ * with a cryptic SyntaxError before the tool is ever reached. (The third
+ * /u compile site, `format: "regex"`, validates instance values inside a
+ * try/catch and fails gracefully — not a crash surface.)
+ *
+ * The fix: at the deep-agent connect funnel (mcp-manager.ts
+ * connectMcpServers), drop every pattern that cannot compile under /u.
+ * Dropping is deliberate — rewriting to a /u-safe equivalent would need an
+ * Annex-B-aware regex transpiler, disproportionate machinery for what is
+ * best-effort client-side validation; the MCP server still validates its
+ * own inputs server-side. This mirrors the loosening posture of
+ * @langchain/mcp-adapters' own schema pipeline (dereferenceJsonSchema →
+ * simplifyJsonSchemaForLLM), which already normalizes schemas for this
+ * exact validator.
+ *
+ * THE INVARIANT: sanitization may only ever LOOSEN validation, never
+ * tighten it. Dropping a `patternProperties` entry naively would violate
+ * this — @cfworker marks pattern-matched keys as "evaluated" and routes
+ * unevaluated keys into the `additionalProperties` / `unevaluatedProperties`
+ * checks, so under `additionalProperties: false` the drop would flip a
+ * crash into a false REJECTION of valid inputs. Whenever a
+ * `patternProperties` entry is dropped, any restrictive
+ * `additionalProperties` / `unevaluatedProperties` at that schema level is
+ * therefore relaxed too.
+ *
+ * Scope: this sanitizer serves the EXECUTION path only. Discovery
+ * (activities/discover-mcp-server.ts) persists tool schemas verbatim from
+ * listTools — deliberately: the stored schema is the vendor's truth for
+ * display, and discovery never invokes tools, so it cannot hit the crash.
+ * Do not "extend" sanitization there.
+ */
+
+/** One dropped regex constraint, for the caller's log line. */
+export interface DroppedPattern {
+  /** JSON-pointer-style path of the dropped constraint within the schema. */
+  location: string;
+  /** The pattern source that failed to compile under the unicode flag. */
+  pattern: string;
+  /**
+   * True when the pattern compiles WITHOUT the /u flag — vendor sloppiness
+   * (Annex B legacy syntax), the oss#420 class. False means the regex is
+   * broken outright; either way validation could only crash, so both drop.
+   */
+  compilesWithoutUnicodeFlag: boolean;
+}
+
+/** Keywords whose value is a single subschema. */
+const SINGLE_SCHEMA_KEYWORDS = [
+  "additionalProperties",
+  "unevaluatedProperties",
+  "propertyNames",
+  "items",
+  "additionalItems",
+  "unevaluatedItems",
+  "contains",
+  "not",
+  "if",
+  "then",
+  "else",
+] as const;
+
+/** Keywords whose value is an array of subschemas. */
+const SCHEMA_ARRAY_KEYWORDS = ["anyOf", "allOf", "oneOf", "prefixItems"] as const;
+
+/** Keywords whose value is an object mapping names to subschemas. */
+const SCHEMA_MAP_KEYWORDS = [
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+] as const;
+
+function compilesUnderUnicodeFlag(pattern: string): boolean {
+  try {
+    new RegExp(pattern, "u");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function compilesWithoutUnicodeFlag(pattern: string): boolean {
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** JSON-pointer token escaping (RFC 6901): `~` → `~0`, `/` → `~1`. */
+function pointerToken(token: string): string {
+  return token.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+
+/**
+ * Drop unicode-invalid regex patterns from a JSON schema, in place.
+ *
+ * Walks only schema positions (the recursion set is @cfworker's own
+ * validated-keyword list), so a property literally NAMED "pattern" under
+ * `properties` is never touched. The walker handles composition keywords
+ * (anyOf/allOf/oneOf/not/if-then-else) even though the adapter's
+ * simplifyJsonSchemaForLLM currently strips them, and carries a visited-set
+ * cycle guard even though the adapter's $ref inlining currently guarantees
+ * an acyclic result — correctness here must not depend on another
+ * package's internals holding across dependency bumps.
+ *
+ * Returns the dropped constraints (empty for clean schemas — the common
+ * case, which this walk leaves byte-identical).
+ */
+export function sanitizeSchemaPatterns(schema: unknown): DroppedPattern[] {
+  const dropped: DroppedPattern[] = [];
+  if (!isPlainObject(schema)) return dropped;
+  walkSchema(schema, "", dropped, new Set());
+  return dropped;
+}
+
+function recordDrop(dropped: DroppedPattern[], location: string, pattern: string): void {
+  dropped.push({
+    location,
+    pattern,
+    compilesWithoutUnicodeFlag: compilesWithoutUnicodeFlag(pattern),
+  });
+}
+
+function walkSchema(
+  node: Record<string, unknown>,
+  path: string,
+  dropped: DroppedPattern[],
+  seen: Set<object>,
+): void {
+  if (seen.has(node)) return;
+  seen.add(node);
+
+  if (typeof node.pattern === "string" && !compilesUnderUnicodeFlag(node.pattern)) {
+    recordDrop(dropped, `${path}/pattern`, node.pattern);
+    delete node.pattern;
+  }
+
+  if (isPlainObject(node.patternProperties)) {
+    const patternProperties = node.patternProperties;
+    let droppedEntry = false;
+    for (const key of Object.keys(patternProperties)) {
+      if (compilesUnderUnicodeFlag(key)) continue;
+      recordDrop(dropped, `${path}/patternProperties/${pointerToken(key)}`, key);
+      delete patternProperties[key];
+      droppedEntry = true;
+    }
+    if (droppedEntry) {
+      // Never-tighten: keys the dropped pattern used to match would now
+      // fall through to these checks and could be falsely rejected.
+      if (node.additionalProperties !== undefined && node.additionalProperties !== true) {
+        delete node.additionalProperties;
+      }
+      if (node.unevaluatedProperties !== undefined && node.unevaluatedProperties !== true) {
+        delete node.unevaluatedProperties;
+      }
+      if (Object.keys(patternProperties).length === 0) {
+        delete node.patternProperties;
+      }
+    }
+  }
+
+  for (const keyword of SINGLE_SCHEMA_KEYWORDS) {
+    const value = node[keyword];
+    if (isPlainObject(value)) {
+      walkSchema(value, `${path}/${keyword}`, dropped, seen);
+    }
+  }
+
+  for (const keyword of SCHEMA_ARRAY_KEYWORDS) {
+    const value = node[keyword];
+    if (!Array.isArray(value)) continue;
+    value.forEach((entry, index) => {
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/${keyword}/${index}`, dropped, seen);
+      }
+    });
+  }
+
+  for (const keyword of SCHEMA_MAP_KEYWORDS) {
+    const value = node[keyword];
+    if (!isPlainObject(value)) continue;
+    for (const [name, entry] of Object.entries(value)) {
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/${keyword}/${pointerToken(name)}`, dropped, seen);
+      }
+    }
+  }
+
+  // Draft-07 `items` tuple form and `dependencies` schema form — both
+  // keywords are dual-shaped, so the typed loops above miss these arms.
+  if (Array.isArray(node.items)) {
+    node.items.forEach((entry, index) => {
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/items/${index}`, dropped, seen);
+      }
+    });
+  }
+  if (isPlainObject(node.dependencies)) {
+    for (const [name, entry] of Object.entries(node.dependencies)) {
+      // Array-valued entries are dependentRequired (property names, not
+      // schemas) — only schema-valued entries are walked.
+      if (isPlainObject(entry)) {
+        walkSchema(entry, `${path}/dependencies/${pointerToken(name)}`, dropped, seen);
+      }
+    }
+  }
+}

package/src/shared/mcp-transport-guard.ts

@@ -60,8 +60,8 @@ export function resolveMcpTransportPosture(
 /**
  * Assert that a resolved MCP server's transport is allowed under the given
  * posture. Applies only to user-defined McpServer resources flowing through
- * the resolvers — the internal datastore attachment is synthesized
- * separately and is already HTTP in cloud mode.
+ * the resolvers — the internal synthesized attachments are built
+ * separately and are already HTTP in cloud mode.
  *
  * @throws McpTransportError when the posture forbids stdio and the server uses it
  */