@sema-agent/server 1.185.0

package/dist/config.js

@@ -0,0 +1,605 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel } from "@sema-agent/core";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
+import { parseApprovalHmacKeys, parsePrincipalJwks } from "./security.js";
+import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
+function csv(name) {
+    return (process.env[name] ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+const AUTONOMY_MODES = ["read-only", "ask", "plan", "auto"];
+export function parseAutonomy(raw) {
+    const v = raw?.trim();
+    if (!v)
+        return undefined;
+    if (!AUTONOMY_MODES.includes(v)) {
+        throw new Error(`env AUTONOMY="${v}" must be one of ${AUTONOMY_MODES.join(" | ")}`);
+    }
+    return v;
+}
+function resolveEnvForward(csvNames) {
+    const out = {};
+    for (const name of csvNames.split(",").map((s) => s.trim()).filter(Boolean)) {
+        const v = process.env[name];
+        if (v !== undefined && v !== "")
+            out[name] = v;
+    }
+    return out;
+}
+function env(name, fallback) {
+    const v = process.env[name];
+    if (v === undefined || v === "") {
+        if (fallback !== undefined)
+            return fallback;
+        throw new Error(`missing required env: ${name}`);
+    }
+    return v;
+}
+function env2(primary, alias, fallback) {
+    const v = process.env[primary] || process.env[alias];
+    if (v === undefined || v === "") {
+        if (fallback !== undefined)
+            return fallback;
+        throw new Error(`missing required env: ${primary} (or ${alias})`);
+    }
+    return v;
+}
+function numEnv(name, fallback) {
+    const raw = env(name, fallback);
+    const n = Number(raw);
+    if (!Number.isFinite(n))
+        throw new Error(`env ${name}="${raw}" must be a number`);
+    return n;
+}
+function numEnvBounded(name, fallback, min, max) {
+    const n = numEnv(name, fallback);
+    if (n < min || n > max)
+        throw new Error(`env ${name}=${n} must be in [${min}, ${max}]`);
+    return n;
+}
+const CONFIG_WARNINGS = [];
+export function drainConfigWarnings() {
+    return CONFIG_WARNINGS.splice(0, CONFIG_WARNINGS.length);
+}
+function optFinitePositiveEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return undefined;
+    const n = Number(raw);
+    if (!(Number.isFinite(n) && n > 0)) {
+        CONFIG_WARNINGS.push({ env: name, raw });
+        return undefined;
+    }
+    return n;
+}
+function enumEnv(name, fallback, allowed) {
+    const v = (process.env[name] ?? fallback);
+    if (!allowed.includes(v))
+        throw new Error(`env ${name}="${v}" must be one of: ${allowed.join(", ")}`);
+    return v;
+}
+function headerNameEnv(name, fallback) {
+    const v = env(name, fallback);
+    if (!/^[A-Za-z0-9_-]+$/.test(v))
+        throw new Error(`env ${name}="${v}" must be a single header name ([A-Za-z0-9_-]+)`);
+    return v;
+}
+function normalizeSshPrivateKey(raw) {
+    const v = raw.trim();
+    if (v.includes("BEGIN ") && v.includes("PRIVATE KEY")) {
+        return v.includes("\n") ? raw : v.replace(/\\n/g, "\n");
+    }
+    try {
+        return Buffer.from(v, "base64").toString("utf8");
+    }
+    catch {
+        return raw;
+    }
+}
+function buildExtraBody() {
+    const body = {};
+    const raw = process.env.MODEL_EXTRA_BODY;
+    if (raw && raw.trim()) {
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (e) {
+            throw new Error(`MODEL_EXTRA_BODY is not valid JSON: ${e.message}`);
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("MODEL_EXTRA_BODY must be a JSON object");
+        }
+        Object.assign(body, parsed);
+    }
+    const fp = process.env.MODEL_FREQUENCY_PENALTY;
+    const pp = process.env.MODEL_PRESENCE_PENALTY;
+    if (fp !== undefined && fp !== "")
+        body.frequency_penalty = Number(fp);
+    if (pp !== undefined && pp !== "")
+        body.presence_penalty = Number(pp);
+    return Object.keys(body).length > 0 ? body : undefined;
+}
+export function loadConfig() {
+    CONFIG_WARNINGS.length = 0;
+    const gatewayBaseUrl = env("MODEL_GATEWAY_BASEURL", "http://127.0.0.1:8000/v1");
+    const modelId = env("MODEL_ID", "Qwen3.5-35B");
+    const singleUserTurnkey = process.env.REQUIRE_PRINCIPAL !== "true";
+    const postureOn = (envVal, infraReady = true) => envVal === "true" ? true : envVal === "false" ? false : singleUserTurnkey && infraReady;
+    const dbBackendRaw = enumEnv("DB_BACKEND", "mysql", ["mysql", "tidb", "pg", "local"]);
+    const dbBackend = dbBackendRaw === "tidb" ? "mysql" : dbBackendRaw;
+    const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local";
+    const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "tidb", "auto"]);
+    const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
+    const memoryEngineEnabled = process.env.MEMORY_ENGINE !== "off";
+    const memoryEngineBackendRaw = process.env.MEMORY_ENGINE_BACKEND ?? "file";
+    if (!["file", "pg", "tidb"].includes(memoryEngineBackendRaw)) {
+        throw new Error(`MEMORY_ENGINE_BACKEND must be file|pg|tidb, got "${memoryEngineBackendRaw}"`);
+    }
+    const memoryEngineBackend = memoryEngineBackendRaw;
+    const workflowSizeGuidelineRaw = process.env.WORKFLOW_SIZE_GUIDELINE;
+    if (workflowSizeGuidelineRaw !== undefined && !["small", "medium", "large", "unrestricted"].includes(workflowSizeGuidelineRaw)) {
+        throw new Error(`WORKFLOW_SIZE_GUIDELINE must be small|medium|large|unrestricted, got "${workflowSizeGuidelineRaw}"`);
+    }
+    const workflowSizeGuideline = workflowSizeGuidelineRaw;
+    const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && process.env.REQUIRE_PRINCIPAL !== "true" ? "local" : undefined);
+    const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
+    const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
+    const memorySyncScopeRaw = process.env.MEMORY_SYNC_SCOPE || undefined;
+    let memorySync;
+    if (memorySyncUrl === undefined) {
+        if (memorySyncToken !== undefined || memorySyncScopeRaw !== undefined) {
+            throw new Error("MEMORY_SYNC_TOKEN/MEMORY_SYNC_SCOPE are set but MEMORY_SYNC_URL is not — refusing to start half-configured (set MEMORY_SYNC_URL to enable memory sync, or unset the other MEMORY_SYNC_* keys)");
+        }
+    }
+    else {
+        if (memoryEngineBackend !== "file") {
+            throw new Error(`MEMORY_SYNC_URL is a FILE-memory (TOC client) knob, but MEMORY_ENGINE_BACKEND=${memoryEngineBackend} — the DB memory plane IS the central sync authority (it serves POST /v1/memory/sync/:scope) and must not also run the client leg; unset MEMORY_SYNC_* here`);
+        }
+        if (memorySyncToken === undefined) {
+            throw new Error("MEMORY_SYNC_URL is set but MEMORY_SYNC_TOKEN is not — refusing to start half-configured (the central sync face requires a bearer token)");
+        }
+        const isV2ScopeKey = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
+        const scope = memorySyncScopeRaw ?? (memoryScope !== undefined ? (isV2ScopeKey(memoryScope) ? memoryScope : formatUserScope(memoryScope)) : undefined);
+        if (scope === undefined) {
+            throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine so MEMORY_SCOPE (default \"local\") provides one");
+        }
+        memorySync = { url: memorySyncUrl, token: memorySyncToken, scope };
+    }
+    const localDataRoot = process.env.LOCAL_DATA_ROOT || process.env.CONFIG_LOCAL_DIR || process.env.AGENT_DATA_DIR || join(homedir(), ".ai-agent");
+    const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!(process.env.MYSQL_HOST || process.env.TIDB_HOST);
+    const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
+    const needsDb = needsTidb;
+    const provider = env("MODEL_PROVIDER", "gateway");
+    const extraBody = buildExtraBody();
+    const thinkingDefault = (() => { const v = process.env.MODEL_DEFAULT_THINKING; return v && isThinkingLevel(v) && v !== "off" ? v : undefined; })();
+    const effortLevels = (process.env.MODEL_REASONING_EFFORT_LEVELS ?? "").split(",").map((s) => s.trim()).filter((s) => isThinkingLevel(s) && s !== "off");
+    const model = {
+        id: modelId,
+        name: modelId,
+        api: provider === "anthropic" ? "anthropic-messages" : "openai-completions",
+        provider,
+        baseUrl: "",
+        reasoning: env("MODEL_REASONING", "true") === "true",
+        input: env("MODEL_VISION", "true") === "true" ? ["text", "image"] : ["text"],
+        cost: {
+            input: Number(env("MODEL_COST_INPUT", "0")),
+            output: Number(env("MODEL_COST_OUTPUT", "0")),
+            cacheRead: Number(env("MODEL_COST_CACHE_READ", "0")),
+            cacheWrite: Number(env("MODEL_COST_CACHE_WRITE", "0")),
+        },
+        contextWindow: Number(env("MODEL_CONTEXT_WINDOW", "262144")),
+        maxTokens: Number(env("MODEL_MAX_TOKENS", "4096")),
+        ...(optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHARS_PER_TOKEN") } : {}),
+        params: { promptCacheFamily: provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
+        ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
+        ...(effortLevels.length > 0 && provider !== "anthropic" ? { compat: { reasoningEffortLevels: effortLevels } } : {}),
+        ...(extraBody ? { extraBody } : {}),
+    };
+    const cheapId = process.env.MODEL_CHEAP_ID;
+    const cheapModel = cheapId
+        ? {
+            ...model,
+            id: cheapId,
+            name: cheapId,
+            input: process.env.MODEL_CHEAP_VISION === undefined
+                ? model.input
+                : process.env.MODEL_CHEAP_VISION === "true"
+                    ? ["text", "image"]
+                    : ["text"],
+            cost: {
+                input: Number(process.env.MODEL_CHEAP_COST_INPUT ?? model.cost.input),
+                output: Number(process.env.MODEL_CHEAP_COST_OUTPUT ?? model.cost.output),
+                cacheRead: Number(process.env.MODEL_CHEAP_COST_CACHE_READ ?? model.cost.cacheRead),
+                cacheWrite: Number(process.env.MODEL_CHEAP_COST_CACHE_WRITE ?? model.cost.cacheWrite),
+            },
+            contextWindow: process.env.MODEL_CHEAP_CONTEXT_WINDOW ? Number(process.env.MODEL_CHEAP_CONTEXT_WINDOW) : model.contextWindow,
+            maxTokens: process.env.MODEL_CHEAP_MAX_TOKENS ? Number(process.env.MODEL_CHEAP_MAX_TOKENS) : model.maxTokens,
+            ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
+            reasoning: process.env.MODEL_CHEAP_REASONING === undefined ? model.reasoning : process.env.MODEL_CHEAP_REASONING === "true",
+        }
+        : undefined;
+    const models = { default: model, [model.id]: model };
+    if (cheapModel)
+        models[cheapModel.id] = cheapModel;
+    const cheapRef = cheapModel ? cheapModel.id : "default";
+    const verifierEnv = process.env.MODEL_VERIFIER;
+    const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : "default";
+    const roles = {
+        verifier: verifierRef,
+    };
+    for (const r of ROSTER_PRIMARY_ROLES)
+        roles[r] = "default";
+    for (const r of ROSTER_CHEAP_ROLES)
+        roles[r] = cheapRef;
+    for (const r of csv("MODEL_CODE_ROLES")) {
+        const role = r;
+        const cur = roles[role];
+        if (cur === undefined)
+            continue;
+        roles[role] =
+            typeof cur === "string"
+                ? { model: cur, systemPrompt: CODE_AGENT_PROMPT }
+                : { ...cur, systemPrompt: CODE_AGENT_PROMPT };
+    }
+    const directApprovalDoor = process.env.DIRECT_APPROVAL_DOOR === "true";
+    const principalJwtPubkeys = parsePrincipalJwks(process.env.PRINCIPAL_JWT_PUBKEYS);
+    const principalJwtIss = process.env.PRINCIPAL_JWT_ISS || undefined;
+    const principalJwtAud = process.env.PRINCIPAL_JWT_AUD || undefined;
+    const principalJwtMaxTtlSec = Math.max(0, numEnv("PRINCIPAL_JWT_MAX_TTL_SEC", "120"));
+    const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS);
+    const dgOperators = csv("OPERATOR_PRINCIPALS");
+    const dgDurable = process.env.DURABLE_APPROVAL === "true";
+    const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
+    if (directApprovalDoor) {
+        const missing = [];
+        if (!dgDurable)
+            missing.push("DURABLE_APPROVAL=true (the direct door's crypto gate only exists on the durable /decide path)");
+        if (dgHmacKeys.length === 0)
+            missing.push("APPROVAL_HMAC_KEYS");
+        if (principalJwtPubkeys.length === 0)
+            missing.push("PRINCIPAL_JWT_PUBKEYS");
+        if (!principalJwtIss)
+            missing.push("PRINCIPAL_JWT_ISS");
+        if (!principalJwtAud)
+            missing.push("PRINCIPAL_JWT_AUD");
+        if (dgOperators.length === 0)
+            missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
+        if (process.env.REQUIRE_PRINCIPAL !== "true")
+            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the spoofable header governs owner/quota checks)");
+        if (missing.length) {
+            throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
+        }
+    }
+    const authTokens = Object.fromEntries((process.env.SERVICE_AUTH_TOKENS ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.includes("="))
+        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
+        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+    const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
+    if (process.env.IMAGE_BAKES_ENABLED === "true" && dgOperators.length === 0) {
+        throw new Error("IMAGE_BAKES_ENABLED=true but OPERATOR_PRINCIPALS is empty — the bake door runs build.sh on the privileged build host; an empty operator set makes isOperator() true-for-all (world-writable RCE). Set OPERATOR_PRINCIPALS or disable bakes (IMAGE-API-DESIGN.md §P2.4a boot invariant)");
+    }
+    if (process.env.IMAGE_BAKES_ENABLED === "true" && !Object.values(authTokens).includes(bakeRunnerPrincipal)) {
+        throw new Error(`IMAGE_BAKES_ENABLED=true but no SERVICE_AUTH_TOKENS entry maps to the runner principal '${bakeRunnerPrincipal}' — the bake-runner authenticates by its credential (token-derived source), so a '<BAKE_RUNNER_TOKEN>=${bakeRunnerPrincipal}' SERVICE_AUTH_TOKENS entry is required or claim/ingest/heartbeat all 403 (IMAGE-API-DESIGN.md §P2.12 boot invariant)`);
+    }
+    return {
+        port: Number(env("PORT", "8090")),
+        gatewayBaseUrl,
+        gatewayApiKey: process.env.MODEL_API_KEY,
+        gatewayFallbackUrls: csv("MODEL_GATEWAY_FALLBACK_URLS"),
+        anthropic: (process.env.ANTHROPIC_API_KEY ?? process.env.ANTHROPIC_AUTH_TOKEN)
+            ? {
+                apiKey: process.env.ANTHROPIC_API_KEY,
+                authToken: process.env.ANTHROPIC_AUTH_TOKEN,
+                baseUrl: process.env.ANTHROPIC_BASEURL ?? process.env.ANTHROPIC_BASE_URL,
+                version: process.env.ANTHROPIC_VERSION,
+                cacheBreakpoints: (process.env.ANTHROPIC_CACHE_BREAKPOINTS ?? "true") === "true",
+                maxRetries: Number(env("ANTHROPIC_MAX_RETRIES", "2")),
+            }
+            : undefined,
+        resilience: {
+            connectTimeoutMs: Number(env("MODEL_CONNECT_TIMEOUT_MS", "0")),
+            firstTokenTimeoutMs: Number(env("MODEL_FIRST_TOKEN_TIMEOUT_MS", "0")),
+            idleTimeoutMs: Number(env("MODEL_IDLE_TIMEOUT_MS", "300000")),
+            circuitBreaker: process.env.MODEL_CIRCUIT_BREAKER === "true",
+            failureThreshold: Number(env("MODEL_CB_FAILURE_THRESHOLD", "5")),
+            cooldownMs: Number(env("MODEL_CB_COOLDOWN_MS", "30000")),
+        },
+        model,
+        models,
+        modelApiKeyEnv: {},
+        modelApiKeys: {},
+        modelQuotaWeights: {},
+        tiers: {},
+        projects: {},
+        roles,
+        sessionBackend,
+        sessionCacheTtlSec: Number(env("SESSION_CACHE_TTL_SEC", "300")),
+        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"),
+        memoryEngineEnabled,
+        memoryEngineDir: process.env.MEMORY_ENGINE_DIR || undefined,
+        memoryEngineRemoteLaneAllowed: process.env.MEMORY_ENGINE_REMOTE_LANE === "allow",
+        memoryEngineBackend,
+        ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}),
+        memoryScope,
+        ...(memorySync ? { memorySync } : {}),
+        remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
+            ? {
+                provider: "e2b",
+                apiKey: process.env.E2B_API_KEY,
+                ...(process.env.E2B_TEMPLATE ? { template: process.env.E2B_TEMPLATE } : {}),
+                ...(process.env.E2B_TIMEOUT_MS ? { timeoutMs: Number(process.env.E2B_TIMEOUT_MS) } : {}),
+                ...(process.env.E2B_LIVENESS_MS ? { livenessMs: Number(process.env.E2B_LIVENESS_MS) } : {}),
+                ...(process.env.E2B_ALLOW_NET ? { allowInternetAccess: process.env.E2B_ALLOW_NET !== "false" } : {}),
+                ...(process.env.E2B_SANDBOX_ENV ? { sandboxEnv: resolveEnvForward(process.env.E2B_SANDBOX_ENV) } : {}),
+            }
+            :
+                process.env.REMOTE_EXEC === "k8s" && process.env.K8S_SANDBOX_IMAGE
+                    ? {
+                        provider: "k8s",
+                        image: process.env.K8S_SANDBOX_IMAGE,
+                        ...(process.env.K8S_API_URL ? { apiUrl: process.env.K8S_API_URL } : {}),
+                        ...(process.env.K8S_TOKEN ? { token: process.env.K8S_TOKEN } : {}),
+                        ...(process.env.K8S_CA_CERT_B64 ? { caCert: Buffer.from(process.env.K8S_CA_CERT_B64, "base64").toString("utf8") } : {}),
+                        ...(process.env.K8S_INSECURE_TLS === "true" ? { insecureTls: true } : {}),
+                        ...(process.env.K8S_NAMESPACE ? { namespace: process.env.K8S_NAMESPACE } : {}),
+                        ...(process.env.K8S_RUNTIME_CLASS != null ? { runtimeClass: process.env.K8S_RUNTIME_CLASS } : {}),
+                        ...(process.env.K8S_MOUNT_PATH ? { mountPath: process.env.K8S_MOUNT_PATH } : {}),
+                        ...(process.env.K8S_TIMEOUT_MS ? { timeoutMs: Number(process.env.K8S_TIMEOUT_MS) } : {}),
+                        ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
+                        ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
+                        ...(process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
+                            ? {
+                                s3Snapshot: {
+                                    endpoint: process.env.MINIO_ENDPOINT,
+                                    bucket: process.env.WORKSPACE_SNAPSHOT_BUCKET ?? "workspaces",
+                                    accessKey: process.env.MINIO_ACCESS_KEY,
+                                    secretKey: process.env.MINIO_SECRET_KEY,
+                                    ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
+                                    ...(process.env.WORKSPACE_SNAPSHOT_PREFIX ? { keyPrefix: process.env.WORKSPACE_SNAPSHOT_PREFIX } : {}),
+                                    ...(process.env.WORKSPACE_SNAPSHOT_TTL_SEC ? { presignTtlSec: Number(process.env.WORKSPACE_SNAPSHOT_TTL_SEC) } : {}),
+                                },
+                            }
+                            : {}),
+                    }
+                    :
+                        process.env.REMOTE_EXEC === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
+                            ? {
+                                provider: "ssh",
+                                host: process.env.SSH_HOST,
+                                username: process.env.SSH_USER,
+                                privateKey: normalizeSshPrivateKey(process.env.SSH_PRIVATE_KEY),
+                                ...(process.env.SSH_PORT ? { port: Number(process.env.SSH_PORT) } : {}),
+                                ...(process.env.SSH_MOUNT_PATH ? { mountPath: process.env.SSH_MOUNT_PATH } : {}),
+                            }
+                            :
+                                process.env.REMOTE_EXEC === "adb" && process.env.ADB_SERIAL
+                                    ? {
+                                        provider: "adb",
+                                        serial: process.env.ADB_SERIAL,
+                                        ...(process.env.ADB_PATH ? { adbPath: process.env.ADB_PATH } : {}),
+                                        ...(process.env.ADB_MOUNT_PATH ? { mountPath: process.env.ADB_MOUNT_PATH } : {}),
+                                    }
+                                    :
+                                        process.env.REMOTE_EXEC === "host"
+                                            ? {
+                                                provider: "host",
+                                                ...(process.env.HOST_WORKSPACE_BASE ? { workspaceBase: process.env.HOST_WORKSPACE_BASE } : {}),
+                                                ...(process.env.HOST_COMMAND_TIMEOUT_MS ? { commandTimeoutMs: Number(process.env.HOST_COMMAND_TIMEOUT_MS) } : {}),
+                                            }
+                                            :
+                                                process.env.REMOTE_EXEC === "local-docker" && process.env.DOCKER_IMAGE
+                                                    ? {
+                                                        provider: "local-docker",
+                                                        image: process.env.DOCKER_IMAGE,
+                                                        ...(process.env.DOCKER_MOUNT_PATH ? { mountPath: process.env.DOCKER_MOUNT_PATH } : {}),
+                                                        ...(process.env.DOCKER_PATH ? { dockerPath: process.env.DOCKER_PATH } : {}),
+                                                        ...(process.env.DOCKER_HOST ? { dockerHost: process.env.DOCKER_HOST } : {}),
+                                                        ...(process.env.DOCKER_MEMORY ? { memory: process.env.DOCKER_MEMORY } : {}),
+                                                        ...(process.env.DOCKER_CPUS ? { cpus: Number(process.env.DOCKER_CPUS) } : {}),
+                                                        ...(process.env.DOCKER_PIDS_LIMIT ? { pidsLimit: Number(process.env.DOCKER_PIDS_LIMIT) } : {}),
+                                                        ...(process.env.DOCKER_DROP_CAPS === "true" ? { dropAllCaps: true } : {}),
+                                                        ...(process.env.DOCKER_NETWORK
+                                                            ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }
+                                                            : {}),
+                                                        ...(process.env.DOCKER_COMMAND_TIMEOUT_MS ? { commandTimeoutMs: Number(process.env.DOCKER_COMMAND_TIMEOUT_MS) } : {}),
+                                                        ...(process.env.DOCKER_SANDBOX_ENV ? { env: resolveEnvForward(process.env.DOCKER_SANDBOX_ENV) } : {}),
+                                                    }
+                                                    :
+                                                        process.env.CONFIG_PROVIDER === "local"
+                                                            ? { provider: "host" }
+                                                            : undefined,
+        worktreeIsolation: process.env.WORKTREE_ISOLATION_ENABLED === "true" && process.env.WORKTREE_REPO_ROOT
+            ? {
+                repoRoot: process.env.WORKTREE_REPO_ROOT,
+                ...(process.env.WORKTREE_ALLOWED_ROOTS
+                    ? { allowedRoots: process.env.WORKTREE_ALLOWED_ROOTS.split(",").map((s) => s.trim()).filter(Boolean) }
+                    : {}),
+                ...(process.env.WORKTREE_BASE_COMMIT ? { commit: process.env.WORKTREE_BASE_COMMIT } : {}),
+            }
+            : undefined,
+        dbBackend,
+        localDataRoot,
+        tidb: needsDb && dbBackend === "mysql"
+            ? {
+                host: env2("MYSQL_HOST", "TIDB_HOST"),
+                port: Number(env2("MYSQL_PORT", "TIDB_PORT", process.env.MYSQL_HOST ? "3306" : "4000")),
+                user: env2("MYSQL_USER", "TIDB_USER"),
+                password: env2("MYSQL_PASSWORD", "TIDB_PASSWORD", ""),
+                database: env2("MYSQL_DATABASE", "TIDB_DATABASE"),
+                connectionLimit: process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE
+                    ? Number(process.env.MYSQL_POOL_SIZE || process.env.TIDB_POOL_SIZE)
+                    : undefined,
+            }
+            : undefined,
+        pg: needsDb && dbBackend === "pg"
+            ? {
+                host: env("PG_HOST"),
+                port: Number(env("PG_PORT", "5432")),
+                user: env("PG_USER"),
+                password: env("PG_PASSWORD", ""),
+                database: env("PG_DATABASE"),
+                connectionLimit: process.env.PG_POOL_SIZE ? Number(process.env.PG_POOL_SIZE) : undefined,
+            }
+            : undefined,
+        dbQueryTimeoutMs: optFinitePositiveEnv("DB_QUERY_TIMEOUT_MS"),
+        snapshotBlobStore: process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
+            ? {
+                endpoint: process.env.MINIO_ENDPOINT,
+                bucket: process.env.SESSION_SNAPSHOT_BUCKET ?? "session-snapshots",
+                accessKey: process.env.MINIO_ACCESS_KEY,
+                secretKey: process.env.MINIO_SECRET_KEY,
+                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
+                ...(process.env.SESSION_SNAPSHOT_PREFIX ? { keyPrefix: process.env.SESSION_SNAPSHOT_PREFIX } : {}),
+                ...((ttl) => (ttl !== undefined ? { presignTtlSec: ttl } : {}))(optFinitePositiveEnv("SESSION_SNAPSHOT_TTL_SEC")),
+            }
+            : undefined,
+        authToken: process.env.SERVICE_AUTH_TOKEN,
+        authTokens,
+        allowUnauthedWrites: process.env.ALLOW_UNAUTHED_WRITES === "true",
+        metricsToken: process.env.METRICS_TOKEN || undefined,
+        traceToken: process.env.TRACE_TOKEN || undefined,
+        corsOrigins: (process.env.CORS_ORIGIN ?? "").split(",").map((s) => s.trim()).filter(Boolean),
+        principalHeader: headerNameEnv("PRINCIPAL_HEADER", "x-agent-principal"),
+        requirePrincipal: process.env.REQUIRE_PRINCIPAL === "true",
+        autonomy: parseAutonomy(process.env.AUTONOMY),
+        approvalRequire: csv("APPROVAL_REQUIRE"),
+        operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
+        cascadeLadder: csv("MODEL_CASCADE_LADDER"),
+        approvalDeny: csv("APPROVAL_DENY"),
+        approvalPollMs: Number(env("APPROVAL_POLL_MS", "1500")),
+        durableApproval: process.env.DURABLE_APPROVAL === "true",
+        resourceSuspend: process.env.RESOURCE_SUSPEND === "true",
+        resourceSuspendTtlSec: Math.max(0, numEnv("RESOURCE_SUSPEND_TTL_SEC", "0")),
+        approvalAutoBudget: Math.min(10000, Math.max(0, numEnv("APPROVAL_AUTO_BUDGET", "0"))),
+        approvalNeverAuto: csv("APPROVAL_NEVER_AUTO"),
+        approvalHmacKeys: dgHmacKeys,
+        directApprovalDoor,
+        principalJwtPubkeys,
+        principalJwtIss,
+        principalJwtAud,
+        principalJwtMaxTtlSec,
+        directDoorActive,
+        infraCostRates: {
+            toolCallMicroUsd: Math.max(0, numEnv("INFRA_COST_TOOL_CALL", "0")),
+            sandboxSecMicroUsd: Math.max(0, numEnv("INFRA_COST_SANDBOX_SEC", "0")),
+            egressGbMicroUsd: Math.max(0, numEnv("INFRA_COST_EGRESS_GB", "0")),
+        },
+        leaderEnabled: process.env.LEADER_ENABLED === "true",
+        leaderFanoutEnabled: process.env.LEADER_FANOUT_ENABLED !== "false",
+        routerEnabled: process.env.ROUTER_ENABLED === "true",
+        selfOrchestrationEnabled: postureOn(process.env.SELF_ORCHESTRATION_ENABLED),
+        forkEnabled: postureOn(process.env.FORK_ENABLED),
+        experimentalObserverAgents: process.env.EXPERIMENTAL_OBSERVER_AGENTS === "true",
+        schedulerEnabled: postureOn(process.env.SCHEDULER_ENABLED),
+        projectMemoryDisabled: process.env.PROJECT_MEMORY_DISABLED === "true",
+        planModeEnabled: process.env.PLAN_MODE_ENABLED !== "false",
+        ...(process.env.SCHEDULER_STORE_PATH ? { schedulerStorePath: process.env.SCHEDULER_STORE_PATH } : {}),
+        selfOrchestrationModels: csv("SELF_ORCHESTRATION_MODELS"),
+        selfOrchestrationWorkerIsolation: process.env.SELF_ORCHESTRATION_WORKER_ISOLATION === "true",
+        workflowRunStoreBackend: enumEnv("WORKFLOW_RUN_STORE", "auto", ["auto", "file", "memory"]),
+        workflowOrphanGraceMs: Math.max(60_000, numEnv("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000))),
+        workflowJournalRetentionMs: Math.max(60_000, numEnv("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000))),
+        workflowRunRetentionMs: Math.max(60_000, numEnv("WORKFLOW_RUN_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000))),
+        ...(process.env.SANDBOX_PKG_SOURCE !== "none"
+            ? { sandboxPkgSource: process.env.SANDBOX_PKG_SOURCE || "global" }
+            : {}),
+        sessionAutoTitle: process.env.SESSION_AUTO_TITLE !== "false",
+        selectEnvironmentTool: process.env.SELECT_ENVIRONMENT_TOOL !== "false",
+        envFactsEnabled: process.env.SANDBOX_ENV_FACTS !== "false",
+        lspEnabled: process.env.LSP_ENABLED === "true",
+        lspHostEnabled: process.env.LSP_ENABLED !== "false",
+        drainGraceMs: Math.max(10_000, numEnv("DRAIN_GRACE_MS", String(10 * 60 * 1000))),
+        mcpElicitation: {
+            enabled: process.env.MCP_ELICITATION_ENABLED === "true",
+            throttle: {
+                maxConcurrentPerRun: numEnvBounded("MCP_ELICITATION_MAX_CONCURRENT", String(DEFAULT_ELICITATION_THROTTLE.maxConcurrentPerRun), 1, 64),
+                maxTotalPerRun: numEnvBounded("MCP_ELICITATION_MAX_TOTAL", String(DEFAULT_ELICITATION_THROTTLE.maxTotalPerRun), 1, 10_000),
+                minIntervalMsPerServer: numEnvBounded("MCP_ELICITATION_MIN_INTERVAL_MS", String(DEFAULT_ELICITATION_THROTTLE.minIntervalMsPerServer), 0, 600_000),
+                ttlMs: numEnvBounded("MCP_ELICITATION_TTL_MS", String(DEFAULT_ELICITATION_THROTTLE.ttlMs), 1_000, 3_600_000),
+            },
+        },
+        askQuestionEnabled: postureOn(process.env.ASK_QUESTION_ENABLED),
+        imageBakes: {
+            enabled: process.env.IMAGE_BAKES_ENABLED === "true",
+            runnerPrincipal: bakeRunnerPrincipal,
+            registry: process.env.BAKE_IMAGE_REGISTRY || null,
+            cacheBase: process.env.BAKE_CACHE_BASE || null,
+            defaultBaseRef: process.env.SANDBOX_BASE_REF || null,
+            leaseMs: Math.max(1000, numEnv("BAKE_LEASE_MS", "90000")),
+            staleMs: Math.max(1000, numEnv("BAKE_STALE_MS", "180000")),
+            submitRateMax: Math.max(0, numEnv("BAKE_SUBMIT_RATE_MAX", "10")),
+            submitRateWindowSec: Math.max(1, numEnv("BAKE_SUBMIT_RATE_WINDOW_SEC", "60")),
+        },
+        toolTrace: process.env.TOOL_TRACE === "true",
+        traceThinking: process.env.TRACE_THINKING !== "false",
+        logLevel: env("LOG_LEVEL", "info"),
+        rateLimitPerMin: numEnv("RATE_LIMIT_RPM", "0"),
+        maxTaskCostUsd: numEnv("MAX_TASK_COST_USD", "0"),
+        maxTaskTokens: numEnv("MAX_TASK_TOKENS", "0"),
+        maxPrincipalCostUsd: numEnv("MAX_PRINCIPAL_COST_USD", "0"),
+        costQuotaWindowSec: numEnv("COST_QUOTA_WINDOW_SEC", "86400"),
+        degrade: process.env.MODEL_DEGRADE_TO
+            ? {
+                to: env("MODEL_DEGRADE_TO"),
+                atCostFraction: Number(env("MODEL_DEGRADE_AT_COST_FRACTION", "0.7")),
+                reactive: process.env.MODEL_DEGRADE_REACTIVE === "true",
+                downgradeOn: csv("MODEL_DEGRADE_ON").length
+                    ? csv("MODEL_DEGRADE_ON")
+                    : undefined,
+                toSupportsImages: process.env.MODEL_DEGRADE_TO_VISION === "true",
+            }
+            : undefined,
+        otel: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
+            ? {
+                endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT.replace(/\/$/, ""),
+                intervalMs: Number(env("OTEL_EXPORT_INTERVAL_MS", "15000")),
+                serviceName: env("OTEL_SERVICE_NAME", "sema-server"),
+                headers: Object.fromEntries(csv("OTEL_EXPORTER_OTLP_HEADERS").map((kv) => {
+                    const i = kv.indexOf("=");
+                    return i === -1 ? [kv, ""] : [kv.slice(0, i).trim(), kv.slice(i + 1).trim()];
+                })),
+            }
+            : undefined,
+        approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
+        reapIntervalSec: numEnv("REAP_INTERVAL_SEC", "60"),
+        runStaleSec: numEnv("REAP_RUN_STALE_SEC", "120"),
+        toolResultTtlSec: Number(env("TOOL_RESULT_TTL_SEC", "86400")),
+        gitApiBaseUrl: process.env.GIT_API_BASEURL,
+        gitApiToken: process.env.GIT_API_TOKEN,
+        defaultScenario: env("DEFAULT_SCENARIO", "default"),
+        skillsDir: env("SKILLS_DIR", "skills"),
+        oaApiBaseUrl: process.env.OA_API_BASEURL,
+        oaServiceToken: process.env.OA_SERVICE_TOKEN,
+        oaIssue: process.env.OA_ISSUE_TOKEN
+            ? {
+                baseUrl: (() => {
+                    const u = process.env.OA_ISSUE_BASEURL ?? process.env.GIT_API_BASEURL;
+                    if (!u)
+                        throw new Error("OA_ISSUE_TOKEN is set but no OA_ISSUE_BASEURL / GIT_API_BASEURL — the issue tool needs a git host");
+                    return u;
+                })(),
+                owner: env("OA_ISSUE_OWNER", "AI-Only"),
+                repo: env("OA_ISSUE_REPO", "oa-asset-system"),
+                token: env("OA_ISSUE_TOKEN"),
+                defaultLabels: csv("OA_ISSUE_LABELS").map(Number).filter((n) => Number.isInteger(n)),
+            }
+            : undefined,
+        configCenter: (process.env.SEMA_REGISTRY_URL || process.env.CONFIG_CENTER_URL)
+            ? {
+                baseUrl: process.env.SEMA_REGISTRY_URL || env("CONFIG_CENTER_URL"),
+                token: process.env.SEMA_REGISTRY_TOKEN || process.env.CONFIG_CENTER_TOKEN || "",
+                dryRun: (process.env.SEMA_REGISTRY_DRY_RUN ?? process.env.CONFIG_CENTER_DRY_RUN) === "true",
+                worker: process.env.SEMA_REGISTRY_WORKER || process.env.CONFIG_CENTER_WORKER || undefined,
+            }
+            : undefined,
+        configProvider: process.env.CONFIG_PROVIDER || undefined,
+        configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
+    };
+}
+//# sourceMappingURL=config.js.map