@sema-agent/server 1.185.0

package/deploy/sema-up/chart/templates/pg-cluster.yaml

@@ -0,0 +1,57 @@
+# ── 数据面:CNPG HA(REV-2 §3c 调优参数)──────────────────────────────────────
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: sema-pg
+  namespace: {{ .Release.Namespace }}
+spec:
+  instances: {{ .Values.pg.instances }}
+  # 反亲和(>=3 机 required,不然调度器把多实例挤同节点——复审实抓 pg-2/pg-3 同机;
+  # <3 机 preferred,required 会让副本永久 Pending——单节点 dev 真踩)
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname
+    podAntiAffinityType: {{ .Values.pg.antiAffinity }}
+  storage:
+    size: {{ .Values.pg.storageSize }}
+{{- if .Values.pg.storageClass }}
+    storageClass: {{ .Values.pg.storageClass }}
+{{- end }}
+  bootstrap:
+    initdb:
+      database: sema
+      owner: sema
+  postgresql:
+    parameters:
+{{ toYaml .Values.pg.parameters | indent 6 }}
+{{- if .Values.pg.backup.enabled }}
+  # ⚠ in-tree barman 在 CNPG 1.31 移除——operator 钉 1.30.0;升 operator 前必须先迁 barman-cloud plugin(需 cert-manager)
+  backup:
+    retentionPolicy: {{ .Values.pg.backup.retention }}
+    barmanObjectStore:
+      destinationPath: {{ .Values.pg.backup.bucket }}
+      endpointURL: http://sema-minio.{{ .Release.Namespace }}.svc:9000
+      s3Credentials:
+        accessKeyId:
+          name: sema-minio
+          key: rootUser
+        secretAccessKey:
+          name: sema-minio
+          key: rootPassword
+      wal:
+        compression: gzip
+{{- end }}
+{{- if .Values.pg.backup.enabled }}
+---
+# 每日基备(WAL 连续归档另在跑,支持 PITR);bucket 需先建(cluster-up mc mb)
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: sema-pg-daily
+  namespace: {{ .Release.Namespace }}
+spec:
+  schedule: {{ .Values.pg.backup.schedule | quote }}
+  backupOwnerReference: self
+  cluster:
+    name: sema-pg
+{{- end }}

package/deploy/sema-up/chart/templates/registry.yaml

@@ -0,0 +1,88 @@
+# ── sema-registry 配置中心(可选,各档默认带上;SQLite 落 PVC)──────────────────
+{{- if .Values.registry.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sema-registry-env
+  namespace: {{ .Release.Namespace }}
+stringData:
+  ADMIN_BOOTSTRAP_PASSWORD: {{ required "registry.adminPassword is required (registry.enabled=true)" .Values.registry.adminPassword | quote }}
+  SESSION_SECRET: {{ required "registry.sessionSecret is required" .Values.registry.sessionSecret | quote }}
+  SERVICE_PULL_TOKEN: {{ required "registry.pullToken is required" .Values.registry.pullToken | quote }}
+{{- if .Values.registry.giteaOauthClientSecret }}
+  GITEA_OAUTH_CLIENT_SECRET: {{ .Values.registry.giteaOauthClientSecret | quote }}
+{{- end }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sema-registry-data
+  namespace: {{ .Release.Namespace }}
+spec:
+  accessModes: [ReadWriteOnce]
+{{- if .Values.registry.storageClass }}
+  storageClassName: {{ .Values.registry.storageClass }}
+{{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.registry.storageSize }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sema-registry
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: 1        # SQLite 单写者;要横向扩先迁 CONFIG_STORE=pg
+  strategy: { type: Recreate }   # RWO PVC:滚动升级会双 pod 抢卷,Recreate 才换得动
+  selector:
+    matchLabels: { app: sema-registry }
+  template:
+    metadata:
+      labels: { app: sema-registry }
+    spec:
+{{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{- range . }}
+        - name: {{ . }}
+{{- end }}
+{{- end }}
+      containers:
+        - name: registry
+          image: {{ required "registry.image is required (registry.enabled=true)" .Values.registry.image | quote }}
+          ports: [{ containerPort: 3000 }]
+          env:
+            - { name: NODE_ENV, value: production }
+            - { name: CONFIG_STORE, value: sqlite }
+            - { name: CONFIG_DB_PATH, value: /app/data/config.db }
+            - { name: ADMIN_BOOTSTRAP_USER, value: {{ .Values.registry.adminUser | quote }} }
+            - { name: ADMIN_BOOTSTRAP_PASSWORD, valueFrom: { secretKeyRef: { name: sema-registry-env, key: ADMIN_BOOTSTRAP_PASSWORD } } }
+            - { name: SESSION_SECRET, valueFrom: { secretKeyRef: { name: sema-registry-env, key: SESSION_SECRET } } }
+            - { name: SERVICE_PULL_TOKEN, valueFrom: { secretKeyRef: { name: sema-registry-env, key: SERVICE_PULL_TOKEN } } }
+{{- if .Values.registry.giteaBaseUrl }}
+            - { name: GITEA_BASE_URL, value: {{ .Values.registry.giteaBaseUrl | quote }} }
+            - { name: GITEA_OAUTH_CLIENT_ID, value: {{ .Values.registry.giteaOauthClientId | quote }} }
+            - { name: GITEA_OAUTH_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: sema-registry-env, key: GITEA_OAUTH_CLIENT_SECRET } } }
+{{- end }}
+          volumeMounts: [{ name: data, mountPath: /app/data }]
+          readinessProbe:
+            httpGet: { path: /api/healthz, port: 3000 }
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      volumes:
+        - name: data
+          persistentVolumeClaim: { claimName: sema-registry-data }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sema-registry
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: NodePort
+  selector: { app: sema-registry }
+  ports:
+    - port: 3000
+      targetPort: 3000
+      nodePort: {{ .Values.registry.nodePort }}
+{{- end }}

package/deploy/sema-up/chart/templates/sandbox-rbac.yaml

@@ -0,0 +1,45 @@
+# ── 沙箱 lane RBAC(k8s+kata;五动词)────────────────────────────────
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sema-runner
+  namespace: {{ .Values.sandbox.namespace }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sema-runner-token
+  namespace: {{ .Values.sandbox.namespace }}
+  annotations:
+    kubernetes.io/service-account.name: sema-runner
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: sema-runner
+  namespace: {{ .Values.sandbox.namespace }}
+rules:
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get, list, watch, create, delete]
+  - apiGroups: [""]
+    resources: [pods/exec, pods/attach]
+    verbs: [create, get]
+  - apiGroups: [""]
+    resources: [pods/log]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: sema-runner
+  namespace: {{ .Values.sandbox.namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: sema-runner
+subjects:
+  - kind: ServiceAccount
+    name: sema-runner
+    namespace: {{ .Values.sandbox.namespace }}

package/deploy/sema-up/chart/templates/server-v4pro.yaml

@@ -0,0 +1,76 @@
+# ── v4-pro 变体 worker(serverV4pro.enabled 开关;2026-07-11 从手工 kubectl 资源收编进 chart:
+#    与主 sema-server 同镜像/同 env 面,仅 MODEL_ID 不同;复用 sema-server-env secret。
+#    as-built 忠实:无 topologySpreadConstraints(单副本手工建时即无,避免收编时触发滚动)。
+#    公网入口=Gcore LB listener 8091 → NodePort {{ .Values.serverV4pro.nodePort }}(LB 面不归 chart 管)。──
+{{- if .Values.serverV4pro.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sema-server-v4pro
+  namespace: {{ .Release.Namespace }}
+  labels: { app: sema-server-v4pro }
+spec:
+  replicas: {{ .Values.serverV4pro.replicas }}
+  selector:
+    matchLabels: { app: sema-server-v4pro }
+  template:
+    metadata:
+      labels: { app: sema-server-v4pro }
+    spec:
+{{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{- range . }}
+        - name: {{ . }}
+{{- end }}
+{{- end }}
+      containers:
+        - name: server
+          image: {{ .Values.serverV4pro.image | default (required "server.image is required" .Values.server.image) | quote }}
+          imagePullPolicy: {{ .Values.server.pullPolicy }}
+          ports: [{ containerPort: 8090 }]
+          env:
+            - { name: PORT, value: "8090" }
+            - { name: DB_BACKEND, value: pg }
+            - { name: SESSION_BACKEND, value: auto }
+            - { name: PG_HOST, value: sema-pg-rw.{{ .Release.Namespace }}.svc }
+            - { name: PG_PORT, value: "5432" }
+            - { name: PG_USER, value: sema }
+            - { name: PG_DATABASE, value: sema }
+            - { name: PG_PASSWORD, valueFrom: { secretKeyRef: { name: sema-pg-app, key: password } } }
+            - { name: MINIO_ENDPOINT, value: "http://sema-minio.{{ .Release.Namespace }}.svc:9000" }
+            - { name: MINIO_ACCESS_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
+            - { name: MINIO_SECRET_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootPassword } } }
+            - { name: SERVICE_AUTH_TOKEN, valueFrom: { secretKeyRef: { name: sema-server-env, key: SERVICE_AUTH_TOKEN } } }
+            - { name: MODEL_GATEWAY_BASEURL, value: {{ required "server.modelGatewayBaseurl is required" .Values.server.modelGatewayBaseurl | quote }} }
+            - { name: MODEL_ID, value: {{ required "serverV4pro.modelId is required" .Values.serverV4pro.modelId | quote }} }
+            - { name: MODEL_API_KEY, valueFrom: { secretKeyRef: { name: sema-server-env, key: MODEL_API_KEY } } }
+            - { name: MODEL_VISION, value: {{ .Values.server.modelVision | quote }} }
+            - { name: SANDBOX_PKG_SOURCE, value: {{ .Values.server.sandboxPkgSource | quote }} }
+            - { name: REMOTE_EXEC, value: k8s }
+            - { name: K8S_API_URL, value: "https://kubernetes.default.svc" }
+{{- if .Values.server.k8sInsecureTls }}
+            - { name: K8S_INSECURE_TLS, value: "true" }
+{{- end }}
+            - { name: K8S_NAMESPACE, value: {{ .Values.sandbox.namespace }} }
+            - { name: K8S_RUNTIME_CLASS, value: {{ .Values.sandbox.runtimeClass }} }
+            - { name: K8S_SANDBOX_IMAGE, value: {{ .Values.sandbox.image | quote }} }
+            - { name: K8S_TOKEN, valueFrom: { secretKeyRef: { name: sema-runner-token-copy, key: token } } }
+          readinessProbe:
+            httpGet: { path: /health, port: 8090 }
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sema-server-v4pro
+  namespace: {{ .Release.Namespace }}
+  labels: { app: sema-server-v4pro }
+spec:
+  type: NodePort
+  selector: { app: sema-server-v4pro }
+  ports:
+    - port: 8090
+      targetPort: 8090
+      nodePort: {{ .Values.serverV4pro.nodePort }}
+{{- end }}

package/deploy/sema-up/chart/templates/server.yaml

@@ -0,0 +1,88 @@
+# ── 引擎(副本跨机打散;私有仓拉取凭据=cluster-up 6b 的 sema-regcred,经 default SA 注入;
+#    values.imagePullSecrets 为显式纵深)──────────────────────────────────────────
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sema-server-env
+  namespace: {{ .Release.Namespace }}
+stringData:
+  SERVICE_AUTH_TOKEN: {{ required "server.serviceAuthToken is required" .Values.server.serviceAuthToken | quote }}
+  MODEL_API_KEY: {{ required "server.modelApiKey is required" .Values.server.modelApiKey | quote }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sema-server
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.server.replicas }}
+  selector:
+    matchLabels: { app: sema-server }
+  template:
+    metadata:
+      labels: { app: sema-server }
+    spec:
+{{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{- range . }}
+        - name: {{ . }}
+{{- end }}
+{{- end }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels: { app: sema-server }
+      containers:
+        - name: server
+          image: {{ required "server.image is required" .Values.server.image | quote }}
+          imagePullPolicy: {{ .Values.server.pullPolicy }}
+          ports: [{ containerPort: 8090 }]
+          env:
+            - { name: PORT, value: "8090" }
+            - { name: DB_BACKEND, value: pg }
+            - { name: SESSION_BACKEND, value: auto }
+            - { name: PG_HOST, value: sema-pg-rw.{{ .Release.Namespace }}.svc }
+            - { name: PG_PORT, value: "5432" }
+            - { name: PG_USER, value: sema }
+            - { name: PG_DATABASE, value: sema }
+            - { name: PG_PASSWORD, valueFrom: { secretKeyRef: { name: sema-pg-app, key: password } } }
+            - { name: MINIO_ENDPOINT, value: "http://sema-minio.{{ .Release.Namespace }}.svc:9000" }
+            - { name: MINIO_ACCESS_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootUser } } }
+            - { name: MINIO_SECRET_KEY, valueFrom: { secretKeyRef: { name: sema-minio, key: rootPassword } } }
+            - { name: SERVICE_AUTH_TOKEN, valueFrom: { secretKeyRef: { name: sema-server-env, key: SERVICE_AUTH_TOKEN } } }
+            - { name: MODEL_GATEWAY_BASEURL, value: {{ required "server.modelGatewayBaseurl is required" .Values.server.modelGatewayBaseurl | quote }} }
+            - { name: MODEL_ID, value: {{ required "server.modelId is required" .Values.server.modelId | quote }} }
+            - { name: MODEL_API_KEY, valueFrom: { secretKeyRef: { name: sema-server-env, key: MODEL_API_KEY } } }
+            - { name: MODEL_VISION, value: {{ .Values.server.modelVision | quote }} }
+            - { name: REQUIRE_PRINCIPAL, value: {{ .Values.server.requirePrincipal | default "false" | quote }} }
+            - { name: SANDBOX_PKG_SOURCE, value: {{ .Values.server.sandboxPkgSource | quote }} }
+            - { name: REMOTE_EXEC, value: k8s }
+            - { name: K8S_API_URL, value: "https://kubernetes.default.svc" }
+{{- if .Values.server.k8sInsecureTls }}
+            - { name: K8S_INSECURE_TLS, value: "true" }
+{{- end }}
+            - { name: K8S_NAMESPACE, value: {{ .Values.sandbox.namespace }} }
+{{- if .Values.sandbox.runtimeClass }}
+            - { name: K8S_RUNTIME_CLASS, value: {{ .Values.sandbox.runtimeClass }} }
+{{- end }}
+            - { name: K8S_SANDBOX_IMAGE, value: {{ .Values.sandbox.image | quote }} }
+            - { name: K8S_TOKEN, valueFrom: { secretKeyRef: { name: sema-runner-token-copy, key: token } } }
+          readinessProbe:
+            httpGet: { path: /health, port: 8090 }
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sema-server
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: NodePort
+  selector: { app: sema-server }
+  ports:
+    - port: 8090
+      targetPort: 8090
+      nodePort: {{ .Values.server.nodePort }}

package/deploy/sema-up/chart/values-full-single.yaml

@@ -0,0 +1,9 @@
+# full-single(单节点 k3s dev/测试)覆盖:1 实例 PG、preferred 反亲和(required 在单机=永久
+# Pending——真踩)、2 副本 server。用法:
+#   helm upgrade --install sema-stack ./chart -n sema --create-namespace \
+#     -f chart/values-full-single.yaml --set server.image=… --set …(凭据)
+pg:
+  instances: 1
+  antiAffinity: preferred
+server:
+  replicas: 2

package/deploy/sema-up/chart/values.yaml

@@ -0,0 +1,100 @@
+# sema-stack 默认 values = full-cluster 形态(3 机准生产;单机覆盖见 values-full-single.yaml)。
+# 凭据类(minio.rootPassword / server.serviceAuthToken / server.modelApiKey)必须由安装方
+# --set/--values 注入(cluster-up.sh 从 $WORK/.env 读)——本文件不含任何真实凭据。
+
+pg:
+  instances: 3
+  # >=3 机 required(不然调度器把多实例挤同节点,HA 名不副实——复审实抓);
+  # <3 机 preferred(required 会让副本永久 Pending——单节点 dev 真踩)
+  antiAffinity: required
+  storageSize: 100Gi
+  storageClass: longhorn
+  # REV-2 §3c 调优参数(as-built 值;按机器规格重算由安装方覆盖)
+  parameters:
+    shared_buffers: "8GB"
+    effective_cache_size: "86GB"
+    maintenance_work_mem: "2GB"
+    random_page_cost: "1.1"
+    effective_io_concurrency: "200"
+    checkpoint_completion_target: "0.9"
+    max_parallel_workers: "8"
+  backup:
+    enabled: true
+    retention: 7d
+    # ⚠ in-tree barman 在 CNPG 1.31 移除——operator 钉 1.30;升 operator 前先迁 barman-cloud plugin
+    schedule: "0 0 3 * * *"   # 每日 03:00 UTC 基备(WAL 连续归档另在跑,支持 PITR)
+    bucket: s3://sema-pg-backup/
+
+minio:
+  image: minio/minio:latest
+  storageSize: 200Gi
+  storageClass: longhorn
+  rootUser: sema
+  rootPassword: ""   # REQUIRED(cluster-up 注入)
+
+server:
+  image: ""          # REQUIRED:registry 引用(海外=docker.io/<ns>/sema-server:<tag>)或节点预灌 tag
+  pullPolicy: IfNotPresent   # tar 预灌=Never
+  replicas: 3
+  nodePort: 30890
+  serviceAuthToken: ""   # REQUIRED
+  modelGatewayBaseurl: ""  # REQUIRED
+  modelId: ""              # REQUIRED
+  modelApiKey: ""          # REQUIRED
+  modelVision: "false"
+  requirePrincipal: "false"   # users=multi 时 true(身份隔离;compose 路径同名 env)
+  # region=global 时置 "global"(B5 env-first);cn 留空 = 域内默认
+  sandboxPkgSource: ""
+  # k8s exec lane 的 TLS 姿势:true=渲染 K8S_INSECURE_TLS=true(chart 0.1.0 as-built);
+  # false=不渲染(2026-07-09 TLS 修=in-cluster CA 后的现役姿势,海外集群带外已删该 env,
+  # 收编时默认 false 以贴合 live、避免 upgrade 把 insecure 面加回来)
+  k8sInsecureTls: false
+
+# v4-pro 变体 worker(2026-07-11 手工 kubectl 资源收编进 chart;同镜像/同 env 面,仅 MODEL_ID 不同;
+# 公网入口=Gcore LB listener 8091 → nodePort,LB 面不归 chart 管)
+serverV4pro:
+  enabled: false
+  modelId: deepseek-v4-pro
+  replicas: 1
+  nodePort: 30891
+  image: ""   # 留空 = 跟 server.image 同镜像
+
+# sema-registry 配置中心(MCP/skill/模型配置云同步;各档默认带上,--registry=false 可关)。
+# SQLite 落 PVC;凭据由安装方注入(kube-up.sh 从 $WORK/.env 读,不轮换)。
+registry:
+  enabled: true
+  image: ""            # enabled=true 时 REQUIRED(GHCR/Hub 的 sema-registry 镜像,迁移中;SWR 已弃用)
+  nodePort: 30300
+  storageSize: 2Gi
+  storageClass: ""     # 空=集群默认 SC
+  adminUser: zhaoheran
+  adminPassword: ""    # REQUIRED(kube-up 注入)
+  sessionSecret: ""    # REQUIRED
+  pullToken: ""        # REQUIRED
+  # git 面(--git=provision/connect 时注入;都空=只有表单登录)
+  giteaBaseUrl: ""
+  giteaOauthClientId: ""
+  giteaOauthClientSecret: ""
+
+# 自建 Gitea(--git=provision;引导管理员/token/OAuth app 是一次性动作,归 kube-up.sh)
+gitea:
+  enabled: false
+  image: gitea/gitea:1.24
+  httpNodePort: 30330
+  sshNodePort: 30322
+  storageSize: 10Gi
+  storageClass: ""     # 空=集群默认 SC
+  domain: ""           # clone URL 用的对外地址(kube-up 填节点 IP)
+
+sandbox:
+  namespace: sema-sandbox
+  runtimeClass: kata-qemu   # 置空 = 不指定 runtimeClass(已有 k8s 无 kata 时的降级,沙箱=runc 隔离)
+  # 默认=公开池 code-node(0.33GB:git+node+uv python3.12+pkg-source hook;clay 拍 2026-07-13——
+  # 小巧默认,重任务用 sandboxImageProfile 按需选 code-python/code-full 等,Hub 池 public 匿名可拉)。
+  # 裸 OS 镜像(如 ubuntu)没有 pkg-source hook——sandboxPkgSource=global 时官方源不会材料化,别退回。
+  image: docker.io/claybobby/code-node:20260707-749ab84f5fdd-786f5ef10ffd
+
+# 私有 registry 拉取(6b:secret 由 cluster-up 建 + patch default SA;这里的显式引用是纵深,
+# 留空=只靠 SA 注入)
+imagePullSecrets: []
+# - sema-regcred