@sema-agent/server 1.285.1 → 1.286.0

package/README.md

@@ -82,10 +82,15 @@ Requirements: Node ≥ 20 (npm path) and an OpenAI-compatible model gateway.
 > noise with no runtime exposure here**: `glob` has exactly one load site inside `e2b` — a `dynamicImport`
 > in its *template-build* file-packing path — and this server only ever touches E2B's *sandbox runtime*
 > API. Verified by execution, not by reading: importing `e2b`, constructing the adapter and driving a real
-> `exec` never puts `glob` in the module cache. We cannot silence it for you — npm `overrides` only apply
-> when the package.json being read *is the project npm was invoked on*, so ours is ignored when this
-> package is installed as a dependency. If the warning bothers you, add `"overrides": { "glob": "^13" }`
-> to **your own** project's package.json (that is the one npm reads); the real fix is upstream in `e2b`.
+> `exec` never puts `glob` in the module cache. **We deliberately do not silence it.** The only thing that
+> actually works is bundling e2b's whole subtree into this package (measured: the warning does go away) —
+> and that costs 2.7 MB → 20.8 MB unpacked, marks the tree `invalid` in `npm ls`, and decouples the `e2b`
+> you install from the one e2b publishes. Not worth it for a warning with no runtime reach. Things that
+> do **not** work, in case you were about to try: our `overrides` (they only apply when the package.json
+> being read *is the project npm was invoked on*), and a published `npm-shrinkwrap.json` (also ignored when
+> this package is a dependency — both measured). If the warning bothers you, add
+> `"overrides": { "glob": "^13" }` to **your own** project's package.json — that is the one npm reads, and
+> `glob@13` is API-compatible with what e2b uses. The real fix is upstream in `e2b`.
 
 ```bash
 # A) npm

package/README.zh-CN.md

@@ -74,6 +74,18 @@
 
 环境要求:Node ≥ 20(npm 路径)+ 一个 OpenAI 兼容模型网关。
 
+> **关于安装时那条 `glob@11` 弃用警告。** `npm install` 会为 `glob@11.1.0` 打一条 deprecated 警告,它由
+> `e2b`(E2B 沙箱 SDK)间接引入。这是**安装期噪声,在这里没有任何运行时曝露面**:`glob` 在 `e2b` 里的
+> 唯一加载点是它 *template-build* 打包路径里的一处 `dynamicImport`,而本服务只使用 E2B 的**沙箱运行时**
+> 接口。这一条是**跑出来的、不是读代码推断的**:import `e2b`、构造适配器、真调一次 `exec`,全程 `glob`
+> 从未进入模块缓存。**我们是刻意不消它的。** 唯一真能消掉的办法是把 e2b 整棵子树 bundle 进本包
+> (实测有效,警告确实消失),代价是解包体积 2.7 MB → 20.8 MB、`npm ls` 会把依赖树标成 `invalid`、
+> 且你装到的 `e2b` 与 e2b 官方发布的那份脱钩 —— 为一条没有运行时影响的警告付这些,不划算。
+> **顺带告诉你哪些做法没用**(免得你去试):我们写的 `overrides`(只在"被读的那份 package.json 正是
+> npm 本次调用的项目清单"时生效),以及随包发布的 `npm-shrinkwrap.json`(本包作为依赖被安装时同样被
+> 忽略)—— 两条都是实测。若这条警告碍事,把 `"overrides": { "glob": "^13" }` 加进**你自己项目**的
+> package.json(那份才是 npm 会读的;`glob@13` 与 e2b 用到的 API 兼容,已验)。真正的修复在上游 `e2b`。
+
 ```bash
 # A) npm
 npm install @sema-agent/server

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -6,6 +6,8 @@ export interface HardenedVmLimits {
     concurrency?: number;
     maxHeapMb?: number;
 }
+export declare function setScriptRealmRejectionObserver(observer: (summary: string) => void): void;
+export declare function installScriptRealmRejectionGuard(): void;
 export interface HardenedMembrane {
     bridge(hostFn: (...args: unknown[]) => unknown): (...a: unknown[]) => Promise<unknown>;
     dataIn(value: unknown): unknown;

package/dist/orchestration/hardened-vm-runner.js

@@ -24,6 +24,30 @@ function scrubProtoDeep(value) {
         scrubProtoDeep(value[key]);
     }
 }
+let rejectionGuardInstalled = false;
+let onScriptRealmRejection;
+export function setScriptRealmRejectionObserver(observer) {
+    onScriptRealmRejection = observer;
+}
+export function installScriptRealmRejectionGuard() {
+    if (rejectionGuardInstalled)
+        return;
+    rejectionGuardInstalled = true;
+    process.on("unhandledRejection", (reason, promise) => {
+        if (!(promise instanceof Promise)) {
+            const summary = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
+            try {
+                (onScriptRealmRejection ?? ((s) => console.warn(`hardened-vm: un-awaited script rejection contained: ${s}`)))(summary);
+            }
+            catch {
+            }
+            return;
+        }
+        if (process.listenerCount("unhandledRejection") > 1)
+            return;
+        throw reason;
+    });
+}
 function sterilizingParse(json) {
     const parsed = JSON.parse(json);
     scrubProtoDeep(parsed);
@@ -44,6 +68,7 @@ async function runHardened(opts) {
     const { signal } = opts;
     if (signal?.aborted)
         throw new WorkflowScriptError("hardened-vm aborted before start");
+    installScriptRealmRejectionGuard();
     const sandbox = { __proto__: null };
     const ctx = vm.createContext(sandbox, { codeGeneration: { strings: false, wasm: false } });
     vm.runInContext(`(() => {
@@ -73,7 +98,20 @@ async function runHardened(opts) {
        if (r.ok) return r.v;
        const e = new Error(r.err); e.name = r.name || "Error"; throw e;
      })`, ctx);
+    let inFlightHostCalls = 0;
+    let scriptSettled = false;
+    let fireDeadlock;
+    const probeQuiescence = () => {
+        if (scriptSettled || inFlightHostCalls > 0)
+            return;
+        setImmediate(() => {
+            if (scriptSettled || inFlightHostCalls > 0)
+                return;
+            fireDeadlock?.();
+        });
+    };
     const bridge = (hostFn) => mkBridge(async (argsJson) => {
+        inFlightHostCalls++;
         try {
             const out = await hostFn(...sterilizingParse(argsJson));
             return JSON.stringify({ ok: true, v: out ?? null });
@@ -85,6 +123,10 @@ async function runHardened(opts) {
                 name: e instanceof Error ? e.name : "Error",
             });
         }
+        finally {
+            inFlightHostCalls--;
+            probeQuiescence();
+        }
     });
     const membrane = { bridge, dataIn, ctxEval: (src) => vm.runInContext(src, ctx) };
     for (const [name, value] of Object.entries(opts.buildGlobals(membrane)))
@@ -97,6 +139,8 @@ async function runHardened(opts) {
         throw new WorkflowScriptError(`script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
     }
     const scriptPromise = invocation.runInContext(ctx, { timeout: cfg.syncTimeoutMs });
+    scriptPromise.then(() => (scriptSettled = true), () => (scriptSettled = true));
+    probeQuiescence();
     let timer;
     let onAbort;
     try {
@@ -109,6 +153,7 @@ async function runHardened(opts) {
                     onAbort = () => reject(new WorkflowScriptError("hardened-vm aborted"));
                     signal.addEventListener("abort", onAbort, { once: true });
                 }
+                fireDeadlock = () => reject(new WorkflowScriptError("script deadlocked: no host call (agent/phase) in flight and nothing can resume the script — usually an un-awaited promise cycle, e.g. `const r = phase(...)` without await whose body reads `r`."));
             }),
         ]);
         return marshalOut(result);

package/dist/orchestration/workflow-completion-inbox.js

@@ -268,7 +268,7 @@ export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPri
                 }
                 catch {
                 }
-                await emit({ type: "task_notification", task_id: e.runId, status: e.status, summary: e.summary, ...extras });
+                await emit({ type: "task_notification", task_id: e.runId, status: e.status, summary: e.summary, ...extras, injected: false });
             }
             else {
                 await emit({ type: "workflow_complete", runId: e.runId, status: e.status, summary: e.summary });

package/dist/trace/project.js

@@ -82,6 +82,7 @@ export function taskProgressEventData(ev) {
 export function taskNotificationEventData(ev) {
     const n = ev.notification;
     return {
+        injected: false,
         task_id: n.task_id,
         task_type: n.task_type,
         ...(n.sessionId !== undefined ? { sessionId: n.sessionId } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.285.1",
+  "version": "1.286.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",