@sema-agent/server 1.285.2 → 1.287.0

package/README.md

@@ -82,10 +82,15 @@ Requirements: Node ≥ 20 (npm path) and an OpenAI-compatible model gateway.
 > noise with no runtime exposure here**: `glob` has exactly one load site inside `e2b` — a `dynamicImport`
 > in its *template-build* file-packing path — and this server only ever touches E2B's *sandbox runtime*
 > API. Verified by execution, not by reading: importing `e2b`, constructing the adapter and driving a real
-> `exec` never puts `glob` in the module cache. We cannot silence it for you — npm `overrides` only apply
-> when the package.json being read *is the project npm was invoked on*, so ours is ignored when this
-> package is installed as a dependency. If the warning bothers you, add `"overrides": { "glob": "^13" }`
-> to **your own** project's package.json (that is the one npm reads); the real fix is upstream in `e2b`.
+> `exec` never puts `glob` in the module cache. **We deliberately do not silence it.** The only thing that
+> actually works is bundling e2b's whole subtree into this package (measured: the warning does go away) —
+> and that costs 2.7 MB → 20.8 MB unpacked, marks the tree `invalid` in `npm ls`, and decouples the `e2b`
+> you install from the one e2b publishes. Not worth it for a warning with no runtime reach. Things that
+> do **not** work, in case you were about to try: our `overrides` (they only apply when the package.json
+> being read *is the project npm was invoked on*), and a published `npm-shrinkwrap.json` (also ignored when
+> this package is a dependency — both measured). If the warning bothers you, add
+> `"overrides": { "glob": "^13" }` to **your own** project's package.json — that is the one npm reads, and
+> `glob@13` is API-compatible with what e2b uses. The real fix is upstream in `e2b`.
 
 ```bash
 # A) npm

package/README.zh-CN.md

@@ -78,10 +78,13 @@
 > `e2b`(E2B 沙箱 SDK)间接引入。这是**安装期噪声,在这里没有任何运行时曝露面**:`glob` 在 `e2b` 里的
 > 唯一加载点是它 *template-build* 打包路径里的一处 `dynamicImport`,而本服务只使用 E2B 的**沙箱运行时**
 > 接口。这一条是**跑出来的、不是读代码推断的**:import `e2b`、构造适配器、真调一次 `exec`,全程 `glob`
-> 从未进入模块缓存。我们**没法替你消掉它** —— npm 的 `overrides` 只在"被读的那份 package.json 正是
-> npm 本次调用的项目清单"时生效,所以本包作为依赖被安装时,我们写的那份会被忽略。若这条警告碍事,
-> 把 `"overrides": { "glob": "^13" }` 加进**你自己项目**的 package.json(那份才是 npm 会读的);
-> 真正的修复在上游 `e2b`。
+> 从未进入模块缓存。**我们是刻意不消它的。** 唯一真能消掉的办法是把 e2b 整棵子树 bundle 进本包
+> (实测有效,警告确实消失),代价是解包体积 2.7 MB → 20.8 MB、`npm ls` 会把依赖树标成 `invalid`、
+> 且你装到的 `e2b` 与 e2b 官方发布的那份脱钩 —— 为一条没有运行时影响的警告付这些,不划算。
+> **顺带告诉你哪些做法没用**(免得你去试):我们写的 `overrides`(只在"被读的那份 package.json 正是
+> npm 本次调用的项目清单"时生效),以及随包发布的 `npm-shrinkwrap.json`(本包作为依赖被安装时同样被
+> 忽略)—— 两条都是实测。若这条警告碍事,把 `"overrides": { "glob": "^13" }` 加进**你自己项目**的
+> package.json(那份才是 npm 会读的;`glob@13` 与 e2b 用到的 API 兼容,已验)。真正的修复在上游 `e2b`。
 
 ```bash
 # A) npm

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -6,6 +6,8 @@ export interface HardenedVmLimits {
     concurrency?: number;
     maxHeapMb?: number;
 }
+export declare function setScriptRealmRejectionObserver(observer: (summary: string) => void): void;
+export declare function installScriptRealmRejectionGuard(): void;
 export interface HardenedMembrane {
     bridge(hostFn: (...args: unknown[]) => unknown): (...a: unknown[]) => Promise<unknown>;
     dataIn(value: unknown): unknown;

package/dist/orchestration/hardened-vm-runner.js

@@ -24,6 +24,30 @@ function scrubProtoDeep(value) {
         scrubProtoDeep(value[key]);
     }
 }
+let rejectionGuardInstalled = false;
+let onScriptRealmRejection;
+export function setScriptRealmRejectionObserver(observer) {
+    onScriptRealmRejection = observer;
+}
+export function installScriptRealmRejectionGuard() {
+    if (rejectionGuardInstalled)
+        return;
+    rejectionGuardInstalled = true;
+    process.on("unhandledRejection", (reason, promise) => {
+        if (!(promise instanceof Promise)) {
+            const summary = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
+            try {
+                (onScriptRealmRejection ?? ((s) => console.warn(`hardened-vm: un-awaited script rejection contained: ${s}`)))(summary);
+            }
+            catch {
+            }
+            return;
+        }
+        if (process.listenerCount("unhandledRejection") > 1)
+            return;
+        throw reason;
+    });
+}
 function sterilizingParse(json) {
     const parsed = JSON.parse(json);
     scrubProtoDeep(parsed);
@@ -44,6 +68,7 @@ async function runHardened(opts) {
     const { signal } = opts;
     if (signal?.aborted)
         throw new WorkflowScriptError("hardened-vm aborted before start");
+    installScriptRealmRejectionGuard();
     const sandbox = { __proto__: null };
     const ctx = vm.createContext(sandbox, { codeGeneration: { strings: false, wasm: false } });
     vm.runInContext(`(() => {
@@ -73,7 +98,20 @@ async function runHardened(opts) {
        if (r.ok) return r.v;
        const e = new Error(r.err); e.name = r.name || "Error"; throw e;
      })`, ctx);
+    let inFlightHostCalls = 0;
+    let scriptSettled = false;
+    let fireDeadlock;
+    const probeQuiescence = () => {
+        if (scriptSettled || inFlightHostCalls > 0)
+            return;
+        setImmediate(() => {
+            if (scriptSettled || inFlightHostCalls > 0)
+                return;
+            fireDeadlock?.();
+        });
+    };
     const bridge = (hostFn) => mkBridge(async (argsJson) => {
+        inFlightHostCalls++;
         try {
             const out = await hostFn(...sterilizingParse(argsJson));
             return JSON.stringify({ ok: true, v: out ?? null });
@@ -85,6 +123,10 @@ async function runHardened(opts) {
                 name: e instanceof Error ? e.name : "Error",
             });
         }
+        finally {
+            inFlightHostCalls--;
+            probeQuiescence();
+        }
     });
     const membrane = { bridge, dataIn, ctxEval: (src) => vm.runInContext(src, ctx) };
     for (const [name, value] of Object.entries(opts.buildGlobals(membrane)))
@@ -97,6 +139,8 @@ async function runHardened(opts) {
         throw new WorkflowScriptError(`script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
     }
     const scriptPromise = invocation.runInContext(ctx, { timeout: cfg.syncTimeoutMs });
+    scriptPromise.then(() => (scriptSettled = true), () => (scriptSettled = true));
+    probeQuiescence();
     let timer;
     let onAbort;
     try {
@@ -109,6 +153,7 @@ async function runHardened(opts) {
                     onAbort = () => reject(new WorkflowScriptError("hardened-vm aborted"));
                     signal.addEventListener("abort", onAbort, { once: true });
                 }
+                fireDeadlock = () => reject(new WorkflowScriptError("script deadlocked: no host call (agent/phase) in flight and nothing can resume the script — usually an un-awaited promise cycle, e.g. `const r = phase(...)` without await whose body reads `r`."));
             }),
         ]);
         return marshalOut(result);

package/dist/orchestration/workflow-completion-inbox.js

@@ -268,7 +268,7 @@ export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPri
                 }
                 catch {
                 }
-                await emit({ type: "task_notification", task_id: e.runId, status: e.status, summary: e.summary, ...extras });
+                await emit({ type: "task_notification", task_id: e.runId, status: e.status, summary: e.summary, ...extras, injected: false });
             }
             else {
                 await emit({ type: "workflow_complete", runId: e.runId, status: e.status, summary: e.summary });

package/dist/plugins/background-agent-store-sql.js

@@ -132,7 +132,7 @@ export async function ensurePgBackgroundAgentSchema(q) {
     handle VARCHAR(190) COLLATE "C" NOT NULL,
     scope VARCHAR(190) NOT NULL,
     owner VARCHAR(190) NOT NULL,
-    session_scoped BOOLEAN NOT NULL,
+    session_scoped SMALLINT NOT NULL,
     session_id VARCHAR(190),
     parent_session_id VARCHAR(190),
     -- core 1.367 δ(additive,TiDB 同案):root 锚(listBySession 第二臂)

package/dist/plugins/pg-image-bake.js

@@ -7,9 +7,9 @@ export const PG_IMAGE_BAKE_SCHEMA = [
      profile          VARCHAR(128) NOT NULL,
      bands            JSONB        NULL,
      base_ref         VARCHAR(255) NULL,
-     push             BOOLEAN      NOT NULL DEFAULT FALSE,
-     dry_run          BOOLEAN      NOT NULL DEFAULT FALSE,
-     logs             BOOLEAN      NOT NULL DEFAULT FALSE,
+     push             SMALLINT     NOT NULL DEFAULT 0,
+     dry_run          SMALLINT     NOT NULL DEFAULT 0,
+     logs             SMALLINT     NOT NULL DEFAULT 0,
      argv             JSONB        NOT NULL,
      status           VARCHAR(16)  NOT NULL,
      state            VARCHAR(16)  NULL,
@@ -26,7 +26,7 @@ export const PG_IMAGE_BAKE_SCHEMA = [
      ingest_secret    VARCHAR(64)  NULL,
      runner_id        VARCHAR(64)  NULL,
      lease_until      TIMESTAMPTZ(3) NULL,
-     cancel_requested BOOLEAN      NOT NULL DEFAULT FALSE,
+     cancel_requested SMALLINT     NOT NULL DEFAULT 0,
      requested_by     VARCHAR(128) NULL,
      created_at       TIMESTAMPTZ(3) NOT NULL,
      updated_at       TIMESTAMPTZ(3) NOT NULL,
@@ -141,14 +141,14 @@ export class PgImageBake {
         try {
             await this.pool.query("INSERT INTO image_bake (bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, " +
                 "idem_key, cancel_requested, requested_by, created_at, updated_at) " +
-                "VALUES ($1,$2,$3::jsonb,$4,$5,$6,$7,$8::jsonb,'queued',$9,FALSE,$10,$11,$12)", [
+                "VALUES ($1,$2,$3::jsonb,$4,$5,$6,$7,$8::jsonb,'queued',$9,0,$10,$11,$12)", [
                 bakeId,
                 input.profile,
                 input.bands == null ? null : JSON.stringify(input.bands),
                 input.baseRef,
-                input.push,
-                input.dryRun,
-                input.logs,
+                input.push ? 1 : 0,
+                input.dryRun ? 1 : 0,
+                input.logs ? 1 : 0,
                 JSON.stringify(input.argv),
                 input.idemKey,
                 input.requestedBy,
@@ -179,15 +179,15 @@ export class PgImageBake {
             await conn.query("SELECT pool FROM image_bake_admit WHERE pool = $1 FOR UPDATE", [this.poolName]);
             const res = await conn.query("INSERT INTO image_bake (bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, " +
                 "idem_key, cancel_requested, requested_by, created_at, updated_at) " +
-                "SELECT $1,$2,$3::jsonb,$4,$5,$6,$7,$8::jsonb,'queued',$9,FALSE,$10,$11,$12 WHERE NOT EXISTS " +
-                "(SELECT 1 FROM image_bake WHERE status IN ('queued','running') AND dry_run = FALSE)", [
+                "SELECT $1,$2,$3::jsonb,$4,$5,$6,$7,$8::jsonb,'queued',$9,0,$10,$11,$12 WHERE NOT EXISTS " +
+                "(SELECT 1 FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0)", [
                 bakeId,
                 input.profile,
                 input.bands == null ? null : JSON.stringify(input.bands),
                 input.baseRef,
-                input.push,
-                input.dryRun,
-                input.logs,
+                input.push ? 1 : 0,
+                input.dryRun ? 1 : 0,
+                input.logs ? 1 : 0,
                 JSON.stringify(input.argv),
                 input.idemKey,
                 input.requestedBy,
@@ -229,7 +229,7 @@ export class PgImageBake {
         return res.rows[0] ? mapRow(res.rows[0]) : null;
     }
     async findActiveAny() {
-        const res = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE status IN ('queued','running') AND dry_run = FALSE ` +
+        const res = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0 ` +
             "ORDER BY created_at ASC LIMIT 1");
         return res.rows[0] ? mapRow(res.rows[0]) : null;
     }
@@ -413,7 +413,7 @@ export class PgImageBake {
         return (leaseRes.rowCount ?? 0) >= 1;
     }
     async requestCancel(bakeId) {
-        const res = await this.pool.query("UPDATE image_bake SET cancel_requested = TRUE, updated_at = $1 WHERE bake_id = $2 AND status IN ('queued','running')", [new Date(), bakeId]);
+        const res = await this.pool.query("UPDATE image_bake SET cancel_requested = 1, updated_at = $1 WHERE bake_id = $2 AND status IN ('queued','running')", [new Date(), bakeId]);
         return (res.rowCount ?? 0) > 0;
     }
     async isCancelRequested(bakeId) {

package/dist/plugins/pg-image-index.js

@@ -21,7 +21,7 @@ export const PG_IMAGE_INDEX_SCHEMA = [
      generator_version  VARCHAR(32),
      build_date         TIMESTAMPTZ(3),
      supersedes         VARCHAR(64),
-     signed             BOOLEAN      NOT NULL DEFAULT FALSE,
+     signed             SMALLINT     NOT NULL DEFAULT 0,
      created_at         TIMESTAMPTZ(3) NOT NULL,
      updated_at         TIMESTAMPTZ(3) NOT NULL,
      PRIMARY KEY (id)
@@ -129,7 +129,7 @@ function upsertParams(e, id, now) {
         e.generatorVersion == null ? null : pgSanitizeText(e.generatorVersion),
         e.buildDate ? new Date(e.buildDate) : null,
         e.supersedes == null ? null : pgSanitizeText(e.supersedes),
-        e.signed ? true : false,
+        e.signed ? 1 : 0,
         now,
         now,
     ];

package/dist/plugins/roster-store-sql.js

@@ -16,7 +16,7 @@ function rowToEntry(r) {
     };
 }
 const RESOLVE_WHERE_TIDB = `name_key = ? AND BINARY scope = ? AND (BINARY owner = ? OR (session_scoped = 1 AND ? IS NOT NULL AND BINARY owner = ?))`;
-const RESOLVE_WHERE_PG = `name_key = $1 AND scope = $2 AND (owner = $3 OR (session_scoped = TRUE AND $4::varchar IS NOT NULL AND owner = $5))`;
+const RESOLVE_WHERE_PG = `name_key = $1 AND scope = $2 AND (owner = $3 OR (session_scoped = 1 AND $4::varchar IS NOT NULL AND owner = $5))`;
 const COLS = "name, agent_id, session_id, tool_use_id, owner, scope, session_scoped, root_session_id, model, created_at_ms";
 export async function ensureTiDBRosterSchema(pool) {
     await pool.query(`CREATE TABLE IF NOT EXISTS ${ROSTER_TABLE} (
@@ -53,7 +53,7 @@ export async function ensurePgRosterSchema(q) {
     -- owner/scope:core 1.365 BREAKING 双轴必填(TiDB 同案;曾 nullable 的由来见两 ensure 上方顶注 ①)
     owner VARCHAR(190) COLLATE "C" NOT NULL,
     scope VARCHAR(190) COLLATE "C" NOT NULL,
-    session_scoped BOOLEAN,
+    session_scoped SMALLINT,
     -- core 1.367 δ(additive,TiDB 同案):RosterEntry.rootSessionId verbatim 存
     root_session_id VARCHAR(190),
     -- core 1.373 additive(TiDB 同案):解析后模型 id(NULL = 该 spawn 未记录模型)
@@ -75,7 +75,7 @@ function upsertParams(entry, now) {
         entry.toolUseId ?? null,
         entry.owner,
         entry.scope,
-        entry.sessionScoped === undefined ? null : entry.sessionScoped,
+        entry.sessionScoped === undefined ? null : entry.sessionScoped ? 1 : 0,
         entry.rootSessionId ?? null,
         entry.model ?? null,
         entry.createdAt,

package/dist/trace/project.js

@@ -82,6 +82,7 @@ export function taskProgressEventData(ev) {
 export function taskNotificationEventData(ev) {
     const n = ev.notification;
     return {
+        injected: false,
         task_id: n.task_id,
         task_type: n.task_type,
         ...(n.sessionId !== undefined ? { sessionId: n.sessionId } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.285.2",
+  "version": "1.287.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -47,7 +47,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^1.424.0",
+    "@sema-agent/core": "^1.427.0",
     "@sema-agent/registry-core": "^0.10.21",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",