@sema-agent/server 1.301.0 → 1.303.0

package/dist/http/server.js

@@ -3291,11 +3291,11 @@ export function createHttpServer(deps) {
                 scope = decodeURIComponent(url.slice("/v1/memory/sync/".length));
             }
             catch {
-                sendJson(res, 400, { error: "malformed percent-encoding in :scope", code: "memory_sync_invalid_scope" });
+                sendJson(res, 400, { error: "malformed percent-encoding in :scope", code: "memory_sync_invalid_scope", errorCode: "memory_sync_invalid_scope" });
                 return;
             }
             if (scope.length === 0) {
-                sendJson(res, 400, { error: "missing :scope", code: "memory_sync_invalid_scope" });
+                sendJson(res, 400, { error: "missing :scope", code: "memory_sync_invalid_scope", errorCode: "memory_sync_invalid_scope" });
                 return;
             }
             if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
@@ -3305,7 +3305,7 @@ export function createHttpServer(deps) {
             const body = await readJson(req);
             const parsed = parseMemorySyncRequest(body, scope);
             if (!parsed.ok) {
-                sendJson(res, 422, { error: parsed.error, code: "memory_sync_invalid_body" });
+                sendJson(res, 422, { error: parsed.error, code: "memory_sync_invalid_body", errorCode: "memory_sync_invalid_body" });
                 return;
             }
             try {
@@ -4042,7 +4042,7 @@ export function createHttpServer(deps) {
                     if (typeof fs.blobSizes === "function") {
                         const known = (await fs.blobSizes([hash])).get(hash);
                         if (known !== undefined && known > cap) {
-                            sendJson(res, 413, { error: "file exceeds the single-file read limit — download it via the archive endpoint", code: "workspace_file_too_large", sizeBytes: known, limit: cap });
+                            sendJson(res, 413, { error: "file exceeds the single-file read limit — download it via the archive endpoint", code: "workspace_file_too_large", errorCode: "workspace_file_too_large", sizeBytes: known, limit: cap });
                             return;
                         }
                     }
@@ -4052,7 +4052,7 @@ export function createHttpServer(deps) {
                         return;
                     }
                     if (bytes.byteLength > cap) {
-                        sendJson(res, 413, { error: "file exceeds the single-file read limit — download it via the archive endpoint", code: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
+                        sendJson(res, 413, { error: "file exceeds the single-file read limit — download it via the archive endpoint", code: "workspace_file_too_large", errorCode: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
                         return;
                     }
                     const ct = workspaceContentType(pathParam);
@@ -4259,7 +4259,7 @@ export function createHttpServer(deps) {
                     }
                     const put = await fs.putBlob(hash, new Uint8Array(body));
                     if (!put.ok) {
-                        sendJson(res, 502, { error: "blob store write failed", code: put.error.code });
+                        sendJson(res, 502, { error: "blob store write failed", code: put.error.code, errorCode: put.error.code });
                         return;
                     }
                     res.writeHead(204).end();
@@ -4626,7 +4626,7 @@ export function createHttpServer(deps) {
                     }
                     const allow = deps.config.attachmentMimeAllowlist;
                     if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
-                        sendJson(res, 415, { code: "attachment.mime_not_allowed", error: `mime '${mime}' is not in this deployment's allowlist`, allowed: allow });
+                        sendJson(res, 415, { code: "attachment.mime_not_allowed", errorCode: "attachment.mime_not_allowed", error: `mime '${mime}' is not in this deployment's allowlist`, allowed: allow });
                         return;
                     }
                     const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
@@ -4636,7 +4636,7 @@ export function createHttpServer(deps) {
                     }
                     catch (err) {
                         if (err instanceof HttpError && err.status === 413) {
-                            sendJson(res, 413, { code: "attachment.too_large", error: `attachment exceeds the per-file limit (${max} bytes)`, maxBytes: max });
+                            sendJson(res, 413, { code: "attachment.too_large", errorCode: "attachment.too_large", error: `attachment exceeds the per-file limit (${max} bytes)`, maxBytes: max });
                             return;
                         }
                         throw err;
@@ -5260,7 +5260,7 @@ export function createHttpServer(deps) {
             if (e instanceof HttpError) {
                 return {
                     status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, code: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                    body: { error: `resume blocked by an admission policy change: ${e.message}`, code: "resume_blocked_by_policy", errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
                 };
             }
             throw e;
@@ -5646,9 +5646,9 @@ export function createHttpServer(deps) {
                     body: {
                         error: e.message,
                         code: e.code,
-                        ...(e.code === "checkpoint.invalid_outcome"
-                            ? { errorCode: outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid" }
-                            : {}),
+                        errorCode: e.code === "checkpoint.invalid_outcome"
+                            ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
+                            : e.code,
                         ...(retriable ? { retriable: true } : {}),
                     },
                 };
@@ -5888,7 +5888,7 @@ export function createHttpServer(deps) {
             return false;
         deps.metrics?.inc("fleet_lease_rejected_total");
         res.setHeader("retry-after", String(adm.retryAfterSec));
-        sendJson(res, 429, { error: "budget exhausted (quota lease)", code: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        sendJson(res, 429, { error: "budget exhausted (quota lease)", code: "quota_exhausted", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
         return true;
     }
     function rateLimited(req, res) {

package/dist/main.js

@@ -1440,6 +1440,12 @@ async function main() {
         void toolResultStore?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)?.catch(() => undefined);
         void fileSnapshotStore?.sweepOrphanBlobs?.().catch(() => undefined);
         void taskAttachmentStore?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs).then(reapCount("attachments_reaped_total", {})).catch(() => undefined);
+        void taskAttachmentStore?.sweepOrphanObjects?.(3_600_000)
+            .then((n) => { if (n > 0) {
+            metrics.inc("attachment_orphan_objects_swept_total", {}, n);
+            logger.info("attachment_orphan_objects_swept", { removed: n });
+        } })
+            .catch((err) => logger.warn("attachment_orphan_sweep_failed", { err: String(err) }));
         void backend?.session()?.sweepStagingSessions?.().catch(() => undefined);
         void imageBakes?.reapStaleBakes(config.imageBakes.staleMs).then(reapCount("bakes_reaped_total", {})).catch(() => undefined);
         void worktreeReap?.();

package/dist/plugins/blob-backend.d.ts

@@ -30,6 +30,7 @@ export interface MinioBlobBackendConfig {
     region?: string;
     keyPrefix?: string;
     presignTtlSec?: number;
+    fetchImpl?: typeof fetch;
 }
 export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
@@ -46,6 +47,10 @@ export declare class MinioBlobBackend implements BlobBackend {
     putBlob(hash: string, bytes: Uint8Array): Promise<void>;
     getBlob(hash: string): Promise<Uint8Array | undefined>;
     hasBlobs(hashes: string[]): Promise<Set<string>>;
+    listObjects(): AsyncGenerator<{
+        hash: string;
+        lastModifiedMs: number;
+    }>;
     deleteBlobs(hashes: string[]): Promise<number>;
 }
 //# sourceMappingURL=blob-backend.d.ts.map

package/dist/plugins/blob-backend.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { presignS3Url } from "./s3-presign.js";
+import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 const BLOB_GC_GRACE_MS = 3_600_000;
 export const SQL_BLOB_DEFAULT_MAX_BYTES = 6_291_456;
 export class BlobTooLargeError extends Error {
@@ -191,6 +191,40 @@ export class MinioBlobBackend {
         });
         return present;
     }
+    async *listObjects() {
+        const f = this.cfg.fetchImpl ?? fetch;
+        let token;
+        do {
+            const url = presignS3ListUrl({
+                endpoint: this.cfg.endpoint,
+                bucket: this.cfg.bucket,
+                prefix: this.keyPrefix,
+                ...(token ? { continuationToken: token } : {}),
+                maxKeys: 1000,
+                accessKey: this.cfg.accessKey,
+                secretKey: this.cfg.secretKey,
+                ...(this.cfg.region ? { region: this.cfg.region } : {}),
+                expiresSec: this.ttl,
+            });
+            const res = await f(url, { method: "GET" });
+            if (!res.ok)
+                throw new Error(`listObjects: MinIO ${res.status}`);
+            const xml = await res.text();
+            for (const m of xml.matchAll(/<Contents>([\s\S]*?)<\/Contents>/g)) {
+                const block = m[1];
+                const key = /<Key>([^<]*)<\/Key>/.exec(block)?.[1];
+                const lm = /<LastModified>([^<]*)<\/LastModified>/.exec(block)?.[1];
+                if (key === undefined || !key.startsWith(this.keyPrefix))
+                    continue;
+                const ms = lm ? Date.parse(lm) : NaN;
+                yield { hash: key.slice(this.keyPrefix.length), lastModifiedMs: Number.isFinite(ms) ? ms : Date.now() };
+            }
+            const truncated = /<IsTruncated>true<\/IsTruncated>/.test(xml);
+            token = truncated ? /<NextContinuationToken>([^<]*)<\/NextContinuationToken>/.exec(xml)?.[1] : undefined;
+            if (truncated && token === undefined)
+                throw new Error("listObjects: truncated response without NextContinuationToken");
+        } while (token !== undefined);
+    }
     async deleteBlobs(hashes) {
         if (hashes.length === 0)
             return 0;

package/dist/plugins/s3-presign.d.ts

@@ -21,6 +21,18 @@ export interface S3BucketPresignParams {
     now?: Date;
 }
 export declare function presignS3BucketUrl(p: S3BucketPresignParams): string;
+export declare function presignS3ListUrl(p: {
+    endpoint: string;
+    bucket: string;
+    prefix: string;
+    continuationToken?: string;
+    maxKeys?: number;
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+    expiresSec?: number;
+    now?: Date;
+}): string;
 export interface S3CopyPresignParams {
     endpoint: string;
     bucket: string;

package/dist/plugins/s3-presign.js

@@ -35,6 +35,7 @@ function presignCanonical(p) {
     const headerNames = [...headerMap.keys()].sort();
     const signedHeaderList = headerNames.join(";");
     const params = {
+        ...(p.extraQuery ?? {}),
         "X-Amz-Algorithm": "AWS4-HMAC-SHA256",
         "X-Amz-Credential": `${p.accessKey}/${scope}`,
         "X-Amz-Date": amzDate,
@@ -67,6 +68,24 @@ export function presignS3Url(p) {
 export function presignS3BucketUrl(p) {
     return presignCanonical({ ...p, canonicalUri: `/${uriEncode(p.bucket, true)}/` });
 }
+export function presignS3ListUrl(p) {
+    return presignCanonical({
+        endpoint: p.endpoint,
+        canonicalUri: `/${uriEncode(p.bucket, true)}/`,
+        method: "GET",
+        accessKey: p.accessKey,
+        secretKey: p.secretKey,
+        ...(p.region ? { region: p.region } : {}),
+        ...(p.expiresSec ? { expiresSec: p.expiresSec } : {}),
+        ...(p.now ? { now: p.now } : {}),
+        extraQuery: {
+            "list-type": "2",
+            prefix: p.prefix,
+            ...(p.continuationToken ? { "continuation-token": p.continuationToken } : {}),
+            ...(p.maxKeys ? { "max-keys": String(p.maxKeys) } : {}),
+        },
+    });
+}
 export function presignS3CopyUrl(p) {
     for (const [label, key] of [
         ["destination", p.key],

package/dist/plugins/task-attachment-store.d.ts

@@ -22,12 +22,17 @@ export interface TaskAttachmentStore {
     delete(owner: string, id: string): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<number>;
     reapUnbound(olderThanMs: number): Promise<number>;
+    sweepOrphanObjects?(graceMs: number, nowMs?: number): Promise<number>;
 }
 export declare const TASK_ATTACHMENT_TABLE = "task_attachment";
 export interface AttachmentBytesStore {
     putBlob(hash: string, bytes: Uint8Array): Promise<void>;
     getBlob(hash: string): Promise<Uint8Array | undefined>;
     deleteBlobs(hashes: string[]): Promise<number>;
+    listObjects?(): AsyncGenerator<{
+        hash: string;
+        lastModifiedMs: number;
+    }>;
 }
 export declare function materializedRelPaths(atts: TaskAttachmentRecord[]): Map<string, string>;
 export declare function bindAttachmentsForTask(opts: {
@@ -78,6 +83,8 @@ export declare class TiDBTaskAttachmentStore implements TaskAttachmentStore {
     delete(owner: string, id: string): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<number>;
     reapUnbound(olderThanMs: number): Promise<number>;
+    sweepOrphanObjects(graceMs: number, nowMs?: number): Promise<number>;
+    private referencedShas;
 }
 export declare class PgTaskAttachmentStore implements TaskAttachmentStore {
     private readonly q;
@@ -94,5 +101,7 @@ export declare class PgTaskAttachmentStore implements TaskAttachmentStore {
     delete(owner: string, id: string): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<number>;
     reapUnbound(olderThanMs: number): Promise<number>;
+    sweepOrphanObjects(graceMs: number, nowMs?: number): Promise<number>;
+    private referencedShas;
 }
 //# sourceMappingURL=task-attachment-store.d.ts.map

package/dist/plugins/task-attachment-store.js

@@ -159,6 +159,32 @@ export class TiDBTaskAttachmentStore {
         await this.deleteBytesIfUnreferenced(rows.map((r) => r.sha256));
         return res.affectedRows ?? 0;
     }
+    async sweepOrphanObjects(graceMs, nowMs = Date.now()) {
+        const lister = this.bytes;
+        if (typeof lister.listObjects !== "function")
+            return 0;
+        const candidates = [];
+        for await (const o of lister.listObjects()) {
+            if (nowMs - o.lastModifiedMs >= graceMs)
+                candidates.push(o.hash);
+        }
+        let removed = 0;
+        for (let i = 0; i < candidates.length; i += 200) {
+            const batch = candidates.slice(i, i + 200);
+            const referenced = await this.referencedShas(batch);
+            const orphans = batch.filter((h) => !referenced.has(h));
+            if (orphans.length > 0)
+                removed += await this.bytes.deleteBlobs(orphans);
+        }
+        return removed;
+    }
+    async referencedShas(shas) {
+        if (shas.length === 0)
+            return new Set();
+        const ph = shas.map(() => "?").join(",");
+        const [rows] = await this.pool.query(`SELECT DISTINCT sha256 FROM ${TASK_ATTACHMENT_TABLE} WHERE sha256 IN (${ph})`, shas);
+        return new Set(rows.map((r) => String(r.sha256)));
+    }
 }
 export class PgTaskAttachmentStore {
     q;
@@ -220,5 +246,31 @@ export class PgTaskAttachmentStore {
         await this.deleteBytesIfUnreferenced(res.rows.map((r) => r.sha256));
         return res.rows.length;
     }
+    async sweepOrphanObjects(graceMs, nowMs = Date.now()) {
+        const lister = this.bytes;
+        if (typeof lister.listObjects !== "function")
+            return 0;
+        const candidates = [];
+        for await (const o of lister.listObjects()) {
+            if (nowMs - o.lastModifiedMs >= graceMs)
+                candidates.push(o.hash);
+        }
+        let removed = 0;
+        for (let i = 0; i < candidates.length; i += 200) {
+            const batch = candidates.slice(i, i + 200);
+            const referenced = await this.referencedShas(batch);
+            const orphans = batch.filter((h) => !referenced.has(h));
+            if (orphans.length > 0)
+                removed += await this.bytes.deleteBlobs(orphans);
+        }
+        return removed;
+    }
+    async referencedShas(shas) {
+        if (shas.length === 0)
+            return new Set();
+        const ph = shas.map((_, i) => `$${i + 1}`).join(",");
+        const r = await this.q(`SELECT DISTINCT sha256 FROM ${TASK_ATTACHMENT_TABLE} WHERE sha256 IN (${ph})`, shas);
+        return new Set(r.rows.map((row) => String(row.sha256)));
+    }
 }
 //# sourceMappingURL=task-attachment-store.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.301.0",
+  "version": "1.303.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",