@sema-agent/server 1.304.0 → 1.306.0

package/dist/config.d.ts

@@ -164,6 +164,7 @@ export interface ServiceConfig {
     };
     snapshotBlobSqlMaxBytes?: number;
     snapshotBlobAllowSql: boolean;
+    bindHost?: string;
     attachmentOrphanGraceMs: number;
     workspaceFileMaxBytes: number;
     sendUserFile?: {
@@ -315,4 +316,10 @@ export declare function logConfigDiagnostics(logger: {
 }): void;
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): void;
 export declare function loadConfig(): ServiceConfig;
+export declare function resolveBindHost(config: {
+    bindHost?: string;
+    allowUnauthedWrites?: boolean;
+    authToken?: string;
+    authTokens?: Record<string, string>;
+}): string | undefined;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -538,6 +538,7 @@ export function loadConfig() {
             : undefined,
         snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
         snapshotBlobAllowSql: process.env.SNAPSHOT_BLOB_ALLOW_SQL_BYTES === "true",
+        bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
         attachmentOrphanGraceMs: ((v) => (v !== undefined && Number.isFinite(v) && v >= 0 ? v : 3_600_000))(process.env.ATTACHMENT_ORPHAN_GRACE_MS !== undefined ? Number(process.env.ATTACHMENT_ORPHAN_GRACE_MS) : undefined),
         workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
         sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
@@ -727,4 +728,10 @@ export function loadConfig() {
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
     };
 }
+export function resolveBindHost(config) {
+    if (config.bindHost)
+        return config.bindHost;
+    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+    return config.allowUnauthedWrites && !anyServiceAuth ? "127.0.0.1" : undefined;
+}
 //# sourceMappingURL=config.js.map

package/dist/http/server.js

@@ -4263,7 +4263,7 @@ export function createHttpServer(deps) {
                         sendJson(res, 413, {
                             code: "blob_too_large_for_sql",
                             errorCode: "blob_too_large_for_sql",
-                            error: `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes; mysql-protocol packet limit) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs`,
+                            error: `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`,
                         });
                         return;
                     }
@@ -6821,7 +6821,9 @@ function routeLabel(_method, url) {
     return "other";
 }
 function workspaceContentType(relPath) {
-    const ext = relPath.slice(relPath.lastIndexOf(".") + 1).toLowerCase();
+    const base = relPath.slice(relPath.lastIndexOf("/") + 1);
+    const dot = base.lastIndexOf(".");
+    const ext = dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
     const TABLE = {
         txt: "text/plain; charset=utf-8", md: "text/plain; charset=utf-8", log: "text/plain; charset=utf-8",
         json: "application/json; charset=utf-8", csv: "text/csv; charset=utf-8",

package/dist/http/tar.js

@@ -19,7 +19,11 @@ export function splitTarPath(relPath) {
     }
     return null;
 }
+const USTAR_MAX_SIZE = 8 * 1024 * 1024 * 1024 - 1;
 export function tarHeader(relPath, sizeBytes, mtimeSec) {
+    if (!Number.isFinite(sizeBytes) || sizeBytes < 0 || sizeBytes > USTAR_MAX_SIZE) {
+        throw new Error(`tar: size ${sizeBytes} not representable in a ustar header (12-octal-byte field, max 8GiB-1): ${relPath}`);
+    }
     const split = splitTarPath(relPath);
     if (split === null)
         throw new Error(`tar: path not representable in ustar (must be ≤255 bytes and splittable at "/"): ${relPath}`);

package/dist/main.js

@@ -24,7 +24,7 @@ import { stat as fsStat, readFile as fsReadFile } from "node:fs/promises";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, purgeScratchpadDir, sweepStaleScratchpads, resumeFactsForLane } from "./env-facts.js";
 import { normalizeSuggestNextPrompts, normalizeResilience, normalizeAttachments, normalizeResumeAtMode, resolveTaskLimits, taskAgentsSpecFragment, retainBackgroundProcessesFromBody, toolNameListFromBody, promptProfileFromBody } from "./spec-fields.js";
 import { createBrain, brainSummary } from "./brain.js";
-import { loadConfig, logConfigDiagnostics } from "./config.js";
+import { loadConfig, logConfigDiagnostics, resolveBindHost } from "./config.js";
 import { resourceSuspendOptIn } from "./resource-suspend.js";
 import { createSessionStore, ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
@@ -2340,7 +2340,15 @@ async function main() {
         },
     });
     runDenySweep = server.denyExpiredApprovals;
-    await new Promise((resolve) => server.listen(config.port, resolve));
+    const bindHost = resolveBindHost(config);
+    await new Promise((resolve) => (bindHost ? server.listen(config.port, bindHost, resolve) : server.listen(config.port, resolve)));
+    logger.info("listening", {
+        port: config.port,
+        bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
+        ...(bindHost === "127.0.0.1" && !config.bindHost
+            ? { note: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
+            : {}),
+    });
     const fleetClient = startFleetClientFromEnv(config, {
         instanceId,
         version: serviceVersion(),

package/dist/plugins/blob-backend.js

@@ -75,14 +75,24 @@ export async function sqlBlobSizes(dialect, pool, hashes) {
     if (hashes.length === 0)
         return new Map();
     const distinct = [...new Set(hashes)];
-    if (dialect === "tidb") {
-        const ph = distinct.map(() => "?").join(",");
-        const [rows] = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, distinct);
-        return new Map(rows.map((r) => [String(r.blob_hash), Number(r.byte_len)]));
+    const CHUNK = 1000;
+    const out = new Map();
+    for (let i = 0; i < distinct.length; i += CHUNK) {
+        const part = distinct.slice(i, i + CHUNK);
+        if (dialect === "tidb") {
+            const ph = part.map(() => "?").join(",");
+            const [rows] = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, part);
+            for (const r of rows)
+                out.set(String(r.blob_hash), Number(r.byte_len));
+        }
+        else {
+            const ph = part.map((_, j) => `$${j + 1}`).join(",");
+            const r = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, part);
+            for (const row of r.rows)
+                out.set(row.blob_hash, Number(row.byte_len));
+        }
     }
-    const ph = distinct.map((_, i) => `$${i + 1}`).join(",");
-    const r = await pool.query(`SELECT blob_hash, byte_len FROM snapshot_blob WHERE blob_hash IN (${ph})`, distinct);
-    return new Map(r.rows.map((row) => [row.blob_hash, Number(row.byte_len)]));
+    return out;
 }
 async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes) {
     if (hashes.length === 0)
@@ -250,14 +260,17 @@ export class MinioBlobBackend {
         }
         if (toDelete.length === 0)
             return 0;
+        let okCount = 0;
         await mapBounded(toDelete, MINIO_OP_CONCURRENCY, async (hash) => {
             try {
-                await fetch(this.presign(hash, "DELETE"), { method: "DELETE" });
+                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(hash, "DELETE"), { method: "DELETE" });
+                if (res.ok || res.status === 404)
+                    okCount++;
             }
             catch {
             }
         });
-        return toDelete.length;
+        return okCount;
     }
 }
 //# sourceMappingURL=blob-backend.js.map

package/dist/plugins/task-attachment-store.js

@@ -163,20 +163,26 @@ export class TiDBTaskAttachmentStore {
         const lister = this.bytes;
         if (typeof lister.listObjects !== "function")
             return 0;
-        const candidates = [];
-        for await (const o of lister.listObjects()) {
-            if (nowMs - o.lastModifiedMs >= graceMs)
-                candidates.push(o.hash);
-        }
         let removed = 0;
-        for (let i = 0; i < candidates.length; i += 200) {
-            const batch = candidates.slice(i, i + 200);
+        let batch = [];
+        const flush = async () => {
+            if (batch.length === 0)
+                return;
             const referenced = await this.referencedShas(batch);
             const orphans = batch.filter((h) => !referenced.has(h));
             const safe = await this.filterStillOrphan(orphans, graceMs, nowMs);
             if (safe.length > 0)
                 removed += await this.bytes.deleteBlobs(safe);
+            batch = [];
+        };
+        for await (const o of lister.listObjects()) {
+            if (nowMs - o.lastModifiedMs < graceMs)
+                continue;
+            batch.push(o.hash);
+            if (batch.length >= 200)
+                await flush();
         }
+        await flush();
         return removed;
     }
     async referencedShas(shas) {
@@ -269,20 +275,26 @@ export class PgTaskAttachmentStore {
         const lister = this.bytes;
         if (typeof lister.listObjects !== "function")
             return 0;
-        const candidates = [];
-        for await (const o of lister.listObjects()) {
-            if (nowMs - o.lastModifiedMs >= graceMs)
-                candidates.push(o.hash);
-        }
         let removed = 0;
-        for (let i = 0; i < candidates.length; i += 200) {
-            const batch = candidates.slice(i, i + 200);
+        let batch = [];
+        const flush = async () => {
+            if (batch.length === 0)
+                return;
             const referenced = await this.referencedShas(batch);
             const orphans = batch.filter((h) => !referenced.has(h));
             const safe = await this.filterStillOrphan(orphans, graceMs, nowMs);
             if (safe.length > 0)
                 removed += await this.bytes.deleteBlobs(safe);
+            batch = [];
+        };
+        for await (const o of lister.listObjects()) {
+            if (nowMs - o.lastModifiedMs < graceMs)
+                continue;
+            batch.push(o.hash);
+            if (batch.length >= 200)
+                await flush();
         }
+        await flush();
         return removed;
     }
     async referencedShas(shas) {

package/dist/trace/project.js

@@ -62,7 +62,7 @@ export function toolEndEventData(ev) {
         isError: ev.isError,
         ...(ev.output !== undefined ? { output: redactDeep(ev.output) } : {}),
         ...(ev.truncated ? { truncated: true } : {}),
-        ...(typeof ev.totalChars === "number" ? { totalChars: ev.totalChars } : {}),
+        ...(Number.isFinite(ev.totalChars) ? { totalChars: ev.totalChars } : {}),
         ...(ev.structured !== undefined ? { structured: redactDeep(ev.structured) } : {}),
         ...identityFields(ev),
     };
@@ -241,7 +241,7 @@ export function projectEvents(events, opts = {}) {
                 break;
             case "tool_end": {
                 const callId = String(d.toolCallId ?? "");
-                blocks.push({ type: "tool-result", callId, ...(typeof d.label === "string" ? { label: d.label } : {}), output: d.output, ...(d.isError ? { isError: true } : {}), ...(d.truncated ? { truncated: true } : {}), ...(typeof d.totalChars === "number" ? { totalChars: d.totalChars } : {}), ...(d.structured !== undefined ? { structured: d.structured } : {}), ...identityFields(d) });
+                blocks.push({ type: "tool-result", callId, ...(typeof d.label === "string" ? { label: d.label } : {}), output: d.output, ...(d.isError ? { isError: true } : {}), ...(d.truncated ? { truncated: true } : {}), ...(Number.isFinite(d.totalChars) ? { totalChars: d.totalChars } : {}), ...(d.structured !== undefined ? { structured: d.structured } : {}), ...identityFields(d) });
                 break;
             }
             case "prompt_assembled":
@@ -307,7 +307,7 @@ export function mapTraceEvent(type, seq, data) {
         case "tool_start":
             return { event: "tool-call", data: { seq, id: data.toolCallId, name: data.toolName, ...(typeof data.label === "string" ? { label: data.label } : {}), input: data.args, ...identityFields(data) } };
         case "tool_end":
-            return { event: "tool-result", data: { seq, callId: data.toolCallId, ...(typeof data.label === "string" ? { label: data.label } : {}), isError: Boolean(data.isError), ...(data.output !== undefined ? { output: data.output } : {}), ...(data.truncated ? { truncated: true } : {}), ...(typeof data.totalChars === "number" ? { totalChars: data.totalChars } : {}), ...(data.structured !== undefined ? { structured: data.structured } : {}), ...identityFields(data) } };
+            return { event: "tool-result", data: { seq, callId: data.toolCallId, ...(typeof data.label === "string" ? { label: data.label } : {}), isError: Boolean(data.isError), ...(data.output !== undefined ? { output: data.output } : {}), ...(data.truncated ? { truncated: true } : {}), ...(Number.isFinite(data.totalChars) ? { totalChars: data.totalChars } : {}), ...(data.structured !== undefined ? { structured: data.structured } : {}), ...identityFields(data) } };
         case "turn_end": {
             const tokens = toContractTokens(data.usage);
             return { event: "turn", data: { seq, ...(tokens ? { tokens } : {}) } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.304.0",
+  "version": "1.306.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",