@sema-agent/server 1.305.0 → 1.306.0

package/dist/config.d.ts

@@ -164,6 +164,7 @@ export interface ServiceConfig {
     };
     snapshotBlobSqlMaxBytes?: number;
     snapshotBlobAllowSql: boolean;
+    bindHost?: string;
     attachmentOrphanGraceMs: number;
     workspaceFileMaxBytes: number;
     sendUserFile?: {
@@ -315,4 +316,10 @@ export declare function logConfigDiagnostics(logger: {
 }): void;
 export declare function applyAutoCompactWindow(m: Model, explicit?: number): void;
 export declare function loadConfig(): ServiceConfig;
+export declare function resolveBindHost(config: {
+    bindHost?: string;
+    allowUnauthedWrites?: boolean;
+    authToken?: string;
+    authTokens?: Record<string, string>;
+}): string | undefined;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -538,6 +538,7 @@ export function loadConfig() {
             : undefined,
         snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
         snapshotBlobAllowSql: process.env.SNAPSHOT_BLOB_ALLOW_SQL_BYTES === "true",
+        bindHost: process.env.BIND_HOST || process.env.HOST || undefined,
         attachmentOrphanGraceMs: ((v) => (v !== undefined && Number.isFinite(v) && v >= 0 ? v : 3_600_000))(process.env.ATTACHMENT_ORPHAN_GRACE_MS !== undefined ? Number(process.env.ATTACHMENT_ORPHAN_GRACE_MS) : undefined),
         workspaceFileMaxBytes: optFinitePositiveEnv("WORKSPACE_FILE_MAX_BYTES") ?? 8 * 1024 * 1024,
         sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
@@ -727,4 +728,10 @@ export function loadConfig() {
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
     };
 }
+export function resolveBindHost(config) {
+    if (config.bindHost)
+        return config.bindHost;
+    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+    return config.allowUnauthedWrites && !anyServiceAuth ? "127.0.0.1" : undefined;
+}
 //# sourceMappingURL=config.js.map

package/dist/main.js

@@ -24,7 +24,7 @@ import { stat as fsStat, readFile as fsReadFile } from "node:fs/promises";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, purgeScratchpadDir, sweepStaleScratchpads, resumeFactsForLane } from "./env-facts.js";
 import { normalizeSuggestNextPrompts, normalizeResilience, normalizeAttachments, normalizeResumeAtMode, resolveTaskLimits, taskAgentsSpecFragment, retainBackgroundProcessesFromBody, toolNameListFromBody, promptProfileFromBody } from "./spec-fields.js";
 import { createBrain, brainSummary } from "./brain.js";
-import { loadConfig, logConfigDiagnostics } from "./config.js";
+import { loadConfig, logConfigDiagnostics, resolveBindHost } from "./config.js";
 import { resourceSuspendOptIn } from "./resource-suspend.js";
 import { createSessionStore, ensureChildSessionDurableWithPromotion } from "./plugins/session-store.js";
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
@@ -2340,7 +2340,15 @@ async function main() {
         },
     });
     runDenySweep = server.denyExpiredApprovals;
-    await new Promise((resolve) => server.listen(config.port, resolve));
+    const bindHost = resolveBindHost(config);
+    await new Promise((resolve) => (bindHost ? server.listen(config.port, bindHost, resolve) : server.listen(config.port, resolve)));
+    logger.info("listening", {
+        port: config.port,
+        bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
+        ...(bindHost === "127.0.0.1" && !config.bindHost
+            ? { note: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
+            : {}),
+    });
     const fleetClient = startFleetClientFromEnv(config, {
         instanceId,
         version: serviceVersion(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.305.0",
+  "version": "1.306.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",