@sema-agent/server 1.310.0 → 1.312.0

package/dist/config.d.ts

@@ -1,308 +1,7 @@
-import type { SealedKeyPoison } from "./sealed-key.js";
-import { type McpServerSpec, type Model, type ModelRoles } from "@sema-agent/core";
-import { type ApprovalHmacKey, type PrincipalJwtKey } from "./security.js";
-import { type ElicitationThrottle } from "./elicitation.js";
-import type { InfraCostRates } from "./finance/cost-taxonomy.js";
-import type { Autonomy, CommandRule } from "./runtime-governance.js";
-export interface ScopedMcpServer {
-    scenarios: string[];
-    spec: McpServerSpec;
-}
-export interface ImageBakeConfig {
-    enabled: boolean;
-    runnerPrincipal: string;
-    registry: string | null;
-    cacheBase: string | null;
-    defaultBaseRef: string | null;
-    leaseMs: number;
-    staleMs: number;
-    submitRateMax: number;
-    submitRateWindowSec: number;
-}
-export interface ServiceConfig {
-    port: number;
-    gatewayBaseUrl: string;
-    gatewayApiKey?: string;
-    gatewayFallbackUrls: string[];
-    anthropic?: {
-        apiKey?: string;
-        authToken?: string;
-        baseUrl?: string;
-        version?: string;
-        cacheBreakpoints: boolean;
-        maxRetries: number;
-    };
-    resilience: {
-        connectTimeoutMs: number;
-        firstTokenTimeoutMs: number;
-        idleTimeoutMs: number;
-        circuitBreaker: boolean;
-        failureThreshold: number;
-        cooldownMs: number;
-    };
-    model: Model;
-    models: Record<string, Model>;
-    modelApiKeyEnv: Record<string, string>;
-    modelApiKeys: Record<string, string | SealedKeyPoison>;
-    modelQuotaWeights: Record<string, number>;
-    tiers: Record<string, string>;
-    projects: Record<string, {
-        displayName?: string;
-        gitRemotes?: string[];
-        defaultScopes?: string[];
-    }>;
-    roles: ModelRoles;
-    sessionBackend: "memory" | "tidb" | "auto";
-    sessionCacheTtlSec: number;
-    rewindSnapshotMaxMb?: number;
-    memoryEngineEnabled: boolean;
-    memoryEngineDir?: string;
-    memoryEngineRemoteLaneAllowed: boolean;
-    memoryScope?: string;
-    memorySync?: {
-        url: string;
-        token: string;
-        scope: string;
-        maxPushEntries?: number;
-        maxPullEntries?: number;
-    };
-    remoteExec?: {
-        provider: "e2b";
-        apiKey: string;
-        template?: string;
-        timeoutMs?: number;
-        livenessMs?: number;
-        allowInternetAccess?: boolean;
-        sandboxEnv?: Record<string, string>;
-        mountPath?: string;
-    } | {
-        provider: "k8s";
-        image: string;
-        apiUrl?: string;
-        token?: string;
-        caCert?: string;
-        insecureTls?: boolean;
-        namespace?: string;
-        runtimeClass?: string;
-        mountPath?: string;
-        timeoutMs?: number;
-        memory?: string;
-        cpu?: string;
-        s3Snapshot?: {
-            endpoint: string;
-            bucket: string;
-            accessKey: string;
-            secretKey: string;
-            region?: string;
-            keyPrefix?: string;
-            presignTtlSec?: number;
-        };
-    } | {
-        provider: "ssh";
-        host: string;
-        port?: number;
-        username: string;
-        privateKey: string;
-        mountPath?: string;
-    } | {
-        provider: "adb";
-        serial: string;
-        adbPath?: string;
-        mountPath?: string;
-    } | {
-        provider: "host";
-        workspaceBase?: string;
-        commandTimeoutMs?: number;
-    } | {
-        provider: "local-docker";
-        image: string;
-        mountPath?: string;
-        dockerPath?: string;
-        dockerHost?: string;
-        memory?: string;
-        cpus?: number;
-        pidsLimit?: number;
-        dropAllCaps?: boolean;
-        network?: "none" | "bridge" | "host";
-        commandTimeoutMs?: number;
-        env?: Record<string, string>;
-    };
-    worktreeIsolation?: {
-        repoRoot: string;
-        allowedRoots?: string[];
-        commit?: string;
-    };
-    mcpServers?: ScopedMcpServer[];
-    tidb?: {
-        host: string;
-        port: number;
-        user: string;
-        password: string;
-        database: string;
-        connectionLimit?: number;
-    };
-    dbBackend: "mysql" | "pg" | "local" | "memory";
-    dbBackendExplicit: boolean;
-    localDataRoot?: string;
-    pg?: {
-        host: string;
-        port: number;
-        user: string;
-        password: string;
-        database: string;
-        connectionLimit?: number;
-    };
-    dbQueryTimeoutMs?: number;
-    snapshotBlobStore?: {
-        endpoint: string;
-        bucket: string;
-        accessKey: string;
-        secretKey: string;
-        region?: string;
-        keyPrefix?: string;
-        presignTtlSec?: number;
-    };
-    snapshotBlobSqlMaxBytes?: number;
-    snapshotBlobAllowSql: boolean;
-    pluginsAllowHosts: string[];
-    bindHost?: string;
-    attachmentOrphanGraceMs: number;
-    workspaceFileMaxBytes: number;
-    sendUserFile?: {
-        endpoint: string;
-        publicEndpoint?: string;
-        publicBucket: string;
-        privateBucket: string;
-        privateKeyPrefix: string;
-        sandboxPutEndpoint?: string;
-        accessKey: string;
-        secretKey: string;
-        region?: string;
-        defaultTtlSec: number;
-    };
-    authToken?: string;
-    authTokens: Record<string, string>;
-    allowUnauthedWrites?: boolean;
-    metricsToken?: string;
-    traceToken?: string;
-    corsOrigins: string[];
-    attachmentMaxBytes: number;
-    attachmentMimeAllowlist?: string[];
-    attachmentUnboundTtlMs: number;
-    principalHeader: string;
-    requirePrincipal: boolean;
-    autonomy?: Autonomy;
-    commandPolicy?: CommandRule[];
-    approvalRequire: string[];
-    operatorPrincipals: string[];
-    approvalDeny: string[];
-    approvalPollMs: number;
-    durableApproval: boolean;
-    resourceSuspend: boolean;
-    resourceSuspendTtlSec: number;
-    approvalAutoBudget: number;
-    approvalNeverAuto: string[];
-    approvalHmacKeys: ApprovalHmacKey[];
-    directApprovalDoor: boolean;
-    principalJwtPubkeys: PrincipalJwtKey[];
-    principalJwtIss?: string;
-    principalJwtAud?: string;
-    principalJwtMaxTtlSec: number;
-    directDoorActive: boolean;
-    infraCostRates: InfraCostRates;
-    leaderEnabled: boolean;
-    leaderFanoutEnabled: boolean;
-    routerEnabled: boolean;
-    selfOrchestrationEnabled: boolean;
-    forkEnabled: boolean;
-    experimentalObserverAgents: boolean;
-    selfOrchestrationModels: string[];
-    selfOrchestrationWorkerIsolation: boolean;
-    workflowRunStoreBackend: "auto" | "file" | "memory";
-    workflowOrphanGraceMs: number;
-    schedulerEnabled: boolean;
-    projectMemoryDisabled: boolean;
-    schedulerStorePath?: string;
-    configBootFetchBudgetMs: number;
-    schedulerSessionWakeup: boolean;
-    planModeEnabled: boolean;
-    workflowJournalRetentionMs: number;
-    workflowRunRetentionMs: number;
-    backgroundAgentRetentionMs: number;
-    backgroundAgentStaleRunningMs: number;
-    backgroundAgentParkClaimStaleMs: number;
-    rosterRetentionMs: number;
-    scratchpadSweepTtlMs: number;
-    sandboxPkgSource?: string;
-    sessionAutoTitle: boolean;
-    selectEnvironmentTool: boolean;
-    envFactsEnabled: boolean;
-    sensitiveWritePatterns: string[];
-    manualModeShellGate?: "always" | "classify";
-    toolDeferLongtail: boolean;
-    lspEnabled: boolean;
-    lspHostEnabled: boolean;
-    drainGraceMs: number;
-    sighupIdleGraceMs: number;
-    mcpElicitation: {
-        enabled: boolean;
-        throttle: ElicitationThrottle;
-    };
-    askQuestionEnabled: boolean;
-    toolApprovalEnabled: boolean;
-    workflowAgentsReadOnly: boolean;
-    imageBakes: ImageBakeConfig;
-    toolTrace: boolean;
-    traceThinking: boolean;
-    logLevel: "debug" | "info" | "warn" | "error";
-    rateLimitPerMin: number;
-    maxTaskCostUsd: number;
-    maxTaskTokens: number;
-    maxPrincipalCostUsd: number;
-    costQuotaWindowSec: number;
-    degrade?: {
-        to: string;
-        atCostFraction: number;
-        reactive: boolean;
-        downgradeOn?: ("rate_limit" | "breaker_open")[];
-        toSupportsImages: boolean;
-    };
-    cascadeLadder: string[];
-    otel?: {
-        endpoint: string;
-        intervalMs: number;
-        serviceName: string;
-        headers: Record<string, string>;
-    };
-    approvalTimeoutSec: number;
-    reapIntervalSec: number;
-    toolResultTtlSec: number;
-    runStaleSec: number;
-    syncImportLeaseStaleSec: number;
-    gitApiBaseUrl?: string;
-    gitApiToken?: string;
-    memoryEngineBackend: "file" | "pg" | "tidb";
-    workflowSizeGuideline?: "small" | "medium" | "large" | "unrestricted";
-    defaultScenario: string;
-    skillsDir: string;
-    oaApiBaseUrl?: string;
-    oaServiceToken?: string;
-    oaIssue?: {
-        baseUrl: string;
-        owner: string;
-        repo: string;
-        token: string;
-        defaultLabels?: number[];
-    };
-    configCenter?: {
-        baseUrl: string;
-        token: string;
-        dryRun: boolean;
-        worker?: string;
-    };
-    configProvider?: string;
-    configLocalDir?: string;
-}
+import { type Model } from "@sema-agent/core";
+import type { Autonomy } from "./runtime-governance.js";
+import type { ServiceConfig } from "./config-types.js";
+export type { ServiceConfig, ScopedMcpServer, ImageBakeConfig } from "./config-types.js";
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
 export declare function drainConfigWarnings(): Array<{
     env: string;

package/dist/config.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, RECOMMENDED_SENSITIVE_PATTERNS } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
-import { parseApprovalHmacKeys, parsePrincipalJwks } from "./security.js";
+import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 function csv(name) {
     return (process.env[name] ?? "")

package/dist/env-facts.d.ts

@@ -1,4 +1,4 @@
-import type { ImageCapabilities } from "./plugins/tidb-image-index.js";
+import type { ImageCapabilities } from "./plugins/store-contracts.js";
 export interface SandboxEnvFacts {
     profile?: string;
     capabilities?: string[];

package/dist/hooks/hook-llm.d.ts

@@ -1,5 +1,5 @@
 import type { Model } from "@sema-agent/core";
-import type { ServiceConfig } from "../config.js";
+import type { ServiceConfig } from "../config-types.js";
 import type { HookLlmCall } from "./hook-runner.js";
 export type HookModelPick = {
     ok: true;

package/dist/http/server.d.ts

@@ -1,10 +1,11 @@
 import http from "node:http";
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type McpServerSpec, type Runner, type TaskSpec, type TaskResult, type CascadeConfig, type QuestionAnswer, type WorkflowRunStore, type MemoryEntry, type AgentDefinition } from "@sema-agent/core";
-import type { ServiceConfig } from "../config.js";
+import { type Runner, type TaskSpec, type TaskResult, type CascadeConfig, type QuestionAnswer, type WorkflowRunStore, type MemoryEntry } from "@sema-agent/core";
+import type { TaskRequestBody } from "./wire-types.js";
+import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../sema-registry.js";
 import { type OwnerAwareSessionStore } from "../security.js";
-import type { BakeState, BakeErrorCode } from "../plugins/tidb-image-bake.js";
+import type { BakeState, BakeErrorCode } from "../plugins/store-contracts.js";
 import type { RunStore, ApprovalStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, StoreBackend } from "../plugins/store-backend.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
@@ -159,88 +160,7 @@ export interface ServiceDeps {
         blocked?: string[];
     } | undefined;
 }
-export interface TaskRequestBody {
-    objective: string;
-    sessionId?: string;
-    images?: Array<{
-        data: string;
-        mimeType: string;
-    } | {
-        url: string;
-    }>;
-    attachmentIds?: string[];
-    clientContext?: {
-        timeZone?: string;
-        userEmail?: string;
-    };
-    systemPrompt?: string;
-    appendSystemPrompt?: string;
-    model?: string;
-    compactionModel?: string;
-    maxCostUsd?: number;
-    maxTokens?: number;
-    verify?: boolean;
-    verifyRounds?: number;
-    cascade?: boolean;
-    jobId?: string;
-    skills?: Array<{
-        name: string;
-        description: string;
-        content: string;
-    }>;
-    sandboxImageProfile?: string;
-    capabilitiesNeeded?: string[];
-    outputSchema?: Record<string, unknown>;
-    reasoningEffort?: string;
-    resumeAt?: string;
-    resumeAtMode?: string;
-    requireExistingSession?: boolean;
-    suggestNextPrompts?: boolean | {
-        count?: number;
-        role?: string;
-    };
-    rewindFiles?: boolean;
-    rewindFilesTo?: string;
-    resilience?: {
-        allowDegrade?: boolean;
-        allowFailover?: boolean;
-        bypassBreaker?: boolean;
-    };
-    finalVerification?: boolean;
-    limits?: {
-        timeoutSec?: number;
-        maxOutputTokens?: number;
-        maxTurns?: number;
-    };
-    attachments?: {
-        todoReminder?: boolean;
-        changedFiles?: boolean | {
-            maxFiles?: number;
-        };
-        planModeReminder?: boolean;
-        backgroundTasks?: boolean;
-        toolsDelta?: boolean;
-    };
-    forwardSubagentEvents?: boolean;
-    scratchpadDir?: string;
-    retainSubagentSessions?: boolean | {
-        ttlMs?: number;
-        max?: number;
-    };
-    agents?: AgentDefinition[];
-    retainBackgroundProcesses?: boolean;
-    excludeTools?: string[];
-    deferTools?: string[];
-    promptProfile?: "simple" | "classic";
-    permissionMode?: string;
-    memoryWrite?: boolean;
-    projectId?: string;
-    cwd?: string;
-    mcpServers?: McpServerSpec[];
-    selfOrchestration?: boolean;
-    enableFork?: boolean;
-    [k: string]: unknown;
-}
+export type { TaskRequestBody } from "./wire-types.js";
 export declare const MAX_USER_SKILLS = 10;
 export declare const MAX_SKILL_CONTENT_CHARS = 1048576;
 export declare const MAX_SYSTEM_PROMPT_CHARS = 16384;

package/dist/http/wire-types.d.ts

@@ -0,0 +1,84 @@
+import type { AgentDefinition, McpServerSpec } from "@sema-agent/core";
+export interface TaskRequestBody {
+    objective: string;
+    sessionId?: string;
+    images?: Array<{
+        data: string;
+        mimeType: string;
+    } | {
+        url: string;
+    }>;
+    attachmentIds?: string[];
+    clientContext?: {
+        timeZone?: string;
+        userEmail?: string;
+    };
+    systemPrompt?: string;
+    appendSystemPrompt?: string;
+    model?: string;
+    compactionModel?: string;
+    maxCostUsd?: number;
+    maxTokens?: number;
+    verify?: boolean;
+    verifyRounds?: number;
+    cascade?: boolean;
+    jobId?: string;
+    skills?: Array<{
+        name: string;
+        description: string;
+        content: string;
+    }>;
+    sandboxImageProfile?: string;
+    capabilitiesNeeded?: string[];
+    outputSchema?: Record<string, unknown>;
+    reasoningEffort?: string;
+    resumeAt?: string;
+    resumeAtMode?: string;
+    requireExistingSession?: boolean;
+    suggestNextPrompts?: boolean | {
+        count?: number;
+        role?: string;
+    };
+    rewindFiles?: boolean;
+    rewindFilesTo?: string;
+    resilience?: {
+        allowDegrade?: boolean;
+        allowFailover?: boolean;
+        bypassBreaker?: boolean;
+    };
+    finalVerification?: boolean;
+    limits?: {
+        timeoutSec?: number;
+        maxOutputTokens?: number;
+        maxTurns?: number;
+    };
+    attachments?: {
+        todoReminder?: boolean;
+        changedFiles?: boolean | {
+            maxFiles?: number;
+        };
+        planModeReminder?: boolean;
+        backgroundTasks?: boolean;
+        toolsDelta?: boolean;
+    };
+    forwardSubagentEvents?: boolean;
+    scratchpadDir?: string;
+    retainSubagentSessions?: boolean | {
+        ttlMs?: number;
+        max?: number;
+    };
+    agents?: AgentDefinition[];
+    retainBackgroundProcesses?: boolean;
+    excludeTools?: string[];
+    deferTools?: string[];
+    promptProfile?: "simple" | "classic";
+    permissionMode?: string;
+    memoryWrite?: boolean;
+    projectId?: string;
+    cwd?: string;
+    mcpServers?: McpServerSpec[];
+    selfOrchestration?: boolean;
+    enableFork?: boolean;
+    [k: string]: unknown;
+}
+//# sourceMappingURL=wire-types.d.ts.map

package/dist/http/wire-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=wire-types.js.map

package/dist/images/manifest.d.ts

@@ -1,4 +1,4 @@
-import type { ImageIndexUpsert, ImageNestedBuildMode, ImageStatus } from "../plugins/tidb-image-index.js";
+import type { ImageIndexUpsert, ImageNestedBuildMode, ImageStatus } from "../plugins/store-contracts.js";
 export declare function nestedBuildModeOf(v: string | boolean | undefined): ImageNestedBuildMode;
 export interface BuildManifest {
     profile?: string;

package/dist/index.d.ts

@@ -5,7 +5,8 @@ export { createTidbPool, ensureSchema, SCHEMA_STATEMENTS } from "./plugins/tidb-
 export { TiDBSessionStore } from "./plugins/tidb-session-store.js";
 export { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 export { CachingSessionStore, type CachingOptions } from "./plugins/caching-session-store.js";
-export { TiDBRunStore, type RunRecord, type RunEvent, } from "./plugins/tidb-run-store.js";
+export { TiDBRunStore } from "./plugins/tidb-run-store.js";
+export type { RunRecord, RunEvent } from "./plugins/store-contracts.js";
 export { runInBackground } from "./runs.js";
 export { TiDBApprovalStore, type ApprovalRow, type ApprovalStatus, } from "./plugins/tidb-approval-store.js";
 export { createOaApprovalPolicy, type OaApprovalOptions } from "./approval.js";

package/dist/index.js

@@ -5,7 +5,7 @@ export { createTidbPool, ensureSchema, SCHEMA_STATEMENTS } from "./plugins/tidb-
 export { TiDBSessionStore } from "./plugins/tidb-session-store.js";
 export { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
 export { CachingSessionStore } from "./plugins/caching-session-store.js";
-export { TiDBRunStore, } from "./plugins/tidb-run-store.js";
+export { TiDBRunStore } from "./plugins/tidb-run-store.js";
 export { runInBackground } from "./runs.js";
 export { TiDBApprovalStore, } from "./plugins/tidb-approval-store.js";
 export { createOaApprovalPolicy } from "./approval.js";