@sema-agent/server 1.312.0 → 1.314.0

package/dist/security.js

@@ -1,8 +1,8 @@
 import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cryptoVerify } from "node:crypto";
-import { join } from "node:path";
-import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
+import { uuidv7 } from "@sema-agent/core";
 import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
 export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+import { memoryScopeFor } from "./memory-scope.js";
 const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 export function isUuidV7(s) {
     return UUIDV7_RE.test(s);
@@ -128,41 +128,7 @@ export function verifiedPrincipal(req, config) {
         assertPrincipalShape(sub);
     return sub;
 }
-export function memoryScopeFor(config, principal, projectId) {
-    if (config.requirePrincipal === true) {
-        if (config.memoryEngineBackend === "pg" || config.memoryEngineBackend === "tidb") {
-            if (!principal)
-                return undefined;
-            return projectId ? formatProjScope(principal, projectId) : formatUserScope(principal);
-        }
-        return undefined;
-    }
-    return config.memoryScope;
-}
-export function memoryEngineRemoteLanePosture(config) {
-    const lane = config.remoteExec?.provider;
-    if (lane === undefined || lane === "host")
-        return undefined;
-    return { lane, posture: config.memoryEngineRemoteLaneAllowed === true ? "forced" : "dark" };
-}
-export function memoryEngineBackendFor(config, fallbackRoot) {
-    if (config.requirePrincipal === true || !config.memoryEngineEnabled)
-        return undefined;
-    if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
-        return undefined;
-    const root = resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
-    const dir = join(root, "memory");
-    return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
-}
-export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
-    if (!scope)
-        return undefined;
-    const isV2 = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
-    const extras = (defaultScopes ?? []).filter((s, i, arr) => typeof s === "string" && s.length > 0 && s !== scope && arr.indexOf(s) === i);
-    const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : {};
-    const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
-    return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
-}
+export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 export function approvalHmacMessage(env) {
     return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
 }

package/dist/tool-approval.d.ts

@@ -20,7 +20,7 @@ export interface ToolApprovalRunContext {
     abortSignal?: AbortSignal;
 }
 export type ToolApprovalDecision = "allow" | "allow_session" | "deny";
-export declare function parseToolApprovalDecision(body: unknown): {
+export declare function parseToolApprovalResponse(body: unknown): {
     ok: true;
     value: ToolApprovalDecision;
     updatedInput?: unknown;
@@ -28,6 +28,7 @@ export declare function parseToolApprovalDecision(body: unknown): {
     ok: false;
     error: string;
 };
+export declare const parseToolApprovalDecision: typeof parseToolApprovalResponse;
 export declare class ToolApprovalCoordinator {
     private readonly als;
     private readonly pending;

package/dist/tool-approval.js

@@ -12,7 +12,7 @@ function sessionAllowCategory(toolName) {
 function sessionAllowKey(owner, sessionId, category) {
     return JSON.stringify([owner, sessionId, category]);
 }
-export function parseToolApprovalDecision(body) {
+export function parseToolApprovalResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
     const d = body.decision;
@@ -22,6 +22,7 @@ export function parseToolApprovalDecision(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
+export const parseToolApprovalDecision = parseToolApprovalResponse;
 function isChildAsk(req) {
     return req.fromSubagent === true;
 }
@@ -208,7 +209,7 @@ export class ToolApprovalCoordinator {
         return settled.allowed;
     }
     respond(id, principal, body) {
-        const parsed = parseToolApprovalDecision(body);
+        const parsed = parseToolApprovalResponse(body);
         if (!parsed.ok)
             return { status: 400, body: { error: parsed.error } };
         const entry = this.pending.get(id);

package/dist/trace/core-keyset-guard.d.ts

@@ -1,8 +1,8 @@
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, TaskEvent } from "@sema-agent/core";
 type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected>>;
-type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId";
+type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "createdAt";

package/dist/trace/project.d.ts

@@ -108,6 +108,7 @@ export declare function taskNotificationEventData(ev: {
             edits: number;
         }>;
         resumable?: boolean;
+        completionId?: string;
     };
     eventId?: string;
     parentToolCallId?: string;

package/dist/trace/project.js

@@ -92,6 +92,7 @@ export function taskNotificationEventData(ev) {
         ...(n.seq !== undefined ? { seq: n.seq } : {}),
         ...(n.lines !== undefined ? { lines: n.lines.map((l) => redactSecrets(l)) } : {}),
         ...(n.stoppedBy !== undefined ? { stoppedBy: n.stoppedBy } : {}),
+        ...(n.completionId !== undefined ? { completionId: n.completionId } : {}),
         ...(n.source !== undefined ? { source: redactSecrets(n.source) } : {}),
         ...(n.exitCode !== undefined ? { exitCode: n.exitCode } : {}),
         ...(n.partial !== undefined ? { partial: n.partial } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.312.0",
+  "version": "1.314.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -51,7 +51,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^1.444.0",
+    "@sema-agent/core": "^1.452.0",
     "@sema-agent/registry-core": "^0.10.21",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",