@sema-agent/server 1.313.0 → 1.314.0

package/dist/main.js

@@ -63,10 +63,10 @@ import { exportMemoryScope } from "./memory-export.js";
 import { performMemorySync } from "./memory-sync.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { createLeaderEndpoint } from "./leader/endpoint.js";
-import { buildLeaderRunner } from "./leader/wire.js";
+import { createLeaderRunner } from "./leader/wire.js";
 import { WorkflowNotifyGate, JournalingWorkflowRunStore, FileWorkflowNotifyJournalStore, } from "./orchestration/workflow-notify-journal.js";
 import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, resolveCompletionRoute, resolveServedSession, } from "./orchestration/workflow-completion-inbox.js";
-import { buildPricing, buildTracer, buildSideQueryAccountant, cappedCeiling, ModelUsageTracker, PromptManifestTracker } from "./budget.js";
+import { buildPricing, createTracer, createSideQueryAccountant, cappedCeiling, ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import { CostQuota } from "./observability/cost-quota.js";
 import { startOtlpExporter } from "./observability/otel-exporter.js";
 import { HEARTBEAT_MS, backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "./runs.js";
@@ -84,14 +84,14 @@ import { LocalTaskAttachmentStore } from "./plugins/local-task-attachment-store.
 import { MinioBlobBackend, SQL_BLOB_DEFAULT_MAX_BYTES } from "./plugins/blob-backend.js";
 import { TiDBBackgroundAgentStore, PgBackgroundAgentStore, ensureTiDBBackgroundAgentSchema, ensurePgBackgroundAgentSchema } from "./plugins/background-agent-store-sql.js";
 import { TiDBMailboxStore, PgMailboxStore, ensureTiDBMailboxSchema, ensurePgMailboxSchema } from "./plugins/mailbox-store-sql.js";
-import { createPrincipalCapsClient, gateExecutionLane, scopedTokenNeedsWorker, applyObserverEnvOptIn } from "./runtime-caps-resolver.js";
+import { createPrincipalEntitlementsClient, gateExecutionLane, scopedTokenNeedsWorker, applyObserverEnvOptIn } from "./runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "./runtime-governance.js";
 import { parseTaskSettings, applyTaskSettings, coercePermissionMode, withPermissionMode, effectiveThinking, acceptAppendSystemPrompt, hasConstitutionAnchors, providerDropsAppend, MAX_SETTINGS_OUTPUT_STYLE_CHARS } from "./task-settings.js";
-import { buildTaskHooks, composeHooks } from "./hooks/hook-runner.js";
+import { createTaskHooks, composeHooks } from "./hooks/hook-runner.js";
 import { createHookLlm } from "./hooks/hook-llm.js";
 import { selfOrchestrationFromBody, enableForkFromBody, workflowModelAllowlistFor, normalizeRetainSubagentSessions } from "./task-workflow.js";
 import { FleetUsageAccumulator, startFleetClientFromEnv } from "./fleet-client.js";
-import { buildFleetLeaseFromEnv } from "./fleet-lease.js";
+import { createFleetLeaseFromEnv } from "./fleet-lease.js";
 import { reclaimOrphansAtBoot } from "./boot-reclaim.js";
 import { evictLspOnDestroy } from "./lsp-evict.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
@@ -104,7 +104,7 @@ import { createWorkerHardenedVmRunner } from "./orchestration/hardened-vm-worker
 import { WorkflowAgentRegistry } from "./orchestration/workflow-agent-steer.js";
 import { SubagentSteerRegistry } from "./orchestration/subagent-steer.js";
 import { FleetEventBus, fleetBackgroundChildPublisher } from "./fleet/fleet-bus.js";
-import { buildKeyResolver } from "./key-resolver.js";
+import { createKeyResolver } from "./key-resolver.js";
 function serviceVersion() {
     try {
         const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
@@ -668,9 +668,9 @@ async function main() {
     const modelUsageTracker = new ModelUsageTracker();
     const promptManifestTracker = new PromptManifestTracker();
     const fleetUsage = config.configCenter && process.env.FLEET_ADVERTISE_ADDRESS ? new FleetUsageAccumulator() : undefined;
-    const fleetLease = buildFleetLeaseFromEnv(config, { logger, metrics });
-    const tracer = buildTracer(metrics, costQuota, modelUsageTracker, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1, promptManifestTracker);
-    const sideQueryAccounting = buildSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1);
+    const fleetLease = createFleetLeaseFromEnv(config, { logger, metrics });
+    const tracer = createTracer(metrics, costQuota, modelUsageTracker, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1, promptManifestTracker);
+    const sideQueryAccounting = createSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1);
     const toolResultStore = backend?.toolResult ? backend.toolResult() : undefined;
     const sessionPolicyStore = backend ? backend.sessionPolicy() : undefined;
     const fileSnapshotStore = backend ? backend.fileSnapshot() : undefined;
@@ -975,7 +975,7 @@ async function main() {
         });
     }
     const principalCaps = config.configCenter && !config.configCenter.dryRun
-        ? createPrincipalCapsClient({
+        ? createPrincipalEntitlementsClient({
             baseUrl: config.configCenter.baseUrl,
             token: config.configCenter.token,
             ...(config.configCenter.worker ? { worker: config.configCenter.worker } : {}),
@@ -1190,19 +1190,19 @@ async function main() {
         tracer,
         promptSource,
         sessionStore: subRunnerSessions,
-        ...(executionEnvFactory ? { executionEnvFactory } : {}),
-        ...(lspManager ? { lspManager } : {}),
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(mailboxStore ? { mailboxStore } : {}),
-        ...(rosterStore ? { rosterStore } : {}),
-        ...(runnerDeps.onBackgroundChildEvent ? { onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent } : {}),
-        ...(runnerDeps.loadProjectMemory ? { loadProjectMemory: runnerDeps.loadProjectMemory } : {}),
-        ...(runnerDeps.probeInstructionSources ? { probeInstructionSources: runnerDeps.probeInstructionSources } : {}),
+        executionEnvFactory: executionEnvFactory ? executionEnvFactory : undefined,
+        lspManager: lspManager ? lspManager : undefined,
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        mailboxStore: mailboxStore ? mailboxStore : undefined,
+        rosterStore: rosterStore ? rosterStore : undefined,
+        onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent ? runnerDeps.onBackgroundChildEvent : undefined,
+        loadProjectMemory: runnerDeps.loadProjectMemory ? runnerDeps.loadProjectMemory : undefined,
+        probeInstructionSources: runnerDeps.probeInstructionSources ? runnerDeps.probeInstructionSources : undefined,
         hooks: deploymentHooks,
-        ...(runnerDeps.onError ? { onError: runnerDeps.onError } : {}),
+        onError: runnerDeps.onError ? runnerDeps.onError : undefined,
         toolResultStore,
-        ...(sessionPolicyStore ? { sessionPolicyStore } : {}),
-        ...(checkpointStore ? { checkpointStore } : {}),
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        checkpointStore: checkpointStore ? checkpointStore : undefined,
     });
     const authorize = createAuthorizer(config, sessionStore);
     const runStore = backend ? backend.run() : undefined;
@@ -1575,7 +1575,7 @@ async function main() {
                         if (!planeDeferred)
                             markRosterLanded(r.effective);
                         mutateInPlace(pricing, buildPricing(config.models));
-                        keyResolver = buildKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+                        keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
                         const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
                         const reasons = restartReasons(effective, r.effective);
                         const skillsChangeDetected = reasons.includes("skills");
@@ -1675,7 +1675,7 @@ async function main() {
             if (!planeDeferredLate)
                 markRosterLanded(r.effective);
             mutateInPlace(pricing, buildPricing(config.models));
-            keyResolver = buildKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+            keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
             effective = r.effective;
             latestEffective = r.effective;
             ccEtag = r.etag;
@@ -1705,7 +1705,7 @@ async function main() {
         if (bootConfigPending)
             void bootConfigPending.then((r) => (lkgBooted ? refreshTick(r) : deferredBootApply(r)), () => { });
     }
-    let keyResolver = buildKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
+    let keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
     if (process.env.ANTHROPIC_AUTH_TOKEN && !process.env.ANTHROPIC_API_KEY && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
         logger.warn("per_model_key_bearer_gateway_combo", {
             perModelKeys: Object.keys(config.modelApiKeys).length + Object.keys(config.modelApiKeyEnv).length,
@@ -1789,7 +1789,7 @@ async function main() {
         (leaderProvider === "e2b" ||
             (leaderProvider === "k8s" && "s3" in leaderMinio && executionEnvFactory) ||
             (leaderProvider === "host" && executionEnvFactory))
-        ? createLeaderEndpoint(buildLeaderRunner({
+        ? createLeaderEndpoint(createLeaderRunner({
             brain, models: config.models, roles: config.roles, pricing, logger,
             fanoutEnabled: config.leaderFanoutEnabled,
             ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
@@ -1997,7 +1997,7 @@ async function main() {
                     return undefined;
                 }
                 const effMode = coercePermissionMode(body.permissionMode) ?? parsedSettings.settings?.permissions?.defaultMode;
-                return buildTaskHooks(hc, {
+                return createTaskHooks(hc, {
                     logger,
                     sessionId: auth?.sessionId ?? "",
                     cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),

package/dist/memory-scope.d.ts

@@ -0,0 +1,18 @@
+import { FileMemoryEngineBackend } from "@sema-agent/core";
+import type { ServiceConfig } from "./config-types.js";
+export declare function memoryScopeFor(config: ServiceConfig, principal?: string, projectId?: string): string | undefined;
+export declare function memoryEngineRemoteLanePosture(config: ServiceConfig): {
+    lane: string;
+    posture: "dark" | "forced";
+} | undefined;
+export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRoot?: string): {
+    backend: FileMemoryEngineBackend;
+    root: string;
+} | undefined;
+export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[]): {
+    scope: string;
+    scopes?: string[];
+    writeScope?: string | null;
+    scopeContract?: "v2";
+} | undefined;
+//# sourceMappingURL=memory-scope.d.ts.map

package/dist/memory-scope.js

@@ -0,0 +1,38 @@
+import { join } from "node:path";
+import { FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
+export function memoryScopeFor(config, principal, projectId) {
+    if (config.requirePrincipal === true) {
+        if (config.memoryEngineBackend === "pg" || config.memoryEngineBackend === "tidb") {
+            if (!principal)
+                return undefined;
+            return projectId ? formatProjScope(principal, projectId) : formatUserScope(principal);
+        }
+        return undefined;
+    }
+    return config.memoryScope;
+}
+export function memoryEngineRemoteLanePosture(config) {
+    const lane = config.remoteExec?.provider;
+    if (lane === undefined || lane === "host")
+        return undefined;
+    return { lane, posture: config.memoryEngineRemoteLaneAllowed === true ? "forced" : "dark" };
+}
+export function memoryEngineBackendFor(config, fallbackRoot) {
+    if (config.requirePrincipal === true || !config.memoryEngineEnabled)
+        return undefined;
+    if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
+        return undefined;
+    const root = resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
+    const dir = join(root, "memory");
+    return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
+}
+export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
+    if (!scope)
+        return undefined;
+    const isV2 = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
+    const extras = (defaultScopes ?? []).filter((s, i, arr) => typeof s === "string" && s.length > 0 && s !== scope && arr.indexOf(s) === i);
+    const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : {};
+    const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
+    return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
+}
+//# sourceMappingURL=memory-scope.js.map

package/dist/observability/cost-taxonomy.d.ts

@@ -0,0 +1,34 @@
+export interface InfraCostRates {
+    toolCallMicroUsd: number;
+    sandboxSecMicroUsd: number;
+    egressGbMicroUsd: number;
+}
+export interface InfraUsage {
+    toolCalls: number;
+    sandboxWalltimeMs: number;
+    egressBytes: number;
+}
+export interface InfraCostBreakdown {
+    toolCallMicroUsd: number;
+    sandboxWalltimeMicroUsd: number;
+    egressMicroUsd: number;
+    totalMicroUsd: number;
+}
+export interface LlmCostBreakdown {
+    llmRootMicroUsd: number;
+    nestedSubagentMicroUsd: number;
+    memoryConsolidationMicroUsd: number;
+    compactionMicroUsd: number;
+}
+export interface SupervisorCostBreakdown {
+    llm: LlmCostBreakdown | null;
+    infra: InfraCostBreakdown;
+    totalMicroUsd: number;
+}
+export declare function infraCost(usage: InfraUsage, rates: InfraCostRates): InfraCostBreakdown;
+export declare function composeSupervisorCost(llm: LlmCostBreakdown | null, llmTotalMicroUsd: number, infra: InfraCostBreakdown): SupervisorCostBreakdown;
+export declare function hasInfraPricing(r: InfraCostRates): boolean;
+export declare function infraUsageFromEvents(events: ReadonlyArray<{
+    type?: string;
+}>, runDurationMs: number): InfraUsage;
+//# sourceMappingURL=cost-taxonomy.d.ts.map

package/dist/observability/cost-taxonomy.js

@@ -0,0 +1,26 @@
+const nonNeg = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+export function infraCost(usage, rates) {
+    const toolCallMicroUsd = nonNeg(usage.toolCalls) * nonNeg(rates.toolCallMicroUsd);
+    const sandboxWalltimeMicroUsd = (nonNeg(usage.sandboxWalltimeMs) / 1000) * nonNeg(rates.sandboxSecMicroUsd);
+    const egressMicroUsd = (nonNeg(usage.egressBytes) / 1_000_000_000) * nonNeg(rates.egressGbMicroUsd);
+    return {
+        toolCallMicroUsd,
+        sandboxWalltimeMicroUsd,
+        egressMicroUsd,
+        totalMicroUsd: toolCallMicroUsd + sandboxWalltimeMicroUsd + egressMicroUsd,
+    };
+}
+export function composeSupervisorCost(llm, llmTotalMicroUsd, infra) {
+    return { llm, infra, totalMicroUsd: nonNeg(llmTotalMicroUsd) + infra.totalMicroUsd };
+}
+export function hasInfraPricing(r) {
+    return r.toolCallMicroUsd > 0 || r.sandboxSecMicroUsd > 0 || r.egressGbMicroUsd > 0;
+}
+export function infraUsageFromEvents(events, runDurationMs) {
+    return {
+        toolCalls: events.reduce((n, e) => (e.type === "tool_start" ? n + 1 : n), 0),
+        sandboxWalltimeMs: nonNeg(runDurationMs),
+        egressBytes: 0,
+    };
+}
+//# sourceMappingURL=cost-taxonomy.js.map

package/dist/observability/prompt-manifest.d.ts

@@ -0,0 +1,75 @@
+export interface PromptManifestRecord {
+    constitution: string;
+    blocks: Array<{
+        id: string;
+        chars: number;
+        hash: string;
+    }>;
+    sections?: Array<{
+        id: string;
+        slot: string;
+        carrier: string;
+        cadence: string;
+        cacheClass: string;
+        chars: number;
+        hash: string;
+        contentHash?: string;
+    }>;
+    tools?: Array<{
+        wireName: string;
+        aliases: string[];
+        contractId: string;
+        implementationRevision: string;
+        cardId: string;
+        shapeDigest: string;
+        wireSchemaDigest: string;
+    }>;
+    totalChars: number;
+}
+export declare function promptManifestRecordOf(e: {
+    constitution: string;
+    blocks: Array<{
+        id: string;
+        chars: number;
+        hash: string;
+    }>;
+    sections?: Array<{
+        id: string;
+        slot: string;
+        carrier: string;
+        cadence: string;
+        cacheClass: string;
+        chars: number;
+        hash: string;
+        contentHash?: string;
+    }>;
+    tools?: Array<{
+        wireName: string;
+        aliases: string[];
+        contractId: string;
+        implementationRevision: string;
+        cardId: string;
+        shapeDigest: string;
+        wireSchemaDigest: string;
+    }>;
+    totalChars: number;
+}): PromptManifestRecord;
+export declare function configAssembledRecordOf(e: {
+    catalogVersion?: unknown;
+    fields?: unknown;
+    overrideReasons?: unknown;
+    ts?: unknown;
+}): Record<string, unknown> | undefined;
+export declare class PromptManifestTracker {
+    private readonly byTask;
+    private readonly configByTask;
+    private readonly active;
+    private leaseCounter;
+    register(taskId: string): number;
+    record(taskId: string, m: PromptManifestRecord): void;
+    recordConfig(taskId: string, rec: Record<string, unknown>): void;
+    drainConfig(taskId: string): Array<Record<string, unknown>> | undefined;
+    drain(taskId: string): PromptManifestRecord[] | undefined;
+    clear(taskId: string, lease: number): void;
+}
+//# sourceMappingURL=prompt-manifest.d.ts.map

package/dist/observability/prompt-manifest.js

@@ -0,0 +1,82 @@
+export function promptManifestRecordOf(e) {
+    return {
+        constitution: String(e.constitution),
+        blocks: (Array.isArray(e.blocks) ? e.blocks : []).map((b) => ({ id: String(b.id), chars: b.chars, hash: String(b.hash) })),
+        ...(Array.isArray(e.sections)
+            ? { sections: e.sections.map((s) => ({ id: String(s.id), slot: String(s.slot), carrier: String(s.carrier), cadence: String(s.cadence), cacheClass: String(s.cacheClass), chars: s.chars, hash: String(s.hash), ...(typeof s.contentHash === "string" ? { contentHash: s.contentHash } : {}) })) }
+            : {}),
+        ...(Array.isArray(e.tools)
+            ? { tools: e.tools.map((t) => ({ wireName: String(t.wireName), aliases: (Array.isArray(t.aliases) ? t.aliases : []).map(String), contractId: String(t.contractId), implementationRevision: String(t.implementationRevision), cardId: String(t.cardId), shapeDigest: String(t.shapeDigest), wireSchemaDigest: String(t.wireSchemaDigest) })) }
+            : {}),
+        totalChars: e.totalChars,
+    };
+}
+export function configAssembledRecordOf(e) {
+    const rec = {
+        catalogVersion: e.catalogVersion,
+        fields: e.fields,
+        ...(e.overrideReasons !== undefined ? { overrideReasons: e.overrideReasons } : {}),
+        ts: e.ts,
+    };
+    try {
+        if (JSON.stringify(rec).length > 32_768)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    return rec;
+}
+export class PromptManifestTracker {
+    byTask = new Map();
+    configByTask = new Map();
+    active = new Map();
+    leaseCounter = 0;
+    register(taskId) {
+        if (!taskId)
+            return 0;
+        const lease = ++this.leaseCounter;
+        this.active.set(taskId, lease);
+        return lease;
+    }
+    record(taskId, m) {
+        if (!taskId || !this.active.has(taskId))
+            return;
+        const q = this.byTask.get(taskId);
+        if (q)
+            q.push(m);
+        else
+            this.byTask.set(taskId, [m]);
+    }
+    recordConfig(taskId, rec) {
+        if (!taskId || !this.active.has(taskId))
+            return;
+        const q = this.configByTask.get(taskId);
+        if (q)
+            q.push(rec);
+        else
+            this.configByTask.set(taskId, [rec]);
+    }
+    drainConfig(taskId) {
+        const q = this.configByTask.get(taskId);
+        if (!q || q.length === 0)
+            return undefined;
+        this.configByTask.delete(taskId);
+        return q;
+    }
+    drain(taskId) {
+        const q = this.byTask.get(taskId);
+        if (!q || q.length === 0)
+            return undefined;
+        this.byTask.delete(taskId);
+        return q;
+    }
+    clear(taskId, lease) {
+        if (this.active.get(taskId) !== lease)
+            return;
+        this.byTask.delete(taskId);
+        this.active.delete(taskId);
+        this.configByTask.delete(taskId);
+    }
+}
+//# sourceMappingURL=prompt-manifest.js.map

package/dist/plugins/web-search.d.ts

@@ -17,11 +17,12 @@ export interface WebSearchOpts {
     blockedDomains?: string[];
 }
 export type WebSearchFn = (query: string, signal?: AbortSignal, opts?: WebSearchOpts) => Promise<WebSearchResult[]>;
-export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) => void) | undefined): void;
-export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): {
+export interface WebSearchBackend {
     search: WebSearchFn;
     maxResults: number;
-};
+}
+export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) => void) | undefined): void;
+export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
 export declare function webSearchConfigFromEnv(env?: NodeJS.ProcessEnv): WebSearchBackendConfig | undefined;
 export declare function webSearchConfigFromSettings(raw: unknown): WebSearchBackendConfig | undefined;
 //# sourceMappingURL=web-search.d.ts.map

package/dist/question.d.ts

@@ -17,13 +17,14 @@ export interface QuestionThrottle {
     ttlMs: number;
 }
 export declare const DEFAULT_QUESTION_THROTTLE: QuestionThrottle;
-export declare function parseQuestionAnswer(body: unknown): {
+export declare function parseQuestionResponse(body: unknown): {
     ok: true;
     value: QuestionAnswer;
 } | {
     ok: false;
     error: string;
 };
+export declare const parseQuestionAnswer: typeof parseQuestionResponse;
 export declare class QuestionCoordinator {
     private readonly als;
     private readonly pending;

package/dist/question.js

@@ -8,7 +8,7 @@ export const DEFAULT_QUESTION_THROTTLE = {
     ttlMs: 5 * 60_000,
 };
 const NO_HUMAN = { answers: [] };
-export function parseQuestionAnswer(body) {
+export function parseQuestionResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
     const answers = body.answers;
@@ -30,6 +30,7 @@ export function parseQuestionAnswer(body) {
     }
     return { ok: true, value: { answers: out } };
 }
+export const parseQuestionAnswer = parseQuestionResponse;
 function boundQuestions(questions) {
     const redacted = redactDeep(questions);
     try {
@@ -115,7 +116,7 @@ export class QuestionCoordinator {
         return answer;
     };
     respond(id, principal, body) {
-        const parsed = parseQuestionAnswer(body);
+        const parsed = parseQuestionResponse(body);
         if (!parsed.ok)
             return { status: 400, body: { error: parsed.error } };
         const entry = this.pending.get(id);

package/dist/run-local.js

@@ -21,7 +21,7 @@ import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/
 import { HttpError, memoryEngineBackendFor, memorySpecForRequest } from "./security.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing } from "./budget.js";
-import { buildKeyResolver } from "./key-resolver.js";
+import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { createMetrics } from "./observability/metrics.js";
 export function parseArgs(argv) {
@@ -183,7 +183,7 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const sessionStore = fileBackend.sessionStore;
-    const keyResolver = buildKeyResolver(config.modelApiKeyEnv);
+    const keyResolver = createKeyResolver(config.modelApiKeyEnv);
     const hostRx = config.remoteExec?.provider === "host" ? config.remoteExec : undefined;
     const workspaceDir = args.workspace ?? hostRx?.workspaceBase ?? process.cwd();
     const executionEnvFactory = hostRx

package/dist/runtime-caps-resolver.d.ts

@@ -2,7 +2,7 @@ import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./sema-registry.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
-export interface RuntimeCapsResolverOpts {
+export interface EntitlementsResolverOpts {
     baseUrl: string;
     token: string;
     worker?: string;
@@ -15,18 +15,18 @@ export interface RuntimeCapsResolverOpts {
 }
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
-export interface PrincipalCapsClient {
+export interface PrincipalEntitlementsClient {
     resolveRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
     scenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
     executionRuling: (principal: string | undefined) => Promise<ExecutionRuling | undefined>;
 }
 export declare function gateExecutionLane(ruling: ExecutionRuling | undefined, ownLane: string): void;
-export declare function createPrincipalCapsClient(opts: RuntimeCapsResolverOpts): PrincipalCapsClient;
-export declare function createRuntimeCapsResolver(opts: RuntimeCapsResolverOpts): (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
-export type RuntimeCapsResolverFn = (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
-export declare function applyObserverEnvOptIn(centerResolver: RuntimeCapsResolverFn | undefined, opts: {
+export declare function createPrincipalEntitlementsClient(opts: EntitlementsResolverOpts): PrincipalEntitlementsClient;
+export declare function createEntitlementsResolver(opts: EntitlementsResolverOpts): (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
+export type EntitlementsResolverFn = (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
+export declare function applyObserverEnvOptIn(centerResolver: EntitlementsResolverFn | undefined, opts: {
     experimentalObserverAgents: boolean;
     requirePrincipal: boolean;
     warn?: (msg: string, fields?: Record<string, unknown>) => void;
-}): RuntimeCapsResolverFn | undefined;
+}): EntitlementsResolverFn | undefined;
 //# sourceMappingURL=runtime-caps-resolver.d.ts.map

package/dist/runtime-caps-resolver.js

@@ -36,7 +36,7 @@ export function gateExecutionLane(ruling, ownLane) {
         });
     }
 }
-export function createPrincipalCapsClient(opts) {
+export function createPrincipalEntitlementsClient(opts) {
     const ttlMs = opts.ttlMs ?? 60_000;
     const denyTtlMs = opts.denyTtlMs ?? Math.min(ttlMs, 10_000);
     const fetchImpl = opts.fetchImpl ?? fetch;
@@ -115,8 +115,8 @@ export function createPrincipalCapsClient(opts) {
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
 }
-export function createRuntimeCapsResolver(opts) {
-    return createPrincipalCapsClient(opts).resolveRuntimeCaps;
+export function createEntitlementsResolver(opts) {
+    return createPrincipalEntitlementsClient(opts).resolveRuntimeCaps;
 }
 export function applyObserverEnvOptIn(centerResolver, opts) {
     if (!opts.experimentalObserverAgents)

package/dist/security.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingMessage } from "node:http";
-import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
+import { type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
@@ -80,21 +80,7 @@ export declare function ssoVerifiedPrincipal(req: IncomingMessage): string | und
 export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
-export declare function memoryScopeFor(config: ServiceConfig, principal?: string, projectId?: string): string | undefined;
-export declare function memoryEngineRemoteLanePosture(config: ServiceConfig): {
-    lane: string;
-    posture: "dark" | "forced";
-} | undefined;
-export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRoot?: string): {
-    backend: FileMemoryEngineBackend;
-    root: string;
-} | undefined;
-export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[]): {
-    scope: string;
-    scopes?: string[];
-    writeScope?: string | null;
-    scopeContract?: "v2";
-} | undefined;
+export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 export declare function approvalHmacMessage(env: {
     sessionId: string;
     boundCallId?: string | null;

package/dist/security.js

@@ -1,8 +1,8 @@
 import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cryptoVerify } from "node:crypto";
-import { join } from "node:path";
-import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
+import { uuidv7 } from "@sema-agent/core";
 import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
 export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+import { memoryScopeFor } from "./memory-scope.js";
 const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 export function isUuidV7(s) {
     return UUIDV7_RE.test(s);
@@ -128,41 +128,7 @@ export function verifiedPrincipal(req, config) {
         assertPrincipalShape(sub);
     return sub;
 }
-export function memoryScopeFor(config, principal, projectId) {
-    if (config.requirePrincipal === true) {
-        if (config.memoryEngineBackend === "pg" || config.memoryEngineBackend === "tidb") {
-            if (!principal)
-                return undefined;
-            return projectId ? formatProjScope(principal, projectId) : formatUserScope(principal);
-        }
-        return undefined;
-    }
-    return config.memoryScope;
-}
-export function memoryEngineRemoteLanePosture(config) {
-    const lane = config.remoteExec?.provider;
-    if (lane === undefined || lane === "host")
-        return undefined;
-    return { lane, posture: config.memoryEngineRemoteLaneAllowed === true ? "forced" : "dark" };
-}
-export function memoryEngineBackendFor(config, fallbackRoot) {
-    if (config.requirePrincipal === true || !config.memoryEngineEnabled)
-        return undefined;
-    if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
-        return undefined;
-    const root = resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
-    const dir = join(root, "memory");
-    return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
-}
-export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
-    if (!scope)
-        return undefined;
-    const isV2 = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
-    const extras = (defaultScopes ?? []).filter((s, i, arr) => typeof s === "string" && s.length > 0 && s !== scope && arr.indexOf(s) === i);
-    const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : {};
-    const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
-    return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
-}
+export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
 export function approvalHmacMessage(env) {
     return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
 }

package/dist/tool-approval.d.ts

@@ -20,7 +20,7 @@ export interface ToolApprovalRunContext {
     abortSignal?: AbortSignal;
 }
 export type ToolApprovalDecision = "allow" | "allow_session" | "deny";
-export declare function parseToolApprovalDecision(body: unknown): {
+export declare function parseToolApprovalResponse(body: unknown): {
     ok: true;
     value: ToolApprovalDecision;
     updatedInput?: unknown;
@@ -28,6 +28,7 @@ export declare function parseToolApprovalDecision(body: unknown): {
     ok: false;
     error: string;
 };
+export declare const parseToolApprovalDecision: typeof parseToolApprovalResponse;
 export declare class ToolApprovalCoordinator {
     private readonly als;
     private readonly pending;