@sema-agent/server 1.313.0 → 1.315.0

package/dist/config-center/http-client.js

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
+    const scheme = new URL(baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective${worker ? `?worker=${encodeURIComponent(worker)}` : ""}`;
+    const res = await fetchImpl(url, {
+        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
+        signal: AbortSignal.timeout(8000),
+    });
+    if (res.status === 304)
+        return null;
+    if (!res.ok)
+        throw new Error(`sema-registry HTTP ${res.status}`);
+    return { effective: (await res.json()), etag: res.headers.get("etag") ?? undefined };
+}
+export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
+    const scheme = new URL(baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    const params = new URLSearchParams({ principal });
+    if (worker)
+        params.set("worker", worker);
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
+    const res = await fetchImpl(url, {
+        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
+        signal: AbortSignal.timeout(8000),
+    });
+    if (res.status === 304) {
+        if (!etag)
+            throw new Error("sema-registry returned 304 to a non-conditional principal-caps request");
+        return null;
+    }
+    if (!res.ok)
+        throw new Error(`sema-registry principal-caps HTTP ${res.status}`);
+    const body = (await res.json());
+    return {
+        runtimeCaps: body.runtimeCaps ?? null,
+        configured: Boolean(body.configured),
+        ...("scenario" in body || "allowlist" in body
+            ? {
+                scenario: {
+                    scenario: typeof body.scenario === "string" ? body.scenario : null,
+                    allowlist: Array.isArray(body.allowlist) ? body.allowlist.filter((s) => typeof s === "string") : [],
+                },
+            }
+            : {}),
+        ...((() => {
+            const ex = body.execution;
+            if (ex === undefined || ex === null)
+                return {};
+            if (typeof ex.required !== "boolean")
+                return { executionDrift: `execution.required is ${typeof ex.required}, expected boolean — ruling dropped (fail-open)` };
+            if (!Array.isArray(ex.allowedLanes))
+                return { executionDrift: `execution.allowedLanes is ${typeof ex.allowedLanes}, expected string[] — ruling dropped (fail-open)` };
+            const execution = { required: ex.required, allowedLanes: ex.allowedLanes.filter((s) => typeof s === "string") };
+            if (ex.sessionMirror !== undefined && ex.sessionMirror !== null) {
+                const sm = ex.sessionMirror;
+                const smOk = typeof sm === "object" && typeof sm.engineUrl === "string" && sm.engineUrl.length > 0 && (sm.required === undefined || typeof sm.required === "boolean");
+                if (smOk)
+                    execution.sessionMirror = { engineUrl: sm.engineUrl, required: sm.required === true };
+                else
+                    return { execution, executionDrift: "execution.sessionMirror malformed — mirror observation dropped (fail-open; lane ruling kept)" };
+            }
+            return { execution };
+        })()),
+        etag: res.headers.get("etag") ?? undefined,
+    };
+}
+export class ConfigCenterHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ConfigCenterHttpError";
+    }
+}
+export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/skills/content/${encodeURIComponent(contentHash)}`;
+    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+        throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
+    const content = await res.text();
+    const want = contentHash.replace(/^sha256:/, "").toLowerCase();
+    const got = createHash("sha256").update(content, "utf8").digest("hex");
+    if (got !== want)
+        throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
+    return content;
+}
+export async function fetchPromptArtifact(baseUrl, token, artifactDigest, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/epoch-artifacts/${encodeURIComponent(artifactDigest)}`;
+    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+        throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
+    return await res.json();
+}
+export async function fetchPromptBlob(baseUrl, token, contentDigest, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/blobs/${encodeURIComponent(contentDigest)}`;
+    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+        throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    const want = contentDigest.replace(/^sha256:/, "").toLowerCase();
+    const got = createHash("sha256").update(bytes).digest("hex");
+    if (got !== want)
+        throw new Error(`prompt blob hash mismatch for ${contentDigest}: computed sha256:${got}`);
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+//# sourceMappingURL=http-client.js.map

package/dist/config-center/restart-signal.d.ts

@@ -0,0 +1,12 @@
+import type { EffectiveConfig } from "./types.js";
+export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers";
+export interface RestartSignal {
+    restartRequired: true;
+    reasons: RestartSlice[];
+    version: number;
+    since: number;
+}
+export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig): RestartSlice[];
+export declare function planeHasActiveTiers(eff: EffectiveConfig): boolean;
+export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
+//# sourceMappingURL=restart-signal.d.ts.map

package/dist/config-center/restart-signal.js

@@ -0,0 +1,70 @@
+import { resolveActiveTiers } from "@sema-agent/registry-core";
+import { RUNTIME_GATE_KEYS, runtimeGatePresent, resolveDefaultModelName } from "./apply-effective.js";
+const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers"];
+function stableStringify(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(stableStringify).join(",")}]`;
+    const obj = v;
+    return `{${Object.keys(obj)
+        .sort()
+        .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)
+        .join(",")}}`;
+}
+function enabledOnly(rows) {
+    if (!rows)
+        return null;
+    return rows.filter((r) => r.enabled !== false);
+}
+function restartSliceValue(eff, slice) {
+    if (!eff)
+        return null;
+    switch (slice) {
+        case "skills":
+            return enabledOnly(eff.skills?.skills);
+        case "mcp":
+            return enabledOnly(eff.mcp?.servers);
+        case "scenarios":
+            return enabledOnly(eff.scenarios?.scenarios);
+        case "runtime-gates": {
+            const rt = eff.runtime;
+            if (!rt)
+                return null;
+            const present = {};
+            for (const k of RUNTIME_GATE_KEYS)
+                if (runtimeGatePresent(rt, k))
+                    present[k] = rt[k];
+            return Object.keys(present).length ? present : null;
+        }
+        case "models-tiers": {
+            const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
+            if (!active || Object.keys(active).length === 0)
+                return null;
+            const enabled = enabledOnly(eff.models?.models);
+            const names = new Set((enabled ?? []).map((m) => m.name));
+            const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
+            return { models: enabled, tiers: active, default: def.name };
+        }
+    }
+}
+export function restartReasons(boot, current) {
+    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s)) !== stableStringify(restartSliceValue(current, s)));
+}
+export function planeHasActiveTiers(eff) {
+    const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
+    return active !== undefined && Object.keys(active).length > 0;
+}
+export function modelPlaneChanged(prev, next) {
+    if (!prev)
+        return true;
+    const fp = (e) => {
+        const enabled = enabledOnly(e.models?.models);
+        const active = e.models ? (resolveActiveTiers(e.models) ?? null) : null;
+        const names = new Set((enabled ?? []).map((m) => m.name));
+        const def = resolveDefaultModelName(e, (n) => names.has(n), enabled?.[0]?.name ?? "");
+        return stableStringify({ models: enabled, tiers: active, default: def.name });
+    };
+    return fp(prev) !== fp(next);
+}
+//# sourceMappingURL=restart-signal.js.map

package/dist/config-center/skills-mcp.d.ts

@@ -0,0 +1,13 @@
+import type { McpServerSpec } from "@sema-agent/core";
+import type { ScopedMcpServer } from "../config-types.js";
+import type { Logger } from "../observability/logger.js";
+import type { LoadedSkill } from "../capabilities/skills.js";
+import type { CenterMcpServer, CenterSkillManifest } from "./types.js";
+export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
+    skills: CenterSkillManifest[];
+}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch, diskCacheDir?: string): Promise<LoadedSkill[]>;
+export declare function resolveMcpServers(mcp: {
+    servers: CenterMcpServer[];
+}, logger?: Logger): ScopedMcpServer[];
+export declare function mcpForScenario(servers: ScopedMcpServer[] | undefined, scenario: string): McpServerSpec[] | undefined;
+//# sourceMappingURL=skills-mcp.d.ts.map

package/dist/config-center/skills-mcp.js

@@ -0,0 +1,113 @@
+import { skillContentHash } from "@sema-agent/registry-core";
+import { fetchSkillContent } from "./http-client.js";
+export async function applyCenterSkills(baseline, manifest, baseUrl, token, logger, fetchImpl = fetch, diskCacheDir) {
+    const { promises: fsp } = await import("node:fs");
+    const { join: joinPath } = await import("node:path");
+    const diskRead = async (hash) => {
+        if (!diskCacheDir)
+            return undefined;
+        const hex = hash.replace(/^sha256:/, "");
+        if (!/^[0-9a-f]{64}$/.test(hex))
+            return undefined;
+        try {
+            const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");
+            if (skillContentHash(text) === hash)
+                return text;
+            logger?.warn("sema_registry_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
+        }
+        catch {
+        }
+        return undefined;
+    };
+    const pendingWrites = [];
+    const diskWrite = (hash, content) => {
+        if (!diskCacheDir)
+            return;
+        const hex = hash.replace(/^sha256:/, "");
+        pendingWrites.push((async () => {
+            await fsp.mkdir(diskCacheDir, { recursive: true });
+            const tmp = joinPath(diskCacheDir, `${hex}.${Math.random().toString(36).slice(2, 8)}.tmp`);
+            await fsp.writeFile(tmp, content, { mode: 0o600 });
+            await fsp.rename(tmp, joinPath(diskCacheDir, hex));
+        })().catch((err) => logger?.warn("sema_registry_skill_cache_write_failed", { hash, err: String(err) })));
+    };
+    const byName = new Map(baseline.map((s) => [s.spec.name, s]));
+    const contentCache = new Map();
+    const seenNames = new Set();
+    for (const m of manifest.skills ?? []) {
+        if (m.enabled === false)
+            continue;
+        if (seenNames.has(m.name))
+            logger?.warn("sema_registry_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
+        seenNames.add(m.name);
+        try {
+            let content = contentCache.get(m.contentHash);
+            if (content === undefined)
+                content = await diskRead(m.contentHash);
+            if (content === undefined) {
+                content = await fetchSkillContent(baseUrl, token, m.contentHash, fetchImpl);
+                diskWrite(m.contentHash, content);
+            }
+            contentCache.set(m.contentHash, content);
+            const overrodeBuiltin = byName.has(m.name);
+            byName.set(m.name, { spec: { name: m.name, description: m.description, content }, scenarios: m.scenarios ?? [] });
+            logger?.info("sema_registry_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
+        }
+        catch (err) {
+            logger?.warn("sema_registry_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
+        }
+    }
+    await Promise.all(pendingWrites);
+    return [...byName.values()];
+}
+function resolveRefs(refs, server, kind, logger) {
+    if (!refs)
+        return {};
+    const out = {};
+    for (const [key, envName] of Object.entries(refs)) {
+        const v = process.env[envName];
+        if (v === undefined) {
+            logger?.warn("sema_registry_mcp_env_missing", { server, kind, key, envName, note: "skipping this MCP server — referenced env var is unset in this service" });
+            return null;
+        }
+        out[key] = v;
+    }
+    return out;
+}
+export function resolveMcpServers(mcp, logger) {
+    const out = [];
+    for (const s of mcp.servers ?? []) {
+        if (s.enabled === false)
+            continue;
+        const allow = s.allowTools && s.allowTools.length > 0 ? { allowTools: s.allowTools } : {};
+        const elicit = s.elicitation === true ? { elicitation: true } : {};
+        if (s.transport.kind === "stdio") {
+            const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
+            if (env === null)
+                continue;
+            out.push({
+                scenarios: s.scenarios ?? [],
+                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit },
+            });
+        }
+        else {
+            const headers = resolveRefs(s.transport.headerRefs, s.name, "header", logger);
+            if (headers === null)
+                continue;
+            out.push({
+                scenarios: s.scenarios ?? [],
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit },
+            });
+        }
+    }
+    if (out.length > 0)
+        logger?.info("sema_registry_mcp", { servers: out.map((s) => s.spec.name) });
+    return out;
+}
+export function mcpForScenario(servers, scenario) {
+    if (!servers || servers.length === 0)
+        return undefined;
+    const hit = servers.filter((s) => s.scenarios.length === 0 || s.scenarios.includes(scenario)).map((s) => s.spec);
+    return hit.length > 0 ? hit : undefined;
+}
+//# sourceMappingURL=skills-mcp.js.map

package/dist/config-center/types.d.ts

@@ -0,0 +1,143 @@
+import type { CollabTemplateWire } from "../capabilities/collab-wire.js";
+import type { Autonomy, CommandRule } from "../runtime-governance.js";
+export interface CenterModel {
+    name: string;
+    id: string;
+    provider: string;
+    api: "openai-completions" | "anthropic-messages";
+    baseUrl?: string;
+    apiKeyEnv?: string;
+    sealedApiKey?: {
+        ciphertext: string;
+        publicKeyId: string;
+        alg: string;
+        setAt?: string;
+    };
+    tier?: string;
+    reasoning?: boolean;
+    vision?: boolean;
+    contextWindow?: number;
+    maxTokens?: number;
+    autoCompactTokens?: number;
+    charsPerToken?: number;
+    cost?: {
+        input: number;
+        output: number;
+        cacheRead?: number;
+        cacheWrite?: number;
+    };
+    quotaWeight?: number;
+    defaultThinking?: string;
+    reasoningEffortLevels?: string[];
+    extraBody?: Record<string, unknown>;
+    promptGuidance?: string[];
+    enabled?: boolean;
+}
+export type CenterRoleTarget = {
+    model: string;
+} | {
+    select: unknown;
+};
+export interface CenterTeam {
+    name: string;
+    members: {
+        role: string;
+        modelRole?: string;
+        model?: string;
+        systemPrompt?: string;
+    }[];
+    rounds: number;
+    synthesizer?: {
+        role: string;
+        modelRole?: string;
+        systemPrompt?: string;
+    };
+    scenario?: string;
+    maxTranscriptTokens?: number;
+    enabled?: boolean;
+}
+export interface CenterSkillManifest {
+    name: string;
+    description: string;
+    scenarios: string[];
+    contentHash: string;
+    enabled?: boolean;
+}
+export interface CenterMcpServer {
+    name: string;
+    scenarios: string[];
+    enabled?: boolean;
+    allowTools?: string[];
+    elicitation?: boolean;
+    transport: {
+        kind: "stdio";
+        command: string;
+        args?: string[];
+        envRefs?: Record<string, string>;
+    } | {
+        kind: "http";
+        url: string;
+        headerRefs?: Record<string, string>;
+        principalHeader?: string;
+    };
+}
+export interface EffectiveConfig {
+    version: number;
+    updatedAt: string;
+    models: {
+        models: CenterModel[];
+        roles: Record<string, CenterRoleTarget>;
+        atModelAllowlist?: string[];
+    };
+    teams?: {
+        teams: CenterTeam[];
+    };
+    collab?: {
+        templates: CollabTemplateWire[];
+    };
+    skills?: {
+        skills: CenterSkillManifest[];
+    };
+    mcp?: {
+        servers: CenterMcpServer[];
+    };
+    scenarios?: {
+        scenarios: Array<{
+            name: string;
+            toolset: string;
+            enabled?: boolean;
+        }>;
+    };
+    runtime?: {
+        rateLimitPerMin?: number;
+        approvalRequire?: string[];
+        maxTaskCostUsd?: number;
+        maxTaskTokens?: number;
+        maxPrincipalCostUsd?: number;
+        costQuotaWindowSec?: number;
+        autonomy?: Autonomy;
+        commandPolicy?: CommandRule[];
+    };
+    projects?: {
+        projects?: Record<string, unknown>;
+    } | Record<string, unknown>;
+    governance?: {
+        autonomy?: Autonomy;
+        commandPolicy?: CommandRule[];
+        approvalRequire?: string[];
+    };
+    plugins?: {
+        plugins?: unknown[];
+    };
+    prompts?: unknown;
+}
+export interface ExecutionRuling {
+    required: boolean;
+    allowedLanes: string[];
+    sessionMirror?: SessionMirrorRuling;
+}
+export interface SessionMirrorRuling {
+    engineUrl: string;
+    required: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/config-center/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/config-types.d.ts

@@ -2,7 +2,7 @@ import type { SealedKeyPoison } from "./sealed-key.js";
 import type { McpServerSpec, Model, ModelRoles } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
-import type { InfraCostRates } from "./finance/cost-taxonomy.js";
+import type { InfraCostRates } from "./observability/cost-taxonomy.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 export interface ScopedMcpServer {
     scenarios: string[];

package/dist/elicitation.d.ts

@@ -8,12 +8,13 @@ export interface ElicitationFrame {
     mode?: "form";
     action?: McpElicitResponse["action"];
 }
-export interface ElicitRunContext {
+export interface ElicitationRunContext {
     taskId: string;
     owner: string | null;
     emit: (frame: ElicitationFrame) => void | Promise<void>;
     abortSignal?: AbortSignal;
 }
+export type ElicitRunContext = ElicitationRunContext;
 export interface ElicitationThrottle {
     maxConcurrentPerRun: number;
     maxTotalPerRun: number;
@@ -21,13 +22,14 @@ export interface ElicitationThrottle {
     ttlMs: number;
 }
 export declare const DEFAULT_ELICITATION_THROTTLE: ElicitationThrottle;
-export declare function parseElicitResponse(body: unknown): {
+export declare function parseElicitationResponse(body: unknown): {
     ok: true;
     value: McpElicitResponse;
 } | {
     ok: false;
     error: string;
 };
+export declare const parseElicitResponse: typeof parseElicitationResponse;
 export declare class ElicitationCoordinator {
     private readonly als;
     private readonly pending;
@@ -35,7 +37,7 @@ export declare class ElicitationCoordinator {
     private readonly throttle;
     private readonly now;
     constructor(throttle?: ElicitationThrottle, now?: () => number);
-    runWithContext<T>(ctx: ElicitRunContext, fn: () => Promise<T>): Promise<T>;
+    runWithContext<T>(ctx: ElicitationRunContext, fn: () => Promise<T>): Promise<T>;
     elicit: (req: McpElicitRequest, signal?: AbortSignal) => Promise<McpElicitResponse>;
     respond(id: string, principal: string | undefined, body: unknown): {
         status: number;

package/dist/elicitation.js

@@ -9,7 +9,7 @@ export const DEFAULT_ELICITATION_THROTTLE = {
     minIntervalMsPerServer: 1_000,
     ttlMs: 5 * 60_000,
 };
-export function parseElicitResponse(body) {
+export function parseElicitationResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
     const b = body;
@@ -32,6 +32,7 @@ export function parseElicitResponse(body) {
     }
     return { ok: true, value: { action: b.action } };
 }
+export const parseElicitResponse = parseElicitationResponse;
 function boundSchema(schema) {
     if (schema === undefined)
         return undefined;
@@ -126,7 +127,7 @@ export class ElicitationCoordinator {
         return answer;
     };
     respond(id, principal, body) {
-        const parsed = parseElicitResponse(body);
+        const parsed = parseElicitationResponse(body);
         if (!parsed.ok)
             return { status: 400, body: { error: parsed.error } };
         const entry = this.pending.get(id);