@sema-agent/server 1.313.0 → 1.315.0

package/dist/http/server.js

@@ -30,11 +30,17 @@ import { projectEvents, runSummary, mapTraceEvent, turnEndEventData, contextUsag
 import { createLedgerSink } from "../trace/ledger-sink.js";
 import { cacheFamilyOfMirror } from "../budget.js";
 import { projectArtifacts } from "../trace/artifacts.js";
-import { composeSupervisorCost, infraCost, infraUsageFromEvents, hasInfraPricing } from "../finance/cost-taxonomy.js";
+import { composeSupervisorCost, infraCost, infraUsageFromEvents, hasInfraPricing } from "../observability/cost-taxonomy.js";
 import { redactSecrets, redactDeep, redactedPreview } from "../trace/redact.js";
 import { usageSummary, usageSeries, usageBreakdown } from "../usage-analytics.js";
 import { IdempotencyCache } from "./idempotency.js";
 import { pgHasUnstorable } from "../plugins/pg-safe-json.js";
+export function flattenServiceDeps(deps) {
+    const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
+    if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
+        return deps;
+    return { ...stores, ...coordinators, ...seams, ...observability, ...governance, ...deployment, ...knobs, ...flat };
+}
 export const MAX_USER_SKILLS = 10;
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
@@ -195,7 +201,8 @@ function bearerPresentedButUnverified(req, config) {
         return false;
     return true;
 }
-export function createHttpServer(deps) {
+export function createHttpServer(rawDeps) {
+    const deps = flattenServiceDeps(rawDeps);
     const idemCache = new IdempotencyCache();
     let sseConnections = 0;
     let sseOwnerLookups = 0;
@@ -634,7 +641,7 @@ export function createHttpServer(deps) {
         }
         if (deps.drainState?.draining && req.method === "POST" && isBillableSubmitPath(url)) {
             res.setHeader("retry-after", "15");
-            sendJson(res, 503, { error: "draining", errorCode: "draining", message: "this instance is draining for shutdown/upgrade — retry against the replacement instance" });
+            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance" });
             return;
         }
         if (deps.modelReady && !deps.modelReady() && req.method === "POST" && isBillableSubmitPath(url)) {
@@ -655,7 +662,7 @@ export function createHttpServer(deps) {
             const name = url.slice("/v1/capabilities/scenarios/".length).split("?")[0];
             const detail = deps.scenarioDetails?.[name];
             if (!detail) {
-                sendJson(res, 404, { error: "scenario not found", errorCode: "scenario_not_found" });
+                sendError(res, 404, "scenario_not_found", "scenario not found");
                 return;
             }
             sendJson(res, 200, detail);
@@ -1718,7 +1725,7 @@ export function createHttpServer(deps) {
             }
             catch (e) {
                 if (e instanceof CheckpointError && e.code === "steering.invalid_content") {
-                    sendJson(res, 422, { errorCode: "steering.invalid_content", error: e.message });
+                    sendError(res, 422, "steering.invalid_content", e.message);
                     return;
                 }
                 throw e;
@@ -1747,7 +1754,7 @@ export function createHttpServer(deps) {
                 return (await cs.setPendingSteer(token, scope, { text, trusted })) ? "parked" : "no-checkpoint";
             };
             const sendParked = () => sendJson(res, 202, { taskId, status: "suspended", delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
-            const sendNotRunning = (error) => sendJson(res, 409, { errorCode: "steering.not_running", error });
+            const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
             const live = steerableRuns.get(taskId);
             if (live) {
                 try {
@@ -1758,7 +1765,7 @@ export function createHttpServer(deps) {
                 catch (e) {
                     const code = e.code;
                     if (code === "steering.invalid_content") {
-                        sendJson(res, 422, { errorCode: "steering.invalid_content", error: e instanceof Error ? e.message : "invalid steering content" });
+                        sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
                         return;
                     }
                     if (code !== "steering.not_running")
@@ -1896,7 +1903,7 @@ export function createHttpServer(deps) {
             const compactInstructions = compactBody.instructions;
             const live = steerableRuns.get(taskId);
             if (!live) {
-                sendJson(res, 409, { errorCode: "compact.not_running", error: run.status === "running" ? "run is active on another replica — manual compact is replica-local" : `run is ${run.status} — not accepting compaction` });
+                sendError(res, 409, "compact.not_running", run.status === "running" ? "run is active on another replica — manual compact is replica-local" : `run is ${run.status} — not accepting compaction`);
                 return;
             }
             void live.compact(compactInstructions !== undefined ? { instructions: compactInstructions } : undefined).then((outcome) => {
@@ -1953,7 +1960,7 @@ export function createHttpServer(deps) {
                 return;
             const live = steerableRuns.get(taskId);
             if (!live) {
-                sendJson(res, 409, { errorCode: "detach.not_running", error: run.status === "running" ? "run is active on another replica — detach is replica-local" : `run is ${run.status} — no running tool call to detach` });
+                sendError(res, 409, "detach.not_running", run.status === "running" ? "run is active on another replica — detach is replica-local" : `run is ${run.status} — no running tool call to detach`);
                 return;
             }
             live.detach(body.toolCallId);
@@ -1992,10 +1999,7 @@ export function createHttpServer(deps) {
                 return;
             }
             if (body.content.length > STEER_IN_MAX_REQUEST_CHARS) {
-                sendJson(res, 413, {
-                    errorCode: "steer.content_too_large",
-                    error: `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`,
-                });
+                sendError(res, 413, "steer.content_too_large", `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`);
                 return;
             }
             const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
@@ -2007,11 +2011,11 @@ export function createHttpServer(deps) {
             }
             if (wfRun && !runSessionAcceptOk(req, res, { sessionId: wfRun.originatingSessionId ?? null }, "workflow.agent-steer", "workflow not found"))
                 return;
-            const sendNotRunningWf = (error) => sendJson(res, 409, { errorCode: "steering.not_running", error });
+            const sendNotRunningWf = (error) => sendError(res, 409, "steering.not_running", error);
             const redacted = redactSteerIn(body.content, label);
             const resolution = deps.workflowAgentRegistry?.resolve(wfRunId, label);
             if (resolution && resolution.count > 1) {
-                sendJson(res, 409, { errorCode: "steering.ambiguous_label", error: `${resolution.count} live agents share label '${label}' in this run — steer target is ambiguous` });
+                sendError(res, 409, "steering.ambiguous_label", `${resolution.count} live agents share label '${label}' in this run — steer target is ambiguous`);
                 return;
             }
             const handle = resolution?.handle;
@@ -2195,27 +2199,23 @@ export function createHttpServer(deps) {
             const stillParked = details?.error === "parked_pending_approval" || details?.status === "parked";
             if (stopVerb && details?.error !== undefined && (details.status === "running" || stillParked || parkResumeWon || parkArbiterUnreachable)) {
                 const notLocal = details.error === "not_local";
-                sendJson(res, 409, {
-                    errorCode: notLocal
-                        ? "stop.not_local"
-                        : parkArbiterUnreachable
-                            ? "stop.park_arbiter_unreachable"
-                            : parkResumeWon
-                                ? "stop.park_resume_won"
-                                : stillParked
-                                    ? "stop.parked"
-                                    : "stop.not_landed",
-                    error: notLocal
-                        ? "this task is not attached to this instance — cannot stop it here (its durable record is still marked running; if its host process is gone, the retention sweep settles it as interrupted)"
-                        : parkArbiterUnreachable
-                            ? "the approval arbitration store was unreachable — this task's row stays parked (not stopped); retry the stop"
-                            : parkResumeWon
-                                ? "the pending tool-approval was resolved (resumed) concurrently with this stop attempt — the resume won the race, so nothing was stopped; re-check the task's current status"
-                                : stillParked
-                                    ? "this task is durably parked awaiting a tool-approval decision, not actively running — there is no live process to interrupt; resolve (or let expire) the pending approval instead"
-                                    : `stop did not land (${details.error}) — the process may still be running`,
-                    taskId: runId, target, content: out.content, output: out.details,
-                });
+                sendError(res, 409, notLocal
+                    ? "stop.not_local"
+                    : parkArbiterUnreachable
+                        ? "stop.park_arbiter_unreachable"
+                        : parkResumeWon
+                            ? "stop.park_resume_won"
+                            : stillParked
+                                ? "stop.parked"
+                                : "stop.not_landed", notLocal
+                    ? "this task is not attached to this instance — cannot stop it here (its durable record is still marked running; if its host process is gone, the retention sweep settles it as interrupted)"
+                    : parkArbiterUnreachable
+                        ? "the approval arbitration store was unreachable — this task's row stays parked (not stopped); retry the stop"
+                        : parkResumeWon
+                            ? "the pending tool-approval was resolved (resumed) concurrently with this stop attempt — the resume won the race, so nothing was stopped; re-check the task's current status"
+                            : stillParked
+                                ? "this task is durably parked awaiting a tool-approval decision, not actively running — there is no live process to interrupt; resolve (or let expire) the pending approval instead"
+                                : `stop did not land (${details.error}) — the process may still be running`, { taskId: runId, target, content: out.content, output: out.details });
                 return;
             }
             const g14 = (() => {
@@ -2264,10 +2264,7 @@ export function createHttpServer(deps) {
                 return;
             }
             if (body.content.length > STEER_IN_MAX_REQUEST_CHARS) {
-                sendJson(res, 413, {
-                    errorCode: "steer.content_too_large",
-                    error: `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`,
-                });
+                sendError(res, 413, "steer.content_too_large", `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`);
                 return;
             }
             const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
@@ -2278,7 +2275,7 @@ export function createHttpServer(deps) {
             }
             if (!runSessionAcceptOk(req, res, run, `subagent.${verb}`))
                 return;
-            const send409 = (errorCode, error) => sendJson(res, 409, { errorCode, error });
+            const send409 = (errorCode, error) => sendError(res, 409, errorCode, error);
             const redacted = redactSteerIn(body.content, target);
             const resolution = deps.subagentSteerRegistry?.resolve(runId, target);
             if (resolution && resolution.count > 1) {
@@ -2964,13 +2961,13 @@ export function createHttpServer(deps) {
                     return;
                 }
                 if (typeof body.reason === "string" && body.reason.length > MAX_APPROVAL_REASON_CHARS) {
-                    sendJson(res, 413, { error: `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`, errorCode: "reason_too_large" });
+                    sendError(res, 413, "reason_too_large", `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`);
                     return;
                 }
                 const run = await deps.runStore.getRun(taskId);
                 if (!run) {
                     if (deps.config.directDoorActive) {
-                        sendJson(res, 401, { error: "principal proof required", errorCode: "principal_unverified" });
+                        sendError(res, 401, "principal_unverified", "principal proof required");
                         return;
                     }
                     sendJson(res, 404, { error: "task not found" });
@@ -2981,7 +2978,7 @@ export function createHttpServer(deps) {
                     const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
                     const proof = verifyDirectDoorProof({ jwt: hdr("x-approval-principal-token"), mac: hdr("x-approval-mac"), kid: hdr("x-approval-mac-kid") }, { sessionId: run.sessionId, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false });
                     if (!proof.ok) {
-                        sendJson(res, proof.status, { error: proof.error, errorCode: proof.errorCode });
+                        sendError(res, proof.status, proof.errorCode, proof.error);
                         return;
                     }
                     deciderPrincipal = proof.principal;
@@ -3019,7 +3016,7 @@ export function createHttpServer(deps) {
                     return;
                 }
                 if (typeof body.reason === "string" && body.reason.length > MAX_APPROVAL_REASON_CHARS) {
-                    sendJson(res, 413, { error: `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`, errorCode: "reason_too_large" });
+                    sendError(res, 413, "reason_too_large", `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`);
                     return;
                 }
                 let remember = false;
@@ -3033,7 +3030,7 @@ export function createHttpServer(deps) {
                         return;
                     }
                     if (deps.config.directDoorActive) {
-                        sendJson(res, 400, { error: "remember is not supported on a direct-door worker (not covered by the decision proof)", errorCode: "remember_not_in_proof" });
+                        sendError(res, 400, "remember_not_in_proof", "remember is not supported on a direct-door worker (not covered by the decision proof)");
                         return;
                     }
                     if (!deps.approvalExemptionStore) {
@@ -3041,7 +3038,7 @@ export function createHttpServer(deps) {
                         return;
                     }
                     if (!body.checkpointToken && !body.boundCallId) {
-                        sendJson(res, 400, { error: "remember requires the decision binding (echo checkpointToken and/or boundCallId from the pending approval)", errorCode: "remember_requires_binding" });
+                        sendError(res, 400, "remember_requires_binding", "remember requires the decision binding (echo checkpointToken and/or boundCallId from the pending approval)");
                         return;
                     }
                     remember = true;
@@ -3061,10 +3058,7 @@ export function createHttpServer(deps) {
                     }
                 }
                 if (deps.config.directDoorActive && body.updatedInput !== undefined) {
-                    sendJson(res, 400, {
-                        error: "updatedInput is not supported on a direct-door worker (not covered by the decision proof)",
-                        errorCode: "updated_input_not_in_proof",
-                    });
+                    sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                     return;
                 }
                 const binding = {
@@ -3081,7 +3075,7 @@ export function createHttpServer(deps) {
                     };
                     const proof = verifyDirectDoorProof({ jwt: hdr("x-approval-principal-token"), mac: hdr("x-approval-mac"), kid: hdr("x-approval-mac-kid") }, { sessionId, boundCallId: binding.boundCallId, boundInputHash: binding.boundInputHash, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config);
                     if (!proof.ok) {
-                        sendJson(res, proof.status, { error: proof.error, errorCode: proof.errorCode });
+                        sendError(res, proof.status, proof.errorCode, proof.error);
                         return;
                     }
                     deciderPrincipal = proof.principal;
@@ -3133,7 +3127,7 @@ export function createHttpServer(deps) {
         if (deps.approvalStore && url.startsWith("/v1/approvals")) {
             const store = deps.approvalStore;
             if (deps.config.directApprovalDoor) {
-                sendJson(res, 503, { error: "approvals are served by the direct door on this worker", errorCode: "approval_door_unconfigured" });
+                sendError(res, 503, "approval_door_unconfigured", "approvals are served by the direct door on this worker");
                 return;
             }
             if (req.method === "GET" && url === "/v1/approvals") {
@@ -3291,11 +3285,11 @@ export function createHttpServer(deps) {
                 scope = decodeURIComponent(url.slice("/v1/memory/sync/".length));
             }
             catch {
-                sendJson(res, 400, { error: "malformed percent-encoding in :scope", code: "memory_sync_invalid_scope", errorCode: "memory_sync_invalid_scope" });
+                sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope", { code: "memory_sync_invalid_scope" });
                 return;
             }
             if (scope.length === 0) {
-                sendJson(res, 400, { error: "missing :scope", code: "memory_sync_invalid_scope", errorCode: "memory_sync_invalid_scope" });
+                sendError(res, 400, "memory_sync_invalid_scope", "missing :scope", { code: "memory_sync_invalid_scope" });
                 return;
             }
             if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
@@ -3305,7 +3299,7 @@ export function createHttpServer(deps) {
             const body = await readJson(req);
             const parsed = parseMemorySyncRequest(body, scope);
             if (!parsed.ok) {
-                sendJson(res, 422, { error: parsed.error, code: "memory_sync_invalid_body", errorCode: "memory_sync_invalid_body" });
+                sendError(res, 422, "memory_sync_invalid_body", parsed.error, { code: "memory_sync_invalid_body" });
                 return;
             }
             try {
@@ -3931,7 +3925,7 @@ export function createHttpServer(deps) {
                 }
                 catch (e) {
                     if (e instanceof SessionPolicyError) {
-                        sendJson(res, e.code === "conflict" ? 409 : 403, { error: e.message, errorCode: e.code });
+                        sendError(res, e.code === "conflict" ? 409 : 403, e.code, e.message);
                         return;
                     }
                     throw e;
@@ -4047,7 +4041,7 @@ export function createHttpServer(deps) {
                     if (typeof fs.blobSizes === "function") {
                         const known = (await fs.blobSizes([hash])).get(hash);
                         if (known !== undefined && known > cap) {
-                            sendJson(res, 413, { error: "file exceeds the single-file read limit — download it via the archive endpoint", code: "workspace_file_too_large", errorCode: "workspace_file_too_large", sizeBytes: known, limit: cap });
+                            sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: known, limit: cap });
                             return;
                         }
                     }
@@ -4057,7 +4051,7 @@ export function createHttpServer(deps) {
                         return;
                     }
                     if (bytes.byteLength > cap) {
-                        sendJson(res, 413, { error: "file exceeds the single-file read limit — download it via the archive endpoint", code: "workspace_file_too_large", errorCode: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
+                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
                         return;
                     }
                     const ct = workspaceContentType(pathParam);
@@ -4260,11 +4254,7 @@ export function createHttpServer(deps) {
                     }
                     const body = await readRawBody(req, SYNC_BLOB_MAX_BYTES);
                     if (deps.snapshotBlobSqlCapBytes !== undefined && body.byteLength > deps.snapshotBlobSqlCapBytes) {
-                        sendJson(res, 413, {
-                            code: "blob_too_large_for_sql",
-                            errorCode: "blob_too_large_for_sql",
-                            error: `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`,
-                        });
+                        sendError(res, 413, "blob_too_large_for_sql", `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`, { code: "blob_too_large_for_sql" });
                         return;
                     }
                     if (createHash("sha256").update(body).digest("hex") !== hash) {
@@ -4273,7 +4263,7 @@ export function createHttpServer(deps) {
                     }
                     const put = await fs.putBlob(hash, new Uint8Array(body));
                     if (!put.ok) {
-                        sendJson(res, 502, { error: "blob store write failed", code: put.error.code, errorCode: put.error.code });
+                        sendError(res, 502, put.error.code, "blob store write failed", { code: put.error.code });
                         return;
                     }
                     res.writeHead(204).end();
@@ -4325,7 +4315,7 @@ export function createHttpServer(deps) {
                     const dstIds = (await deps.sessionStorage.listEntryIds?.(sessionId)) ?? null;
                     const relA = classifySyncRelationshipByIds(entryIds, dstIds);
                     if ((relA.relation === "fork" || relA.relation === "stale") && resolution !== "overwrite-dst") {
-                        sendJson(res, 409, { error: "sync conflict", errorCode: "conflict", relation: relA });
+                        sendError(res, 409, "conflict", "sync conflict", { relation: relA });
                         return;
                     }
                     let payloadVerified = false;
@@ -4349,7 +4339,7 @@ export function createHttpServer(deps) {
                             for (const snap of snapshots) {
                                 const r = await fss.importManifest(sessionId, snap.key, new Map(snap.manifest), getBlobA);
                                 if (!r.ok) {
-                                    sendJson(res, 422, { error: `snapshot import failed (${r.error.code})`, errorCode: r.error.code === "restore_failed" ? "restore_failed" : "missing_blob" });
+                                    sendError(res, 422, r.error.code === "restore_failed" ? "restore_failed" : "missing_blob", `snapshot import failed (${r.error.code})`);
                                     return;
                                 }
                             }
@@ -4371,7 +4361,7 @@ export function createHttpServer(deps) {
                     }
                     const activeTaskId = await deps.runStore?.getActiveTaskId(sessionId);
                     if (activeTaskId) {
-                        sendJson(res, 409, { error: "session has an active run; sync after it settles", errorCode: "session_active", activeTaskId });
+                        sendError(res, 409, "session_active", "session has an active run; sync after it settles", { activeTaskId });
                         return;
                     }
                     const heldLease = importLeases.get(sessionId);
@@ -4387,12 +4377,8 @@ export function createHttpServer(deps) {
                         }
                         else {
                             const retryAfterSec = staleMs > 0 ? Math.max(1, Math.ceil((staleMs - ageMs) / 1000)) : undefined;
-                            sendJson(res, 409, {
-                                error: "an import is already in flight for this session"
-                                    + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""),
-                                errorCode: "import_in_flight",
-                                ...(retryAfterSec !== undefined ? { retryAfterSec } : {}),
-                            });
+                            sendError(res, 409, "import_in_flight", "an import is already in flight for this session"
+                                + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""), retryAfterSec !== undefined ? { retryAfterSec } : undefined);
                             return;
                         }
                     }
@@ -4408,14 +4394,14 @@ export function createHttpServer(deps) {
                             const present = await fss.hasBlobs(all);
                             const missing = all.find((h) => !present.has(h));
                             if (missing !== undefined) {
-                                sendJson(res, 422, { error: "missing blob; PUT all referenced blobs before import", errorCode: "missing_blob" });
+                                sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
                                 return;
                             }
                         }
                         else {
                             for (const hash of all) {
                                 if (!(await deps.fileSnapshotStore.getBlob(hash))) {
-                                    sendJson(res, 422, { error: "missing blob; PUT all referenced blobs before import", errorCode: "missing_blob" });
+                                    sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
                                     return;
                                 }
                             }
@@ -4521,13 +4507,13 @@ export function createHttpServer(deps) {
                         if (e instanceof PrecheckError) {
                             await pending.handle.abort().catch(() => undefined);
                             cleanupStaging(stagingId);
-                            sendJson(res, e.status, { error: e.message, errorCode: "invalid_entries" });
+                            sendError(res, e.status, "invalid_entries", e.message);
                             return;
                         }
                         if (e instanceof SessionError && e.code === "invalid_session") {
                             await pending.handle.abort().catch(() => undefined);
                             cleanupStaging(stagingId);
-                            sendJson(res, 422, { error: "staged session log failed validation", errorCode: "invalid_entries" });
+                            sendError(res, 422, "invalid_entries", "staged session log failed validation");
                             return;
                         }
                         await pending.handle.abort().catch(() => undefined);
@@ -4538,7 +4524,7 @@ export function createHttpServer(deps) {
                     if (activeAtCommit) {
                         await pending.handle.abort().catch(() => undefined);
                         cleanupStaging(stagingId);
-                        sendJson(res, 409, { error: "session started an active run while the import streamed; sync after it settles", errorCode: "session_active", activeTaskId: activeAtCommit });
+                        sendError(res, 409, "session_active", "session started an active run while the import streamed; sync after it settles", { activeTaskId: activeAtCommit });
                         return;
                     }
                     try {
@@ -4548,7 +4534,7 @@ export function createHttpServer(deps) {
                             for (const snap of pending.snapshots) {
                                 const r = await importManifest(sessionId, snap.key, new Map(snap.manifest), getBlob);
                                 if (!r.ok) {
-                                    sendJson(res, 422, { error: `snapshot import failed (${r.error.code})`, errorCode: r.error.code === "restore_failed" ? "restore_failed" : "missing_blob" });
+                                    sendError(res, 422, r.error.code === "restore_failed" ? "restore_failed" : "missing_blob", `snapshot import failed (${r.error.code})`);
                                     cleanupStaging(stagingId);
                                     return;
                                 }
@@ -4570,12 +4556,12 @@ export function createHttpServer(deps) {
                         if (e instanceof SyncConflictError) {
                             await pending.handle.abort().catch(() => undefined);
                             cleanupStaging(stagingId);
-                            sendJson(res, 409, { error: "sync conflict", errorCode: "conflict", relation: e.relation });
+                            sendError(res, 409, "conflict", "sync conflict", { relation: e.relation });
                             return;
                         }
                         if (e instanceof SessionPolicyError) {
                             cleanupStaging(stagingId);
-                            sendJson(res, e.code === "loosen_forbidden" ? 403 : 409, { error: e.message, errorCode: e.code });
+                            sendError(res, e.code === "loosen_forbidden" ? 403 : 409, e.code, e.message);
                             return;
                         }
                         cleanupStaging(stagingId);
@@ -4640,7 +4626,7 @@ export function createHttpServer(deps) {
                     }
                     const allow = deps.config.attachmentMimeAllowlist;
                     if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
-                        sendJson(res, 415, { code: "attachment.mime_not_allowed", errorCode: "attachment.mime_not_allowed", error: `mime '${mime}' is not in this deployment's allowlist`, allowed: allow });
+                        sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { code: "attachment.mime_not_allowed", allowed: allow });
                         return;
                     }
                     const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
@@ -4650,7 +4636,7 @@ export function createHttpServer(deps) {
                     }
                     catch (err) {
                         if (err instanceof HttpError && err.status === 413) {
-                            sendJson(res, 413, { code: "attachment.too_large", errorCode: "attachment.too_large", error: `attachment exceeds the per-file limit (${max} bytes)`, maxBytes: max });
+                            sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { code: "attachment.too_large", maxBytes: max });
                             return;
                         }
                         throw err;
@@ -4772,7 +4758,7 @@ export function createHttpServer(deps) {
                 catch (e) {
                     const code = e.code;
                     if (typeof code === "string" && code.startsWith("notify.")) {
-                        sendJson(res, 400, { errorCode: code, error: e instanceof Error ? e.message : "invalid notification" });
+                        sendError(res, 400, code, e instanceof Error ? e.message : "invalid notification");
                         return;
                     }
                 }
@@ -5902,7 +5888,7 @@ export function createHttpServer(deps) {
             return false;
         deps.metrics?.inc("fleet_lease_rejected_total");
         res.setHeader("retry-after", String(adm.retryAfterSec));
-        sendJson(res, 429, { error: "budget exhausted (quota lease)", code: "quota_exhausted", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
+        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { code: "quota_exhausted", retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
         return true;
     }
     function rateLimited(req, res) {
@@ -6879,6 +6865,9 @@ function sendJson(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
 }
+function sendError(res, status, errorCode, message, extra) {
+    sendJson(res, status, { error: message, errorCode, ...extra });
+}
 function msg(e) {
     return e instanceof Error ? e.message : String(e);
 }

package/dist/index.d.ts

@@ -22,5 +22,5 @@ export { createCouncilTool } from "./capabilities/code-review-council.js";
 export { loadSkills, skillsForScenario, type LoadedSkill } from "./capabilities/skills.js";
 export { buildScenarios, selectScenario, type Scenario, type ScenarioBundle, type ScenarioDeps, type ScenarioRequest, } from "./capabilities/scenarios.js";
 export { createAuthorizer, principalFrom, memoryScopeFor, memoryEngineBackendFor, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
-export { createHttpServer, type ServiceDeps, type TaskRequestBody, type RequestAuth, } from "./http/server.js";
+export { createHttpServer, type ServiceDeps, type TaskRequestBody, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/key-resolver.d.ts

@@ -1,6 +1,6 @@
 import type { Model } from "@sema-agent/core";
 import { type SealedKeyPoison } from "./sealed-key.js";
-export declare function buildKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): ((model: Model) => Promise<{
+export declare function createKeyResolver(modelApiKeyEnv: Record<string, string>, env?: NodeJS.ProcessEnv, modelApiKeys?: Record<string, string | SealedKeyPoison>): ((model: Model) => Promise<{
     apiKey: string;
 } | undefined>) | undefined;
 //# sourceMappingURL=key-resolver.d.ts.map

package/dist/key-resolver.js

@@ -1,5 +1,5 @@
 import { isSealedKeyPoison, SealedKeyPoisonedError } from "./sealed-key.js";
-export function buildKeyResolver(modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
+export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
     if (Object.keys(modelApiKeyEnv).length === 0 && Object.keys(modelApiKeys).length === 0)
         return undefined;
     return async (model) => {

package/dist/leader/grader-env-factory.d.ts

@@ -32,5 +32,5 @@ export interface MintedGrader extends GraderHandle {
     immutableOraclePaths: string[];
     destroy: () => Promise<void>;
 }
-export declare function buildGraderEnvFactory(_cfg: GraderEnvFactoryCfg): () => Promise<MintedGrader>;
+export declare function createGraderEnvFactory(_cfg: GraderEnvFactoryCfg): () => Promise<MintedGrader>;
 //# sourceMappingURL=grader-env-factory.d.ts.map

package/dist/leader/grader-env-factory.js

@@ -63,9 +63,9 @@ export function changedFilesOutOfAllowlist(changedFiles, allowlist) {
 export function changedFilesWithinAllowlist(changedFiles, allowlist) {
     return changedFilesOutOfAllowlist(changedFiles, allowlist).length === 0;
 }
-export function buildGraderEnvFactory(_cfg) {
+export function createGraderEnvFactory(_cfg) {
     return async () => {
-        throw new Error("buildGraderEnvFactory: the standalone control-plane grader is the auto-accept slice (LEADER_GRADER_FACTORY) — " +
+        throw new Error("createGraderEnvFactory: the standalone control-plane grader is the auto-accept slice (LEADER_GRADER_FACTORY) — " +
             "NOT wired in v1 (which reuses the integration sandbox for R1 and re-seeds it for R2). " +
             "See docs/LEADER-REPAIRLOOP-INTEGRATION.md §3.2/§7.");
     };

package/dist/leader/leader.js

@@ -161,7 +161,9 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
             }));
             return out;
         };
-        if (deps.moduleGate) {
+        const runModuleGate = async () => {
+            if (!deps.moduleGate)
+                return;
             const subById = new Map(subs.map((s) => [s.workerId, s]));
             const maxR = deps.moduleGate.maxRepairs ?? 1;
             await Promise.all(reports.filter((r) => r.status === "completed").map(async (r) => {
@@ -194,7 +196,8 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                 }
             }));
-        }
+        };
+        await runModuleGate();
         const mergeDeps = {
             pullWorkerDiff: async (r) => workerDiff(byId.get(r.workerId)),
             provisionIntegrationSandbox: deps.provisionIntegrationSandbox,

package/dist/leader/wire.d.ts

@@ -61,6 +61,6 @@ export declare function leaderResourceConfig(env?: NodeJS.ProcessEnv): {
         maxSuspends: number;
     };
 };
-export declare function buildLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
+export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
 export {};
 //# sourceMappingURL=wire.d.ts.map