@sema-agent/server 1.314.0 → 1.316.0

package/dist/plugins/image-index-sql.js

@@ -0,0 +1,328 @@
+import { createHash } from "node:crypto";
+import { pgSafeJsonStringify, pgSanitizeText, pgHasUnstorable, PgUnstorableError } from "./pg-safe-json.js";
+import { mapImageRow as mapRow, } from "./store-contracts.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export { mapImageRow as mapRow } from "./store-contracts.js";
+export const PG_IMAGE_INDEX_SCHEMA = [
+    `CREATE TABLE IF NOT EXISTS sandbox_image_index (
+     id                 VARCHAR(64)  NOT NULL,
+     profile            VARCHAR(64)  NOT NULL,
+     bands              JSONB,
+     repo               VARCHAR(255) NOT NULL,
+     tag                VARCHAR(128) NOT NULL,
+     digest             VARCHAR(80)  NOT NULL,
+     toolchain_versions JSONB,
+     capabilities       JSONB,
+     pod_contract       JSONB,
+     size_bytes         BIGINT,
+     status             VARCHAR(16)  NOT NULL DEFAULT 'building',
+     visibility         VARCHAR(16)  NOT NULL DEFAULT 'public',
+     tenant_id          VARCHAR(64),
+     manifest_sha       VARCHAR(64),
+     recipe_git_sha     VARCHAR(64),
+     generator_version  VARCHAR(32),
+     build_date         TIMESTAMPTZ(3),
+     supersedes         VARCHAR(64),
+     signed             SMALLINT     NOT NULL DEFAULT 0,
+     created_at         TIMESTAMPTZ(3) NOT NULL,
+     updated_at         TIMESTAMPTZ(3) NOT NULL,
+     PRIMARY KEY (id)
+   )`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS uq_repo_digest ON sandbox_image_index (repo, digest)`,
+    `CREATE INDEX IF NOT EXISTS idx_profile_status ON sandbox_image_index (profile, status, visibility)`,
+    `CREATE INDEX IF NOT EXISTS idx_digest ON sandbox_image_index (digest)`,
+    `CREATE INDEX IF NOT EXISTS idx_tenant ON sandbox_image_index (tenant_id, status)`,
+];
+export async function ensureSchema(pool) {
+    for (const stmt of PG_IMAGE_INDEX_SCHEMA)
+        await pool.query(stmt);
+}
+const MAX_LIMIT = 200;
+const DEFAULT_LIMIT = 50;
+function visibilityClauseTidb(viewer) {
+    if (viewer.operator)
+        return { sql: "1=1", params: [] };
+    if (viewer.tenantId)
+        return { sql: "(visibility='public' OR tenant_id=?)", params: [viewer.tenantId] };
+    return { sql: "visibility='public'", params: [] };
+}
+function visibilityClausePg(viewer, startIdx) {
+    if (viewer.operator)
+        return { sql: "1=1", params: [], nextIdx: startIdx };
+    if (viewer.tenantId)
+        return {
+            sql: `(visibility = 'public' OR tenant_id = $${startIdx})`,
+            params: [viewer.tenantId],
+            nextIdx: startIdx + 1,
+        };
+    return { sql: "visibility = 'public'", params: [], nextIdx: startIdx };
+}
+function encodeCursor(e) {
+    return Buffer.from(`${e.createdAt}|${e.id}`, "utf8").toString("base64url");
+}
+function decodeCursor(c) {
+    try {
+        const [createdAt, id] = Buffer.from(c, "base64url").toString("utf8").split("|");
+        if (!createdAt || !id)
+            return null;
+        return { createdAt, id };
+    }
+    catch {
+        return null;
+    }
+}
+function tidbUpsertParams(e, id, now) {
+    return [
+        id, e.profile, JSON.stringify(e.bands ?? []), e.repo, e.tag, e.digest,
+        JSON.stringify(e.toolchainVersions ?? {}), JSON.stringify(e.capabilities ?? {}),
+        JSON.stringify(e.podContract ?? {}), e.sizeBytes,
+        e.status, e.visibility, e.tenantId ?? null, e.manifestSha ?? null, e.recipeGitSha ?? null,
+        e.generatorVersion ?? null, e.buildDate ? new Date(e.buildDate) : null, e.supersedes ?? null,
+        e.signed ? 1 : 0, now, now,
+    ];
+}
+const PG_UPSERT_COLS = "(id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes, " +
+    "status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes, " +
+    "signed, created_at, updated_at)";
+const PG_UPSERT_VALUES = "($1,$2,$3::jsonb,$4,$5,$6,$7::jsonb,$8::jsonb,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)";
+function pgUpsertParams(e, id, now) {
+    return [
+        id,
+        pgSanitizeText(e.profile),
+        pgSafeJsonStringify(e.bands ?? []),
+        e.repo,
+        pgSanitizeText(e.tag),
+        e.digest,
+        pgSafeJsonStringify(e.toolchainVersions ?? {}),
+        pgSafeJsonStringify(e.capabilities ?? {}),
+        pgSafeJsonStringify(e.podContract ?? {}),
+        e.sizeBytes,
+        e.status,
+        e.visibility,
+        e.tenantId ?? null,
+        e.manifestSha ?? null,
+        e.recipeGitSha == null ? null : pgSanitizeText(e.recipeGitSha),
+        e.generatorVersion == null ? null : pgSanitizeText(e.generatorVersion),
+        e.buildDate ? new Date(e.buildDate) : null,
+        e.supersedes == null ? null : pgSanitizeText(e.supersedes),
+        e.signed ? 1 : 0,
+        now,
+        now,
+    ];
+}
+export class SqlImageIndex {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    static idFor(repo, digest) {
+        return createHash("sha256").update(`${repo}@${digest}`).digest("hex").slice(0, 64);
+    }
+    async upsert(e) {
+        if (this.db.dialect === "pg") {
+            if (pgHasUnstorable(e.repo))
+                throw new PgUnstorableError("image repo (identity)");
+            if (e.tenantId != null && pgHasUnstorable(e.tenantId))
+                throw new PgUnstorableError("image tenantId (identity)");
+        }
+        const id = SqlImageIndex.idFor(e.repo, e.digest);
+        const now = new Date();
+        await this.db.query(this.q(`INSERT INTO sandbox_image_index
+           (id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes,
+            status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes,
+            signed, created_at, updated_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+         ON DUPLICATE KEY UPDATE
+           profile=VALUES(profile), bands=VALUES(bands), tag=VALUES(tag), toolchain_versions=VALUES(toolchain_versions),
+           capabilities=VALUES(capabilities), pod_contract=VALUES(pod_contract), size_bytes=VALUES(size_bytes),
+           status=VALUES(status), visibility=VALUES(visibility), tenant_id=VALUES(tenant_id),
+           manifest_sha=VALUES(manifest_sha), recipe_git_sha=VALUES(recipe_git_sha),
+           generator_version=VALUES(generator_version), build_date=VALUES(build_date), supersedes=VALUES(supersedes),
+           signed=VALUES(signed), updated_at=VALUES(updated_at)`, `INSERT INTO sandbox_image_index ${PG_UPSERT_COLS}
+         VALUES ${PG_UPSERT_VALUES}
+         ON CONFLICT (id) DO UPDATE SET
+           profile = EXCLUDED.profile, bands = EXCLUDED.bands, tag = EXCLUDED.tag,
+           toolchain_versions = EXCLUDED.toolchain_versions, capabilities = EXCLUDED.capabilities,
+           pod_contract = EXCLUDED.pod_contract, size_bytes = EXCLUDED.size_bytes,
+           status = EXCLUDED.status, visibility = EXCLUDED.visibility, tenant_id = EXCLUDED.tenant_id,
+           manifest_sha = EXCLUDED.manifest_sha, recipe_git_sha = EXCLUDED.recipe_git_sha,
+           generator_version = EXCLUDED.generator_version, build_date = EXCLUDED.build_date,
+           supersedes = EXCLUDED.supersedes, signed = EXCLUDED.signed, updated_at = EXCLUDED.updated_at`), this.db.dialect === "tidb" ? tidbUpsertParams(e, id, now) : pgUpsertParams(e, id, now));
+        return id;
+    }
+    async registerBuilding(e) {
+        if (this.db.dialect === "pg") {
+            if (pgHasUnstorable(e.repo))
+                throw new PgUnstorableError("image repo (identity)");
+            if (e.tenantId != null && pgHasUnstorable(e.tenantId))
+                throw new PgUnstorableError("image tenantId (identity)");
+        }
+        const id = SqlImageIndex.idFor(e.repo, e.digest);
+        const now = new Date();
+        await this.db.query(this.q(`INSERT INTO sandbox_image_index
+           (id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes,
+            status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes,
+            signed, created_at, updated_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+         ON DUPLICATE KEY UPDATE
+           profile=VALUES(profile), bands=VALUES(bands), tag=VALUES(tag), toolchain_versions=VALUES(toolchain_versions),
+           capabilities=VALUES(capabilities), pod_contract=VALUES(pod_contract), size_bytes=VALUES(size_bytes),
+           status=IF(sandbox_image_index.status='published', sandbox_image_index.status, VALUES(status)),
+           visibility=IF(sandbox_image_index.status='published', sandbox_image_index.visibility, VALUES(visibility)),
+           tenant_id=IF(sandbox_image_index.status='published', sandbox_image_index.tenant_id, VALUES(tenant_id)),
+           manifest_sha=VALUES(manifest_sha), recipe_git_sha=VALUES(recipe_git_sha),
+           generator_version=VALUES(generator_version), build_date=VALUES(build_date), supersedes=VALUES(supersedes),
+           signed=IF(sandbox_image_index.status='published', sandbox_image_index.signed, VALUES(signed)), updated_at=VALUES(updated_at)`, `INSERT INTO sandbox_image_index ${PG_UPSERT_COLS}
+         VALUES ${PG_UPSERT_VALUES}
+         ON CONFLICT (id) DO UPDATE SET
+           profile = EXCLUDED.profile, bands = EXCLUDED.bands, tag = EXCLUDED.tag,
+           toolchain_versions = EXCLUDED.toolchain_versions, capabilities = EXCLUDED.capabilities,
+           pod_contract = EXCLUDED.pod_contract, size_bytes = EXCLUDED.size_bytes,
+           status = CASE WHEN sandbox_image_index.status = 'published'
+                         THEN sandbox_image_index.status ELSE EXCLUDED.status END,
+           visibility = CASE WHEN sandbox_image_index.status = 'published'
+                             THEN sandbox_image_index.visibility ELSE EXCLUDED.visibility END,
+           tenant_id = CASE WHEN sandbox_image_index.status = 'published'
+                            THEN sandbox_image_index.tenant_id ELSE EXCLUDED.tenant_id END,
+           manifest_sha = EXCLUDED.manifest_sha, recipe_git_sha = EXCLUDED.recipe_git_sha,
+           generator_version = EXCLUDED.generator_version, build_date = EXCLUDED.build_date,
+           supersedes = EXCLUDED.supersedes,
+           signed = CASE WHEN sandbox_image_index.status = 'published'
+                         THEN sandbox_image_index.signed ELSE EXCLUDED.signed END,
+           updated_at = EXCLUDED.updated_at`), this.db.dialect === "tidb" ? tidbUpsertParams(e, id, now) : pgUpsertParams(e, id, now));
+        return id;
+    }
+    async getById(id) {
+        const { rows } = await this.db.query(this.q("SELECT * FROM sandbox_image_index WHERE id=? LIMIT 1", "SELECT * FROM sandbox_image_index WHERE id = $1 LIMIT 1"), [id]);
+        return rows[0] ? mapRow(rows[0]) : null;
+    }
+    async getByDigest(digest) {
+        const { rows } = await this.db.query(this.q("SELECT * FROM sandbox_image_index WHERE digest=? ORDER BY updated_at DESC LIMIT 1", "SELECT * FROM sandbox_image_index WHERE digest = $1 ORDER BY updated_at DESC LIMIT 1"), [digest]);
+        return rows[0] ? mapRow(rows[0]) : null;
+    }
+    async latestPublished(profile, viewer) {
+        if (this.db.dialect === "tidb") {
+            const vis = visibilityClauseTidb(viewer);
+            const { rows } = await this.db.query(`SELECT * FROM sandbox_image_index
+          WHERE profile=? AND status='published' AND ${vis.sql}
+          ORDER BY (build_date IS NULL), build_date DESC, created_at DESC LIMIT 1`, [profile, ...vis.params]);
+            return rows[0] ? mapRow(rows[0]) : null;
+        }
+        const vis = visibilityClausePg(viewer, 2);
+        const { rows } = await this.db.query(`SELECT * FROM sandbox_image_index
+        WHERE profile = $1 AND status = 'published' AND ${vis.sql}
+        ORDER BY build_date DESC NULLS LAST, created_at DESC LIMIT 1`, [profile, ...vis.params]);
+        return rows[0] ? mapRow(rows[0]) : null;
+    }
+    async list(filter) {
+        const limit = Math.min(Math.max(1, filter.limit ?? DEFAULT_LIMIT), MAX_LIMIT);
+        let rawRows;
+        if (this.db.dialect === "tidb") {
+            const vis = visibilityClauseTidb(filter);
+            const where = [vis.sql];
+            const params = [...vis.params];
+            if (filter.profile) {
+                where.push("profile=?");
+                params.push(filter.profile);
+            }
+            if (filter.status) {
+                where.push("status=?");
+                params.push(filter.status);
+            }
+            if (filter.capability) {
+                where.push("JSON_EXTRACT(capabilities, ?) = true");
+                params.push(`$.${filter.capability}`);
+            }
+            if (filter.cursor) {
+                const c = decodeCursor(filter.cursor);
+                if (c) {
+                    where.push("(created_at < ? OR (created_at = ? AND id < ?))");
+                    params.push(new Date(c.createdAt), new Date(c.createdAt), c.id);
+                }
+            }
+            const sql = `SELECT * FROM sandbox_image_index WHERE ${where.join(" AND ")} ` +
+                `ORDER BY created_at DESC, id DESC LIMIT ?`;
+            const { rows } = await this.db.query(sql, [...params, limit + 1]);
+            rawRows = rows;
+        }
+        else {
+            const vis = visibilityClausePg(filter, 1);
+            const where = [vis.sql];
+            const params = [...vis.params];
+            let idx = vis.nextIdx;
+            if (filter.profile) {
+                where.push(`profile = $${idx++}`);
+                params.push(filter.profile);
+            }
+            if (filter.status) {
+                where.push(`status = $${idx++}`);
+                params.push(filter.status);
+            }
+            if (filter.capability) {
+                where.push(`capabilities -> $${idx++} = 'true'::jsonb`);
+                params.push(filter.capability);
+            }
+            if (filter.cursor) {
+                const c = decodeCursor(filter.cursor);
+                if (c) {
+                    where.push(`(created_at < $${idx} OR (created_at = $${idx + 1} AND id < $${idx + 2}))`);
+                    params.push(new Date(c.createdAt), new Date(c.createdAt), c.id);
+                    idx += 3;
+                }
+            }
+            const sql = `SELECT * FROM sandbox_image_index WHERE ${where.join(" AND ")} ` +
+                `ORDER BY created_at DESC, id DESC LIMIT $${idx}`;
+            params.push(limit + 1);
+            const { rows } = await this.db.query(sql, params);
+            rawRows = rows;
+        }
+        let entries = rawRows.map(mapRow);
+        let nextCursor = null;
+        if (entries.length > limit) {
+            entries = entries.slice(0, limit);
+            const last = entries[entries.length - 1];
+            nextCursor = encodeCursor({ createdAt: last.createdAt, id: last.id });
+        }
+        if (filter.latestOnly) {
+            const seen = new Set();
+            entries = entries.filter((e) => (seen.has(e.profile) ? false : (seen.add(e.profile), true)));
+        }
+        return { entries, nextCursor };
+    }
+    async setStatus(id, status, opts) {
+        if (this.db.dialect === "tidb") {
+            const sets = ["status=?", "updated_at=?"];
+            const params = [status, new Date()];
+            if (opts && "supersedes" in opts) {
+                sets.push("supersedes=?");
+                params.push(opts.supersedes ?? null);
+            }
+            params.push(id);
+            await this.db.query(`UPDATE sandbox_image_index SET ${sets.join(", ")} WHERE id=?`, params);
+            return;
+        }
+        const sets = ["status = $1", "updated_at = $2"];
+        const params = [status, new Date()];
+        let idx = 3;
+        if (opts && "supersedes" in opts) {
+            sets.push(`supersedes = $${idx++}`);
+            params.push(opts.supersedes ?? null);
+        }
+        params.push(id);
+        await this.db.query(`UPDATE sandbox_image_index SET ${sets.join(", ")} WHERE id = $${idx}`, params);
+    }
+}
+export class TiDBImageIndex extends SqlImageIndex {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgImageIndex extends SqlImageIndex {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=image-index-sql.js.map

package/dist/plugins/k8s-bg-scripts.d.ts

@@ -0,0 +1,19 @@
+export declare function buildBgRunnerScript(dir: string): string;
+export declare function buildBgLauncherScript(dir: string, cmdShB64: string, runnerShB64: string): string;
+export declare function buildBgPollScript(dir: string, stdoutCursor: number, stderrCursor: number, readCap: number): string;
+export declare function buildBgKillScript(dir: string): string;
+export declare function buildBgDisposeScript(dir: string): string;
+export declare function buildDetachCapableExec(dir: string, command: string): string;
+export interface ParsedBgPoll {
+    gone: boolean;
+    outTotal: number;
+    errTotal: number;
+    exitCode?: number;
+    alive: boolean;
+    stdout: string;
+    stdoutBytes: number;
+    stderr: string;
+    stderrBytes: number;
+}
+export declare function parseBgPollOutput(raw: string): ParsedBgPoll | undefined;
+//# sourceMappingURL=k8s-bg-scripts.d.ts.map

package/dist/plugins/k8s-bg-scripts.js

@@ -0,0 +1,129 @@
+import { shellQuote } from "./remote-shell.js";
+export function buildBgRunnerScript(dir) {
+    const q = (name) => shellQuote(`${dir}/${name}`);
+    return [
+        `echo $$ > ${q("pgid.tmp")} 2>/dev/null && mv ${q("pgid.tmp")} ${q("pgid")} 2>/dev/null`,
+        `sh ${q("cmd.sh")} > ${q("out")} 2> ${q("err")} < /dev/null`,
+        `__RC=$?`,
+        `echo $__RC > ${q("exit.tmp")} 2>/dev/null && mv ${q("exit.tmp")} ${q("exit")} 2>/dev/null`,
+    ].join("\n");
+}
+export function buildBgLauncherScript(dir, cmdShB64, runnerShB64) {
+    const d = shellQuote(dir);
+    const q = (name) => shellQuote(`${dir}/${name}`);
+    return [
+        `mkdir -p ${d} && chmod 700 ${d}`,
+        `printf %s '${cmdShB64}' | base64 -d > ${q("cmd.sh")}`,
+        `printf %s '${runnerShB64}' | base64 -d > ${q("runner.sh")}`,
+        `setsid sh ${q("runner.sh")} >/dev/null 2>&1 &`,
+        `__i=0; while [ ! -s ${q("pgid")} ] && [ $__i -lt 40 ]; do __i=$((__i+1)); sleep 0.05; done`,
+        `if [ -s ${q("pgid")} ]; then echo SEMABG_LAUNCHED; else echo SEMABG_NOPGID; fi`,
+    ].join("\n");
+}
+export function buildBgPollScript(dir, stdoutCursor, stderrCursor, readCap) {
+    const d = shellQuote(dir);
+    const slice = (file, cursor) => [
+        `__N=$((__T - ${cursor}))`,
+        `if [ "$__N" -gt 0 ]; then`,
+        `  if [ "$__N" -le ${readCap} ]; then tail -c +$(( ${cursor} + 1 )) ${d}/${file} 2>/dev/null | head -c "$__N" | base64;`,
+        `  else tail -c +$(( __T - ${readCap} + 1 )) ${d}/${file} 2>/dev/null | head -c ${readCap} | base64; fi`,
+        `fi`,
+    ].join("\n");
+    return [
+        `if [ ! -d ${d} ]; then echo SEMABG_GONE; exit 0; fi`,
+        `__OT=$(wc -c < ${d}/out 2>/dev/null); __OT=$(( \${__OT:-0} + 0 ))`,
+        `__ET=$(wc -c < ${d}/err 2>/dev/null); __ET=$(( \${__ET:-0} + 0 ))`,
+        `__EX=$( [ -f ${d}/exit ] && cat ${d}/exit 2>/dev/null || echo - )`,
+        `__PG=$(cat ${d}/pgid 2>/dev/null); __PG=\${__PG:--}`,
+        `if [ "$__PG" = "-" ]; then __AL=1; elif kill -0 -"$__PG" 2>/dev/null; then __AL=1; else __AL=0; fi`,
+        `echo "SEMABG_META o=$__OT e=$__ET x=$__EX a=$__AL"`,
+        `echo SEMABG_O`,
+        `__T=$__OT`,
+        slice("out", stdoutCursor),
+        `echo SEMABG_E`,
+        `__T=$__ET`,
+        slice("err", stderrCursor),
+        `echo SEMABG_X`,
+    ].join("\n");
+}
+export function buildBgKillScript(dir) {
+    const d = shellQuote(dir);
+    return [
+        `__i=0; while [ ! -s ${d}/pgid ] && [ $__i -lt 40 ]; do __i=$((__i+1)); sleep 0.05; done`,
+        `__PG=$(cat ${d}/pgid 2>/dev/null); __PG=\${__PG:--}`,
+        `if [ "$__PG" != "-" ]; then kill -TERM -"$__PG" 2>/dev/null || kill -TERM "$__PG" 2>/dev/null; sleep 1; kill -KILL -"$__PG" 2>/dev/null || kill -KILL "$__PG" 2>/dev/null; fi`,
+        `echo SEMABG_KILLED`,
+    ].join("\n");
+}
+export function buildBgDisposeScript(dir) {
+    const d = shellQuote(dir);
+    return [
+        `__PG=$(cat ${d}/pgid 2>/dev/null); __PG=\${__PG:--}`,
+        `if [ "$__PG" != "-" ]; then kill -KILL -"$__PG" 2>/dev/null || kill -KILL "$__PG" 2>/dev/null; fi`,
+        `rm -rf ${d} 2>/dev/null`,
+        `echo SEMABG_DISPOSED`,
+    ].join("\n");
+}
+export function buildDetachCapableExec(dir, command) {
+    const d = shellQuote(dir);
+    const q = (name) => shellQuote(`${dir}/${name}`);
+    const cmdB64 = Buffer.from(command, "utf8").toString("base64");
+    const writePgid = (val) => `printf %s ${val} > ${q("pgid.tmp")} 2>/dev/null && mv ${q("pgid.tmp")} ${q("pgid")} 2>/dev/null`;
+    return [
+        `__cmd=$(printf %s '${cmdB64}' | base64 -d)`,
+        `mkdir -p ${d} 2>/dev/null`,
+        `trap 'rm -rf ${d} 2>/dev/null' EXIT`,
+        `if command -v setsid >/dev/null 2>&1; then`,
+        `  setsid sh -c "$__cmd" &`,
+        `  __pg=$!`,
+        `  ${writePgid('"$__pg"')}`,
+        `  wait "$__pg"; __rc=$?`,
+        `else`,
+        `  ${writePgid('"$$"')}`,
+        `  sh -c "$__cmd"; __rc=$?`,
+        `fi`,
+        `exit $__rc`,
+    ].join("\n");
+}
+export function parseBgPollOutput(raw) {
+    if (raw.includes("SEMABG_GONE")) {
+        return { gone: true, outTotal: 0, errTotal: 0, alive: false, stdout: "", stdoutBytes: 0, stderr: "", stderrBytes: 0 };
+    }
+    const lines = raw.split("\n");
+    const metaIdx = lines.findIndex((l) => l.startsWith("SEMABG_META "));
+    if (metaIdx < 0)
+        return undefined;
+    const oIdx = lines.indexOf("SEMABG_O", metaIdx + 1);
+    const eIdx = oIdx >= 0 ? lines.indexOf("SEMABG_E", oIdx + 1) : -1;
+    const xIdx = eIdx >= 0 ? lines.indexOf("SEMABG_X", eIdx + 1) : -1;
+    if (oIdx < 0 || eIdx < 0 || xIdx < 0)
+        return undefined;
+    const m = /o=(\d+) e=(\d+) x=(\S+) a=([01])/.exec(lines[metaIdx].slice("SEMABG_META ".length));
+    if (!m)
+        return undefined;
+    const outTotal = parseInt(m[1], 10);
+    const errTotal = parseInt(m[2], 10);
+    const exTok = m[3];
+    const alive = m[4] === "1";
+    const exitParsed = exTok === "-" ? NaN : parseInt(exTok, 10);
+    const exitCode = Number.isFinite(exitParsed) ? exitParsed : undefined;
+    const decode = (from, to) => {
+        const b64 = lines.slice(from, to).join("").replace(/\s+/g, "");
+        const buf = Buffer.from(b64, "base64");
+        return { text: buf.toString("utf8"), bytes: buf.length };
+    };
+    const o = decode(oIdx + 1, eIdx);
+    const e = decode(eIdx + 1, xIdx);
+    return {
+        gone: false,
+        outTotal,
+        errTotal,
+        ...(exitCode !== undefined ? { exitCode } : {}),
+        alive,
+        stdout: o.text,
+        stdoutBytes: o.bytes,
+        stderr: e.text,
+        stderrBytes: e.bytes,
+    };
+}
+//# sourceMappingURL=k8s-bg-scripts.js.map

package/dist/plugins/k8s-exec-protocol.d.ts

@@ -0,0 +1,20 @@
+export interface PodSpecPatch {
+    volumes?: unknown[];
+    volumeMounts?: unknown[];
+    podSecurityContext?: Record<string, unknown>;
+    containerSecurityContext?: Record<string, unknown>;
+    labels?: Record<string, string>;
+}
+export declare function applyPodSpecPatch(pod: {
+    metadata: {
+        labels?: Record<string, string>;
+    };
+    spec: Record<string, unknown>;
+}, patch: PodSpecPatch): void;
+export declare function execSocketTlsOptions(ca: string | undefined, insecureTls: boolean): Record<string, unknown>;
+export declare function exitCodeFromStatus(statusJson: string): {
+    exitCode: number;
+} | {
+    error: string;
+};
+//# sourceMappingURL=k8s-exec-protocol.d.ts.map

package/dist/plugins/k8s-exec-protocol.js

@@ -0,0 +1,87 @@
+export function applyPodSpecPatch(pod, patch) {
+    assertHardeningOnly(patch.podSecurityContext, "podSecurityContext");
+    assertHardeningOnly(patch.containerSecurityContext, "containerSecurityContext");
+    if (patch.labels) {
+        const identity = {};
+        for (const k of ["app", "managed-by"]) {
+            const v = pod.metadata.labels?.[k];
+            if (v !== undefined)
+                identity[k] = v;
+        }
+        pod.metadata.labels = { ...pod.metadata.labels, ...patch.labels, ...identity };
+    }
+    const spec = pod.spec;
+    assertVolumesPodLocal(patch.volumes, "volumes");
+    if (patch.volumes?.length)
+        spec.volumes = [...(spec.volumes ?? []), ...patch.volumes];
+    if (patch.podSecurityContext)
+        spec.securityContext = { ...(spec.securityContext ?? {}), ...patch.podSecurityContext };
+    const container = spec.containers?.[0];
+    if (container) {
+        if (patch.volumeMounts?.length)
+            container.volumeMounts = [...(container.volumeMounts ?? []), ...patch.volumeMounts];
+        if (patch.containerSecurityContext)
+            container.securityContext = { ...(container.securityContext ?? {}), ...patch.containerSecurityContext };
+    }
+}
+function assertHardeningOnly(sc, where) {
+    if (!sc)
+        return;
+    const bad = (msg) => {
+        throw new Error(`podSpecPatch.${where} rejected — it may only HARDEN, never weaken isolation: ${msg}`);
+    };
+    if (sc.privileged === true)
+        bad("privileged:true");
+    if (sc.allowPrivilegeEscalation === true)
+        bad("allowPrivilegeEscalation:true");
+    if (sc.readOnlyRootFilesystem === false)
+        bad("readOnlyRootFilesystem:false");
+    if (sc.runAsNonRoot === false)
+        bad("runAsNonRoot:false");
+    if (sc.runAsUser === 0)
+        bad("runAsUser:0 (root)");
+    const caps = sc.capabilities;
+    if (caps && Array.isArray(caps.add) && caps.add.length > 0)
+        bad(`capabilities.add ${JSON.stringify(caps.add)} (a hardening patch may only .drop)`);
+    if (sc.procMount === "Unmasked")
+        bad('procMount:"Unmasked" (re-exposes masked /proc)');
+    const seccomp = sc.seccompProfile;
+    if (seccomp && seccomp.type === "Unconfined")
+        bad('seccompProfile.type:"Unconfined" (disables syscall filtering)');
+}
+function assertVolumesPodLocal(volumes, where) {
+    if (!volumes?.length)
+        return;
+    const POD_LOCAL = new Set(["emptyDir", "configMap", "secret", "projected", "downwardAPI", "ephemeral"]);
+    for (const v of volumes) {
+        const vol = v;
+        const sources = Object.keys(vol).filter((k) => k !== "name");
+        for (const src of sources) {
+            if (!POD_LOCAL.has(src)) {
+                throw new Error(`podSpecPatch.${where} rejected — volume source ${JSON.stringify(src)} is not pod-local (host-backed sources like hostPath/csi/flexVolume cross the Kata VM boundary into the node FS). Allowed: ${[...POD_LOCAL].join("/")}`);
+            }
+        }
+    }
+}
+export function execSocketTlsOptions(ca, insecureTls) {
+    const caList = ca ? [ca] : undefined;
+    return { ca: caList, rejectUnauthorized: !insecureTls, tls: { ca: caList, rejectUnauthorized: !insecureTls } };
+}
+export function exitCodeFromStatus(statusJson) {
+    try {
+        const s = JSON.parse(statusJson);
+        if (s.status === "Success")
+            return { exitCode: 0 };
+        const cause = s.details?.causes?.find((c) => c.reason === "ExitCode");
+        if (cause?.message?.trim()) {
+            const code = Number(cause.message);
+            if (Number.isFinite(code))
+                return { exitCode: code };
+        }
+        return { error: s.message || s.reason || "exec failed without an exit code" };
+    }
+    catch {
+        return { error: `unparseable exec status: ${statusJson.slice(0, 200)}` };
+    }
+}
+//# sourceMappingURL=k8s-exec-protocol.js.map

package/dist/plugins/outcome-ledger-sql.d.ts

@@ -0,0 +1,70 @@
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool, PoolClient } from "pg";
+import type { TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
+import { type SqlDriver } from "./sql-driver.js";
+export interface MechanicalOutcome {
+    route?: "single" | "fanout";
+    workerCount?: number;
+    oraclePassed?: number;
+    oracleTotal?: number;
+    assembleExit?: number;
+    lintExit?: number;
+    mergeOk?: boolean;
+    replanTriggers?: string[];
+    costMicroUsd?: number;
+    turns?: number;
+}
+export interface LlmAssistedOutcome {
+    stuckEvents?: number;
+    verifier?: {
+        verdict: string;
+        confidence: number;
+    };
+}
+export interface SignatureInputs {
+    taskType?: string;
+    toolset?: string[];
+    targetLang?: string;
+    moduleCount?: number;
+    tag?: string;
+}
+export type RunStatus = "completed-graded" | "infra-aborted";
+export interface TaskOutcome {
+    taskId?: string;
+    model: string;
+    runStatus?: RunStatus;
+    signatureInputs: SignatureInputs;
+    mechanical: MechanicalOutcome;
+    llmAssisted?: LlmAssistedOutcome;
+    core?: unknown;
+}
+export declare function taskSignature(s: SignatureInputs): string;
+export declare function deriveOutcome(m: MechanicalOutcome, runStatus?: RunStatus): "pass" | "partial" | "fail" | "aborted";
+export declare function coreOutcomeToLedgerRow(o: CoreTaskOutcome): TaskOutcome;
+export declare const PG_OUTCOME_LEDGER_SCHEMA: string[];
+export declare function ensurePgOutcomeLedgerSchema(pool: PgPool | PoolClient): Promise<void>;
+export declare class SqlOutcomeLedger {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    private json;
+    record(o: TaskOutcome): Promise<string>;
+    recordCore(o: CoreTaskOutcome): Promise<void>;
+    summary(opts?: {
+        taskSignature?: string;
+        includeAborted?: boolean;
+    }): Promise<Array<{
+        taskSignature: string;
+        model: string;
+        n: number;
+        passRate: number;
+        meanCostMicroUsd: number;
+    }>>;
+}
+export declare class TiDBOutcomeLedger extends SqlOutcomeLedger {
+    constructor(pool: MySqlPool);
+}
+export declare class PgOutcomeLedger extends SqlOutcomeLedger {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=outcome-ledger-sql.d.ts.map