@sema-agent/server 1.314.0 → 1.316.0

package/dist/config-center/skills-mcp.js

@@ -0,0 +1,113 @@
+import { skillContentHash } from "@sema-agent/registry-core";
+import { fetchSkillContent } from "./http-client.js";
+export async function applyCenterSkills(baseline, manifest, baseUrl, token, logger, fetchImpl = fetch, diskCacheDir) {
+    const { promises: fsp } = await import("node:fs");
+    const { join: joinPath } = await import("node:path");
+    const diskRead = async (hash) => {
+        if (!diskCacheDir)
+            return undefined;
+        const hex = hash.replace(/^sha256:/, "");
+        if (!/^[0-9a-f]{64}$/.test(hex))
+            return undefined;
+        try {
+            const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");
+            if (skillContentHash(text) === hash)
+                return text;
+            logger?.warn("sema_registry_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
+        }
+        catch {
+        }
+        return undefined;
+    };
+    const pendingWrites = [];
+    const diskWrite = (hash, content) => {
+        if (!diskCacheDir)
+            return;
+        const hex = hash.replace(/^sha256:/, "");
+        pendingWrites.push((async () => {
+            await fsp.mkdir(diskCacheDir, { recursive: true });
+            const tmp = joinPath(diskCacheDir, `${hex}.${Math.random().toString(36).slice(2, 8)}.tmp`);
+            await fsp.writeFile(tmp, content, { mode: 0o600 });
+            await fsp.rename(tmp, joinPath(diskCacheDir, hex));
+        })().catch((err) => logger?.warn("sema_registry_skill_cache_write_failed", { hash, err: String(err) })));
+    };
+    const byName = new Map(baseline.map((s) => [s.spec.name, s]));
+    const contentCache = new Map();
+    const seenNames = new Set();
+    for (const m of manifest.skills ?? []) {
+        if (m.enabled === false)
+            continue;
+        if (seenNames.has(m.name))
+            logger?.warn("sema_registry_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
+        seenNames.add(m.name);
+        try {
+            let content = contentCache.get(m.contentHash);
+            if (content === undefined)
+                content = await diskRead(m.contentHash);
+            if (content === undefined) {
+                content = await fetchSkillContent(baseUrl, token, m.contentHash, fetchImpl);
+                diskWrite(m.contentHash, content);
+            }
+            contentCache.set(m.contentHash, content);
+            const overrodeBuiltin = byName.has(m.name);
+            byName.set(m.name, { spec: { name: m.name, description: m.description, content }, scenarios: m.scenarios ?? [] });
+            logger?.info("sema_registry_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
+        }
+        catch (err) {
+            logger?.warn("sema_registry_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
+        }
+    }
+    await Promise.all(pendingWrites);
+    return [...byName.values()];
+}
+function resolveRefs(refs, server, kind, logger) {
+    if (!refs)
+        return {};
+    const out = {};
+    for (const [key, envName] of Object.entries(refs)) {
+        const v = process.env[envName];
+        if (v === undefined) {
+            logger?.warn("sema_registry_mcp_env_missing", { server, kind, key, envName, note: "skipping this MCP server — referenced env var is unset in this service" });
+            return null;
+        }
+        out[key] = v;
+    }
+    return out;
+}
+export function resolveMcpServers(mcp, logger) {
+    const out = [];
+    for (const s of mcp.servers ?? []) {
+        if (s.enabled === false)
+            continue;
+        const allow = s.allowTools && s.allowTools.length > 0 ? { allowTools: s.allowTools } : {};
+        const elicit = s.elicitation === true ? { elicitation: true } : {};
+        if (s.transport.kind === "stdio") {
+            const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
+            if (env === null)
+                continue;
+            out.push({
+                scenarios: s.scenarios ?? [],
+                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit },
+            });
+        }
+        else {
+            const headers = resolveRefs(s.transport.headerRefs, s.name, "header", logger);
+            if (headers === null)
+                continue;
+            out.push({
+                scenarios: s.scenarios ?? [],
+                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit },
+            });
+        }
+    }
+    if (out.length > 0)
+        logger?.info("sema_registry_mcp", { servers: out.map((s) => s.spec.name) });
+    return out;
+}
+export function mcpForScenario(servers, scenario) {
+    if (!servers || servers.length === 0)
+        return undefined;
+    const hit = servers.filter((s) => s.scenarios.length === 0 || s.scenarios.includes(scenario)).map((s) => s.spec);
+    return hit.length > 0 ? hit : undefined;
+}
+//# sourceMappingURL=skills-mcp.js.map

package/dist/config-center/types.d.ts

@@ -0,0 +1,143 @@
+import type { CollabTemplateWire } from "../capabilities/collab-wire.js";
+import type { Autonomy, CommandRule } from "../runtime-governance.js";
+export interface CenterModel {
+    name: string;
+    id: string;
+    provider: string;
+    api: "openai-completions" | "anthropic-messages";
+    baseUrl?: string;
+    apiKeyEnv?: string;
+    sealedApiKey?: {
+        ciphertext: string;
+        publicKeyId: string;
+        alg: string;
+        setAt?: string;
+    };
+    tier?: string;
+    reasoning?: boolean;
+    vision?: boolean;
+    contextWindow?: number;
+    maxTokens?: number;
+    autoCompactTokens?: number;
+    charsPerToken?: number;
+    cost?: {
+        input: number;
+        output: number;
+        cacheRead?: number;
+        cacheWrite?: number;
+    };
+    quotaWeight?: number;
+    defaultThinking?: string;
+    reasoningEffortLevels?: string[];
+    extraBody?: Record<string, unknown>;
+    promptGuidance?: string[];
+    enabled?: boolean;
+}
+export type CenterRoleTarget = {
+    model: string;
+} | {
+    select: unknown;
+};
+export interface CenterTeam {
+    name: string;
+    members: {
+        role: string;
+        modelRole?: string;
+        model?: string;
+        systemPrompt?: string;
+    }[];
+    rounds: number;
+    synthesizer?: {
+        role: string;
+        modelRole?: string;
+        systemPrompt?: string;
+    };
+    scenario?: string;
+    maxTranscriptTokens?: number;
+    enabled?: boolean;
+}
+export interface CenterSkillManifest {
+    name: string;
+    description: string;
+    scenarios: string[];
+    contentHash: string;
+    enabled?: boolean;
+}
+export interface CenterMcpServer {
+    name: string;
+    scenarios: string[];
+    enabled?: boolean;
+    allowTools?: string[];
+    elicitation?: boolean;
+    transport: {
+        kind: "stdio";
+        command: string;
+        args?: string[];
+        envRefs?: Record<string, string>;
+    } | {
+        kind: "http";
+        url: string;
+        headerRefs?: Record<string, string>;
+        principalHeader?: string;
+    };
+}
+export interface EffectiveConfig {
+    version: number;
+    updatedAt: string;
+    models: {
+        models: CenterModel[];
+        roles: Record<string, CenterRoleTarget>;
+        atModelAllowlist?: string[];
+    };
+    teams?: {
+        teams: CenterTeam[];
+    };
+    collab?: {
+        templates: CollabTemplateWire[];
+    };
+    skills?: {
+        skills: CenterSkillManifest[];
+    };
+    mcp?: {
+        servers: CenterMcpServer[];
+    };
+    scenarios?: {
+        scenarios: Array<{
+            name: string;
+            toolset: string;
+            enabled?: boolean;
+        }>;
+    };
+    runtime?: {
+        rateLimitPerMin?: number;
+        approvalRequire?: string[];
+        maxTaskCostUsd?: number;
+        maxTaskTokens?: number;
+        maxPrincipalCostUsd?: number;
+        costQuotaWindowSec?: number;
+        autonomy?: Autonomy;
+        commandPolicy?: CommandRule[];
+    };
+    projects?: {
+        projects?: Record<string, unknown>;
+    } | Record<string, unknown>;
+    governance?: {
+        autonomy?: Autonomy;
+        commandPolicy?: CommandRule[];
+        approvalRequire?: string[];
+    };
+    plugins?: {
+        plugins?: unknown[];
+    };
+    prompts?: unknown;
+}
+export interface ExecutionRuling {
+    required: boolean;
+    allowedLanes: string[];
+    sessionMirror?: SessionMirrorRuling;
+}
+export interface SessionMirrorRuling {
+    engineUrl: string;
+    required: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/config-center/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/fleet/fleet-bus.js

@@ -262,94 +262,78 @@ export function fleetBackgroundChildPublisher(bus, log) {
             return u.tokens;
         return undefined;
     };
-    return (e) => {
-        if (e.kind === "spawn") {
-            const tomb = meta.get(e.taskId);
-            const inheritParent = !e.parentTaskId && !e.parentSessionId && tomb?.done === true;
-            const m = {
-                ...(e.parentTaskId ? { parentTaskId: e.parentTaskId } : {}),
-                ...(!e.parentTaskId && e.parentSessionId ? { parentSessionLink: e.parentSessionId } : {}),
-                ...(inheritParent && tomb?.parentTaskId !== undefined ? { parentTaskId: tomb.parentTaskId } : {}),
-                ...(inheritParent && tomb?.parentSessionLink !== undefined ? { parentSessionLink: tomb.parentSessionLink } : {}),
-                ...(inheritParent && tomb?.resolvedParentId !== undefined ? { resolvedParentId: tomb.resolvedParentId } : {}),
-                ...(e.sessionScoped && e.owner ? { hostSessionId: e.rootSessionId ?? e.owner } : {}),
-                tenantScope: e.scope ?? "default",
-                sessionScoped: e.sessionScoped,
-                spawnedAt: e.startedAt ?? Date.now(),
-                ...(e.rootSessionId ? { rootSessionId: e.rootSessionId } : {}),
-                ...(e.parentToolCallId ? { parentToolCallId: e.parentToolCallId } : {}),
-                ...(e.sessionId ? { aliasUuid: e.sessionId } : {}),
-                ...(e.workflowRunId ? { workflowRunId: e.workflowRunId } : {}),
-                ...(e.workflowRunId && !(e.sessionScoped && e.owner)
-                    ? (() => {
-                        if (e.rootSessionId)
-                            return { hostSessionId: e.rootSessionId };
-                        if (e.parentSessionId)
-                            return { hostSessionId: e.parentSessionId };
-                        const host = e.parentTaskId ? bus.snapshot().tasks.find((r) => r.id === e.parentTaskId && r.scope === (e.scope ?? "default")) : undefined;
-                        return host?.sessionId ? { hostSessionId: host.sessionId } : {};
-                    })()
-                    : {}),
-                ...(!(e.sessionScoped && e.owner) && !e.workflowRunId && (e.rootSessionId ?? e.parentSessionId)
-                    ? (() => {
-                        if (e.rootSessionId)
-                            return { hostSessionId: e.rootSessionId };
-                        const childScope = e.scope ?? "default";
-                        for (const pm of meta.values()) {
-                            if (pm.aliasUuid === e.parentSessionId && (pm.tenantScope ?? "default") === childScope) {
-                                return pm.hostSessionId ? { hostSessionId: pm.hostSessionId } : {};
-                            }
-                        }
+    const handleSpawn = (e) => {
+        const tomb = meta.get(e.taskId);
+        const inheritParent = !e.parentTaskId && !e.parentSessionId && tomb?.done === true;
+        const m = {
+            ...(e.parentTaskId ? { parentTaskId: e.parentTaskId } : {}),
+            ...(!e.parentTaskId && e.parentSessionId ? { parentSessionLink: e.parentSessionId } : {}),
+            ...(inheritParent && tomb?.parentTaskId !== undefined ? { parentTaskId: tomb.parentTaskId } : {}),
+            ...(inheritParent && tomb?.parentSessionLink !== undefined ? { parentSessionLink: tomb.parentSessionLink } : {}),
+            ...(inheritParent && tomb?.resolvedParentId !== undefined ? { resolvedParentId: tomb.resolvedParentId } : {}),
+            ...(e.sessionScoped && e.owner ? { hostSessionId: e.rootSessionId ?? e.owner } : {}),
+            tenantScope: e.scope ?? "default",
+            sessionScoped: e.sessionScoped,
+            spawnedAt: e.startedAt ?? Date.now(),
+            ...(e.rootSessionId ? { rootSessionId: e.rootSessionId } : {}),
+            ...(e.parentToolCallId ? { parentToolCallId: e.parentToolCallId } : {}),
+            ...(e.sessionId ? { aliasUuid: e.sessionId } : {}),
+            ...(e.workflowRunId ? { workflowRunId: e.workflowRunId } : {}),
+            ...(e.workflowRunId && !(e.sessionScoped && e.owner)
+                ? (() => {
+                    if (e.rootSessionId)
+                        return { hostSessionId: e.rootSessionId };
+                    if (e.parentSessionId)
                         return { hostSessionId: e.parentSessionId };
-                    })()
-                    : {}),
-            };
-            remember(e.taskId, m);
-            bus.publishTask({ id: e.taskId, name: redactSecrets(e.description ?? e.name ?? e.taskId), ...(e.agentType ? { agentType: redactSecrets(e.agentType) } : {}), ...rowTags(m), status: "running", tokens: 0, ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
-            dlog("bg_child_event", { kind: "spawn", taskId: e.taskId, sessionScoped: e.sessionScoped, scope: m.tenantScope, hostSessionId: m.hostSessionId ?? null, parentTaskId: m.parentTaskId ?? null });
-            return;
-        }
-        const m = meta.get(e.taskId) ?? { sessionScoped: e.sessionScoped, tenantScope: "default", spawnedAt: Date.now() };
-        if (!meta.has(e.taskId)) {
-            remember(e.taskId, m);
-            dlog("bg_child_event", { kind: `${e.kind}-lazy-mint`, taskId: e.taskId, sessionScoped: e.sessionScoped });
-        }
-        else {
-            remember(e.taskId, m);
-        }
-        if (m.done) {
-            dlog("bg_child_event", { kind: `${e.kind}-after-terminal-ignored`, taskId: e.taskId });
-            return;
-        }
-        if (m.parentToolCallId === undefined && e.parentToolCallId)
-            m.parentToolCallId = e.parentToolCallId;
-        if (e.kind === "tick") {
-            if (!m.suppressedTwin && e.progressTaskId && (!e.progressParentTaskId || e.progressParentTaskId === (m.parentTaskId ?? m.parentSessionLink))) {
-                const tail = ` ${e.progressTaskId}`;
-                for (const row of bus.snapshot().tasks) {
-                    if (row.id.endsWith(tail))
-                        bus.removeTask(row.id);
-                }
-                m.suppressedTwin = true;
-            }
-            if (m.aliasUuid === undefined && e.progressTaskId && (!e.progressParentTaskId || e.progressParentTaskId === (m.parentTaskId ?? m.parentSessionLink))) {
-                m.aliasUuid = e.progressTaskId;
-                for (const [cid, cm] of meta) {
-                    if ((cm.parentTaskId ?? cm.parentSessionLink) === m.aliasUuid && cm.resolvedParentId === undefined && !cm.done) {
-                        bus.publishTask({ id: cid, ...rowTags(cm) });
+                    const host = e.parentTaskId ? bus.snapshot().tasks.find((r) => r.id === e.parentTaskId && r.scope === (e.scope ?? "default")) : undefined;
+                    return host?.sessionId ? { hostSessionId: host.sessionId } : {};
+                })()
+                : {}),
+            ...(!(e.sessionScoped && e.owner) && !e.workflowRunId && (e.rootSessionId ?? e.parentSessionId)
+                ? (() => {
+                    if (e.rootSessionId)
+                        return { hostSessionId: e.rootSessionId };
+                    const childScope = e.scope ?? "default";
+                    for (const pm of meta.values()) {
+                        if (pm.aliasUuid === e.parentSessionId && (pm.tenantScope ?? "default") === childScope) {
+                            return pm.hostSessionId ? { hostSessionId: pm.hostSessionId } : {};
+                        }
                     }
+                    return { hostSessionId: e.parentSessionId };
+                })()
+                : {}),
+        };
+        remember(e.taskId, m);
+        bus.publishTask({ id: e.taskId, name: redactSecrets(e.description ?? e.name ?? e.taskId), ...(e.agentType ? { agentType: redactSecrets(e.agentType) } : {}), ...rowTags(m), status: "running", tokens: 0, ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
+        dlog("bg_child_event", { kind: "spawn", taskId: e.taskId, sessionScoped: e.sessionScoped, scope: m.tenantScope, hostSessionId: m.hostSessionId ?? null, parentTaskId: m.parentTaskId ?? null });
+    };
+    const handleTick = (e, m) => {
+        if (!m.suppressedTwin && e.progressTaskId && (!e.progressParentTaskId || e.progressParentTaskId === (m.parentTaskId ?? m.parentSessionLink))) {
+            const tail = ` ${e.progressTaskId}`;
+            for (const row of bus.snapshot().tasks) {
+                if (row.id.endsWith(tail))
+                    bus.removeTask(row.id);
+            }
+            m.suppressedTwin = true;
+        }
+        if (m.aliasUuid === undefined && e.progressTaskId && (!e.progressParentTaskId || e.progressParentTaskId === (m.parentTaskId ?? m.parentSessionLink))) {
+            m.aliasUuid = e.progressTaskId;
+            for (const [cid, cm] of meta) {
+                if ((cm.parentTaskId ?? cm.parentSessionLink) === m.aliasUuid && cm.resolvedParentId === undefined && !cm.done) {
+                    bus.publishTask({ id: cid, ...rowTags(cm) });
                 }
             }
-            const tokens = sumUsage(e.usage);
-            const name = e.name ? redactSecrets(e.name) : undefined;
-            const agentType = e.agentType ? redactSecrets(e.agentType) : name;
-            const currentAction = e.currentAction ? redactSecrets(e.currentAction) : undefined;
-            const currentTool = e.currentTool
-                ? { toolName: e.currentTool.toolName, ...(e.currentTool.target !== undefined ? { target: redactSecrets(e.currentTool.target).slice(0, 300) } : {}) }
-                : undefined;
-            bus.publishTask({ id: e.taskId, ...rowTags(m), status: "running", ...(tokens !== undefined ? { tokens } : {}), ...(name ? { name } : {}), ...(agentType ? { agentType } : {}), ...(currentAction ? { currentAction } : {}), ...(currentTool ? { currentTool } : {}), ...(e.usage?.toolUses !== undefined ? { toolUses: e.usage.toolUses } : {}), ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
-            return;
         }
+        const tokens = sumUsage(e.usage);
+        const name = e.name ? redactSecrets(e.name) : undefined;
+        const agentType = e.agentType ? redactSecrets(e.agentType) : name;
+        const currentAction = e.currentAction ? redactSecrets(e.currentAction) : undefined;
+        const currentTool = e.currentTool
+            ? { toolName: e.currentTool.toolName, ...(e.currentTool.target !== undefined ? { target: redactSecrets(e.currentTool.target).slice(0, 300) } : {}) }
+            : undefined;
+        bus.publishTask({ id: e.taskId, ...rowTags(m), status: "running", ...(tokens !== undefined ? { tokens } : {}), ...(name ? { name } : {}), ...(agentType ? { agentType } : {}), ...(currentAction ? { currentAction } : {}), ...(currentTool ? { currentTool } : {}), ...(e.usage?.toolUses !== undefined ? { toolUses: e.usage.toolUses } : {}), ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
+    };
+    const handleTerminal = (e, m) => {
         const status = e.status === "completed" ? "completed" : e.status === "killed" ? "killed" : "failed";
         bus.publishTask({
             id: e.taskId, ...rowTags(m), status,
@@ -420,6 +404,31 @@ export function fleetBackgroundChildPublisher(bus, log) {
         m.done = true;
         m.suppressedTwin = true;
     };
+    return (e) => {
+        if (e.kind === "spawn") {
+            handleSpawn(e);
+            return;
+        }
+        const m = meta.get(e.taskId) ?? { sessionScoped: e.sessionScoped, tenantScope: "default", spawnedAt: Date.now() };
+        if (!meta.has(e.taskId)) {
+            remember(e.taskId, m);
+            dlog("bg_child_event", { kind: `${e.kind}-lazy-mint`, taskId: e.taskId, sessionScoped: e.sessionScoped });
+        }
+        else {
+            remember(e.taskId, m);
+        }
+        if (m.done) {
+            dlog("bg_child_event", { kind: `${e.kind}-after-terminal-ignored`, taskId: e.taskId });
+            return;
+        }
+        if (m.parentToolCallId === undefined && e.parentToolCallId)
+            m.parentToolCallId = e.parentToolCallId;
+        if (e.kind === "tick") {
+            handleTick(e, m);
+            return;
+        }
+        handleTerminal(e, m);
+    };
 }
 export function fleetRunLabels(objective) {
     const oneLine = redactSecrets((objective ?? "").replace(/\s+/g, " ")).trim();

package/dist/hooks/hook-runner.js

@@ -523,7 +523,7 @@ export function createTaskHooks(config, ctx) {
     const onceFired = new Set();
     const hooks = {};
     if (pre) {
-        hooks.preToolUse = async (toolName, input, tctx) => {
+        const preToolUseHook = async (toolName, input, tctx) => {
             let currentInput = input;
             let rewritten = false;
             let asked;
@@ -608,9 +608,10 @@ export function createTaskHooks(config, ctx) {
             }
             return undefined;
         };
+        hooks.preToolUse = preToolUseHook;
     }
     if (post) {
-        hooks.postToolUse = async (toolName, input, output, tctx) => {
+        const postToolUseHook = async (toolName, input, output, tctx) => {
             const contexts = [];
             const responseText = output.content
                 .map((c) => (c && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
@@ -657,9 +658,10 @@ export function createTaskHooks(config, ctx) {
             }
             return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
         };
+        hooks.postToolUse = postToolUseHook;
     }
     if (postFailure) {
-        hooks.postToolUseFailure = async (toolName, input, f, tctx) => {
+        const postToolUseFailureHook = async (toolName, input, f, tctx) => {
             const contexts = [];
             const payload = {
                 ...basePayload(ctx),
@@ -700,9 +702,10 @@ export function createTaskHooks(config, ctx) {
             }
             return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
         };
+        hooks.postToolUseFailure = postToolUseFailureHook;
     }
     if (postBatch) {
-        hooks.postToolBatch = async (calls) => {
+        const postToolBatchHook = async (calls) => {
             const contexts = [];
             const payload = {
                 ...basePayload(ctx),
@@ -740,9 +743,10 @@ export function createTaskHooks(config, ctx) {
             }
             return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
         };
+        hooks.postToolBatch = postToolBatchHook;
     }
     if (promptSubmit) {
-        hooks.userPromptSubmit = async (prompt) => {
+        const userPromptSubmitHook = async (prompt) => {
             const contexts = [];
             const payload = { ...basePayload(ctx), hook_event_name: "UserPromptSubmit", prompt: clip(prompt, MAX_TOOL_INPUT_CHARS) };
             const singles = await runMatchingEntries("UserPromptSubmit", ignoreMatchers(promptSubmit), "", payload, ctx, onceFired, Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000);
@@ -777,9 +781,10 @@ export function createTaskHooks(config, ctx) {
             }
             return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
         };
+        hooks.userPromptSubmit = userPromptSubmitHook;
     }
     if (stopEntries) {
-        hooks.stop = async (sctx) => {
+        const stopHook = async (sctx) => {
             const payload = { ...basePayload(ctx), hook_event_name: "Stop", stop_hook_active: sctx.stopHookActive };
             let llmExtra;
             const wantsPrompt = stopEntries.some((g) => g.hooks.some((h) => h.type === "prompt"));
@@ -867,9 +872,10 @@ export function createTaskHooks(config, ctx) {
                 ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
             };
         };
+        hooks.stop = stopHook;
     }
     if (stopFailureEntries) {
-        hooks.stopFailure = async (fctx) => {
+        const stopFailureHook = async (fctx) => {
             const turnError = toAssistantTurnError(fctx.errorKind);
             const payload = {
                 ...basePayload(ctx),
@@ -879,9 +885,10 @@ export function createTaskHooks(config, ctx) {
             };
             await runObserveOnlyEvent("StopFailure", stopFailureEntries, turnError, payload, ctx, onceFired);
         };
+        hooks.stopFailure = stopFailureHook;
     }
     if (preCompactEntries) {
-        hooks.preCompact = async (pctx) => {
+        const preCompactHook = async (pctx) => {
             const payload = {
                 ...basePayload(ctx),
                 hook_event_name: "PreCompact",
@@ -911,9 +918,10 @@ export function createTaskHooks(config, ctx) {
             }
             return undefined;
         };
+        hooks.preCompact = preCompactHook;
     }
     if (postCompactEntries) {
-        hooks.postCompact = async (cctx) => {
+        const postCompactHook = async (cctx) => {
             const payload = {
                 ...basePayload(ctx),
                 hook_event_name: "PostCompact",
@@ -922,6 +930,7 @@ export function createTaskHooks(config, ctx) {
             };
             await runObserveOnlyEvent("PostCompact", postCompactEntries, cctx.trigger, payload, ctx, onceFired);
         };
+        hooks.postCompact = postCompactHook;
     }
     return hooks;
 }

package/dist/http/idempotency.d.ts

@@ -9,4 +9,5 @@ export declare class IdempotencyCache<T> {
     private live;
     private maybeSweep;
 }
+export declare function scopedIdempotencyKey(raw: string | undefined, source: string | null, principal: string | undefined): string | undefined;
 //# sourceMappingURL=idempotency.d.ts.map

package/dist/http/idempotency.js

@@ -46,4 +46,7 @@ export class IdempotencyCache {
                 this.entries.delete(k);
     }
 }
+export function scopedIdempotencyKey(raw, source, principal) {
+    return raw ? `${source ?? ""}\x1f${principal ?? ""}\x1f${raw}` : undefined;
+}
 //# sourceMappingURL=idempotency.js.map

package/dist/http/principal-gate.d.ts

@@ -0,0 +1,12 @@
+import type { IncomingMessage } from "node:http";
+import type { ServiceConfig } from "../config-types.js";
+export declare function headerStr(v: string | string[] | undefined): string | undefined;
+export declare function safeEqual(a: string, b: string): boolean;
+export declare function authorized(req: IncomingMessage, token: string): boolean;
+export declare function systemFor(req: IncomingMessage, config: ServiceConfig): string | null | undefined;
+export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
+export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
+export declare function explicitOperatorOk(principal: string | undefined, operatorPrincipals: readonly string[]): boolean;
+export declare function isOperator(principal: string | undefined, operatorPrincipals: readonly string[]): boolean;
+export declare function explicitOperator(principal: string | undefined, operatorPrincipals: readonly string[]): boolean;
+//# sourceMappingURL=principal-gate.d.ts.map

package/dist/http/principal-gate.js

@@ -0,0 +1,52 @@
+import { timingSafeEqual } from "node:crypto";
+import { verifiedPrincipal, ssoVerifiedPrincipal } from "../security.js";
+export function headerStr(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+export function safeEqual(a, b) {
+    const ab = Buffer.from(a, "utf8");
+    const bb = Buffer.from(b, "utf8");
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+export function authorized(req, token) {
+    const h = req.headers.authorization ?? "";
+    return safeEqual(h, `Bearer ${token}`) || safeEqual(h, `token ${token}`);
+}
+export function systemFor(req, config) {
+    for (const [tok, system] of Object.entries(config.authTokens ?? {})) {
+        if (authorized(req, tok))
+            return system;
+    }
+    if (config.authToken && authorized(req, config.authToken))
+        return null;
+    return undefined;
+}
+export function bearerPresentedButUnverified(req, config) {
+    const h = req.headers.authorization;
+    if (typeof h !== "string" || !/^(Bearer|token) /i.test(h))
+        return false;
+    if (ssoVerifiedPrincipal(req))
+        return false;
+    if (systemFor(req, config) !== undefined)
+        return false;
+    if (config.traceToken && authorized(req, config.traceToken))
+        return false;
+    return true;
+}
+export function gatedPrincipal(req, config) {
+    if (bearerPresentedButUnverified(req, config))
+        return undefined;
+    return verifiedPrincipal(req, config);
+}
+export function explicitOperatorOk(principal, operatorPrincipals) {
+    return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
+}
+export function isOperator(principal, operatorPrincipals) {
+    if (operatorPrincipals.length === 0)
+        return true;
+    return principal !== undefined && operatorPrincipals.includes(principal);
+}
+export function explicitOperator(principal, operatorPrincipals) {
+    return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
+}
+//# sourceMappingURL=principal-gate.js.map