@sema-agent/server 3.0.0 → 3.2.0

package/dist/plugins/remote-env-host.js

@@ -28,8 +28,9 @@
  * (`{ ok:true, exitCode }`), never an error.
  *
  * Platforms: macOS + Linux (POSIX shell). Forward-compatible with the `remoteExec` superset: this file also
- * scaffolds the `local-docker` / `remote-docker` providers' factory entry points (typed stubs that throw a
- * clear "not yet implemented" — explicit fast-follow per DUAL-MODE-DESIGN §5; NOT faked green).
+ * hosts the `local-docker` / `remote-docker` providers' factory entry points — both now IMPLEMENTED by the
+ * container adapter in remote-env-local-docker.ts (the two providers differ only in whether the `-H` daemon
+ * endpoint is off-box and required), re-exported/wrapped here so the discriminator has one canonical site.
  */
 import { spawn } from "node:child_process";
 import os from "node:os";
@@ -1647,19 +1648,38 @@ export function hostExecutionEnvFactory(config = {}) {
 // ─────────────────────────────── remoteExec superset: docker providers ───────────────────────────────
 //
 // DUAL-MODE-DESIGN §5 defines a `remoteExec.provider` superset. `host` (above) is implemented; `local-docker`
-// is NOW IMPLEMENTED (the isolation lane) — it lives in its own module (remote-env-local-docker.ts) and is
-// re-exported here so the discriminator entry point + the historical import site stay stable. `remote-docker`
-// (a REMOTE docker daemon over TLS/SSH) is still an explicit fast-follow stub — it throws a clear "not yet
-// implemented" so selecting it fails loud at wiring time instead of silently degrading isolation. NOT faked green.
+// (the isolation lane) and `remote-docker` (that same container lane aimed at a REMOTE daemon) are BOTH
+// implemented by remote-env-local-docker.ts and re-exported / wrapped here so the discriminator entry points +
+// the historical import sites stay stable.
 // `local-docker` (the isolation lane): real implementation moved to remote-env-local-docker.ts. Re-export the
 // factory + config from here so existing wiring (`import { localDockerExecutionEnvFactory } from "./remote-env-host"`)
 // keeps working and the provider discriminator has one canonical entry point.
 export { localDockerExecutionEnvFactory, RemoteLocalDockerExecutionEnv } from "./remote-env-local-docker.js";
+import { localDockerExecutionEnvFactory } from "./remote-env-local-docker.js";
 /**
- * `remote-docker` factory entry point — wired but an explicit TODO (DUAL-MODE-DESIGN §5 fast-follow). Throws
- * at factory-BUILD time so selecting it before it exists fails loud rather than degrading isolation silently.
+ * `ExecutionEnvFactory` for the TOC `remote-docker` backend (DUAL-MODE-DESIGN §5): a per-task container on
+ * SOMEONE ELSE'S docker daemon (offload — the operator's box stays free; isolation:true, suspendable:false).
+ * Same lifetime contract as local-docker: unconnected/lazy, one container per task, `destroy()` = `docker rm -f`.
+ *
+ * 🔴 **Endpoint credentials are the docker CLI's own** — this adapter deliberately carries none. The docker CLI
+ * reads `DOCKER_CERT_PATH` + `DOCKER_TLS_VERIFY` from the worker's environment (inherited by every spawn) for a
+ * `tcp://` + TLS daemon, and uses `ssh-agent` / `~/.ssh/config` for an `ssh://` one. That keeps key material out
+ * of this process's config objects entirely. Consequence to know: `tcp://…:2376` WITHOUT those env vars fails
+ * loud at connect (the daemon refuses plaintext) — it does not silently downgrade; a plaintext `tcp://…:2375`
+ * daemon is unauthenticated and remains the operator's decision, exactly as in the registry-core schema.
+ * (The registry-core `remote-docker` arm additionally models `tlsCertEnv`/`tlsKeyEnv`/`tlsCaEnv`/`sshKeyEnv` =
+ * env-NAMEs the control plane resolves to PEM BYTES. Materializing those bytes to short-lived 0600 files and
+ * passing `--tlsverify --tlscert/--tlskey/--tlscacert` is the remaining config-surface follow-up, together with
+ * the `provider:"remote-docker"` arm on `AppConfig.remoteExec` — see the note on that union in config-types.ts.)
+ *
+ * Throws at factory-BUILD time on a missing/blank endpoint: a "remote" lane with no endpoint would otherwise
+ * quietly become the LOCAL daemon — an isolation-topology surprise, so it fails loud instead.
  */
-export function remoteDockerExecutionEnvFactory(_config) {
-    throw new RemoteExecutionError("unsupported", "remoteExec provider 'remote-docker' is not yet implemented (DUAL-MODE-DESIGN §5 fast-follow) — use 'host', 'local-docker', or 'e2b' until it ships");
+export function remoteDockerExecutionEnvFactory(config, deps = {}) {
+    const dockerHost = config.dockerHost?.trim();
+    if (!dockerHost) {
+        throw new RemoteExecutionError("connect_failed", "remoteExec provider 'remote-docker' requires a non-empty dockerHost (the remote daemon endpoint, e.g. tcp://host:2376 or ssh://user@host) — use provider 'local-docker' for THIS machine's daemon");
+    }
+    return localDockerExecutionEnvFactory({ ...config, dockerHost, providerLabel: "remote-docker" }, deps);
 }
 //# sourceMappingURL=remote-env-host.js.map

package/dist/plugins/remote-env-local-docker.d.ts

@@ -17,8 +17,20 @@ export interface LocalDockerEnvConfig {
     /**
      * DOCKER_HOST override for the docker CLI (e.g. a non-default socket). Passed as `-H <value>` on EVERY docker
      * invocation (not the process env) so it can't leak / drift. Absent = the daemon DOCKER_HOST points at.
+     *
+     * Pointing this OFF-BOX (`tcp://host:2376`, `ssh://user@host`) is exactly the DUAL-MODE-DESIGN §5
+     * **`remote-docker`** provider — see {@link remoteDockerExecutionEnvFactory} (remote-env-host.ts), which is
+     * this adapter with the endpoint required. Nothing else about the class is host-local: the workspace is
+     * `mkdir`'d INSIDE the container (never a bind-mount of a host path) and bytes move by `docker cp` /
+     * `docker exec cat`, which stream over the daemon API.
      */
     dockerHost?: string;
+    /**
+     * Provider NAME reported on the {@link WorkspaceHandle}. Default `"local-docker"`; the `remote-docker` arm
+     * passes `"remote-docker"` so a handle never mislabels which lane it is (the CLASS is shared — `remote-docker`
+     * IS this adapter aimed at a remote daemon). Cosmetic/observability only: it selects no behavior.
+     */
+    providerLabel?: string;
     /** Container memory limit (docker `--memory`, e.g. "2g"). Absent = no limit. */
     memory?: string;
     /** Container CPU limit (docker `--cpus`, e.g. 1.5). Absent = no limit. */
@@ -65,6 +77,8 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
     private readonly spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */
     private readonly containerName;
+    /** Provider name put on the WorkspaceHandle ("local-docker" | "remote-docker"). Observability only. */
+    private readonly providerName;
     /** Set once the container is up + the workspace dir created. */
     private containerId?;
     private handle?;

package/dist/plugins/remote-env-local-docker.js

@@ -66,6 +66,8 @@ export class RemoteLocalDockerExecutionEnv {
     spawnFn;
     /** Stable container NAME (also our handle id). Created on connect; targeted by every docker exec/cp/rm. */
     containerName;
+    /** Provider name put on the WorkspaceHandle ("local-docker" | "remote-docker"). Observability only. */
+    providerName;
     /** Set once the container is up + the workspace dir created. */
     containerId;
     handle;
@@ -92,6 +94,7 @@ export class RemoteLocalDockerExecutionEnv {
         const id = config.id ?? randomBytes(6).toString("hex");
         const suffix = randomBytes(4).toString("hex"); // always-unique tail so a reused id never collides
         this.containerName = `sema-docker-${sanitizeId(id)}-${suffix}`;
+        this.providerName = config.providerLabel?.trim() || PROVIDER;
     }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));
@@ -165,7 +168,7 @@ export class RemoteLocalDockerExecutionEnv {
             return { ok: false, error: new RemoteExecutionError("connect_failed", "execution env destroyed during connect") };
         }
         this.containerId = run.value.stdout.trim() || this.containerName;
-        this.handle = { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+        this.handle = { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
         if (config?.secrets?.length) {
             // Secrets are injected per-command via cfg.env (resolved by the control plane), not at connect — record only.
         }
@@ -197,7 +200,7 @@ export class RemoteLocalDockerExecutionEnv {
             // re-run `docker run --name <same>` → name conflict → the failure path rm -f's the very container we just
             // re-attached to (destroying the running workspace). The name IS our exec/handle target.
             this.containerId = this.containerName;
-            this.handle ??= { sandboxId: this.containerName, provider: PROVIDER, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
+            this.handle ??= { sandboxId: this.containerName, provider: this.providerName, mountPath: this.cfg.mountPath, sessionToken: this.containerName };
             return ok(this.handle);
         }
         return { ok: false, error: new RemoteExecutionError("connect_failed", `container '${this.containerName}' is not running (gone or stopped) — no managed snapshot to resume`) };
@@ -609,7 +612,11 @@ export class RemoteLocalDockerExecutionEnv {
             return;
         this.containerShellProbed = true;
         try {
-            const r = await this.docker(this.withHostFlag(["exec", this.containerName, "/bin/sh", "-c", "command -v bash"]), { timeoutMs: this.cfg.controlTimeoutMs });
+            // 🔴 NO withHostFlag here — `docker()` already prepends it. A second `-H` is not a harmless repeat: the
+            // docker CLI rejects the whole command (`invalid argument … specify only one -H`), so on every
+            // REMOTE-daemon container (`dockerHost` set — always, on the `remote-docker` arm) the probe used to fail
+            // and silently degrade the user shell to /bin/sh for a reason unrelated to the image.
+            const r = await this.docker(["exec", this.containerName, "/bin/sh", "-c", "command -v bash"], { timeoutMs: this.cfg.controlTimeoutMs });
             if (r.ok && r.value.exitCode === 0 && r.value.stdout.trim().length > 0)
                 this.containerShell = "bash";
         }

package/dist/plugins/run-store-sql.d.ts

@@ -126,9 +126,14 @@ export declare class SqlRunStore {
      * suspend, an INTENTIONAL durable pause" (design/76 §2.5) — the service MUST park it the same way, else the run is
      * terminalized + its lock released and the plan_review/dry_run_review resume can never run (it gets
      * taskId=undefined and drives the model unprotected on an unlocked session). CAS on `running`/`needs_review`
-     * (reaper-revert guard, mirrors setSuspended). 🔴 The store SQL here is exercised by mocked unit tests only — a
-     * real-TiDB integration test of the park→resume→claim invariant is a required-before-GA TODO (the lesson from the
-     * P2 lease-SQL + this needs_review-park bug: mocked tests hide store-SQL defects).
+     * (reaper-revert guard, mirrors setSuspended). The park→resume→claim invariant is pinned on BOTH REAL engines by
+     * `test/run-store-reaper-integration.test.ts` (`inv#1` row ownership across park→resume→handover, `inv#2` two
+     * replicas racing one session ⇒ exactly one claim wins, `inv#3`/`inv#3'` stale-claim takeover vs fresh/parked
+     * claims), closing the former required-before-GA gap. Keep it that way: the P2 lease-SQL bug and this
+     * needs_review-park bug were both born from store SQL that mocked unit tests pass — measured, not asserted, when
+     * the invariant set was built: an upserting (non-exclusive) claim reddened all four real-DB cases while all 111
+     * mocked run-store unit tests stayed green. A mock cannot observe a unique-key claim race, a rolled-back loser,
+     * or a multi-table reaper DELETE.
      */
     setNeedsReview(taskId: string): Promise<void>;
     /**

package/dist/plugins/run-store-sql.js

@@ -206,9 +206,14 @@ export class SqlRunStore {
      * suspend, an INTENTIONAL durable pause" (design/76 §2.5) — the service MUST park it the same way, else the run is
      * terminalized + its lock released and the plan_review/dry_run_review resume can never run (it gets
      * taskId=undefined and drives the model unprotected on an unlocked session). CAS on `running`/`needs_review`
-     * (reaper-revert guard, mirrors setSuspended). 🔴 The store SQL here is exercised by mocked unit tests only — a
-     * real-TiDB integration test of the park→resume→claim invariant is a required-before-GA TODO (the lesson from the
-     * P2 lease-SQL + this needs_review-park bug: mocked tests hide store-SQL defects).
+     * (reaper-revert guard, mirrors setSuspended). The park→resume→claim invariant is pinned on BOTH REAL engines by
+     * `test/run-store-reaper-integration.test.ts` (`inv#1` row ownership across park→resume→handover, `inv#2` two
+     * replicas racing one session ⇒ exactly one claim wins, `inv#3`/`inv#3'` stale-claim takeover vs fresh/parked
+     * claims), closing the former required-before-GA gap. Keep it that way: the P2 lease-SQL bug and this
+     * needs_review-park bug were both born from store SQL that mocked unit tests pass — measured, not asserted, when
+     * the invariant set was built: an upserting (non-exclusive) claim reddened all four real-DB cases while all 111
+     * mocked run-store unit tests stayed green. A mock cannot observe a unique-key claim race, a rolled-back loser,
+     * or a multi-table reaper DELETE.
      */
     async setNeedsReview(taskId) {
         await this.db.query(this.q("UPDATE task_run SET status = 'needs_review', updated_at = ? WHERE task_id = ? AND status IN ('running','needs_review')", "UPDATE task_run SET status = 'needs_review', updated_at = $1 WHERE task_id = $2 AND status IN ('running','needs_review')"), [new Date(), taskId]);

package/dist/run-local.js

@@ -33,7 +33,7 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { validatePromptsDomain, applyCatalogToSource, CORE_ENGINE_VERSION } from "./capabilities/center-prompts.js";
 import { loadConfig, logConfigDiagnostics } from "./config.js";
 import { createConfigProvider } from "./config-provider.js";
-import { applyEffective, resolveMcpServers, mcpForScenario } from "./sema-registry.js";
+import { applyEffective, resolveMcpServers, mcpForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
@@ -272,7 +272,7 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const sessionStore = fileBackend.sessionStore;
-    const keyResolver = createKeyResolver(config.modelApiKeyEnv);
+    const keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys); // [2006] 后续:三参全链(sealed→env→undefined),与 boot 正形同源——二参形曾让 sealed 模型静默落网关 key
     // Host exec lane: run on THIS machine, in a FIXED workspace (CC-like) — the cwd by default (or --workspace /
     // a config.d workdir). The agent's file edits PERSIST there + are user-visible; the dir is the user's OWN and
     // is NEVER deleted (workspaceDir mode). One env per task; the Runner owns its lifetime.

package/dist/runtime-caps-resolver.d.ts

@@ -28,7 +28,7 @@
  */
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
-import { fetchPrincipalCaps, type ExecutionRuling } from "./sema-registry.js";
+import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 export interface EntitlementsResolverOpts {
     baseUrl: string;

package/dist/runtime-caps-resolver.js

@@ -1,4 +1,4 @@
-import { fetchPrincipalCaps } from "./sema-registry.js";
+import { fetchPrincipalCaps } from "./config-center/facade.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
 const defaultLogger = createLogger();

package/dist/runtime-governance.d.ts

@@ -51,7 +51,7 @@ export type Autonomy = "read-only" | "ask" | "plan" | "auto";
 export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
  *  see {@link VALID_COMMAND_NAME}), AND the `decision` enum. Returns the list of human-readable errors (empty =
- *  OK). Called at config-apply (sema-registry.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
+ *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
  *  {@link compileCommandPolicy}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */

package/dist/runtime-governance.js

@@ -108,7 +108,7 @@ const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
 const VALID_DECISIONS = new Set(["allow", "ask", "deny"]);
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
  *  see {@link VALID_COMMAND_NAME}), AND the `decision` enum. Returns the list of human-readable errors (empty =
- *  OK). Called at config-apply (sema-registry.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
+ *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
  *  {@link compileCommandPolicy}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */

package/dist/sema-registry.d.ts

@@ -10,9 +10,23 @@
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
  *
  * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
- * core brain honors model.baseUrl, absent = "" = boot-env endpoint). TODO remaining: hot-reload
- * of models/roles needs Runner support — today teams hot-reload via the registry, while a models/roles
- * change is logged as "restart to apply".
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
  *
  * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
  * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /
@@ -21,7 +35,7 @@
  */
 export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
 export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
-export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSignal, } from "./config-center/restart-signal.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type RestartSignal, } from "./config-center/restart-signal.js";
 export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
 export type { CenterSkillManifest, CenterMcpServer, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./config-center/types.js";
 //# sourceMappingURL=sema-registry.d.ts.map

package/dist/sema-registry.js

@@ -10,9 +10,23 @@
  *     (core 1.45), so each model/cascade-rung authenticates with its own upstream key.
  *
  * Per-model `baseUrl` IS transported (a catalog model may live on a different gateway;
- * core brain honors model.baseUrl, absent = "" = boot-env endpoint). TODO remaining: hot-reload
- * of models/roles needs Runner support — today teams hot-reload via the registry, while a models/roles
- * change is logged as "restart to apply".
+ * core brain honors model.baseUrl, absent = "" = boot-env endpoint).
+ *
+ * Hot-reload status (复审 2026-07-29 P1-11 — 亲读判定,取代此处旧的 "models/roles are restart-to-apply"
+ * TODO, which went stale when `mutateInPlace` landed):
+ *   - models/roles/roster/teams/projects/autonomy — **HOT**. `applyEffective` mutates `config.models`/
+ *     `config.roles` IN PLACE, and core's Runner reads `this.deps.models/roles` per task off that very
+ *     reference. Both brains re-resolve `model.baseUrl || config.baseUrl` inside `buildRequest()` on every
+ *     call (core 2.1.0 `brain/openai.js` + `brain/anthropic.js`), so a moved gateway takes effect on the
+ *     next task with no restart.
+ *   - the same plane under a **tier-frozen** Runner — deferred, not hot: core expands a PRIVATE catalog copy
+ *     at construction, so `main` defers the whole plane and the `models-tiers` restart slice signals.
+ *   - **`degrade-route`** — the one genuinely boot-frozen catalog consumer left: reactive degrade
+ *     (`MODEL_DEGRADE_REACTIVE`) bakes the target Model + its gateway + its key into the brain composition
+ *     at boot. It cannot be hot-applied without rebuilding the brain, so it is registered on the existing
+ *     restartRequired /health contract instead (see `restart-signal.ts`). Fail-loud beats serving a stale
+ *     gateway silently on the rate-limit path.
+ *   - skills/mcp/scenarios/runtime-gates — restart-to-apply by construction (baked into the boot wiring).
  *
  * (design/158 A13, internal-lossless) This module is now a FACADE: the implementation lives in
  * `src/config-center/` split by responsibility group (HTTP client / EffectiveConfig application /

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -67,7 +67,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^0.0.46",
+    "@sema-agent/sdk": "^1.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",