@sema-agent/server 7.115.0 → 7.116.0

package/dist/http/routes/rules.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { sendJson, sendError, httpErrorCode } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendUnauthorized } from "../principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
@@ -93,13 +94,14 @@ export async function handleRules(req, res, match, ctx) {
         sendUnauthorized(res, "identity");
         return;
     }
-    const lane = deps.ruleConsent;
-    if (lane === undefined) {
+    const ruleFact = facts.ruleLane(deps);
+    if (!ruleFact.available) {
         sendError(res, 501, "capability.rule_store_required", "this deployment has no permission-rule store wired");
         return;
     }
+    const lane = ruleFact.lane;
     if (match.decl.id === "rules-list") {
-        await handleRuleList(res, match.search, principal, lane, deps.config.operatorPrincipals);
+        await handleRuleList(res, match.search, principal, lane, deps.config);
         return;
     }
     let rawBody;
@@ -115,11 +117,11 @@ export async function handleRules(req, res, match, ctx) {
         return;
     }
     if (match.decl.id === "rules-revoke") {
-        await handleRuleRevoke(res, rawBody, principal, lane, deps.config.operatorPrincipals);
+        await handleRuleRevoke(res, rawBody, principal, lane, deps.config);
         return;
     }
     if (match.decl.id === "rules-write") {
-        await handleRuleWrite(res, rawBody, principal, lane, deps.config.operatorPrincipals);
+        await handleRuleWrite(res, rawBody, principal, lane, deps.config);
         return;
     }
     if (match.decl.id === "rules-local-import-prepare") {
@@ -201,19 +203,29 @@ export async function handleRules(req, res, match, ctx) {
     }
     sendJson(res, 200, { result: redeemed.result });
 }
-function resolveTargetPrincipal(requested, caller, operatorPrincipals) {
+function resolveTargetPrincipal(requested, caller, config) {
     if (requested === undefined || requested === caller)
         return { ok: true, principal: caller };
-    if (!explicitOperatorOk(caller, operatorPrincipals))
-        return { ok: false };
+    if (!facts.operatorLane({ config }).available)
+        return { ok: false, why: "operator_principals_empty" };
+    if (!explicitOperatorOk(caller, config.operatorPrincipals))
+        return { ok: false, why: "not_operator" };
     return { ok: true, principal: requested };
 }
-async function handleRuleList(res, search, caller, lane, operatorPrincipals) {
+async function handleRuleList(res, search, caller, lane, config) {
     const q = new URLSearchParams(search);
-    const target = resolveTargetPrincipal(q.get("principal") ?? undefined, caller, operatorPrincipals);
+    const target = resolveTargetPrincipal(q.get("principal") ?? undefined, caller, config);
     if (!target.ok) {
-        sendError(res, 403, "auth.operator_only", "reading another principal's rules is an operator-only action");
-        return;
+        switch (target.why) {
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            case "not_operator":
+                sendError(res, 403, "auth.operator_only", "reading another principal's rules is an operator-only action");
+                return;
+            default:
+                return assertNever(target.why);
+        }
     }
     const limit = Math.min(RULES_PAGE_MAX, Math.max(1, Number(q.get("limit") ?? RULES_PAGE_DEFAULT) || RULES_PAGE_DEFAULT));
     const scopeRaw = q.get("scope");
@@ -280,7 +292,7 @@ function sendRuleWriteFailure(res, verb, committed) {
         }
     }
 }
-async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
+async function handleRuleWrite(res, rawBody, caller, lane, config) {
     const parsed = RuleIdentityBodySchema.safeParse(rawBody);
     if (!parsed.success) {
         sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
@@ -296,10 +308,18 @@ async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
         sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
         return;
     }
-    const target = resolveTargetPrincipal(parsed.data.principal, caller, operatorPrincipals);
+    const target = resolveTargetPrincipal(parsed.data.principal, caller, config);
     if (!target.ok) {
-        sendError(res, 403, "auth.operator_only", "writing another principal's rules is an operator-only action");
-        return;
+        switch (target.why) {
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            case "not_operator":
+                sendError(res, 403, "auth.operator_only", "writing another principal's rules is an operator-only action");
+                return;
+            default:
+                return assertNever(target.why);
+        }
     }
     const written = await lane.writeRule({ principal: target.principal, behavior, rule: parsed.data.rule, scope });
     switch (written.status) {
@@ -326,7 +346,7 @@ async function handleRuleWrite(res, rawBody, caller, lane, operatorPrincipals) {
         }
     }
 }
-async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals) {
+async function handleRuleRevoke(res, rawBody, caller, lane, config) {
     const parsed = RuleIdentityBodySchema.safeParse(rawBody);
     if (!parsed.success) {
         sendError(res, 400, "request.body_shape", "body must be {behavior, rule, scope} with an optional principal");
@@ -337,10 +357,18 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
         sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
         return;
     }
-    const target = resolveTargetPrincipal(parsed.data.principal, caller, operatorPrincipals);
+    const target = resolveTargetPrincipal(parsed.data.principal, caller, config);
     if (!target.ok) {
-        sendError(res, 403, "auth.operator_only", "revoking another principal's rules is an operator-only action");
-        return;
+        switch (target.why) {
+            case "operator_principals_empty":
+                sendOperatorPrincipalsRequired(res);
+                return;
+            case "not_operator":
+                sendError(res, 403, "auth.operator_only", "revoking another principal's rules is an operator-only action");
+                return;
+            default:
+                return assertNever(target.why);
+        }
     }
     const outcome = await lane.removeRule({ principal: target.principal, behavior: parsed.data.behavior, rule: parsed.data.rule, scope });
     switch (outcome.status) {

package/dist/http/routes/run-memory-capture.js

@@ -4,6 +4,7 @@ import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
 const BodySchema = z.object({ reason: z.string().min(1).max(500).optional() }).strict();
 export async function handleRunMemoryCapture(req, res, match, ctx) {
     const { deps } = ctx;
@@ -11,10 +12,12 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
         case "run-memory-capture-optout": {
             if (ctx.helpers.rateLimited(req, res))
                 return;
-            if (!deps.runStore) {
+            const runs = facts.durableRuns(deps);
+            if (!runs.available) {
                 sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
+            const runStore = runs.runStore;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendPrincipalRefusal(res, req, deps.config);
@@ -26,7 +29,7 @@ export async function handleRunMemoryCapture(req, res, match, ctx) {
                 sendError(res, 400, "request.body_shape", "body must be {} or { reason: string (non-empty, at most 500 chars) } — the session memory-capture opt-out verb takes no other keys");
                 return;
             }
-            const run = await deps.runStore.getRun(taskId);
+            const run = await runStore.getRun(taskId);
             if (!run) {
                 sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
                 return;