@sema-agent/server 7.124.0 → 7.125.0

package/dist/web-admin-client/read-warnings.d.ts

@@ -12,7 +12,9 @@
  *
  * **归族判据**(下游两个消费者:候选门 = 非空 ⇒ 这棵树整拒、保 LKG;逐条丢弃面 = 响亮点名、其余照用):每一种告警都是
  * 「写了没生效」,按**失效的颗粒**分:丢的是**一条条目**(`entry-dropped`)⇒ `scope:"entry"` —— 这条条目单独不在,同域其余条目照用,
- * 候选**不**因它整拒;丢的是一个域 / 一组键 / 一个文件 ⇒ `scope:"domain"` —— 候选门错误。(settings-schema 11 起读路径上零抬升臂:
+ * 候选**不**因它整拒;丢的是一个域 / 一组键 / 一份**读的**域文件 ⇒ `scope:"domain"` —— 候选门错误。`config.d` 里**读腿根本不读**的文件
+ * (`unread-config-file`:名字不是域,或是域但不便携 —— `workers.json` / `hosts.json` / 任意非域 `*.json`)⇒ `scope:"unread"` —— 不是
+ * 「读的域判形失败」,候选判官只收读腿读的域;它与逐条丢弃同一「点名不判拒」律(调用方一份文件一行 `config_unread_file`,其余照用)。(settings-schema 11 起读路径上零抬升臂:
  * 此前「值已被收编接受」的两种告警 `hosts-grandfathered` / `legacy-governance-lifted` 随抬升臂一起退役,旧形由一次性迁移改写,
  * 读侧遇旧形一律拒 —— 没有「不入诊断面」的那一族了。)
  *
@@ -24,7 +26,8 @@
  */
 import { z } from "zod";
 import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning } from "@sema-agent/settings-schema";
-/** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`)。 */
+/** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`),
+ *  `"unread"` 进读腿不读的文件面(`unreadFiles`;点名不判拒)。 */
 export type FoldedReadWarning = {
     readonly scope: "domain";
     readonly domain: string;
@@ -35,7 +38,17 @@ export type FoldedReadWarning = {
     readonly entry: string;
     readonly error: string;
     readonly reasonCode: DroppedEntryReasonCode;
+} | ({
+    readonly scope: "unread";
+} & UnreadConfigFile);
+/** `config.d` 里读腿不读的一份文件(本地读腿才有;`why` / `domain` 是契约告警的原值)。 */
+export type UnreadConfigFile = {
+    readonly file: string;
+    readonly why: "not-a-domain" | "non-portable-domain";
+    readonly domain?: string;
 };
+/** `config_unread_file` 一行的体(纯数据;起服 / 刷新 / 迟到起服与 `run-local` 同一体):`dir` = 本地读腿的配置根。 */
+export declare function buildUnreadConfigFileFields(f: UnreadConfigFile, dir: string | undefined): Record<string, unknown>;
 /** 逐条丢弃面的一行(两条读腿的 `droppedEntries` 同形,`config_entry_dropped` 日志行读它):`entry` = 被丢那条的出门形坐标(`models.1`),
  *  `error` = 哪些字段、为什么(人读),`reasonCode` = 为什么丢的**闭集词**(S-1295:settings-schema 铸、原样过境 —— 目录行的
  *  `GET /v1/models.droppedEntries[].reasonCode` 就是这同一个词,取自同一次折叠的同一行)。 */
@@ -60,13 +73,23 @@ export declare function describeSchemaIssueFields(error: unknown): string[];
 /** 契约句子里**值**的位置在本仓诊断面上的写法(一个洞,不回显值;句子的固定词 —— 迁移指路、词表出路、字段名 —— 原样)。 */
 export declare const SCHEMA_OPERAND_HOLE = "\u00ABvalue\u00BB";
 /**
- * 整域失效(`domain-defaulted`)的诊断文案:逐条 issue `坐标: 句子`,句子读 {@link issueSentenceOf}(与逐条丢弃面同一只):带结构化操作数的契约句重铸、
- * 操作数换成 {@link SCHEMA_OPERAND_HOLE};不带的(zod 内建句、退役键墓碑句、迁移指路)原样。读不出 issues 形 ⇒ 退回 {@link errorText}。
+ * 整域失效(`domain-defaulted`)的诊断文案:逐条 issue `坐标: 句子`,句子读 {@link issueSentenceOf}(与逐条丢弃面同一只):custom issue 的结构化句子重铸、
+ * 操作数换成 {@link SCHEMA_OPERAND_HOLE};zod 内建码(含墓碑字段的 `invalid_type`)读 message 原样。读不出 issues 形 ⇒ 退回 {@link errorText}。
  * 为什么不直接用 `error.message`:zod 4 的 message 是整份 issues 的 JSON —— 本地腿出口的引号段指纹(`redactConfigError`)会把它从第一个
  * 引号到最后一个引号整段吞掉,契约拒句里点名的迁移 id(「旧形读写两面响亮拒、拒句点名迁移 id」)就到不了运维眼前。
  */
 export declare function describeDomainIssues(error: unknown): string;
-/** 一条读告警 → 它的诊断面(每一种都进:见文件头「归族判据」)。 */
+/** 一条读告警 → 它的诊断面(每一种都进:见文件头「归族判据」)。按 kind 的重载只是让调用方拿到窄型(`unread` 一面没有 `error` 句)。 */
+export declare function foldEffectiveReadWarning(w: Extract<EffectiveReadWarning, {
+    kind: "unread-config-file";
+}>): Extract<FoldedReadWarning, {
+    scope: "unread";
+}>;
+export declare function foldEffectiveReadWarning(w: Exclude<EffectiveReadWarning, {
+    kind: "unread-config-file";
+}>): Exclude<FoldedReadWarning, {
+    scope: "unread";
+}>;
 export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning;
 /**
  * 🔴 S-712 / S-1295 —— **被丢目录条目的载体行**(载体 = `EffectiveConfig.models.droppedCatalogEntries`,读腿铸,随 effective 走 —— 盘上 LKG
@@ -114,6 +137,7 @@ export declare function splitFoldedReadWarnings(warnings: readonly EffectiveRead
     }>;
     droppedEntries: DroppedConfigEntry[];
     droppedCatalogEntries: DroppedCatalogEntry[];
+    unreadFiles: UnreadConfigFile[];
 };
 /** 把本次读交出的目录载体挂上 effective 的模型域(两腿同一只;空 ⇒ 不挂键)。 */
 export declare function withDroppedCatalogEntries<E extends {

package/dist/web-admin-client/read-warnings.js

@@ -1,5 +1,14 @@
 import { z } from "zod";
 import { DROPPED_ENTRY_REASON_CODES, formatConfigPath, isDisclosableIdentity, renderQuotedSentence, } from "@sema-agent/settings-schema";
+export function buildUnreadConfigFileFields(f, dir) {
+    return {
+        ...(dir !== undefined ? { dir } : {}),
+        file: f.file,
+        why: f.why,
+        ...(f.domain !== undefined ? { domain: f.domain } : {}),
+        note: "config.d holds a file the local read never reads (not a domain, or a domain that is not portable) — it is not applied and does not block the candidate; move it out of config.d if it is stray",
+    };
+}
 export function describeSchemaIssues(error) {
     const issues = schemaIssuesOf(error);
     if (issues === undefined)
@@ -13,8 +22,13 @@ function issueCoordinateOf(raw) {
     return Array.isArray(p) && p.length > 0 ? formatConfigPath(p) : undefined;
 }
 function issueSentenceOf(raw) {
-    const message = typeof raw === "object" && raw !== null ? raw.message : undefined;
-    return contractSentenceOf(raw) ?? (typeof message === "string" ? message : "(unreadable issue)");
+    const issue = typeof raw === "object" && raw !== null ? raw : {};
+    if (issue.code === "custom")
+        return contractSentenceOf(raw) ?? sentencelessCustomIssue(issueCoordinateOf(raw));
+    return typeof issue.message === "string" ? issue.message : "(unreadable issue)";
+}
+function sentencelessCustomIssue(at) {
+    return `(issue code "custom" at ${at ?? "(entry)"} carries no contract sentence — its message is withheld)`;
 }
 function contractSentenceOf(raw) {
     const params = (typeof raw === "object" && raw !== null ? raw.params : undefined);
@@ -74,7 +88,7 @@ export function foldEffectiveReadWarning(w) {
         case "unknown-keys-carried":
             return { scope: "domain", domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
         case "unread-config-file":
-            return { scope: "domain", domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
+            return { scope: "unread", file: w.file, why: w.why, ...(w.domain !== undefined ? { domain: w.domain } : {}) };
         default: {
             const never = w;
             throw new Error(`unhandled EffectiveReadWarning kind: ${JSON.stringify(never)}`);
@@ -109,6 +123,7 @@ export function splitFoldedReadWarnings(warnings) {
     const domainErrors = [];
     const droppedEntries = [];
     const droppedCatalogEntries = [];
+    const unreadFiles = [];
     for (const w of warnings) {
         const f = foldEffectiveReadWarning(w);
         switch (f.scope) {
@@ -124,13 +139,18 @@ export function splitFoldedReadWarnings(warnings) {
                 }
                 break;
             }
+            case "unread": {
+                const { scope: _scope, ...file } = f;
+                unreadFiles.push(file);
+                break;
+            }
             default: {
                 const never = f;
                 throw new Error(`unhandled folded read-warning scope: ${JSON.stringify(never)}`);
             }
         }
     }
-    return { domainErrors, droppedEntries, droppedCatalogEntries };
+    return { domainErrors, droppedEntries, droppedCatalogEntries, unreadFiles };
 }
 export function withDroppedCatalogEntries(effective, rows) {
     if (rows.length === 0 || effective.models === undefined)

package/dist/web-admin-client/stage-limits.js

@@ -1,5 +1,6 @@
 import { LIMITS_HTTP_FLOORS } from "../config.js";
 import { checkCrossInvariants } from "../config-invariants.js";
+import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "../observability/cost-quota.js";
 import { BATCH1_LIMIT_KEYS, DEFERRED_LIMIT_KEYS } from "./hot-keys-registry.js";
 const INFRA_RATE_KEYS = ["toolCallMicroUsd", "sandboxSecMicroUsd", "egressGbMicroUsd"];
 const okNum = (v) => typeof v === "number" && Number.isFinite(v);
@@ -8,7 +9,9 @@ const positive = (key, v) => okNum(v) && v > 0 ? { ok: true, value: v } : { ok:
 const VALIDATORS = {
     rateLimitPerMin: (v) => atLeast("rateLimitPerMin", v, 0),
     maxPrincipalCostUsd: (v) => atLeast("maxPrincipalCostUsd", v, 0),
-    costQuotaWindowSec: (v) => positive("costQuotaWindowSec", v),
+    costQuotaWindowSec: (v) => okNum(v) && costQuotaWindowSecInRange(v)
+        ? { ok: true, value: v }
+        : { ok: false, reason: `costQuotaWindowSec must be a finite number in [${COST_QUOTA_WINDOW_SEC_RANGE.min}, ${COST_QUOTA_WINDOW_SEC_RANGE.max}] (seconds)` },
     maxTaskCostUsd: (v) => atLeast("maxTaskCostUsd", v, 0),
     maxTaskTokens: (v) => atLeast("maxTaskTokens", v, 0),
     infraCostRates: (v, baseline) => {

package/dist/workspace-space.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Workspace persistence by **space** (k8s lane) — the closed word set, the defaults, the retention domain and
+ * the policy shape (pure leaf: no value imports, so `config.ts`, the capability fact and the adapter in `plugins/` can
+ * all import it without a load cycle). The effective policy has ONE reading: the capability fact `workspaceSpace`
+ * (`src/capability-facts.ts`).
+ *
+ * The law (one fact, one seat): a k8s pod's `/workspace` is durable across runs as an object-store "space" owned by the
+ * session's OCCUPANT (its incarnation, `session-incarnation.ts`) — `<keyPrefix>/<incarnation>/space/<snapshotId>.tar.gz`
+ * plus one small `<keyPrefix>/<incarnation>/space/latest` pointer whose body is the newest snapshotId (the durable-suspend
+ * archives of parked runs stay flat under `<keyPrefix>/<sessionId>/` and are never pruned; why each lane has the partition
+ * it has: `plugins/remote-env-k8s.ts`, `K8sEnvConfig`). `connect()` restores the pointer's snapshot through the adapter's one
+ * tar download (shared with `resumeVM`); `destroy()` snapshots through its one tar upload (shared with `suspendVM`),
+ * moves the pointer, then keeps the newest `keep` snapshots inside `space/`. No index table: the bucket is the only record.
+ *
+ * Facility dependence: without a snapshot store (`s3Snapshot`) there is nothing to persist into — the fact is
+ * unavailable and the lane behaves exactly as before (fresh pod, empty `/workspace` every run).
+ */
+/** `WORKSPACE_PERSIST` closed set. `space` = the k8s workspace persists per space (the session occupant); `off` = a fresh
+ *  workspace every run. */
+export declare const WORKSPACE_PERSIST_WORDS: readonly ["space", "off"];
+export type WorkspacePersist = (typeof WORKSPACE_PERSIST_WORDS)[number];
+/**
+ * Default `off` — persistence is opt-in. Why: the run-end commit's ordering against the NEXT run rests on an object-store
+ * marker the commit itself writes, and that PUT can land after the engine's teardown bound; then the next run restores the
+ * previous-but-one snapshot and its own commit later overwrites the late one (the preceding run's changes are lost). That
+ * window closes only with a commit fence held in server-side durable state, written before the session's active-run slot
+ * is released; until then a deployment turns persistence on knowing the window (USAGE §9.3b).
+ */
+export declare const WORKSPACE_PERSIST_DEFAULT: WorkspacePersist;
+/** `WORKSPACE_SNAPSHOT_KEEP` — snapshots kept per space key (closed integer domain; out of domain refuses boot). */
+export declare const WORKSPACE_SNAPSHOT_KEEP_DEFAULT = 3;
+export declare const WORKSPACE_SNAPSHOT_KEEP_RANGE: {
+    readonly min: 1;
+    readonly max: 50;
+};
+/** The effective space policy — the `workspaceSpace` fact's witness and the value of `GET /v1/capabilities.workspaceSync`. */
+export interface WorkspaceSyncCapability {
+    persist: WorkspacePersist;
+    keep: number;
+}
+//# sourceMappingURL=workspace-space.d.ts.map

package/dist/workspace-space.js

@@ -0,0 +1,5 @@
+export const WORKSPACE_PERSIST_WORDS = ["space", "off"];
+export const WORKSPACE_PERSIST_DEFAULT = "off";
+export const WORKSPACE_SNAPSHOT_KEEP_DEFAULT = 3;
+export const WORKSPACE_SNAPSHOT_KEEP_RANGE = { min: 1, max: 50 };
+//# sourceMappingURL=workspace-space.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.124.0",
+  "version": "7.125.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.48.0",
-    "@sema-agent/settings-schema": "11.2.0",
+    "@sema-agent/settings-schema": "11.3.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -80,7 +80,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "15.3.0",
+    "@sema-agent/sdk": "20.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",