@sema-agent/server 7.137.0 → 7.139.0

package/dist/http/device-placement.js

@@ -1,145 +0,0 @@
-import { createCodedHttpError, ssoVerifiedScope } from "../security.js";
-import { gatedPrincipal } from "./principal-gate.js";
-import { DEVICE_ERROR_CODES, assertDeviceIdShape, } from "../device-store.js";
-import { buildDeviceRejection } from "../device-enrollment.js";
-import { releaseClaimedRun } from "./claimed-run.js";
-import { refusalBody } from "./refusal-body.js";
-export function deviceOwnerDomainOf(req, config) {
-    const subject = gatedPrincipal(req, config);
-    if (subject === undefined)
-        return undefined;
-    const tenant = ssoVerifiedScope(req);
-    if (tenant === undefined)
-        return undefined;
-    return { tenant, subject };
-}
-function asHttpError(rej) {
-    return createCodedHttpError(rej.status, rej.code, rej.message);
-}
-function registryUnavailable() {
-    return buildDeviceRejection(DEVICE_ERROR_CODES.NOT_BOUND, "the device binding for this session could not be resolved (the device registry is unavailable) — refusing rather than running on an unverified device");
-}
-export async function resolveDevicePlacementIntent(args) {
-    const laneIsDevice = args.config.remoteExec?.provider === "device";
-    const requested = args.deviceId;
-    if (!laneIsDevice) {
-        if (requested !== undefined) {
-            throw createCodedHttpError(400, "request.precondition_unmet", "deviceId is only accepted on a deployment that executes on the user's own device (REMOTE_EXEC=device) — this deployment does not, so binding this session to a device id would be a declaration that never took effect");
-        }
-        return undefined;
-    }
-    if (!args.store || !args.enrollment) {
-        throw createCodedHttpError(501, "capability.device_lane_required", "device execution is selected for this deployment but its stores are not wired on this replica — refusing to admit a submit that would execute nowhere");
-    }
-    if (args.req === undefined) {
-        throw createCodedHttpError(403, "auth.forbidden", "device placement needs a verified caller domain and this leg carries no request context");
-    }
-    const owner = deviceOwnerDomainOf(args.req, args.config);
-    if (owner === undefined) {
-        throw createCodedHttpError(403, "auth.forbidden", "device placement needs a caller domain: this credential carries no verified tenant scope claim (registry auth-bridge JWT `scope`) — connect through the registry auth bridge");
-    }
-    if (args.rootSessionId === undefined || args.rootSessionId === "") {
-        throw createCodedHttpError(400, "request.precondition_unmet", "device execution binds a device to a ROOT SESSION, so this submit needs a session — none was resolved for it");
-    }
-    if (requested !== undefined) {
-        if (typeof requested !== "string") {
-            throw createCodedHttpError(400, "request.field_invalid", "deviceId must be a string (the device id returned by POST /v1/devices/enroll)");
-        }
-        try {
-            assertDeviceIdShape(requested);
-        }
-        catch {
-            throw createCodedHttpError(400, "request.field_invalid", "deviceId is not a valid device id (byte-exact key: non-empty, no control characters or surrounding whitespace, at most 64 bytes)");
-        }
-    }
-    const requestedDeviceId = requested;
-    let admitted;
-    try {
-        admitted = await args.enrollment.admitSession({
-            rootSessionId: args.rootSessionId,
-            requester: owner,
-            ...(requestedDeviceId === undefined ? {} : { requestedDeviceId }),
-        });
-    }
-    catch {
-        throw asHttpError(registryUnavailable());
-    }
-    if (admitted.ok)
-        return { rootSessionId: args.rootSessionId, owner, admittedDeviceId: admitted.value.deviceId, firstBind: false };
-    if (admitted.reject.code !== DEVICE_ERROR_CODES.NOT_BOUND || requestedDeviceId === undefined)
-        throw asHttpError(admitted.reject);
-    let view;
-    try {
-        view = await args.store.readDeviceForAdmission(requestedDeviceId, owner);
-    }
-    catch {
-        throw asHttpError(registryUnavailable());
-    }
-    if (!view)
-        throw asHttpError(buildDeviceRejection(DEVICE_ERROR_CODES.NOT_FOUND, "device not found"));
-    if (view.row.status === "revoked")
-        throw asHttpError(buildDeviceRejection(DEVICE_ERROR_CODES.REVOKED, "device has been revoked"));
-    if (!view.online)
-        throw asHttpError(buildDeviceRejection(DEVICE_ERROR_CODES.OFFLINE, "device is not connected"));
-    return { rootSessionId: args.rootSessionId, owner, admittedDeviceId: requestedDeviceId, firstBind: true };
-}
-export function placementWriteDeadlineMs(runStaleSec) {
-    const stale = typeof runStaleSec === "number" && Number.isFinite(runStaleSec) && runStaleSec > 0 ? runStaleSec : 120;
-    return Math.min(15_000, Math.max(1_000, Math.floor((stale * 1000) / 4)));
-}
-export async function commitPlacement(ctx, runStore, taskId, intent) {
-    if (intent === undefined)
-        return null;
-    const enrollment = ctx.deviceEnrollment;
-    const releaseRun = (why) => releaseClaimedRun(runStore, taskId, why, (err, step) => {
-        ctx.logger?.warn("device_placement_run_release_failed", { taskId, step, err: err instanceof Error ? err.message : String(err) });
-        ctx.metrics?.inc("device_placement_run_release_failed_total");
-    });
-    if (!enrollment) {
-        await releaseRun("device placement could not be committed: the device lane's admission chain is not wired");
-        throw new Error("commitPlacement: a device placement intent was minted without a DeviceEnrollment — assembly bug (both are read from the same ServiceDeps)");
-    }
-    const deadlineMs = placementWriteDeadlineMs(ctx.config?.runStaleSec);
-    const withDeadline = async (work) => {
-        let timer;
-        try {
-            return await Promise.race([
-                work,
-                new Promise((_resolve, reject) => {
-                    timer = setTimeout(() => reject(new Error(`device placement store call exceeded ${deadlineMs}ms`)), deadlineMs);
-                    timer.unref?.();
-                }),
-            ]);
-        }
-        finally {
-            if (timer)
-                clearTimeout(timer);
-        }
-    };
-    let rejection = null;
-    try {
-        if (intent.firstBind) {
-            const bound = await withDeadline(enrollment.bindPlacement({ rootSessionId: intent.rootSessionId, deviceId: intent.admittedDeviceId, requester: intent.owner }));
-            if (!bound.ok)
-                rejection = bound.reject;
-        }
-        else {
-            const readmitted = await withDeadline(enrollment.admitSession({ rootSessionId: intent.rootSessionId, requester: intent.owner, requestedDeviceId: intent.admittedDeviceId }));
-            if (!readmitted.ok)
-                rejection = readmitted.reject;
-        }
-    }
-    catch (err) {
-        ctx.logger?.warn("device_placement_commit_failed", { rootSessionId: intent.rootSessionId, firstBind: intent.firstBind, deadlineMs, err: err instanceof Error ? err.message : String(err) });
-        rejection = registryUnavailable();
-    }
-    if (rejection === null)
-        return null;
-    ctx.metrics?.inc("device_typed_rejects_total", { errorCode: rejection.code });
-    await releaseRun(`device placement rejected: [${rejection.code}] ${rejection.message}`);
-    return rejection;
-}
-export function devicePlacementErrorBody(rej) {
-    return refusalBody({ errorCode: rej.code, message: rej.message });
-}
-//# sourceMappingURL=device-placement.js.map

package/dist/http/mcp-remote-text.d.ts

@@ -1,5 +0,0 @@
-/** 远端可控自由文本在这几面上的长度上界(字符)。 */
-export declare const MCP_REMOTE_TEXT_MAX = 200;
-/** 引擎铸过的 MCP 远端失败句 → 本服务出口的形:引擎没抹的段过本仓脱敏器、引擎的记号原样,截到 {@link MCP_REMOTE_TEXT_MAX}。 */
-export declare function redactMcpRemoteText(text: string): string;
-//# sourceMappingURL=mcp-remote-text.d.ts.map

package/dist/http/mcp-remote-text.js

@@ -1,7 +0,0 @@
-import { redactSecrets } from "../trace/redact.js";
-const ENGINE_REDACTION_MARK = "[redacted]";
-export const MCP_REMOTE_TEXT_MAX = 200;
-export function redactMcpRemoteText(text) {
-    return text.split(ENGINE_REDACTION_MARK).map((part) => redactSecrets(part)).join(ENGINE_REDACTION_MARK).slice(0, MCP_REMOTE_TEXT_MAX);
-}
-//# sourceMappingURL=mcp-remote-text.js.map