@sema-agent/server 7.146.0 → 7.147.0

package/dist/boot/memory-consolidation.js

@@ -1,6 +1,5 @@
 import { redactSecrets } from "../trace/redact.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { buildOperatorRosterWayOut } from "../http/principal-gate.js";
 import { memoryMountRootOf, memoryScopeContractOf } from "../memory-scope.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
@@ -279,18 +278,6 @@ export function buildConsolidationValveAudit(input) {
     if (!input.valve.enabled || input.valve.source !== "explicit")
         return { warnings: [] };
     const warnings = [];
-    if (!input.operatorRosterPresent) {
-        warnings.push({
-            tag: "memory_consolidation_valve_unreachable",
-            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve and both admin endpoints are mounted, but " +
-                "this worker has no operator: OPERATOR_PRINCIPALS is EMPTY and OPERATOR_SINGLE_USER is not set — an empty operator list means NO ONE " +
-                "is an operator (it deliberately does not mean 'everyone'), so POST /v1/admin/memory/consolidation/run and GET /v1/admin/memory/consolidation " +
-                "answer 501 capability.operator_principals_required to every caller and capabilities.memoryConsolidationDriver reports false. " +
-                `To fix: ${buildOperatorRosterWayOut()}. With OPERATOR_PRINCIPALS, callers must send a listed principal in the configured principal header; a single-user declaration needs no principal. ` +
-                "(Not a startup refusal: the operator roster is shared by every operator " +
-                "endpoint on this worker, so one valve must not decide whether the whole worker starts.)",
-        });
-    }
     if (!input.hasServiceAuth && !input.allowUnauthedWrites) {
         warnings.push({
             tag: "memory_consolidation_run_credential_gated",

package/dist/boot/org-memory.js

@@ -8,7 +8,7 @@ function collectDeploymentOrgScopes(config) {
         scopes.add(config.memoryScope);
     if (config.requirePrincipal !== true) {
         for (const project of Object.values(config.projects)) {
-            for (const s of project.defaultScopes ?? [])
+            for (const s of project.defaultScopes)
                 if (s.startsWith(ORG_PREFIX))
                     scopes.add(s);
         }
@@ -31,6 +31,7 @@ export function createOrgMemoryAdmissionWiring(opts) {
                 fetchSection: (principal) => fetchPrincipalOrgMemory({ baseUrl: centerLeg.baseUrl, credential }, principal, fetch, centerLeg.worker),
                 grantTtlMs: config.memoryOrgGrantTtlMs,
                 unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
+                logger,
             })).now;
             return { lookup: (principal) => directoryNow().lookup(principal) };
         })()
@@ -44,7 +45,7 @@ export function createOrgMemoryAdmissionWiring(opts) {
     const memoryPlaneLive = config.memoryEngineEnabled && config.memoryEngineBackend !== "file";
     if (directory === undefined && config.requirePrincipal === true && memoryPlaneLive) {
         const orgProjects = Object.entries(config.projects)
-            .filter(([, p]) => (p.defaultScopes ?? []).some((s) => s.startsWith(ORG_PREFIX)))
+            .filter(([, p]) => p.defaultScopes.some((s) => s.startsWith(ORG_PREFIX)))
             .map(([id]) => id);
         if (orgProjects.length > 0) {
             throw new Error(`multi-tenant deployment has org: keys in projects[${orgProjects.join(", ")}].defaultScopes but NO org-memory directory source ` +

package/dist/boot/parked-revive-gate.d.ts

@@ -6,7 +6,7 @@ import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import type { ApprovalExemptionStore } from "../plugins/approval-exemption-store.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
 export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigView, ApprovalBaselineConfigView {
-    readonly remoteExec?: ServiceConfig["remoteExec"];
+    readonly remoteExec: ServiceConfig["remoteExec"];
     /** [ref]④:`executionLaneHomeDir` 读的运维声明(切面必须点名本腿消费的每一个字段,否则窄视图字面量会静默丢掉旋钮)。 */
     readonly remoteExecHomeDir?: ServiceConfig["remoteExecHomeDir"];
     /** host 腿裁决 env 的 cwd 占位根(见下方 `hostGateCwd`)。 */

package/dist/boot/parked-revive-gate.js

@@ -24,7 +24,7 @@ export function createParkedReviveInheritedGate(deps) {
                 env: new DeferredSandboxPathEnv({
                     sessionId: row.sessionId,
                     slots,
-                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec?.provider, leg: "parked_revive" }) },
+                    logger: { warn: (event, fields) => logger.warn(event, { ...(fields ?? {}), lane: config.remoteExec.provider, leg: "parked_revive" }) },
                 }),
                 ...homeBase,
             }

package/dist/boot/reapers.js

@@ -97,7 +97,7 @@ export function startReapers(ctx) {
             logger.info("reaper_swept", { metric, ...labels, count: n });
         }
     };
-    const e2bOrphanProvider = config.remoteExec?.provider === "e2b" && config.remoteExec.orphanReclaim !== false
+    const e2bOrphanProvider = config.remoteExec.provider === "e2b" && config.remoteExec.orphanReclaim !== false
         ? createE2bOrphanSandboxProvider({ apiKey: config.remoteExec.apiKey })
         : undefined;
     let e2bOrphanLastRunMs = Date.now() - E2B_ORPHAN_GRACE_MS;