@sema-agent/server 7.147.0 → 7.149.0

package/dist/runtime-governance.js

@@ -1,5 +1,5 @@
 import { clampPermissionMode, combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, modePolicyOf, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
-import { AUTONOMY_MODES, COMMAND_DECISIONS } from "@sema-agent/settings-schema";
+import { AUTONOMY_MODES, COMMAND_DECISIONS, GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
@@ -25,7 +25,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
         },
     };
 }
-const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
+function commandNameRefused(command) {
+    return GovernanceConfig.safeParse({ commandPolicy: [{ command, decision: COMMAND_DECISIONS[0] }] }).error?.issues.some((issue) => issue.path[2] === "command") ?? false;
+}
 function isCommandDecision(raw) {
     return typeof raw === "string" && COMMAND_DECISIONS.includes(raw);
 }
@@ -39,7 +41,7 @@ export function validateCommandRules(rules) {
             continue;
         }
         const { command, decision } = r;
-        if (typeof command !== "string" || !VALID_COMMAND_NAME.test(command)) {
+        if (commandNameRefused(command)) {
             errors.push(`commandPolicy command "${String(command)}" is not a bare argv[0] name — core matches the EXACT command name (no glob/path/operators). ` +
                 `Use e.g. "git" not "git*"; to gate sub-commands or pipes, deny the interpreter ("sh"/"bash") + rely on the sandbox.`);
         }

package/dist/sealed-key-layout.d.ts

@@ -1,10 +1,11 @@
 /**
- * 钥匙保管目录的布局常量 —— 引擎建目录、建停驻行封签子目录时用的**唯一**值(`src/sealed-key.ts` 读它们)。
- * 钥匙文件的权限位不在这里:它就是本服务文件的那一个值 `plugins/owner-only-file-mode.ts` 的 `OWNER_ONLY_FILE_MODE`(部署事实同读它)。
- *
- * 单独成一只零依赖的叶子模块:随包部署事实 `deploy/facts/sealed-key.json`(`src/deploy-facts.ts` 投影、`scripts/gen-deploy-lanes.ts` 生成)
- * 读的是同一份值,生成器不必为了三个常量把整只保管模块(libsodium / 中心上报)装载进来。
+ * 保管目录的**唯一解析**:`SEALED_KEY_DIR`(配置席 `sealedKeyDir`,唯一 env 读点在 `config.ts`)或缺省 `<数据根>/sealed-key`。
+ * 两个读者同读这一只:起服第 2 段建保管店(`boot/web-admin.ts`),与店的持久性判者取证(`store-posture.ts` 的三根之一,`boot/store-evidence.ts` 递路径)。
  */
+export declare function sealedKeyDirOf(config: {
+    readonly sealedKeyDir?: string;
+    readonly localDataRoot?: string;
+}, localRoot: string): string;
 /** 保管目录的权限位:每次建店都 `mkdir` + `chmod` 成它(目录预先存在时 `mkdir` 的 mode 不生效,所以另 `chmod` 一次)。 */
 export declare const SEALED_KEY_DIR_MODE = 448;
 /**
@@ -13,4 +14,10 @@ export declare const SEALED_KEY_DIR_MODE = 448;
  * 放在模型钥匙目录之下是为了「多副本共享 / 跨重启持久」只有一个目录要管(整个保管目录);模型钥匙店只读这一层的 `*.json`,子目录不进它的视野。
  */
 export declare const CHECKPOINT_CTX_KEY_SUBDIR = "checkpoint-ctx-keys";
+/**
+ * 首把钥匙的**创建口**的互斥文件名(在保管目录里,`<保管目录>/.keygen.lock`):目录里一把可装载的钥匙都没有时,谁以 `wx`(`O_CREAT | O_EXCL`)独占建成它,谁生成并发布那一把;
+ * 发布之后(或失败退出时)删除。不以 `.json` 结尾 ⇒ 装载不会把它当钥匙文件,目录里恒不留它(崩溃在生成中途的极窄窗口除外 —— 那时拒句点名这个文件的路径)。
+ * 模型钥匙目录与它之下的 {@link CHECKPOINT_CTX_KEY_SUBDIR} 各是一只目录、各有一把自己的锁。
+ */
+export declare const KEYGEN_LOCK_FILE = ".keygen.lock";
 //# sourceMappingURL=sealed-key-layout.d.ts.map

package/dist/sealed-key-layout.js

@@ -1,3 +1,8 @@
+import { join } from "node:path";
+export function sealedKeyDirOf(config, localRoot) {
+    return config.sealedKeyDir ?? join(config.localDataRoot ?? localRoot, "sealed-key");
+}
 export const SEALED_KEY_DIR_MODE = 0o700;
 export const CHECKPOINT_CTX_KEY_SUBDIR = "checkpoint-ctx-keys";
+export const KEYGEN_LOCK_FILE = ".keygen.lock";
 //# sourceMappingURL=sealed-key-layout.js.map

package/dist/sealed-key.d.ts

@@ -73,14 +73,24 @@ export declare class SealedKeyPublicKeyRefusedError extends Error {
  * 前置:libsodium 已就绪(三处调用方都先等过它);没就绪 ⇒ 当场抛普通错误(不是判决)。
  */
 export declare function judgeSealedKeyPublicKey(publicKeyB64: string): Uint8Array;
+/** {@link ensureSealedKeyStore} 的选项。 */
+export interface EnsureSealedKeyStoreOptions {
+    /** 目录里没有钥匙、别人正拿着创建互斥时,最多等多久(毫秒;缺省 15 s)。测试缝;生产不设。 */
+    readonly genesisLockWaitMs?: number;
+}
 /**
  * Load every keypair under `dir` (creating dir + ONE fresh keypair when none exist) and return the
  * custody store. Invalid/corrupt files are skipped with a warn (they may be an OLD format or a
  * half-write — deleting operator key material on a parse error would destroy decryptability, so we
  * never do; we just don't serve them). Throws only when the store cannot exist at all (fs errors,
- * zero loadable keys AND generation failed).
+ * zero loadable keys AND generation failed, or another process holds the key-creation lock past the wait).
+ *
+ * **首把钥匙只有一个创建口**(共享卷上多个副本在空目录上同时首启,全体只出一把):一把可装载的钥匙都没有 ⇒ 取创建互斥({@link takeKeygenLock},`wx` 独占);
+ * 拿到的那一个**再读一次目录**(读目录到拿互斥之间别人可能已发布)—— 仍空才生成并发布({@link mintFirstKey}),然后撤互斥;没拿到(`EEXIST`)⇒ 重读目录:
+ * 有钥匙了就采用,没有就隔 {@link KEYGEN_LOCK_POLL_MS} 再读,等到 `genesisLockWaitMs` 仍没有 ⇒ 响亮拒({@link keygenLockTimeout}),**不**越过别人的互斥自己生成。
+ * 互斥只在「目录里没有可装载的钥匙」时被问到:已有钥匙的目录(含上次崩溃遗留互斥文件的)起服零等待;共享卷须提供原子的 `O_EXCL` 独占创建(本地盘、NFSv3+、常见 RWX 存储类满足)。
  */
-export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Promise<SealedKeyStore>;
+export declare function ensureSealedKeyStore(dir: string, logger?: Logger, opts?: EnsureSealedKeyStoreOptions): Promise<SealedKeyStore>;
 declare const checkpointCtxKeyStoreBrand: unique symbol;
 /**
  * 停驻行封签那一域的保管店(品牌型):读口与 {@link SealedKeyStore} 同形,型不同 —— {@link createCheckpointCtxSealing} 只收它,模型钥匙那只店交进去是 tsc 错

package/dist/sealed-key.js

@@ -1,15 +1,16 @@
 import { createHash } from "node:crypto";
-import { chmod, readdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, open, readdir, readFile, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { ensureDir } from "@sema-agent/core";
 import _sodium from "libsodium-wrappers";
-import { CHECKPOINT_CTX_KEY_SUBDIR, SEALED_KEY_DIR_MODE } from "./sealed-key-layout.js";
-import { OWNER_ONLY_FILE_MODE } from "./plugins/owner-only-file-mode.js";
+import { CHECKPOINT_CTX_KEY_SUBDIR, KEYGEN_LOCK_FILE, SEALED_KEY_DIR_MODE } from "./sealed-key-layout.js";
+import { OWNER_ONLY_FILE_MODE, atomicWriteFileAsync } from "./plugins/owner-only-file-mode.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { createCenterCredentialSource } from "./center-credential.js";
 import { centerFetch } from "./web-admin-client/center-request.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { CHECKPOINT_CTX_SEAL_ALG } from "./http/checkpoint-ctx.js";
+import { readUpstreamJson } from "./upstream-body.js";
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
 const SEAL_OVERHEAD_BYTES = 48;
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
@@ -61,12 +62,10 @@ export function judgeSealedKeyPublicKey(publicKeyB64) {
     }
     return bytes;
 }
-export async function ensureSealedKeyStore(dir, logger) {
-    await _sodium.ready;
+async function scanKeyDir(dir) {
     const sodium = _sodium;
-    ensureDir(dir);
-    await chmod(dir, SEALED_KEY_DIR_MODE);
     const keys = new Map();
+    const notes = [];
     for (const name of (await readdir(dir)).filter((n) => n.endsWith(".json")).sort()) {
         const path = join(dir, name);
         try {
@@ -79,34 +78,123 @@ export async function ensureSealedKeyStore(dir, logger) {
             if (privateKey.length !== sodium.crypto_box_SECRETKEYBYTES)
                 throw new Error("bad key length");
             if (name !== `${raw.publicKeyId}.json`)
-                logger?.warn("sealed_key_filename_drift", { file: name, publicKeyId: raw.publicKeyId, note: "content publicKeyId wins; rename the file to silence this" });
+                notes.push({ msg: "sealed_key_filename_drift", fields: { file: name, publicKeyId: raw.publicKeyId, note: "content publicKeyId wins; rename the file to silence this" } });
             if (keys.has(raw.publicKeyId)) {
-                logger?.warn("sealed_key_duplicate_id", { file: name, publicKeyId: raw.publicKeyId, note: "duplicate publicKeyId — keeping the first, skipping this file" });
+                notes.push({ msg: "sealed_key_duplicate_id", fields: { file: name, publicKeyId: raw.publicKeyId, note: "duplicate publicKeyId — keeping the first, skipping this file" } });
                 continue;
             }
             keys.set(raw.publicKeyId, { publicKey, privateKey, publicKeyB64: raw.publicKey, createdAt: typeof raw.createdAt === "string" ? raw.createdAt : "" });
         }
         catch (err) {
-            logger?.warn("sealed_key_file_unreadable", { file: path, errKind: err instanceof Error ? err.name : "unknown", ...(err instanceof SealedKeyPublicKeyRefusedError ? { flaw: err.flaw } : {}), note: "skipped (NOT deleted) — ciphertexts sealed for this key will fail loud per-model" });
+            notes.push({
+                msg: "sealed_key_file_unreadable",
+                fields: { file: path, errKind: err instanceof Error ? err.name : "unknown", ...(err instanceof SealedKeyPublicKeyRefusedError ? { flaw: err.flaw } : {}), note: "skipped (NOT deleted) — ciphertexts sealed for this key will fail loud per-model" },
+            });
         }
     }
-    if (keys.size === 0) {
-        const kp = sodium.crypto_box_keypair();
-        const publicKeyB64 = Buffer.from(kp.publicKey).toString("base64");
-        const record = {
-            v: 1,
-            alg: SEALED_KEY_ALG,
-            publicKeyId: deriveKeyId(kp.publicKey),
-            publicKey: publicKeyB64,
-            privateKey: Buffer.from(kp.privateKey).toString("base64"),
-            createdAt: new Date().toISOString(),
-        };
-        const path = join(dir, `${record.publicKeyId}.json`);
-        await writeFile(path, JSON.stringify(record, null, 2) + "\n", { mode: OWNER_ONLY_FILE_MODE });
-        await chmod(path, OWNER_ONLY_FILE_MODE);
-        keys.set(record.publicKeyId, { publicKey: kp.publicKey, privateKey: kp.privateKey, publicKeyB64, createdAt: record.createdAt });
-        logger?.info("sealed_key_generated", { publicKeyId: record.publicKeyId, publicKey: publicKeyB64, dir, note: "new X25519 sealed-box keypair in this directory — the private key exists only here: keep the directory across restarts and identical on every replica that has to open what it sealed, and back it up as a private key" });
+    return { keys, notes };
+}
+const isExists = (err) => typeof err === "object" && err !== null && "code" in err && err.code === "EEXIST";
+const KEYGEN_LOCK_POLL_MS = 50;
+const KEYGEN_LOCK_WAIT_MS = 15_000;
+async function takeKeygenLock(dir) {
+    const path = join(dir, KEYGEN_LOCK_FILE);
+    let handle;
+    try {
+        handle = await open(path, "wx", OWNER_ONLY_FILE_MODE);
+    }
+    catch (err) {
+        if (isExists(err))
+            return undefined;
+        throw err;
+    }
+    try {
+        await handle.close();
+    }
+    catch (error) {
+        await releaseKeygenLock(path, { error }, undefined);
+        throw error;
+    }
+    return path;
+}
+async function releaseKeygenLock(path, primary, logger) {
+    try {
+        await rm(path, { force: true });
+    }
+    catch (cleanup) {
+        if (primary !== undefined) {
+            const text = (e) => (e instanceof Error ? e.message : String(e));
+            throw new Error(`sealed-key custody: ${text(primary.error)} — and the key-creation lock ${path} this process took could not be removed (${text(cleanup)}): remove it by hand, an empty directory is otherwise blocked on it`, { cause: primary.error });
+        }
+        logger?.warn("sealed_key_keygen_lock_not_released", { lock: path, errKind: cleanup instanceof Error ? cleanup.name : "unknown", note: "the key-creation lock this process took could not be removed — harmless while the directory holds a key; with an empty directory every start waits on it until it is removed by hand" });
+    }
+}
+async function keygenLockTimeout(dir, lock, waitedMs) {
+    const heldFor = await stat(lock).then((s) => Math.max(0, Math.round((Date.now() - s.mtimeMs) / 1000)), () => undefined);
+    return new Error(`sealed-key custody ${dir}: the key-creation lock ${lock} is held${heldFor !== undefined ? ` (for ${heldFor}s)` : ""} and no key file appeared within ${waitedMs} ms — ` +
+        `if no replica is starting right now, an earlier start died while generating the key: remove ${lock} and start again`);
+}
+async function mintFirstKey(dir, logger) {
+    const sodium = _sodium;
+    const kp = sodium.crypto_box_keypair();
+    const publicKeyB64 = Buffer.from(kp.publicKey).toString("base64");
+    const record = {
+        v: 1,
+        alg: SEALED_KEY_ALG,
+        publicKeyId: deriveKeyId(kp.publicKey),
+        publicKey: publicKeyB64,
+        privateKey: Buffer.from(kp.privateKey).toString("base64"),
+        createdAt: new Date().toISOString(),
+    };
+    const path = join(dir, `${record.publicKeyId}.json`);
+    await atomicWriteFileAsync(path, JSON.stringify(record, null, 2) + "\n", { durability: "best-effort" });
+    await chmod(path, OWNER_ONLY_FILE_MODE);
+    logger?.info("sealed_key_generated", { publicKeyId: record.publicKeyId, publicKey: publicKeyB64, dir, note: "new X25519 sealed-box keypair in this directory — the private key exists only here: keep the directory across restarts and identical on every replica that has to open what it sealed, and back it up as a private key" });
+    return { id: record.publicKeyId, key: { publicKey: kp.publicKey, privateKey: kp.privateKey, publicKeyB64, createdAt: record.createdAt } };
+}
+export async function ensureSealedKeyStore(dir, logger, opts = {}) {
+    await _sodium.ready;
+    const sodium = _sodium;
+    ensureDir(dir);
+    await chmod(dir, SEALED_KEY_DIR_MODE);
+    const waitMs = opts.genesisLockWaitMs ?? KEYGEN_LOCK_WAIT_MS;
+    const deadline = Date.now() + waitMs;
+    let scan = await scanKeyDir(dir);
+    let minted;
+    try {
+        while (scan.keys.size === 0 && minted === undefined) {
+            const lock = await takeKeygenLock(dir);
+            if (lock !== undefined) {
+                let failure;
+                try {
+                    scan = await scanKeyDir(dir);
+                    if (scan.keys.size === 0)
+                        minted = await mintFirstKey(dir, logger);
+                }
+                catch (error) {
+                    failure = { error };
+                    throw error;
+                }
+                finally {
+                    await releaseKeygenLock(lock, failure, logger);
+                }
+            }
+            else if (Date.now() >= deadline) {
+                throw await keygenLockTimeout(dir, join(dir, KEYGEN_LOCK_FILE), waitMs);
+            }
+            else {
+                await new Promise((resolve) => setTimeout(resolve, KEYGEN_LOCK_POLL_MS));
+                scan = await scanKeyDir(dir);
+            }
+        }
+    }
+    finally {
+        for (const n of scan.notes)
+            logger?.warn(n.msg, n.fields);
     }
+    const keys = new Map(scan.keys);
+    if (minted !== undefined)
+        keys.set(minted.id, minted.key);
     const latestEntry = [...keys.entries()].sort((a, b) => (a[1].createdAt < b[1].createdAt ? 1 : a[1].createdAt > b[1].createdAt ? -1 : a[0] < b[0] ? -1 : 1))[0];
     return {
         latest: { publicKeyId: latestEntry[0], publicKey: latestEntry[1].publicKeyB64, createdAt: latestEntry[1].createdAt },
@@ -209,7 +297,7 @@ export async function reportExecutionPublicKey(opts) {
         if (res.ok) {
             let idempotent = false;
             try {
-                idempotent = (await res.json())?.idempotent === true;
+                idempotent = (await readUpstreamJson(res))?.idempotent === true;
             }
             catch { }
             logger?.info(idempotent ? "sealed_key_already_registered" : "sealed_key_reported", { publicKeyId: key.publicKeyId, status: res.status });