@sema-agent/server 7.43.0 → 7.44.0

package/dist/sandbox-pkg-source.js

@@ -1,55 +1,23 @@
-/**
- * RFC B5/B4 抽象点② (sema-internal server/docs/design/ENV-SELECT-AND-REGION-SOURCE.md): the deployment-region package-source →
- * sandbox env derivation. ENV-FIRST: pod/sandbox env OVERRIDES the image's baked `ENV` (k8s container env wins
- * over image config and is visible to every exec'd process; e2b sandboxEnv likewise) — so the env-overridable
- * ecosystem pieces (pip/uv/npm/corepack/go/rustup/flutter/playwright/nuget) switch region on EXISTING images,
- * no rebake needed. Only the file-bound pieces (apt sources, /etc/gemrc, composer global config, cargo
- * config.toml) still need the in-image `pkg-source.sh` hook (rebaked images; bake prep chowns those files).
- *
- * Profiles:
- *   cn      → inject only the SEMA_PKG_SOURCE marker (the pool's images bake the CN set as their defaults).
- *   global  → official endpoints for every env-overridable ecosystem (overrides the baked CN ENV values).
- *   custom  → SEMA_* explicit URLs (from the service process env) forwarded verbatim + mapped onto the same
- *             ecosystem variables where a mapping is unambiguous (apt has no env form — hook-only).
- *
- * The marker `SEMA_PKG_SOURCE` always rides along: the image's pkg-source.sh hook (pod-start / profile.d)
- * materializes the file-bound pieces from it; images without the hook simply ignore it.
- */
-/** The official (`global`) endpoint set — overrides the pool images' baked CN ENV values. */
 const GLOBAL_ENV = {
-    // python: pip + uv (uv does NOT read pip's variables). The python band bakes the deprecated
-    // UV_INDEX_URL alias; override BOTH aliases to the same value so whichever uv reads, it reads official.
     PIP_INDEX_URL: "https://pypi.org/simple",
     UV_DEFAULT_INDEX: "https://pypi.org/simple",
     UV_INDEX_URL: "https://pypi.org/simple",
-    // node: npm env config beats npmrc files; corepack has its own baked ENV (node band).
     NPM_CONFIG_REGISTRY: "https://registry.npmjs.org",
     COREPACK_NPM_REGISTRY: "https://registry.npmjs.org",
-    // go band bakes goproxy.cn + sum.golang.google.cn
     GOPROXY: "https://proxy.golang.org,direct",
     GOSUMDB: "sum.golang.org",
-    // rust band bakes rsproxy.cn (rustup); the crates registry file (cargo config.toml) is hook territory.
     RUSTUP_DIST_SERVER: "https://static.rust-lang.org",
     RUSTUP_UPDATE_ROOT: "https://static.rust-lang.org/rustup",
-    // flutter band bakes flutter-io.cn
     FLUTTER_STORAGE_BASE_URL: "https://storage.googleapis.com",
     PUB_HOSTED_URL: "https://pub.dev",
-    // browser/python bands bake the npmmirror playwright host; empty string falls through playwright's `||` to
-    // its official CDN (playwright treats a falsy env as unset).
     PLAYWRIGHT_DOWNLOAD_HOST: "",
-    // dotnet band's informational feed pointer
     NUGET_FEED: "https://api.nuget.org/v3/index.json",
 };
-/**
- * Derive the operator-trusted sandbox env for a package-source profile. Returns `{}` for an unknown/empty
- * profile (unset = byte-identical sandbox — the B5 backward-compat contract).
- */
 export function derivePkgSourceEnv(profile, custom) {
     if (!profile)
         return {};
     switch (profile) {
         case "cn":
-            // the images bake the CN set as their defaults — only the marker (hook re-materializes apt, idempotent).
             return { SEMA_PKG_SOURCE: "cn" };
         case "global":
             return { SEMA_PKG_SOURCE: "global", ...GLOBAL_ENV };
@@ -58,14 +26,12 @@ export function derivePkgSourceEnv(profile, custom) {
             const uvIndex = c.uvIndex ?? c.pipIndex;
             return {
                 SEMA_PKG_SOURCE: "custom",
-                // SEMA_* verbatim for the in-image hook (file-bound pieces: apt/gem/composer/cargo)
                 ...(c.aptMirror ? { SEMA_APT_MIRROR: c.aptMirror } : {}),
                 ...(c.pipIndex ? { SEMA_PIP_INDEX: c.pipIndex } : {}),
                 ...(uvIndex ? { SEMA_UV_INDEX: uvIndex } : {}),
                 ...(c.uvPyMirror ? { SEMA_UV_PY_MIRROR: c.uvPyMirror } : {}),
                 ...(c.npmRegistry ? { SEMA_NPM_REGISTRY: c.npmRegistry } : {}),
                 ...(c.nodeMirror ? { SEMA_NODE_MIRROR: c.nodeMirror } : {}),
-                // and the unambiguous env-first mappings (work on existing images, no hook needed)
                 ...(c.pipIndex ? { PIP_INDEX_URL: c.pipIndex } : {}),
                 ...(uvIndex ? { UV_DEFAULT_INDEX: uvIndex, UV_INDEX_URL: uvIndex } : {}),
                 ...(c.uvPyMirror ? { UV_PYTHON_INSTALL_MIRROR: c.uvPyMirror } : {}),
@@ -74,12 +40,9 @@ export function derivePkgSourceEnv(profile, custom) {
             };
         }
         default:
-            // unknown profile — inject only the marker; the in-image hook logs + no-ops on it (fail-safe, not fail-closed:
-            // a typo'd region must not silently flip a deployment to another region's sources).
             return { SEMA_PKG_SOURCE: profile };
     }
 }
-/** Read the `custom` explicit-URL set from the service process env (operator-trusted deployment config). */
 export function customPkgSourceFromEnv(env = process.env) {
     return {
         ...(env.SEMA_APT_MIRROR ? { aptMirror: env.SEMA_APT_MIRROR } : {}),

package/dist/sealed-key.js

@@ -1,35 +1,9 @@
-/**
- * Sealed-box key custody — the EXECUTION-SIDE half (registry-core 0.10.5/0.10.6):
- * the user pastes a model API key in the web UI, the BROWSER seals it against this host's X25519
- * public key (libsodium `crypto_box_seal`), the center stores ONLY the ciphertext
- * (`ModelEntry.sealedApiKey`, write-only face), and THIS module unseals it at apply time so the
- * plaintext exists nowhere but this process's memory (`config.modelApiKeys` → getApiKeyAndHeaders).
- *
- * Custody layout: `<localDataRoot>/sealed-key/<publicKeyId>.json` — ONE FILE PER KEYPAIR (0600,
- * dir 0700). Several keypairs MAY coexist: rotation registers a NEW public key with the center
- * (new ciphertexts are sealed against the newest `createdAt`) while OLD ciphertexts still carry
- * their old `publicKeyId` — they stay decryptable exactly as long as the operator keeps the old
- * private-key file around (the registry-core contract: "旧密文可解性=执行侧留存旧私钥决定").
- * Selection is EXACT by `publicKeyId` — no try-every-key scanning: an id with no file is a loud
- * per-model failure upstream (applyEffective), never a silent fallback.
- *
- * Crypto choice: sealed box (`crypto_box_seal`) is a libsodium-specific construction (ephemeral
- * X25519 keypair + XSalsa20-Poly1305, nonce = BLAKE2b(epk‖rpk)) — node:crypto has no BLAKE2b and
- * no sealed box, and tweetnacl (already in the tree via ssh2) lacks BLAKE2b too, so we depend on
- * `libsodium-wrappers` (pure JS + WASM: no native build step, CI/cross-arch friendly, and the
- * same library the browser side uses — byte-compatible by construction).
- */
 import { createHash } from "node:crypto";
 import { chmod, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import _sodium from "libsodium-wrappers";
-/** Algorithm tag — MUST equal registry-core's `SEALED_BOX_ALG` (v1 sole value; a different alg on
- *  the wire is a loud per-model rejection in applyEffective, never a guess). */
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
-/** crypto_box_seal overhead: 32B ephemeral pk + 16B MAC. Anything shorter cannot be a sealed box. */
 const SEAL_OVERHEAD_BYTES = 48;
-/** Strict base64 shape (standard alphabet, optional padding) — `Buffer.from(b64)` is lenient and
- *  would silently swallow garbage, turning "corrupt ciphertext" into a misleading MAC failure. */
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
 export function sealedKeyPoison(publicKeyId, reason, errKind) {
     return { sealedKeyPoison: true, publicKeyId, reason, ...(errKind ? { errKind } : {}), at: new Date().toISOString() };
@@ -37,13 +11,6 @@ export function sealedKeyPoison(publicKeyId, reason, errKind) {
 export function isSealedKeyPoison(v) {
     return typeof v === "object" && v !== null && v.sealedKeyPoison === true;
 }
-/**
- * The task-level fail-loud face of a poison pill: thrown by the key resolver on EVERY brain call that
- * would otherwise authenticate this model, so a broken sealed key fails the task visibly (same family
- * as a rotation-leg auth failure) instead of silently burning the gateway account. Message carries the
- * sealed-failure marker (reason + publicKeyId + detection time) plus the operator fix — and nothing
- * secret (no ciphertext, no plaintext, by construction of SealedKeyPoison).
- */
 export class SealedKeyPoisonedError extends Error {
     publicKeyId;
     reason;
@@ -58,8 +25,6 @@ export class SealedKeyPoisonedError extends Error {
         this.at = poison.at;
     }
 }
-/** Default id = fingerprint of the RAW public-key bytes: `exec-<sha256(pk)[0..12) hex>`.
- *  Deterministic → regenerating the id from the same key file is stable across boots. */
 export function deriveKeyId(publicKeyRaw) {
     return `exec-${createHash("sha256").update(publicKeyRaw).digest("hex").slice(0, 12)}`;
 }
@@ -68,18 +33,11 @@ function b64ToBytes(b64, what) {
         throw new Error(`${what}: not valid base64`);
     return new Uint8Array(Buffer.from(b64, "base64"));
 }
-/**
- * Load every keypair under `dir` (creating dir + ONE fresh keypair when none exist) and return the
- * custody store. Invalid/corrupt files are skipped with a warn (they may be an OLD format or a
- * half-write — deleting operator key material on a parse error would destroy decryptability, so we
- * never do; we just don't serve them). Throws only when the store cannot exist at all (fs errors,
- * zero loadable keys AND generation failed).
- */
 export async function ensureSealedKeyStore(dir, logger) {
     await _sodium.ready;
     const sodium = _sodium;
     await mkdir(dir, { recursive: true, mode: 0o700 });
-    await chmod(dir, 0o700); // mkdir's mode is ignored when the dir pre-exists — enforce anyway
+    await chmod(dir, 0o700);
     const keys = new Map();
     for (const name of (await readdir(dir)).filter((n) => n.endsWith(".json")).sort()) {
         const path = join(dir, name);
@@ -92,8 +50,6 @@ export async function ensureSealedKeyStore(dir, logger) {
             const privateKey = b64ToBytes(raw.privateKey, "privateKey");
             if (publicKey.length !== sodium.crypto_box_PUBLICKEYBYTES || privateKey.length !== sodium.crypto_box_SECRETKEYBYTES)
                 throw new Error("bad key length");
-            // The file's OWN publicKeyId is authoritative (operators may hand-register custom ids with the
-            // center); a filename drift is only cosmetic — warn, honor the content.
             if (name !== `${raw.publicKeyId}.json`)
                 logger?.warn("sealed_key_filename_drift", { file: name, publicKeyId: raw.publicKeyId, note: "content publicKeyId wins; rename the file to silence this" });
             if (keys.has(raw.publicKeyId)) {
@@ -103,10 +59,6 @@ export async function ensureSealedKeyStore(dir, logger) {
             keys.set(raw.publicKeyId, { publicKey, privateKey, publicKeyB64: raw.publicKey, createdAt: typeof raw.createdAt === "string" ? raw.createdAt : "" });
         }
         catch (err) {
-            // Never delete: could be operator key material in an older/foreign format — unreadable here ≠ worthless.
-            // 🔴 审计 #4 LOW: JSON.parse's SyntaxError EMBEDS ~20 chars of the offending input — a file corrupted
-            // near the `privateKey` field would leak a base64 fragment of the secret into the log. Record only
-            // the error CLASS (err.name), never the message.
             logger?.warn("sealed_key_file_unreadable", { file: path, errKind: err instanceof Error ? err.name : "unknown", note: "skipped (NOT deleted) — ciphertexts sealed for this key will fail loud per-model" });
         }
     }
@@ -123,11 +75,10 @@ export async function ensureSealedKeyStore(dir, logger) {
         };
         const path = join(dir, `${record.publicKeyId}.json`);
         await writeFile(path, JSON.stringify(record, null, 2) + "\n", { mode: 0o600 });
-        await chmod(path, 0o600); // writeFile mode is masked by umask — enforce the exact custody mode
+        await chmod(path, 0o600);
         keys.set(record.publicKeyId, { publicKey: kp.publicKey, privateKey: kp.privateKey, publicKeyB64, createdAt: record.createdAt });
         logger?.info("sealed_key_generated", { publicKeyId: record.publicKeyId, publicKey: publicKeyB64, dir, note: "new X25519 sealed-box keypair — register the PUBLIC key with the registry (see sealed_key_public_key)" });
     }
-    // Newest createdAt = the key new ciphertexts must target (registry contract); ties → lexicographic id.
     const latestEntry = [...keys.entries()].sort((a, b) => (a[1].createdAt < b[1].createdAt ? 1 : a[1].createdAt > b[1].createdAt ? -1 : a[0] < b[0] ? -1 : 1))[0];
     return {
         latest: { publicKeyId: latestEntry[0], publicKey: latestEntry[1].publicKeyB64, createdAt: latestEntry[1].createdAt },
@@ -140,25 +91,13 @@ export async function ensureSealedKeyStore(dir, logger) {
             const ciphertext = b64ToBytes(ciphertextB64, "ciphertext");
             if (ciphertext.length < SEAL_OVERHEAD_BYTES)
                 throw new Error(`ciphertext too short (${ciphertext.length}B < sealed-box ${SEAL_OVERHEAD_BYTES}B overhead)`);
-            // Throws on MAC failure (wrong key / corrupt ciphertext) — exactly the loudness we want.
             return sodium.to_string(sodium.crypto_box_seal_open(ciphertext, key.publicKey, key.privateKey));
         },
     };
 }
-/**
- * Best-effort public-key registration with the sema-registry (`POST /api/config/execution-keys`).
- *
- * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
- * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
- * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
- * secret) with the exact registration instructions, and warn that the web "paste key" face stays
- * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).
- */
 export async function reportExecutionPublicKey(opts) {
     const { baseUrl, adminToken, key, notes, logger } = opts;
     const manual = (why) => {
-        // Full key on purpose: the OPERATOR completes registration by hand. publicKey is public material.
         logger?.warn("sealed_key_public_key", {
             publicKeyId: key.publicKeyId,
             publicKey: key.publicKey,
@@ -182,21 +121,17 @@ export async function reportExecutionPublicKey(opts) {
             signal: AbortSignal.timeout(10_000),
         });
         if (res.ok) {
-            // center 幂等语义:同 id 同 key 重复上报 = 200 {ok,key,idempotent:true}(boot 重报常态)。
             let idempotent = false;
             try {
                 idempotent = (await res.json())?.idempotent === true;
             }
-            catch { /* body 非 JSON 也算 reported */ }
+            catch { }
             logger?.info(idempotent ? "sealed_key_already_registered" : "sealed_key_reported", { publicKeyId: key.publicKeyId, status: res.status });
         }
         else if (res.status === 409) {
-            // 409 = 并发写 CAS 冲突(retry 语义,非「已注册」)。boot 是一次性上报,不循环重试——
-            // 下次 boot 自然重报;这里降级为 manual 面(诚实姿势:本次没写成)。
             manual("registry returned 409 (concurrent write; will re-report on next boot)");
         }
         else {
-            // 400 同 id 异 key = 指纹碰撞或密钥文件被改,绝不静默——manual 面带上下文。
             manual(`registry rejected the report (HTTP ${res.status})`);
         }
     }