@sema-agent/server 7.43.0 → 7.44.0

package/dist/capabilities/prompts/identity.js

@@ -1,9 +1,3 @@
-/**
- * Sema identity — the branded role layer for the `default` scenario (bundle-data layer; wording
- * history: neutralized — no baked model/vendor/protocol facts, because the brain
- * stack has both OpenAI-compatible AND Anthropic-compatible legs and any baked substrate claim is the same
- * class of lie the neutralization removed. The anti-"I am Claude" design is kept.)
- */
 export const SEMA_IDENTITY = "You are Sema, an AI agent built by the Sema team. You act through tools to get real work done.\n" +
     "You run on a large language model chosen and configured by your operator — you are NOT Claude, NOT " +
     "GPT, and NOT made by Anthropic or OpenAI. If asked who you are or which model you are, answer honestly " +

package/dist/capabilities/prompts/team.js

@@ -1,7 +1,3 @@
-/**
- * Built-in team personas (bundle-data layer) — GENERIC personas only; the business prompt is
- * appended at call time by the consumer (team.ts), never baked in here.
- */
 export const TEAM_PERSONAS = {
     analyst: "You analyze the task: lay out the key considerations, options, and trade-offs. Be concrete.",
     critic: "You challenge the analysis: surface gaps, wrong assumptions, risks, and stronger alternatives.",

package/dist/capabilities/repo-tools.js

@@ -1,6 +1,5 @@
 import { Type } from "typebox";
 import { z } from "zod";
-/** Parse `owner/name` or a repo URL (e.g. https://git.example.com/some-org/some-repo.git). */
 export function parseRepo(input) {
     const s = input.trim().replace(/\.git$/, "");
     const m = /^[a-z]+:\/\/[^/]+\/(.+)$/i.exec(s);
@@ -12,11 +11,8 @@ export function parseRepo(input) {
 }
 const MAX_FILE_BYTES = 96 * 1024;
 const MAX_TREE_ENTRIES = 2000;
-/** Bound each Git-host call so a slow/hung host can't pin a review lens to its whole deadline. */
 const REQUEST_TIMEOUT_MS = 15_000;
 export { GIT_API_KINDS, isGitApiKind } from "../git-api-kind.js";
-/** Wire schemas for the Git-host responses we consume (both dialects share these shapes — Gitea copied
- *  GitHub's). Boundary discipline(宪法 [2704] §2):no bare `as` on `.json()`. */
 const RepoInfoWire = z.looseObject({ default_branch: z.string().optional() });
 const TreeWire = z.looseObject({
     tree: z.array(z.looseObject({ path: z.string(), type: z.string() })).optional(),
@@ -28,10 +24,6 @@ const ContentsWire = z.looseObject({
     type: z.string().optional(),
 });
 const PullMetaWire = z.looseObject({ changed_files: z.number().optional() });
-/** Shared guard: `encodeURIComponent` does NOT escape "." — a `..` segment survives the per-segment
- *  encode and the WHATWG URL parser collapses it when `fetch` builds the request, letting a crafted
- *  `path` climb out of `/repos/<owner>/<repo>/contents/` to any endpoint the read token can reach.
- *  The tools are contractually bound to exactly one repo, so reject traversal before it hits fetch. */
 function pathSegmentsRejectingTraversal(path) {
     const segments = path.split("/").filter(Boolean);
     if (segments.some((s) => s === "..")) {
@@ -51,7 +43,6 @@ export function createRepoClient(kind, baseUrl, token, fetchImpl = fetch) {
         }
     }
 }
-/** Thin read-only Gitea API client. Built once at startup; bound to a repo per task. */
 export class GiteaClient {
     baseUrl;
     token;
@@ -81,9 +72,6 @@ export class GiteaClient {
         const { owner, repo } = coords;
         const body = TreeWire.parse(await (await this.api(`/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=true&per_page=${MAX_TREE_ENTRIES}`)).json());
         const paths = (body.tree ?? []).filter((e) => e.type === "blob").map((e) => e.path);
-        // The upstream API caps the listing at `per_page` and reports the overflow via `truncated` — it does
-        // not report how many entries were left out. Surface that (same disclosure-marker family as
-        // `readFile`/`pullDiff` below) so a review lens never mistakes a capped tree for the whole repo.
         return body.truncated
             ? [...paths, `…[truncated, tree has more than ${MAX_TREE_ENTRIES} entries]`]
             : paths;
@@ -106,19 +94,6 @@ export class GiteaClient {
         return text.length > MAX_FILE_BYTES * 4 ? text.slice(0, MAX_FILE_BYTES * 4) + "\n…[diff truncated]" : text;
     }
 }
-/**
- * Thin read-only GitHub (github.com / GHE) API client — same four-call surface as `GiteaClient`.
- *
- * Dialect differences (each one is why `GiteaClient` alone 404s against GitHub):
- *  - base URL is the API root itself (`https://api.github.com`, GHE `https://ghe.example/api/v3`) —
- *    no `/api/v1` prefix is appended;
- *  - auth is `Authorization: Bearer <token>` (Gitea uses `token <token>`);
- *  - a PR's unified diff comes from `/pulls/{n}` via `Accept: application/vnd.github.v3.diff`
- *    (Gitea uses a `.diff` URL suffix);
- *  - the tree API has no `per_page` cap — GitHub returns up to its own limit and reports overflow via
- *    `truncated`; we additionally cap client-side at MAX_TREE_ENTRIES so the model-facing bound is the
- *    same for both dialects.
- */
 export class GitHubClient {
     baseUrl;
     token;
@@ -148,8 +123,6 @@ export class GitHubClient {
         const { owner, repo } = coords;
         const body = TreeWire.parse(await (await this.api(`/repos/${owner}/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`)).json());
         const paths = (body.tree ?? []).filter((e) => e.type === "blob").map((e) => e.path);
-        // Same disclosure-marker family as GiteaClient.tree: a capped listing must never read as the whole
-        // repo. Two cap sources here — upstream `truncated`, and our own client-side MAX_TREE_ENTRIES bound.
         if (paths.length > MAX_TREE_ENTRIES) {
             return [...paths.slice(0, MAX_TREE_ENTRIES), `…[truncated, tree has more than ${MAX_TREE_ENTRIES} entries]`];
         }
@@ -163,9 +136,6 @@ export class GitHubClient {
         const body = ContentsWire.parse(await (await this.api(`/repos/${owner}/${repo}/contents/${segments.map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`)).json());
         if (body.type !== "file" || body.content == null)
             throw new Error(`not a file: ${path}`);
-        // GitHub 文档行为(codex F1 定谳):1–100 MB 文件走对象形返回 `content:"", encoding:"none"` ——
-        // content 非 null 过上面的门,非 base64 臂又会把空串当正文交出 = 「大文件被当空文件评审」的静默
-        // 完整性失败。显式臂响亮拒(本工具本地帽 96 KiB,>1 MB 内容也装不下,拒绝即诚实)。
         if (body.encoding === "none") {
             throw new Error(`file too large for the contents API: ${path} (GitHub returns encoding:"none" for files over 1 MB — this read tool cannot fetch it; review it via the PR diff or skip it)`);
         }
@@ -176,9 +146,6 @@ export class GitHubClient {
     }
     async pullDiff(coords, index) {
         const { owner, repo } = coords;
-        // GitHub 在服务端静默截断 PR diff(300 文件 / 1 MB / 20k 行,文档行为;codex F2 定谳)——被截的
-        // 响应可能远小于本地帽,靠字节数判不出来。先取 PR 元数据拿 changed_files,与 diff 里实际出现的
-        // 文件数对账,少了就显式披露(上游截断与本地帽是两种截断,分开标)。
         const meta = PullMetaWire.parse(await (await this.api(`/repos/${owner}/${repo}/pulls/${index}`)).json());
         const res = await this.api(`/repos/${owner}/${repo}/pulls/${index}`, "application/vnd.github.v3.diff");
         let text = await res.text();
@@ -189,7 +156,6 @@ export class GitHubClient {
         return text.length > MAX_FILE_BYTES * 4 ? text.slice(0, MAX_FILE_BYTES * 4) + "\n…[diff truncated]" : text;
     }
 }
-/** Build the read-only repo tool set bound to one repo (cheap per-task closure; the client is shared). */
 export function repoToolsFor(client, coords) {
     const ref = (r) => (r ? Promise.resolve(r) : client.defaultBranch(coords));
     return [

package/dist/capabilities/sandbox-file-send.js

@@ -1,28 +1,8 @@
 import { hasDestroy } from "@sema-agent/core";
 import { shellQuote as shq } from "../plugins/remote-shell.js";
-/** Leak backstop (codex review HIGH): core skips destroy on suspend/review paths and a crash may skip it
- *  entirely — the suspendVM wrap covers the common case, this bound covers the rest. Far above any real
- *  per-replica concurrency. 修6: at the cap the registry REFUSES the new registration instead of FIFO-evicting
- *  the oldest entry — every entry here is live-until-destroy/suspend by construction, so there is no
- *  "terminal/stale" liveness verdict to evict on, and silently breaking an EXISTING live task's send face to
- *  admit a new one inverts the harm (the old FIFO victim's SendUserFile would report "no sandbox attached"
- *  while its env kept executing). The refused task gets a TYPED capacity error at send time instead. */
 export const TASK_ENV_REGISTRY_MAX = 512;
-/** Replica-local taskId → live ExecutionEnv(s). Registered by the factory wrap, dropped on destroy/suspend.
- *
- *  修5 (concurrent-generation guard): deployments WITHOUT a run-store single-active-session claim can race
- *  two legs of one session through the factory concurrently — previously the second registration silently
- *  OVERWROTE the first, so leg A's later SendUserFile resolved to leg B's env (wrong-generation read/upload).
- *  The registry now keeps EVERY live env per key and `get()` fail-louds on ambiguity: neither leg can silently
- *  read the other's sandbox, and the moment one generation is destroyed/suspended the survivor resolves again.
- *  (Rejecting the second factory call outright was considered and discarded: a stale never-destroyed entry —
- *  crash/no-destroy path — would then brick every future leg of that task, and the factory seam must not fail
- *  env creation for a send-face bookkeeping conflict. Deployments WITH the single-active-session claim
- *  serialize legs upstream and never see this state.) */
 export class TaskEnvRegistry {
     map = new Map();
-    /** 修6: taskIds whose registration was refused at the cap — lets get() report the TRUE reason (typed
-     *  capacity error, not a misleading "no sandbox attached"). Bounded by the same cap (marker-only). */
     refusedAtCapacity = new Set();
     liveCount() {
         let n = 0;
@@ -30,9 +10,6 @@ export class TaskEnvRegistry {
             n += envs.length;
         return n;
     }
-    /** Resolve the ONE live env for a task. Throws typed errors on the two governed failure states:
-     *  ambiguity (修5 — concurrent generations both live) and capacity refusal (修6). Returns undefined when
-     *  the task simply has no registered env (caller reports "no sandbox attached"). */
     get(taskId) {
         if (taskId === undefined)
             return undefined;
@@ -47,26 +24,14 @@ export class TaskEnvRegistry {
         }
         return undefined;
     }
-    /** Wrap the deployment's own factory: register each minted env under the task's CANONICAL id — core hands
-     *  the factory the raw `spec.taskId` but gives tools `hostTaskId = spec.taskId ?? sessionId` (prepare-task
-     *  262/320/428; the sync `/v1/tasks` leg deliberately sets no spec.taskId), so the registry key MUST apply
-     *  the same fallback or every sync-leg lookup misses (codex review HIGH). Unregister when core calls
-     *  destroy() (identity guard: only the env's OWN entry is dropped — a replacement env for a reused key must
-     *  not be evicted by the old one's late destroy). core SKIPS destroy on durable suspend/review (runtask
-     *  keeps the env for the snapshot) — wrap suspendVM the same way so a suspended task doesn't pin its env
-     *  here forever; the bounded-size backstop covers any remaining no-destroy crash path. */
     wrapFactory(factory) {
         return async (ctx) => {
             const env = await factory(ctx);
             const taskId = ctx.taskId ?? ctx.sessionId;
             if (hasDestroy(env)) {
                 const existing = this.map.get(taskId);
-                // 修6: refuse NEW keys at the cap (never evict a live entry — see TASK_ENV_REGISTRY_MAX). A same-key
-                // additional registration is always admitted even at the cap: the 修5 ambiguity guard is a correctness
-                // fence and must not be dodgeable by arriving while the registry is full.
                 if (existing === undefined && this.liveCount() >= TASK_ENV_REGISTRY_MAX) {
                     if (this.refusedAtCapacity.size >= TASK_ENV_REGISTRY_MAX) {
-                        // marker set is itself bounded; beyond it the task degrades to the plain "no sandbox attached" report
                         const oldestMarker = this.refusedAtCapacity.values().next().value;
                         if (oldestMarker !== undefined)
                             this.refusedAtCapacity.delete(oldestMarker);
@@ -78,10 +43,8 @@ export class TaskEnvRegistry {
                         clearMarker();
                         return origDestroy();
                     };
-                    return env; // env itself is untouched — only the send face is refused (typed error at get())
+                    return env;
                 }
-                // 修5: append, never overwrite — a live sibling under the same key makes get() fail loud instead of
-                // silently handing one leg the other leg's sandbox.
                 if (existing === undefined)
                     this.map.set(taskId, [env]);
                 else
@@ -90,7 +53,7 @@ export class TaskEnvRegistry {
                     const envs = this.map.get(taskId);
                     if (envs === undefined)
                         return;
-                    const i = envs.indexOf(env); // identity guard: drop only THIS env's entry
+                    const i = envs.indexOf(env);
                     if (i >= 0)
                         envs.splice(i, 1);
                     if (envs.length === 0)
@@ -107,7 +70,7 @@ export class TaskEnvRegistry {
                     suspendable.suspendVM = async (...args) => {
                         const r = await origSuspend(...args);
                         if (r.ok)
-                            evict(); // suspended env is dormant — the resume leg registers a fresh one
+                            evict();
                         return r;
                     };
                 }
@@ -116,22 +79,6 @@ export class TaskEnvRegistry {
         };
     }
 }
-/**
- * Which REMOTE_EXEC lanes may register the sandbox-send TaskEnvRegistry (and thus mount the sandbox-lane
- * SendUserFile source), under which tenancy gate. The judgment per lane (2026-07-14 ssh backfill review):
- *
- *  - e2b / k8s: one task = one disposable sandbox; the sandbox filesystem IS the tenant's task workspace,
- *    so a sandbox-scoped read is tenant-scoped by construction → open to any tenant.
- *  - ssh: the peer is ONE persistent real machine SHARED across tasks (factory ignores ctx: every task
- *    gets the same host+mountPath; destroy=disconnect only, files persist). Tenant A's task can read the
- *    residue of tenant B's task → the isolation premise FAILS. Multi-tenant here would be an
- *    arbitrary-host-path-read → public-URL exfil face, so the lane opens ONLY single-user
- *    (`requirePrincipal !== true`), the exact gate the host lane uses. NOT a lane to "fix later with a
- *    per-task workspace": tasks legitimately operate outside any workspace on a real host (design/61 —
- *    batch deployment), so per-task dirs would not restore the boundary anyway.
- *  - adb / local-docker / host / unset: no registry (host+unset use the local-fs source in main.ts;
- *    adb/local-docker remain a follow-on).
- */
 export function sandboxSendLaneEnabled(provider, requirePrincipal) {
     if (provider === "e2b" || provider === "k8s")
         return true;
@@ -139,11 +86,6 @@ export function sandboxSendLaneEnabled(provider, requirePrincipal) {
         return requirePrincipal !== true;
     return false;
 }
-// [2354] clay 令兼容面全清:R10 曾留的 `export { shq }` 兼容转口已删——quoting 唯一真源=
-// remote-shell.ts 的 shellQuote(原先仅有的两个消费者是测试文件,已改从真源导入)。
-/** Strip the capability URL (and any SigV4 signature) from text before it reaches an error/log — including
- *  the percent-encoded forms an adapter may echo (the k8s exec transport carries the command in a request
- *  URI, so an error can quote the URL re-encoded; codex review MED). */
 export function redactPutUrl(text, url) {
     return text
         .split(url)
@@ -151,45 +93,25 @@ export function redactPutUrl(text, url) {
         .split(encodeURIComponent(url))
         .join("<presigned-put-url>")
         .replace(/X-Amz-Signature(=|%3D)[0-9a-f]+/gi, "X-Amz-Signature=<redacted>")
-        // A PARTIAL URL (adapter truncation/line-wrap) can survive the exact-match passes above — the SigV4
-        // Credential query param carries the ACCESS KEY ID, scrub it independently (defense in depth).
         .replace(/X-Amz-Credential(=|%3D)[^&\s"']+/gi, "X-Amz-Credential=<redacted>");
 }
-/**
- * The sandbox-lane `send` seam for the SendUserFile tool: in-sandbox stat (existence + regular file +
- * size cap, BEFORE any signing) → presign PUT → in-sandbox `curl -T` → finalize the user-facing link.
- * Throws typed Errors (redacted) — the tool reports them per file.
- */
 export function createSandboxFileSend(deps) {
     return async (path, ctx) => {
         const env = deps.registry.get(ctx.taskId);
         if (!env) {
             throw new Error("no sandbox is attached to this task yet — SendUserFile reads from the task sandbox; retry after the environment has started");
         }
-        // The path is model-controlled and rides a shell line: shq() covers every POSIX metacharacter, but
-        // control chars (NUL truncates argv in some transports; \n splits lines in naive adapters) buy nothing
-        // legitimate — reject outright rather than trust each adapter's quoting edge.
         if (/[\u0000-\u001f\u007f]/.test(path))
             throw new Error("file path contains control characters — not a valid sandbox path");
         if (path.length > 4096)
             throw new Error("file path exceeds 4096 characters — not a valid sandbox path");
-        // `curl -T -` means STDIN by convention — a relative path starting with '-' must ride as ./-name so all
-        // three sites (test operand / stat / curl) name the same real file.
         const q = shq(path.startsWith("-") ? `./${path}` : path);
-        // stat first: fail before minting any capability URL. `test -f` = regular file only (no dirs/devices);
-        // `stat -c %s` = GNU/busybox size (sandbox images are Linux; the ssh lane assumes a LINUX peer — the
-        // whole fleet is — a macOS peer would exit non-zero here and fail loud, see the module header).
-        // ExecutionEnv.exec timeout is SECONDS (e2b, k8s AND ssh adapters all multiply by 1000 — codex
-        // review MED caught ms here; ssh reading = remote-env-ssh.ts `options.timeout * 1000`).
         const stat = await env.exec(`test -f ${q} && stat -c %s -- ${q}`, { timeout: 30 });
         if (!stat.ok)
             throw new Error(`sandbox stat failed: ${stat.error.message}`);
         if (stat.value.exitCode !== 0) {
             throw new Error(`file not found in the sandbox (or not a regular file): ${path} — ls first; absolute paths are safest`);
         }
-        // Advisory pre-check only (the authoritative size accounting is server-side verifySize below — the
-        // sandbox owns its filesystem, so nothing it reports is binding): still worth failing early and cheap.
-        // Strict digit match, not bare parseInt — a digit-prefixed garbled line must fail loud, not truncate.
         const statOut = stat.value.stdout.trim();
         if (!/^\d+$/.test(statOut))
             throw new Error(`sandbox stat returned an unparsable size for ${path}: ${statOut}`);
@@ -199,15 +121,7 @@ export function createSandboxFileSend(deps) {
         }
         const filename = path.split(/[/\\]/).pop();
         const prepared = deps.prepare(filename, ctx.principal);
-        // Everything from here can echo the capability URL (adapter throws included, not just Result errors —
-        // codex review MED) — one redacting fence around the whole upload phase.
         try {
-            // -f: HTTP >= 400 → exit 22 (no silent half-uploads). NO -s: the progress meter on stderr feeds the
-            // e2b/k8s adapters' ~120s zero-output liveness watchdog — a silent multi-minute upload would be killed
-            // as a hang (the k8s snapshot lane solves this with livenessMs:0; a chatty meter is the seam-free way).
-            // The ssh adapter has NO idle-output watchdog on exec() (total-timeout bound only) — the meter is
-            // harmless noise there, so one shared command shape serves all three lanes.
-            // stderr may echo the URL → the redact fence below covers every throw out of this block.
             const up = await env.exec(`curl -f -T ${q} ${shq(prepared.putUrl)}`, { timeout: 300 });
             if (!up.ok)
                 throw new Error(`sandbox upload failed: ${up.error.message}`);
@@ -217,9 +131,6 @@ export function createSandboxFileSend(deps) {
                     throw new Error("sandbox upload failed: curl is not available in this sandbox image");
                 throw new Error(`sandbox upload failed (curl exit ${up.value.exitCode})${detail.length > 0 ? `: ${detail}` : ""}`);
             }
-            // Server-side accounting is authoritative (codex review HIGH: stat→curl is an exploitable TOCTOU —
-            // swap/grow the file between the two and the cap is bypassed with a stale size on the card): HEAD the
-            // real object; over-cap ⇒ deleted inside verifySize; the card carries the verified size.
             const verifiedSize = await prepared.verifySize(deps.maxBytes);
             return prepared.finalize(verifiedSize);
         }

package/dist/capabilities/scenarios.d.ts

@@ -4,7 +4,6 @@ import type { Logger } from "../observability/logger.js";
 import { type RepoReadClient } from "./repo-tools.js";
 import { type LoadedSkill } from "./skills.js";
 import { type ScenarioHands } from "./hands-lane.js";
-export { SCENARIO_ALIASES, canonicalScenarioName, scenarioConfigKeys } from "./scenario-alias.js";
 /**
  * Scenario routing — a deployment serves many scenarios from one image. Each request's `scenario`
  * selects a pre-wired capability bundle: tools (incl. subagent roster) + a whole-harness prompt +