@sema-agent/server 7.43.0 → 7.44.0

package/dist/http/sse-lifecycle.js

@@ -1,24 +1,13 @@
-/**
- * 把 `onClose` 接到这条连接的两个关闭信号上,并保证**至多执行一次**。
- *
- * 连接在调用本函数**之前**就已经断了(接线排在慢查询之后的那种形),`onClose` 会在本函数内
- * **同步**跑一次 —— 调用方据此可以假定:本函数返回后,「已断连」这件事一定已经被通知过了。
- * 于是 `closed` 旗在泵进入循环前就已翻好,不需要每条腿再自己判一次 `res.destroyed`。
- *
- * @param onClose 本连接的全部清理动作(置 `closed` 旗、`clearInterval`、迭代器 `return()` 等)。
- */
 export function bindSseLifecycle(req, res, onClose) {
     let fired = false;
     const once = () => {
         if (fired)
             return;
-        fired = true; // 先落闸再调用:onClose 抛出时不得从第二个事件重入(见顶注)
+        fired = true;
         onClose();
     };
-    res.on("close", once); // 实测恒先到的那一个,也是读干形下唯一到的那一个
+    res.on("close", once);
     req.on("close", once);
-    // 回看:接线之前就断掉的连接,两个事件都已烧完,只有状态位还留着证据(理由与判据选取见顶注)。
-    // 先注册再回看,不是反过来 —— 反过来会在「回看与注册之间」新开一个同样的窗。
     if (res.destroyed || res.closed)
         once();
 }

package/dist/http/sse-log.js

@@ -1,22 +1,6 @@
 import { bindSseLifecycle } from "./sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "./send.js";
-/** #151 车3 §5.3:preamble 的**有界**等待上限。挂起的 store 不许拖住开流——开流是壳的主路径,
- *  而 preamble 只是一个锦上添花的对账基准。超时即按「无卡集基准」继续(与今天等同)。 */
 export const SSE_PREAMBLE_TIMEOUT_MS = 2_000;
-/**
- * 跑一次 preamble,**有界 + fail-open**(#151 车3 §5.3)。
- *
- * 🔴 只 catch throw 是不够的:store **挂起**(不抛)会把整条开流一起拖住。所以这里是 `Promise.race`
- * 而不是 try/catch —— 两种失败形(抛 / 不返回)各自有一条出路,都落到「零帧 + 一次 warn + 继续开流」。
- *
- * 🔴 #151 车3 刀 3b(§14.2 遗留记账兑现):超时**同时 abort** 一个交给 `preamble` 的 `AbortSignal`。
- * 此前只是「丢结果」,原 promise 仍在飞 —— DB 挂死时的重连风暴会一轮轮往连接池里堆等待者。现在读口
- * 拿到 abort 会当场拒绝,调用链不再累积;库那侧的那条查询仍会跑完(驱动无取消 seam,残留边界见
- * `ApprovalAskStore.listPendingBySession` 的注)。丢结果这条语义不变:preamble 只读,丢弃零副作用。
- *
- * 导出给 `routes/tasks.ts` 的 sync 腿直接用 —— 那条腿不走 `streamSseLog`(它不是账本 tail),但
- * 「有界 + fail-open」这条判据必须是**同一份实现**,不能各腿各写一遍。
- */
 export async function collectSsePreamble(preamble, onFailure, timeoutMs = SSE_PREAMBLE_TIMEOUT_MS) {
     const timedOut = Symbol("preamble-timeout");
     let timer;
@@ -26,10 +10,10 @@ export async function collectSsePreamble(preamble, onFailure, timeoutMs = SSE_PR
             preamble(ac.signal),
             new Promise((resolve) => {
                 timer = setTimeout(() => {
-                    ac.abort(); // 先掐读,再回空集——两件事的顺序无关紧要,但都要发生
+                    ac.abort();
                     resolve(timedOut);
                 }, timeoutMs);
-                timer.unref?.(); // 别让这只表把进程钉住(测试进程里尤其明显)
+                timer.unref?.();
             }),
         ]);
         if (raced === timedOut) {
@@ -47,14 +31,10 @@ export async function collectSsePreamble(preamble, onFailure, timeoutMs = SSE_PR
             clearTimeout(timer);
     }
 }
-/** The shared resumable SSE pump (P2.8) — provider supplies the log-specific differences; the liveness/
- *  heartbeat/416/terminal-re-fetch/15-min-cap logic is identical for task_run + image_bake. */
 export async function streamSseLog(req, res, provider, id, staleMs) {
     const lastId = Number(req.headers["last-event-id"] ?? new URL(req.url ?? "", "http://x").searchParams.get("from") ?? 0);
     let from = Number.isFinite(lastId) ? lastId : 0;
     if (from > 0) {
-        // Resume point evicted past retention → 416 so the client re-syncs, instead of a silent incomplete stream
-        // (parity with streamTaskTrace; council). Inert until retention evicts (retainedFrom stays 1 with no TTL).
         const retainedFrom = await provider.retainedFrom(id);
         if (retainedFrom > from + 1) {
             sendError(res, 416, "limit.retention_evicted", "resume point evicted past retention", { retainedFrom });
@@ -62,26 +42,13 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         }
     }
     sseHeaders(res);
-    // 🔴 断连接线必须**先于** preamble 的等待窗接上(codex 复审 2026-08-06 的 medium):Node 的 `'close'`
-    // 只发一次,在等待窗里断连的客户端其 close 事件会在监听器注册之前烧掉 ⇒ `closed` 恒 false ⇒ 泵照常
-    // 进轮询循环,对着已死的 res 反复 getEvents/statusOf 直到终态/stale/15 分钟帽。本行原本紧跟
-    // sseHeaders,是 preamble 插进来才多出这个窗 —— 所以搬接线、不搬 preamble。
-    //
-    // design/245 件1:接线本身收到共享助手(req+res 双挂 + 一次性闸)。此前只挂 `req`,而请求流被读干
-    // 之后 `req` 的 close 不再补发 —— 本泵是 `task_run` 与 `image_bake` 两条日志共用的 seam,调用方
-    // 是谁、在它之前有没有人碰过请求流,不该由本泵去赌。理由全文在 `sse-lifecycle.ts` 顶注。
     let closed = false;
     bindSseLifecycle(req, res, () => {
         closed = true;
     });
-    // #151 车3 §5.1:preamble 排在 416 判定与 sseHeaders **之后**、日志 tail 之前。有界 + fail-open,
-    // 见 collectSsePreamble 顶注;`id:` 行故意不写(非账本行,不推进 Last-Event-ID 游标)。
-    const preamble = provider.preamble?.bind(provider); // bind:接口按方法签名声明,实现方允许用 `this`
+    const preamble = provider.preamble?.bind(provider);
     if (preamble) {
         const frames = await collectSsePreamble(preamble, (reason, err) => provider.onPreambleFailure?.(reason, err));
-        // 等待窗里断连了就别再写(`closed` 由上面的 close 监听器置;`writableEnded`/`destroyed` 是
-        // 第二道 —— codex 复审第二轮 medium 当时指出 res 侧的 close 面本 helper 没听,那半条已由
-        // design/245 件1 的 `bindSseLifecycle` 补上;这道判据保留为第二重,与 routes/tasks.ts 心跳处逐字同源)。
         if (!closed && !res.writableEnded && !res.destroyed) {
             for (const f of frames)
                 res.write(`event: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);
@@ -97,20 +64,11 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         }
     };
     while (!closed) {
-        // Independent reads — issue concurrently to shave the SSE poll latency. The terminal-event gap is
-        // still covered by the extra getEvents below (a `done` landing between these two is re-fetched).
         const [events, row] = await Promise.all([provider.getEvents(id, from), provider.statusOf(id)]);
         write(events);
         if (!row)
             break;
         if (row.status !== "running") {
-            // Terminal. The `done`/`failed` event is appended BEFORE the coarse status flips terminal (runs.ts +
-            // the bake terminal-write), so it can land in the gap between the getEvents and statusOf above — fetch
-            // ONCE MORE so the stream never ends before delivering the terminal event. (The ONE exception is E12's
-            // post-completion `suggestions` event, appended AFTER setTerminal once the fire-and-forget pass settles —
-            // it is intentionally NOT delivered on this live tail; a poller reads it from GET /v1/runs/:id, which is the
-            // `await result() THEN await suggestions()` contract. Releasing the session lock at `done` beats blocking it
-            // on the suggestion LLM pass just to stream a UI nicety.)
             write(await provider.getEvents(id, from));
             break;
         }
@@ -121,13 +79,10 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
             break;
         }
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
-            // BL-16: cap reached but the run continues — emit a terminal reconnect signal (not a silent close, which
-            // a client couldn't distinguish from a completed run). Distinct from the `failed`/`done` run events.
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {
-            // Heartbeat during a long idle tail (e.g. a debate phase) so the relay's idle timeout doesn't fire.
             if (Date.now() - lastBeat > SSE_HEARTBEAT_IDLE_MS) {
                 res.write(`event: heartbeat\ndata: {}\n\n`);
                 lastBeat = Date.now();

package/dist/http/tar.js

@@ -1,23 +1,14 @@
-/**
- * 极小 ustar 写器(workspace 浏览面 #3 的 archive 端点用,[1882]/[1894])。零依赖(仓内 no-SDK 姿势,
- * 同 s3-presign/OTLP 先例)。只写 regular file 条目:512B ustar 头(prefix 155/name 100 拆分)+
- * 内容 512 对齐 + 两块零尾。**不做** PAX/GNU 长名扩展——快照 relPath 超过 prefix+name 可承载
- * (>255 或不可在 "/" 处拆)属病态路径,调用方按 fail-loud 处理(archive 面 422 点名)。
- */
 const BLOCK = 512;
-/** 八进制右对齐 NUL 结尾字段(ustar 数字字段形)。 */
 function octal(n, width) {
     const s = n.toString(8).padStart(width - 1, "0");
     return Buffer.from(s + "\0", "ascii");
 }
-/** 把 relPath 拆成 ustar 的 (prefix ≤155, name ≤100);不可拆 ⇒ null(调用方 fail-loud)。 */
 export function splitTarPath(relPath) {
     const bytes = Buffer.byteLength(relPath, "utf8");
     if (bytes <= 100)
         return { prefix: "", name: relPath };
     if (bytes > 255)
         return null;
-    // 从右往左找一个 "/",使 name ≤100 且 prefix ≤155(按字节算——多字节字符路径保守处理)。
     for (let i = relPath.length - 1; i > 0; i--) {
         if (relPath[i] !== "/")
             continue;
@@ -28,11 +19,6 @@ export function splitTarPath(relPath) {
     }
     return null;
 }
-/** 一个 regular-file 条目的 512B ustar 头。`mtimeSec` 由调用方给(快照无 per-file mtime ⇒ 统一用
- *  快照时刻/0——确定性输出,同輸入同字节)。 */
-/** ustar 的 size 字段是 12 字节八进制(11 位数字 + NUL)⇒ 上限 8 GiB−1。超了写进去会溢出到相邻
- *  字段/丢末位并**静默**产出坏头(复审 F8/A-LOW 实测:2^36 解析回来是值/8)。fail-loud,与
- *  splitTarPath 的病态路径同姿势。当前配置下不可达(快照总字节帽 256MiB),属防御纵深。 */
 const USTAR_MAX_SIZE = 8 * 1024 * 1024 * 1024 - 1;
 export function tarHeader(relPath, sizeBytes, mtimeSec) {
     if (!Number.isFinite(sizeBytes) || sizeBytes < 0 || sizeBytes > USTAR_MAX_SIZE) {
@@ -43,13 +29,13 @@ export function tarHeader(relPath, sizeBytes, mtimeSec) {
         throw new Error(`tar: path not representable in ustar (must be ≤255 bytes and splittable at "/"): ${relPath}`);
     const h = Buffer.alloc(BLOCK, 0);
     h.write(split.name, 0, 100, "utf8");
-    octal(0o644, 8).copy(h, 100); // mode
-    octal(0, 8).copy(h, 108); // uid
-    octal(0, 8).copy(h, 116); // gid
+    octal(0o644, 8).copy(h, 100);
+    octal(0, 8).copy(h, 108);
+    octal(0, 8).copy(h, 116);
     octal(sizeBytes, 12).copy(h, 124);
     octal(Math.max(0, Math.floor(mtimeSec)), 12).copy(h, 136);
-    h.fill(0x20, 148, 156); // chksum = spaces while summing
-    h.write("0", 156, 1, "ascii"); // typeflag: regular file
+    h.fill(0x20, 148, 156);
+    h.write("0", 156, 1, "ascii");
     h.write("ustar\0", 257, 6, "ascii");
     h.write("00", 263, 2, "ascii");
     h.write(split.prefix, 345, 155, "utf8");
@@ -59,11 +45,9 @@ export function tarHeader(relPath, sizeBytes, mtimeSec) {
     Buffer.from(sum.toString(8).padStart(6, "0") + "\0 ", "ascii").copy(h, 148);
     return h;
 }
-/** 内容块的 512 对齐尾垫(0 长内容=0 垫)。 */
 export function tarPadding(sizeBytes) {
     const rem = sizeBytes % BLOCK;
     return Buffer.alloc(rem === 0 ? 0 : BLOCK - rem, 0);
 }
-/** 归档终止:两块 512 零。 */
 export const TAR_END = Buffer.alloc(BLOCK * 2, 0);
 //# sourceMappingURL=tar.js.map

package/dist/http/verify-rounds.js

@@ -1,12 +1,7 @@
-/** Verification rounds requested by a caller, clamped to a safe [1,5] (default 2). */
 export function clampVerifyRounds(v) {
     const n = typeof v === "number" && Number.isFinite(v) ? Math.floor(v) : 2;
     return Math.min(5, Math.max(1, n));
 }
-/** `undefined` when `body.verify` is not `true` (the caller didn't opt into the gate); otherwise the clamped
- *  rounds + (if `maxCostUsd` is a positive number) the same USD→micro-USD cost ceiling the cascade lane uses.
- *  Same expression that lived inline at all four verify/resume call sites in http/server.ts (fresh-submit,
- *  resumeCheckpoint, resumePreempted, resumePlanReview) — collected here VERBATIM (design/97 R9). */
 export function verifyRoundsFromBody(body) {
     return body.verify === true
         ? {

package/dist/http/wire-gate.js

@@ -1,12 +1,3 @@
-/**
- * D-0 (design/80 §1): the single source of truth for the `CheckpointGate.kind` values the service emits on the
- * wire. The suspend path surfaces the gate VERBATIM (`append("suspended", { gate })`, server.ts), and the
- * agent-client SDK renders these as typed arms (an unknown kind falls through the SDK's open `(string & {})`
- * arm and renders generically). This explicit mirror exists so the compile-time guards below + the contract
- * test (`test/wire-gate-contract.test.ts`) keep the wire/SDK in lockstep with core — the guarantee the SDK's
- * own `spec.test.ts` cannot give (it hardcodes the kinds without importing core, so it would stay GREEN the
- * moment core adds a 6th kind; design/80 §3 #10 was therefore unenforced until this).
- */
 export const WIRE_GATE_KINDS = ["human", "irreversible_ask", "resource_limit", "needs_review", "task_done", "plan_review"];
 const _wireCoversCore = true;
 const _noStaleWireKind = true;

package/dist/http/workspace-content.js

@@ -1,13 +1,4 @@
-/**
- * design/158 A9 seam —— workspace 文件面的内容类型/二进制判别,从 `http/server.ts` 整段搬出的原文。
- * routes/sessions.ts 的 workspace 腿要用它,所以住在 http/ 叶子里(routes/* 不可值 import server.ts)。
- */
-/** workspace file 面的 content-type(#3,[1894]③):保守扩展名表——只收「浏览器渲染无歧义且
- *  无主动内容」的类型,其余一律 octet-stream(nosniff 恒带;html/svg 等可执行内容**故意**不进表,
- *  agent 产物=不可信,按下载处理)。 */
 export function workspaceContentType(relPath) {
-    // 🔴 复审 A-LOW:先确认**真有** `.` 再取扩展名——`lastIndexOf` 返回 -1 时 `slice(0)` 会把整个
-    // basename 当扩展名,于是一个名为 `png`/`pdf` 的任意内容文件会命中保守表按 image/png 发出。
     const base = relPath.slice(relPath.lastIndexOf("/") + 1);
     const dot = base.lastIndexOf(".");
     const ext = dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
@@ -19,7 +10,6 @@ export function workspaceContentType(relPath) {
     };
     return TABLE[ext] ?? "application/octet-stream";
 }
-/** 二进制判别([1894]③):首 8KiB 含 NUL 即二进制(git 同判据——快、稳、无误伤 UTF-8)。 */
 export function looksBinary(bytes) {
     const n = Math.min(bytes.byteLength, 8192);
     for (let i = 0; i < n; i++)

package/dist/images/bake-validate.js

@@ -1,25 +1,4 @@
-/**
- * Bake input WHITELIST + vetted-argv builder (IMAGE-API-DESIGN.md §P2.4 — the anti-RCE core).
- *
- * bands/profile/baseRef/bump compose a Dockerfile + a `FROM` + a `docker build` = arbitrary code on the build
- * host. So EVERY field is validated SERVER-SIDE against a CLOSED SET *before* an argv is built; off-list → an
- * error, never coerced. The runner only ever sees the VETTED argv this module emits (never operator free-text)
- * and only runs `build.sh`, which composes Dockerfiles from the in-repo `bands/` via `gen-dockerfile.sh` — there
- * is no path here to inject a raw Dockerfile or a shell command.
- *
- * Set membership is the gate (NOT regex): `^[a-z0-9-]+$` is belt-only — `python; rm -rf /` ∉ the frozen set →
- * rejected, and the argv is a RAW vetted VECTOR the runner array-spawns (each element in its own argv slot, no
- * shell), never concatenated into a command string.
- *
- * The frozen catalogs below MIRROR the recipe source of truth (`gen-dockerfile.sh` `profile_bands()` + the
- * `bands/` dir). A DRIFT test (test/image-bake-validate.test.ts) asserts they still match — a silently-drifted
- * list would either reject a valid profile or admit a removed band. Keep them in lockstep with the recipes.
- */
 import { SHA256_DIGEST_RE as DIGEST_RE } from "../digest-form.js";
-/**
- * FROZEN profile catalog — mirrored from `e2b-template/dev-sandbox/gen-dockerfile.sh` `profile_bands()`.
- * (db / browser-nodriver are opt-in overlays, NOT in `code-full` — `code-full-db` adds db; per design §4.)
- */
 export const FROZEN_PROFILES = [
     "code-python",
     "code-node",
@@ -41,7 +20,6 @@ export const FROZEN_PROFILES = [
     "code-full",
     "code-full-db",
 ];
-/** FROZEN band set — mirrored from the `e2b-template/dev-sandbox/bands/` directory (one dir per band). */
 export const FROZEN_BANDS = [
     "python",
     "node",
@@ -63,11 +41,6 @@ export const FROZEN_BANDS = [
     "browser-nodriver",
     "db",
 ];
-/**
- * FROZEN bump-tool set — the toolchain identifiers a `--bump <tool>=<ver>` may target. Conservative union of the
- * version-overridable toolchains the bands accept (`<TOOL>_VERSION` env, build.sh forwards `--bump tool=ver`).
- * Set-membership is the gate; the value is range-checked by VER_RE. Off-list tool → 400 (never coerced).
- */
 export const FROZEN_BUMP_TOOLS = [
     "node",
     "python",
@@ -86,28 +59,14 @@ export const FROZEN_BUMP_TOOLS = [
 const PROFILE_SET = new Set(FROZEN_PROFILES);
 const BAND_SET = new Set(FROZEN_BANDS);
 const BUMP_TOOL_SET = new Set(FROZEN_BUMP_TOOLS);
-/** Bump value range (P2.4d): printable version-ish tokens only, ≤40 chars — folds into the lockhash. */
 export const VER_RE = /^[A-Za-z0-9._-]{1,40}$/;
-/** Belt-only band shape (set-membership is the real gate); a defense-in-depth reject of structurally weird ids. */
 export const BAND_SHAPE_RE = /^[a-z0-9-]+$/;
 function reject(status, error, conflictBands) {
     return conflictBands ? { ok: false, status, error, conflictBands } : { ok: false, status, error };
 }
-/**
- * Validate + normalize a `POST /v1/images/bakes` body into a vetted argv, or a typed rejection.
- *
- * Order is deliberate: profile XOR bands → bands set-membership (dupes/empties/shape) → bump set+range →
- * baseRef shape (the index allow-list check is done by the caller via `baseRefAllowed`, async) → build the
- * raw vetted argv. The output repo is server-fixed (`sema-images/<profile>`); the caller CANNOT set
- * `--tag` (build.sh auto-computes the immutable tag — kills namespace-squat) nor an arbitrary `FROM`.
- *
- * `baseRefAllowed` is checked HERE for shape only; the digest-in-index allow-list is the caller's async step
- * (it owns the TiDB index). A present-but-malformed `baseRef` is rejected before any DB hit.
- */
 export function validateBake(body) {
     const hasProfile = body.profile !== undefined && body.profile !== null && body.profile !== "";
     const hasBands = body.bands !== undefined && body.bands !== null;
-    // profile XOR bands — exactly one required.
     if (hasProfile && hasBands)
         return reject(400, "provide profile OR bands, not both");
     if (!hasProfile && !hasBands)
@@ -126,7 +85,6 @@ export function validateBake(body) {
             return reject(400, "bands must be an array of band ids");
         if (body.bands.length === 0)
             return reject(400, "bands must be a non-empty array");
-        // Cap length at the all-bands count — a longer list can only be dupes/garbage.
         if (body.bands.length > FROZEN_BANDS.length)
             return reject(400, `at most ${FROZEN_BANDS.length} bands`);
         const seen = new Set();
@@ -139,21 +97,18 @@ export function validateBake(body) {
             if (seen.has(raw))
                 return reject(400, `duplicate band '${raw}'`);
             seen.add(raw);
-            // "custom"/tenant bands are a P4 affordance → 501 (not a 400) so the UI distinguishes "not yet" from "bad".
             if (!BAND_SET.has(raw))
                 offList.push(raw);
         }
         if (offList.length > 0) {
-            // An off-list band that is the reserved tenant marker routes to P4; any other off-list id is an unknown band.
             if (offList.includes("custom")) {
                 return reject(501, "custom/tenant bake is P4");
             }
             return reject(400, `unknown band(s): ${offList.join(", ")}`, offList);
         }
         bands = body.bands;
-        profile = "custom"; // build.sh records profile="custom" for --bands; the argv carries --bands, not --profile.
+        profile = "custom";
     }
-    // bump — {tool:ver}: tool ∈ FROZEN_BUMP_TOOLS, ver ∈ VER_RE. Off-list/range → 400.
     let bump = null;
     if (body.bump !== undefined && body.bump !== null) {
         if (typeof body.bump !== "object" || Array.isArray(body.bump)) {
@@ -170,8 +125,6 @@ export function validateBake(body) {
         }
         bump = Object.keys(out).length > 0 ? out : null;
     }
-    // baseRef — caller CANNOT pass an arbitrary FROM. Shape-check here (the index allow-list is the caller's async
-    // step). Default = the pinned current base, injected by the caller when baseRef is absent.
     let baseRef = null;
     if (body.baseRef !== undefined && body.baseRef !== null && body.baseRef !== "") {
         if (typeof body.baseRef !== "string" || !DIGEST_RE.test(body.baseRef)) {
@@ -182,7 +135,6 @@ export function validateBake(body) {
     const push = body.push === true;
     const dryRun = body.dryRun === true;
     const logs = body.logs === true;
-    // pkgSource — RFC B4 closed set (cn|global); off-list → 400, never coerced (same discipline as every field).
     let pkgSource = null;
     if (body.pkgSource !== undefined && body.pkgSource !== null && body.pkgSource !== "") {
         if (body.pkgSource !== "cn" && body.pkgSource !== "global") {
@@ -200,25 +152,9 @@ export function validateBake(body) {
         dryRun,
         logs,
         pkgSource,
-        // argv is built by the caller AFTER it resolves the effective baseRef (the index allow-list + default base).
         argv: [],
     };
 }
-/**
- * Build the VETTED, NORMALIZED build.sh argv from an accepted validation + the caller-resolved effective fields
- * (the index-checked baseRef and the build-host CACHE_BASE — both runner-environment facts image-api injects,
- * never operator free-text). The elements are RAW (no shell-quoting): the runner array-spawns build.sh so each
- * element lands in its own argv slot (no shell can re-interpret a frozen-set value). The runner runs
- * `build.sh <argv...>` and ONLY this.
- *
- * Server-fixed invariants enforced here (NOT caller-settable, P2.4d):
- *   - `--json` always (machine output the runner parses).
- *   - selection is `--profile <p>` XOR `--bands a,b,c` (already vetted).
- *   - NO `--tag` (build.sh auto-computes the immutable tag — kills namespace-squat / overwrite-by-naming).
- *   - the output repo is server-fixed `sema-images/<profile>` (build.sh's IMAGE_PREFIX default; not forwarded).
- *   - `--base-ref` is the index-checked effective base (caller resolves the default when absent).
- *   - `--cache-base` is the build-host promoted cache (runner env).
- */
 export function buildBakeArgv(v, effective) {
     const args = [];
     if (v.bands && v.bands.length > 0) {
@@ -242,11 +178,6 @@ export function buildBakeArgv(v, effective) {
     if (v.dryRun)
         args.push("--dry-run");
     args.push("--json");
-    // Return the RAW vetted vector. Set-membership against FROZEN_PROFILES/BANDS/BUMP_TOOLS is the RCE gate; the
-    // runner array-spawns build.sh with each element in its own argv slot (no shell), so a frozen-set value can
-    // never be re-interpreted by a shell. Shell-quoting here would embed literal single-quotes into each slot →
-    // build.sh sees `'--profile'` (quotes included) and dies "unknown arg" on the first one (H2). Quoting is wrong
-    // for an array-spawn boundary; the injection boundary is the array slot, not a joined command string.
     return args;
 }
 //# sourceMappingURL=bake-validate.js.map

package/dist/images/manifest.js

@@ -4,18 +4,16 @@ const NESTED_BUILD_MODES = [
     "rootless-buildkit",
     "privileged-dind",
 ];
-/** Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract). */
 export function nestedBuildModeOf(v) {
     if (typeof v === "string") {
         return NESTED_BUILD_MODES.includes(v)
             ? v
             : v
-                ? "rootless-buildkit" // an unknown non-empty posture is treated as the safe default the pool uses
+                ? "rootless-buildkit"
                 : "none";
     }
     return v ? "rootless-buildkit" : "none";
 }
-/** Parse a docker-style size ("64m" / "512M" / "1g") → MB. Undefined on an unparseable / absent value. */
 export function shmToMB(v) {
     if (!v)
         return undefined;
@@ -25,14 +23,12 @@ export function shmToMB(v) {
     const n = Number(m[1]);
     return (m[2] ?? "m").toLowerCase() === "g" ? n * 1024 : n;
 }
-/** --bands builds record profile="custom", so the tag's repo part ("code-flutter:tag" → "code-flutter") wins. */
 export function profileFromManifest(m) {
     if (m.profile && m.profile !== "custom")
         return m.profile;
     const repo = (m.tag ?? "").split(":")[0] ?? "";
     return repo || m.profile || "custom";
 }
-/** Pure projection: a build.sh manifest + the push-time facts → an index upsert. */
 export function manifestToIndexEntry(m, opts) {
     const profile = profileFromManifest(m);
     const tag = (m.tag ?? "").includes(":") ? (m.tag ?? "").split(":")[1] : (m.tag ?? "");
@@ -61,7 +57,6 @@ export function manifestToIndexEntry(m, opts) {
         sizeBytes: opts.sizeBytes ?? m.sizeBytes ?? null,
         status: opts.status ?? "published",
         visibility,
-        // a tenant image carries its owner; the standard pool's "standard-pool" owner is NOT a tenant.
         tenantId: visibility === "tenant" && m.owner && m.owner !== "standard-pool" ? m.owner : null,
         manifestSha: opts.manifestSha ?? null,
         recipeGitSha: m.recipeGitSha && m.recipeGitSha !== "nogit" ? m.recipeGitSha : null,

package/dist/index.js

@@ -1,14 +1,7 @@
-// Library surface (for embedding the service wiring in another Node app — e.g. the shell's seamless local mode
-// runs the sema-server HTTP wire in-process via createHttpServer + a local StoreBackend).
 export { loadConfig } from "./config.js";
 export { createBrain } from "./brain.js";
 export { createSessionStore } from "./plugins/session-store.js";
-// design/158 B5-①([1971] 声明后落):中立后端缝 —— 嵌入姿势(见顶注)= createHttpServer + StoreBackend。
 export { createStoreBackend } from "./plugins/store-backend.js";
-// ── B5-②(clay 两拍终裁 2026-07-30:cli/core 零消费,弃用窗撤销直接删)——6 个 TiDB 方言专属导出已摘 ──
-// 判据:①backend-可插铁律(公面即承诺,方言类在公面=邀请绕过中立缝直连方言);②公面瘸腿(PG 孪生
-// 从未导出);③全生态扫描零消费。替代:构造走 createStoreBackend(kind mysql|pg|local),DDL 审阅走
-// docs/schema/baseline-{mysql,pg}.sql(生成基线,机器门逐字节)。类/函数本体仍是内部实现(深径 import)。
 export { CachingSessionStore } from "./plugins/caching-session-store.js";
 export { runInBackground } from "./runs.js";
 export { createHardenedVmRunner, runInHardenedVm } from "./orchestration/hardened-vm-runner.js";
@@ -22,25 +15,11 @@ export { nowTool } from "./capabilities/builtin-tools.js";
 export { createCouncilTool } from "./capabilities/code-review-council.js";
 export { loadSkills, skillsForScenario } from "./capabilities/skills.js";
 export { buildScenarios, selectScenario, } from "./capabilities/scenarios.js";
-// #318:会话级任务清单车道(嵌入式装配自己组 ScenarioDeps 时接 `taskListStoreFor` 的属主工厂)。
-// 两条 `ensure*TaskListSchema` 一并导出:车道**不建表**(建表属主 = 调它的装配层,见车道顶注),
-// 所以走 SQL 臂的嵌入式装配必须自己先 await 对应方言的 ensure —— 不导出等于把那一步藏起来。
 export { createTaskListLane, taskListKeyFor, MAX_TASK_LIST_SESSIONS } from "./boot/task-list-lane.js";
 export { ensureTiDBTaskListSchema, ensurePgTaskListSchema } from "./plugins/task-list-store-sql.js";
 export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
 export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { createHttpServer, } from "./http/server.js";
-// ── A-057.8:`ServiceCoreDeps.sideQuery` 是**必填**席,而它的装配链此前整条不在公面上 ──
-// CHANGELOG 对自建 `ServiceDeps` 的嵌入方逐字指路「按 `createSideQueryLane` 装配即可」,但
-// `package.json` 的 `exports` 只开 `.` / `./main` / `./package.json`(无通配、无 typesVersions),
-// `files` 又只出 `dist` ⇒ 安装态里被指路的那个源文件读都读不到,深径 import 必
-// `ERR_PACKAGE_PATH_NOT_EXPORTED`。嵌入方于是只剩「手抄一份 per-model key 解析 + poison 处理」,
-// 而抄漏 poison 那半 = 拿共享网关账号去打别家上游,正是 #303 立案要修的凭据外泄病灶本身。
-// 🔴 poison 的判别式(`isSealedKeyPoison` / `SealedKeyPoisonedError`)与工厂**同批**出面是刻意的:
-// 只给工厂不给判据,嵌入方对「sealed key 解不开」就只能靠 message 猜,而猜错的方向恰好是静默回落
-// 网关 key(安全轴上没有静默降级 —— CLAUDE.md #157)。
-// 🔴 这五个值导出必须保持**值**形态(不许改成 `export type`):门 = `test/export-liveness-gate.test.ts`
-// 的 gate:embedder-assembly-exports(表内符号缺一即红;runtime 类被 type-only 化同样红)。
 export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-lane.js";
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isSealedKeyPoison, SealedKeyPoisonedError } from "./sealed-key.js";

package/dist/key-resolver.js

@@ -7,30 +7,15 @@ export function createKeyResolver(modelApiKeyEnv, env = process.env, modelApiKey
         return apiKey ? { apiKey } : undefined;
     };
 }
-/**
- * The ONE per-model key chain, synchronous: **sealed custody → env-NAME reference → (caller's) gateway key**,
- * with a poisoned sealed entry THROWING instead of returning undefined. `createKeyResolver` is the async
- * `getApiKeyAndHeaders` face of exactly this function — every other consumer must call it rather than
- * re-implement a subset of the chain.
- *
- * 复审 2026-07-29(同族缺口):`brain.ts` 的反应式降级 hop 曾只查 `modelApiKeyEnv` —— sealed-box 托管密钥的
- * 降级目标(按互斥契约**永不**落 modelApiKeyEnv)于是静默拿网关 key 打自己的网关(错 key 打上游),毒丸更
- * 被当成"没配 key"。链只有一条,重复实现就会长出这种半条链的偏差,故此处抽出同步内核共用。
- *
- * `undefined` = this model has no per-model key ⇒ the CALLER's gateway/default credential applies (the
- * additive contract). An empty env value counts as unset (unchanged from the original inline chain).
- */
 export function resolveModelApiKey(modelName, modelApiKeyEnv, env = process.env, modelApiKeys = {}) {
     const sealed = modelApiKeys[modelName];
-    // Poison pill: the operator configured a sealed key for this model but it cannot be unsealed —
-    // fail the brain call LOUD (never undefined = never the gateway fallback).
     if (isSealedKeyPoison(sealed))
         throw new SealedKeyPoisonedError(modelName, sealed);
     if (sealed)
-        return sealed; // sealed-box custody wins (registry-core: sealed 压过 apiKeyEnv)
+        return sealed;
     const envName = modelApiKeyEnv[modelName];
     if (!envName)
-        return undefined; // model has no per-model key → core uses the gateway key
+        return undefined;
     return env[envName] || undefined;
 }
 //# sourceMappingURL=key-resolver.js.map

package/dist/leader/diffout.js

@@ -1,33 +1,15 @@
-/**
- * 一次 diff 的字节帽(pull 腿与 push/上行腿**共用同一个数**)。
- *
- * 🔴 exported 是判据的一部分(2026-08-08,#176 二轮扫描 finding):`diffup.ts` 原先另抄了一份同值常量,
- * 而它**本就已经** `import { safeRev } from "./diffout.js"` —— 依赖边在,共享零成本。两份手抄的后果不是
- * 「多写一行」,是**单边改值后上行/pull 两腿对同一个 diff 的过/拒判定分家**:同一份补丁在一条腿上过、
- * 另一条腿上被截断,而两处都「按自己的常量」正确工作,没有任何一处会报错。
- * (同族先例:`checkpoint-store-sql.ts` 的 `export const TERMINAL_GRACE_MS`。)
- */
 export const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 const DEFAULT_READ_TIMEOUT_MS = 30_000;
-/** A safe git rev token: sha, branch/tag name, or `A..B`. No shell metacharacters, no leading dash.
- *  🔗 近亲判据:`leader/planner.ts` 的 branch 校验用同一套字符类 + 同一个 200 上限 + 同样拒前导 `-`,
- *  只在 `..` 上有意分家(这里要放行 `A..B` 区间形,那边全拒)。差异与候裁说明写在 planner 那处
- *  (#176 二轮扫描 finding)——单边加字符类成员时,请两处一起看。 */
 const SAFE_REV = /^[A-Za-z0-9._/-]{1,200}$/;
 export function safeRev(rev) {
     return SAFE_REV.test(rev) && !rev.startsWith("-") && !rev.includes("..--");
 }
-/**
- * Pull `<baseSha>..<ref>` from a worker container as a `git format-patch` series. Never throws — failures
- * (bad rev, non-zero git, truncation, transport loss, empty diff) are returned as `{ ok: false }`.
- */
 export async function pullDiff(env, baseSha, opts = {}) {
     const ref = opts.ref ?? "HEAD";
     if (!safeRev(baseSha) || !safeRev(ref)) {
         return { ok: false, error: `unsafe git rev (baseSha=${JSON.stringify(baseSha)} ref=${JSON.stringify(ref)})` };
     }
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_DIFF_BYTES;
-    // --stdout (council#14): emit the whole series to stdout, not .patch files. Newest-last (default order).
     const cmd = `git format-patch --stdout ${baseSha}..${ref}`;
     let patch = "";
     let bytes = 0;
@@ -36,7 +18,7 @@ export async function pullDiff(env, baseSha, opts = {}) {
     try {
         for await (const chunk of env.execStream(cmd, {
             ...(opts.cwd ? { cwd: opts.cwd } : {}),
-            maxOutputBytes: maxBytes + 1, // +1 so we can DETECT the overflow (council#13 fail-on-truncation)
+            maxOutputBytes: maxBytes + 1,
             readTimeoutMs: opts.readTimeoutMs ?? DEFAULT_READ_TIMEOUT_MS,
             ...(opts.signal ? { signal: opts.signal } : {}),
         })) {
@@ -56,7 +38,6 @@ export async function pullDiff(env, baseSha, opts = {}) {
         }
     }
     catch (e) {
-        // execStream throws on transport loss / suspendVM-aborted in-flight command (no exit chunk).
         return { ok: false, error: `execStream failed before exit: ${e instanceof Error ? e.message : String(e)}` };
     }
     if (exitCode === undefined) {