@sema-agent/server 7.8.0 → 7.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -2569,7 +2569,12 @@ export function createHttpServer(rawDeps) {
2569
2569
  sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
2570
2570
  return false;
2571
2571
  }
2572
- if (owner !== null && principal !== owner) {
2572
+ // [3273] C8:窄互认的读面半场——[3262] 只修了提交/续发面(createAuthorizer),head/audit/events
2573
+ // 三读面走本函数,7.8.0 未同窗 ⇒ cli 停发哨兵头后存量会话「能续跑但看不见」,且 404 与「压根
2574
+ // 不存在」黑盒同形(test [3273] 实测)。同 security.ts 三条件窄臂,语义/墓碑注同源(存量随会话
2575
+ // 生命周期消亡后可整删);带具名 principal 的请求对哨兵行仍走下方 404 无 oracle 形。
2576
+ const legacyShellOwner = !deps.config.requirePrincipal && owner === "anon:shell-live" && (principal === undefined || principal === null);
2577
+ if (!legacyShellOwner && owner !== null && principal !== owner) {
2573
2578
  sendError(res, 404, "not_found.run", "run not found"); // don't reveal existence to non-owners
2574
2579
  return false;
2575
2580
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sema-agent/server",
3
- "version": "7.8.0",
3
+ "version": "7.8.1",
4
4
  "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
5
5
  "type": "module",
6
6
  "license": "BUSL-1.1",
@@ -69,7 +69,7 @@
69
69
  "sharp": "^0.35.3"
70
70
  },
71
71
  "devDependencies": {
72
- "@sema-agent/sdk": "^6.10.0",
72
+ "@sema-agent/sdk": "^6.11.0",
73
73
  "@types/libsodium-wrappers": "^0.7.14",
74
74
  "@types/node": "22.10.2",
75
75
  "@types/pg": "^8.20.0",