@sema-agent/settings-schema 10.1.0 → 11.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "10.1.0",
-  "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
+  "version": "11.0.0",
+  "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-web-admin, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",
   "repository": {
@@ -84,6 +84,10 @@
       "types": "./dist/node.d.ts",
       "default": "./dist/node.js"
     },
+    "./one-time-migrations": {
+      "types": "./dist/one-time-migrations.d.ts",
+      "default": "./dist/one-time-migrations.js"
+    },
     "./scheduler-store": {
       "types": "./dist/scheduler-store.d.ts",
       "default": "./dist/scheduler-store.js"
@@ -96,10 +100,6 @@
       "types": "./dist/fleet.d.ts",
       "default": "./dist/fleet.js"
     },
-    "./migrate": {
-      "types": "./dist/migrate.d.ts",
-      "default": "./dist/migrate.js"
-    },
     "./api/auth": {
       "types": "./dist/api/auth.d.ts",
       "default": "./dist/api/auth.js"
@@ -111,6 +111,14 @@
     "./api/scopes": {
       "types": "./dist/api/scopes.d.ts",
       "default": "./dist/api/scopes.js"
+    },
+    "./api/pull-token": {
+      "types": "./dist/api/pull-token.d.ts",
+      "default": "./dist/api/pull-token.js"
+    },
+    "./api/feedback": {
+      "types": "./dist/api/feedback.d.ts",
+      "default": "./dist/api/feedback.js"
     }
   },
   "files": [
@@ -138,16 +146,16 @@
     "publish:npm": "npm publish --access public --@sema-agent:registry=https://registry.npmjs.org/ --\"//registry.npmjs.org/:_authToken=${NPM_TOKEN}\""
   },
   "devDependencies": {
-    "@sema-agent/core": "7.33.1",
+    "@sema-agent/core": "7.47.0",
     "@types/node": "^22.10.0",
     "esbuild": "^0.21.5",
     "typescript": "^5.7.0",
     "vitest": "^2.1.0"
   },
   "dependencies": {
-    "zod": "^3.24.0"
+    "zod": "^4.4.0"
   },
   "peerDependencies": {
-    "zod": "^3.24.0"
+    "zod": "^4.4.0"
   }
 }

package/conformance/cases/c46-s811-host-name-url-userinfo-characterization/meta.json

@@ -1,6 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "🚧 S-811 特征格(既有,非回归;本版刻意不修,设计随 S-809 三表归一):超长主机名 `https://admin:hunter2@hhh…h.com`(81 字)被 `hosts-grandfathered` 按名剔掉,`droppedNames` 的标签过出门那一道 —— 但那一道(`redactSecrets`)不查 URL userinfo,于是 63 字标签里原样带着 `admin:hunter2`。本条把**今天的读数**钉成金样:S-811 修后(自由文本面加 userinfo 判定)本条翻红 —— 届时金样改成 `droppedNames: [\"[redacted-secret]\"]`、meta.secrets 补上 `hunter2`,这一格就从特征钉变成护栏。",
-  "firstRedOn": [],
-  "note": "车PE(2026-09-27)按主会话令加(codex 验修腿 [high] S-811)。刻意**不**在 secrets 里登 `hunter2`:登了,告警面零命中门会把今天的现状判红 —— 现状要能如实入库,修复时一并补。"
-}

package/conformance/cases/c47-s811-roles-key-url-userinfo-characterization/meta.json

@@ -1,6 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "🚧 S-811 特征格(既有,非回归;本版刻意不修,设计随 S-809 三表归一):坏 roles 键 `https://admin:hunter2@db.example.com/x` 被逐条丢掉,坐标段与 zod 回显的 received / message 都只过 `redactSecrets`,它不查 URL userinfo,于是坐标 `[\"roles\", \"https://admin:hunter2@db.example.com/x\"]` 原样出门(错误句同带)。同一个串作身份 6.3.0 起不可披露(身份面有 userinfo 否决),自由文本面没有 —— 本条把今天的读数钉成金样:S-811 修后本条翻红,届时坐标段改成 `[redacted-secret]`、meta.secrets 补上 `hunter2`。",
-  "firstRedOn": [],
-  "note": "车PE(2026-09-27)按主会话令加(codex 验修腿 [high] S-811)。刻意**不**在 secrets 里登 `hunter2`(登了即判红今天的现状)。"
-}

package/conformance/migrate-workers/m01-g5-k8s-env-lifted/expected.json

@@ -1,49 +0,0 @@
-{
-  "doc": {
-    "workers": [
-      {
-        "name": "direct",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0,
-          "execution": {
-            "lane": "k8s",
-            "coords": {
-              "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
-              "K8S_NAMESPACE": "sandboxes"
-            },
-            "secretRefs": {}
-          },
-          "store": {
-            "backend": "local",
-            "session": "auto"
-          }
-        },
-        "coords": {},
-        "env": {
-          "LOG_LEVEL": "debug"
-        }
-      }
-    ]
-  },
-  "changed": [
-    "direct"
-  ],
-  "dropped": [
-    {
-      "name": "direct",
-      "index": 0,
-      "field": [
-        "runtime",
-        "memoryBackend"
-      ]
-    }
-  ],
-  "refused": []
-}

package/conformance/migrate-workers/m01-g5-k8s-env-lifted/input.json

@@ -1,26 +0,0 @@
-{
-  "workers": [
-    {
-      "name": "direct",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "sessionBackend": "auto",
-        "memoryBackend": "off",
-        "requirePrincipal": false,
-        "rateLimitRpm": 0
-      },
-      "coords": {},
-      "env": {
-        "REMOTE_EXEC": "k8s",
-        "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
-        "K8S_NAMESPACE": "sandboxes",
-        "LOG_LEVEL": "debug"
-      }
-    }
-  ]
-}

package/conformance/migrate-workers/m01-g5-k8s-env-lifted/meta.json

@@ -1,4 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "G5 正臂:6.x 活舰队形(env.REMOTE_EXEC=k8s + 同车道 K8S_*)⇒ runtime.execution {lane: k8s, coords 搬入},env 里两键消失、非车道键留下;memoryBackend 进 dropped(从未生效);无 SQL 坐标 ⇒ store.backend local。"
-}

package/conformance/migrate-workers/m02-g5-idempotent/expected.json

@@ -1,38 +0,0 @@
-{
-  "doc": {
-    "workers": [
-      {
-        "name": "direct",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0,
-          "execution": {
-            "lane": "k8s",
-            "coords": {
-              "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
-              "K8S_NAMESPACE": "sandboxes"
-            },
-            "secretRefs": {}
-          },
-          "store": {
-            "backend": "local",
-            "session": "auto"
-          }
-        },
-        "coords": {},
-        "env": {
-          "LOG_LEVEL": "debug"
-        }
-      }
-    ]
-  },
-  "changed": [],
-  "dropped": [],
-  "refused": []
-}

package/conformance/migrate-workers/m02-g5-idempotent/input.json

@@ -1,33 +0,0 @@
-{
-  "workers": [
-    {
-      "name": "direct",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "requirePrincipal": false,
-        "rateLimitRpm": 0,
-        "execution": {
-          "lane": "k8s",
-          "coords": {
-            "K8S_SANDBOX_IMAGE": "registry.internal/sandbox@sha256:abc",
-            "K8S_NAMESPACE": "sandboxes"
-          },
-          "secretRefs": {}
-        },
-        "store": {
-          "backend": "local",
-          "session": "auto"
-        }
-      },
-      "coords": {},
-      "env": {
-        "LOG_LEVEL": "debug"
-      }
-    }
-  ]
-}

package/conformance/migrate-workers/m02-g5-idempotent/meta.json

@@ -1,5 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "G5 幂等:输入 = m01 的迁移输出(已迁形)⇒ changed / dropped / refused 全空,doc 字节相等。input.json 由加冕脚本从 m01 的 expected 生成,不手写。",
-  "inputFrom": "m01-g5-k8s-env-lifted"
-}

package/conformance/migrate-workers/m03-g5-refused-no-lane/expected.json

@@ -1,71 +0,0 @@
-{
-  "doc": {
-    "workers": [
-      {
-        "name": "canary",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0,
-          "execution": {
-            "lane": "e2b",
-            "coords": {},
-            "secretRefs": {
-              "E2B_API_KEY": "HOST_E2B_KEY"
-            }
-          },
-          "store": {
-            "backend": "local",
-            "session": "auto"
-          }
-        },
-        "coords": {}
-      }
-    ]
-  },
-  "changed": [
-    "canary"
-  ],
-  "dropped": [
-    {
-      "name": "canary",
-      "index": 1,
-      "field": [
-        "runtime",
-        "memoryBackend"
-      ]
-    }
-  ],
-  "refused": [
-    {
-      "name": "handless",
-      "index": 0,
-      "field": [
-        "env",
-        "REMOTE_EXEC"
-      ],
-      "reason": "an enabled worker names no execution lane (env.REMOTE_EXEC is unset) — it boots with no hands and still reports tasks completed. The migration does not guess a lane: set runtime.execution.lane (host | e2b | k8s | ssh | adb | local-docker | device) by hand, or disable the worker",
-      "original": {
-        "name": "handless",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "sessionBackend": "auto",
-          "memoryBackend": "off",
-          "requirePrincipal": false,
-          "rateLimitRpm": 0
-        },
-        "coords": {}
-      }
-    }
-  ]
-}

package/conformance/migrate-workers/m03-g5-refused-no-lane/input.json

@@ -1,42 +0,0 @@
-{
-  "workers": [
-    {
-      "name": "handless",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "sessionBackend": "auto",
-        "memoryBackend": "off",
-        "requirePrincipal": false,
-        "rateLimitRpm": 0
-      },
-      "coords": {}
-    },
-    {
-      "name": "canary",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "sessionBackend": "auto",
-        "memoryBackend": "off",
-        "requirePrincipal": false,
-        "rateLimitRpm": 0
-      },
-      "coords": {},
-      "env": {
-        "REMOTE_EXEC": "e2b"
-      },
-      "secretEnv": {
-        "E2B_API_KEY": "HOST_E2B_KEY"
-      }
-    }
-  ]
-}

package/conformance/migrate-workers/m03-g5-refused-no-lane/meta.json

@@ -1,4 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "G5 refused:enabled 且无 env.REMOTE_EXEC 的 worker(WA-49 病例本身)⇒ refused 点名 env.REMOTE_EXEC,不进输出 doc;同域的 canary(e2b,密钥在 secretEnv)照迁进 runtime.execution.secretRefs。"
-}

package/conformance/migrate-workers/m04-g7b-session-tidb-lifted/expected.json

@@ -1,52 +0,0 @@
-{
-  "doc": {
-    "workers": [
-      {
-        "name": "persist",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY",
-          "dbPasswordEnv": "HOST_TIDB_PW"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0,
-          "execution": {
-            "lane": "host",
-            "coords": {},
-            "secretRefs": {}
-          },
-          "store": {
-            "backend": "mysql",
-            "session": "mysql",
-            "db": {
-              "host": "tidb.internal",
-              "port": 4000,
-              "user": "svc",
-              "database": "sema"
-            }
-          }
-        },
-        "coords": {
-          "gitApiBaseUrl": "https://git.internal"
-        }
-      }
-    ]
-  },
-  "changed": [
-    "persist"
-  ],
-  "dropped": [
-    {
-      "name": "persist",
-      "index": 0,
-      "field": [
-        "runtime",
-        "memoryBackend"
-      ]
-    }
-  ],
-  "refused": []
-}

package/conformance/migrate-workers/m04-g7b-session-tidb-lifted/input.json

@@ -1,30 +0,0 @@
-{
-  "workers": [
-    {
-      "name": "persist",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY",
-        "tidbPasswordEnv": "HOST_TIDB_PW"
-      },
-      "runtime": {
-        "sessionBackend": "tidb",
-        "memoryBackend": "off",
-        "requirePrincipal": false,
-        "rateLimitRpm": 0,
-        "db": "sema"
-      },
-      "coords": {
-        "gitApiBaseUrl": "https://git.internal",
-        "tidbHost": "tidb.internal",
-        "tidbPort": 4000,
-        "tidbUser": "svc"
-      },
-      "env": {
-        "REMOTE_EXEC": "host"
-      }
-    }
-  ]
-}

package/conformance/migrate-workers/m04-g7b-session-tidb-lifted/meta.json

@@ -1,4 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "G7b:旧形 runtime.sessionBackend tidb(今天引擎见之拒启)+ tidb 坐标 ⇒ store {backend: mysql, session: mysql, db} + secretRefs.dbPasswordEnv —— 改成能起的形 + 通知行,不是拒。"
-}

package/conformance/migrate-workers/m05-row-verdict-reserved-env/expected.json

@@ -1,82 +0,0 @@
-{
-  "doc": {
-    "workers": [
-      {
-        "name": "alpha",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0,
-          "execution": {
-            "lane": "host",
-            "coords": {},
-            "secretRefs": {}
-          },
-          "store": {
-            "backend": "local",
-            "session": "auto"
-          }
-        },
-        "coords": {}
-      },
-      {
-        "name": "gamma",
-        "enabled": false,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0
-        },
-        "coords": {}
-      }
-    ]
-  },
-  "changed": [],
-  "dropped": [],
-  "refused": [
-    {
-      "name": "beta",
-      "index": 1,
-      "field": [
-        "env"
-      ],
-      "reason": "the stored worker is not a valid WorkerSpec — env: env cannot set reserved key \"FLEET_GENERATION\" — set it via (set by the config renderer from the worker's generation — not configurable)",
-      "original": {
-        "name": "beta",
-        "enabled": true,
-        "host": "default",
-        "image": "sema-server:latest",
-        "secretRefs": {
-          "apiKeyEnv": "MODEL_KEY"
-        },
-        "runtime": {
-          "requirePrincipal": false,
-          "rateLimitRpm": 0,
-          "execution": {
-            "lane": "host",
-            "coords": {},
-            "secretRefs": {}
-          },
-          "store": {
-            "backend": "local",
-            "session": "auto"
-          }
-        },
-        "coords": {},
-        "env": {
-          "FLEET_GENERATION": "7",
-          "LOG_LEVEL": "debug"
-        }
-      }
-    }
-  ]
-}

package/conformance/migrate-workers/m05-row-verdict-reserved-env/input.json

@@ -1,68 +0,0 @@
-{
-  "workers": [
-    {
-      "name": "alpha",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "requirePrincipal": false,
-        "rateLimitRpm": 0,
-        "execution": {
-          "lane": "host",
-          "coords": {},
-          "secretRefs": {}
-        },
-        "store": {
-          "backend": "local",
-          "session": "auto"
-        }
-      },
-      "coords": {}
-    },
-    {
-      "name": "beta",
-      "enabled": true,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "requirePrincipal": false,
-        "rateLimitRpm": 0,
-        "execution": {
-          "lane": "host",
-          "coords": {},
-          "secretRefs": {}
-        },
-        "store": {
-          "backend": "local",
-          "session": "auto"
-        }
-      },
-      "coords": {},
-      "env": {
-        "FLEET_GENERATION": "7",
-        "LOG_LEVEL": "debug"
-      }
-    },
-    {
-      "name": "gamma",
-      "enabled": false,
-      "host": "default",
-      "image": "sema-server:latest",
-      "secretRefs": {
-        "apiKeyEnv": "MODEL_KEY"
-      },
-      "runtime": {
-        "requirePrincipal": false,
-        "rateLimitRpm": 0
-      },
-      "coords": {}
-    }
-  ]
-}

package/conformance/migrate-workers/m05-row-verdict-reserved-env/meta.json

@@ -1,4 +0,0 @@
-{
-  "contributor": "contract",
-  "claim": "8.2.0 逐行终判:一份已是 7.x 形的 workers 文档(三行都不需要迁),其中 beta 在 env 里设了保留名 FLEET_GENERATION(渲染器是它的唯一写手)⇒ beta 进 refused(field = env,拒因是读侧自己那句,点名保留键与它的唯一写位),alpha / gamma 原样留在 doc,changed / dropped 为空;过滤后的 doc 整域读得进。8.1.0 及以前这份文档迁移回零变化、随后整域读抛。"
-}