@sema-agent/settings-schema 6.3.0 → 7.0.0

package/dist/remote-exec.d.ts

@@ -1,26 +1,29 @@
 /**
  * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
  *
- * Per the product owner's decision the exec layer is user-configurable & pluggable. This SCHEMA is a
- * FORWARD-COMPATIBLE SUPERSET: it carries both the backends the worker service already implements today AND the
- * TOC single-machine backends the product owner added (the service implements those in PHASES — host + e2b first,
- * local/remote-docker fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
- *   FLEET (implemented today, the worker service's config module):
+ * The exec layer is user-configurable & pluggable. This SCHEMA carries the per-machine `config.d/remote-exec.json`
+ * shape for the lanes a consumer can drive from that file. The discriminator is `provider`:
+ *   FLEET:
  *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
  *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
  *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
  *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
- *   TOC single-machine (product-owner scope; service implements in phases — macOS + Linux first):
+ *   TOC single-machine (macOS + Linux):
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
- *                     agent). No isolation. macOS/Linux.
+ *                     agent). No isolation.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
- *   - `remote-docker` a user-specified REMOTE host's docker (offload; isolated).
+ *
+ * 7.0.0: every `provider` word here is an execution lane word (`EXECUTION_LANE_WORDS`, `execution-lanes.ts` — the ONE
+ * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
+ * The `remote-docker` variant was DELETED (zero aliases): no engine read point ever turned that word into a running lane
+ * (the engine refuses `REMOTE_EXEC=remote-docker` at boot and only warned "unwired" when this file named it). A remote
+ * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`).
  *
  * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
- * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*, the remote-docker TLS/SSH creds) is carried here as an
- * env-NAME ref (the `ENV_NAME` regex from types.ts) — NEVER a literal value. The consumer resolves NAME → value
- * from its own env (service env / k8s secret / the TOC local `.env`), so this package never carries a
- * credential. This is SCHEMA + secret-as-env-NAME ONLY; the service owns the adapter implementations.
+ * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*) is carried here as an env-NAME ref (the `ENV_NAME` regex
+ * from types.ts) — NEVER a literal value. The consumer resolves NAME → value from its own env (service env / k8s
+ * secret / the TOC local `.env`), so this package never carries a credential. This is SCHEMA + secret-as-env-NAME
+ * ONLY; the service owns the adapter implementations.
  */
 import { z } from "zod";
 export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
@@ -61,7 +64,7 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     memory?: string | undefined;
     workdir?: string | undefined;
     cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
     mountPath?: string | undefined;
 }, {
     provider: "local-docker";
@@ -69,52 +72,8 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     memory?: string | undefined;
     workdir?: string | undefined;
     cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
-    mountPath?: string | undefined;
-}>, z.ZodObject<{
-    /** The remote docker endpoint — a DOCKER_HOST url: `ssh://user@host` or `tcp://host:2376`. A `user@` is OK
-     *  (it's the ssh target, not a secret); an embedded PASSWORD is rejected — credentials go in the env-NAME
-     *  fields below, NEVER in the URL (the secret-as-env-NAME boundary). */
-    dockerHost: z.ZodEffects<z.ZodString, string, string>;
-    /** env-NAMEs for a tcp+TLS endpoint (NEVER the cert/key bytes). */
-    tlsCertEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    tlsKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    tlsCaEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    /** env-NAME for the SSH private key when dockerHost is `ssh://…` (NEVER the key value). */
-    sshKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    image: z.ZodEffects<z.ZodString, string, string>;
-    memory: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    cpus: z.ZodOptional<z.ZodNumber>;
-    network: z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>;
-    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    provider: z.ZodLiteral<"remote-docker">;
-}, "strip", z.ZodTypeAny, {
-    provider: "remote-docker";
-    image: string;
-    dockerHost: string;
-    memory?: string | undefined;
-    workdir?: string | undefined;
-    cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
-    mountPath?: string | undefined;
-    tlsCertEnv?: string | undefined;
-    tlsKeyEnv?: string | undefined;
-    tlsCaEnv?: string | undefined;
-    sshKeyEnv?: string | undefined;
-}, {
-    provider: "remote-docker";
-    image: string;
-    dockerHost: string;
-    memory?: string | undefined;
-    workdir?: string | undefined;
-    cpus?: number | undefined;
-    network?: "none" | "host" | "bridge" | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
     mountPath?: string | undefined;
-    tlsCertEnv?: string | undefined;
-    tlsKeyEnv?: string | undefined;
-    tlsCaEnv?: string | undefined;
-    sshKeyEnv?: string | undefined;
 }>, z.ZodObject<{
     provider: z.ZodLiteral<"e2b">;
     /** env-NAME holding the E2B API key (service: E2B_API_KEY). NEVER the key. */
@@ -192,8 +151,8 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
 }, "strip", z.ZodTypeAny, {
     provider: "k8s";
     image: string;
-    cpu?: string | undefined;
     memory?: string | undefined;
+    cpu?: string | undefined;
     mountPath?: string | undefined;
     timeoutMs?: number | undefined;
     apiUrl?: string | undefined;
@@ -214,8 +173,8 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
 }, {
     provider: "k8s";
     image: string;
-    cpu?: string | undefined;
     memory?: string | undefined;
+    cpu?: string | undefined;
     mountPath?: string | undefined;
     timeoutMs?: number | undefined;
     apiUrl?: string | undefined;
@@ -242,19 +201,19 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodO
     privateKeyEnv: z.ZodEffects<z.ZodString, string, string>;
     mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
-    provider: "ssh";
     host: string;
+    provider: "ssh";
     username: string;
     privateKeyEnv: string;
-    mountPath?: string | undefined;
     port?: number | undefined;
+    mountPath?: string | undefined;
 }, {
-    provider: "ssh";
     host: string;
+    provider: "ssh";
     username: string;
     privateKeyEnv: string;
-    mountPath?: string | undefined;
     port?: number | undefined;
+    mountPath?: string | undefined;
 }>, z.ZodObject<{
     provider: z.ZodLiteral<"adb">;
     serial: z.ZodEffects<z.ZodString, string, string>;

package/dist/remote-exec.js

@@ -1,34 +1,37 @@
 /**
  * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
  *
- * Per the product owner's decision the exec layer is user-configurable & pluggable. This SCHEMA is a
- * FORWARD-COMPATIBLE SUPERSET: it carries both the backends the worker service already implements today AND the
- * TOC single-machine backends the product owner added (the service implements those in PHASES — host + e2b first,
- * local/remote-docker fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
- *   FLEET (implemented today, the worker service's config module):
+ * The exec layer is user-configurable & pluggable. This SCHEMA carries the per-machine `config.d/remote-exec.json`
+ * shape for the lanes a consumer can drive from that file. The discriminator is `provider`:
+ *   FLEET:
  *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
  *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
  *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
  *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
- *   TOC single-machine (product-owner scope; service implements in phases — macOS + Linux first):
+ *   TOC single-machine (macOS + Linux):
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
- *                     agent). No isolation. macOS/Linux.
+ *                     agent). No isolation.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
- *   - `remote-docker` a user-specified REMOTE host's docker (offload; isolated).
+ *
+ * 7.0.0: every `provider` word here is an execution lane word (`EXECUTION_LANE_WORDS`, `execution-lanes.ts` — the ONE
+ * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
+ * The `remote-docker` variant was DELETED (zero aliases): no engine read point ever turned that word into a running lane
+ * (the engine refuses `REMOTE_EXEC=remote-docker` at boot and only warned "unwired" when this file named it). A remote
+ * docker daemon is the `local-docker` lane pointed at it (`DOCKER_HOST` — in a WorkerSpec, `runtime.execution.coords`).
  *
  * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
- * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*, the remote-docker TLS/SSH creds) is carried here as an
- * env-NAME ref (the `ENV_NAME` regex from types.ts) — NEVER a literal value. The consumer resolves NAME → value
- * from its own env (service env / k8s secret / the TOC local `.env`), so this package never carries a
- * credential. This is SCHEMA + secret-as-env-NAME ONLY; the service owns the adapter implementations.
+ * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*) is carried here as an env-NAME ref (the `ENV_NAME` regex
+ * from types.ts) — NEVER a literal value. The consumer resolves NAME → value from its own env (service env / k8s
+ * secret / the TOC local `.env`), so this package never carries a credential. This is SCHEMA + secret-as-env-NAME
+ * ONLY; the service owns the adapter implementations.
  */
 import { z } from "zod";
-import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul, urlQueryFragmentHasSecret } from "./types.js";
+import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul } from "./types.js";
 /** A non-empty exec-bound string (an image / path / shell / arg the adapter feeds to spawn()/fs). Rejects a NUL
  *  byte uniformly — a NUL validates here but makes Node throw at spawn/boot (fail-OPEN → runtime crash). R20. */
 const execStr = z.string().min(1).refine((s) => !hasNul(s), "must not contain a NUL byte");
-/** Container knobs shared by the two docker lanes (local-docker / remote-docker). `network` defaults to
- *  `none` at the adapter (the safe posture for untrusted code — see the dual-mode design note). */
+/** Container knobs of the `local-docker` lane. `network` defaults to `none` at the adapter (the safe posture for
+ *  untrusted code — see the dual-mode design note). */
 const DOCKER_FIELDS = {
     /** Sandbox image (required — a run must be reproducible). */
     image: execStr,
@@ -58,60 +61,6 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
     // ── local-docker: containers on this machine's docker (isolated; enables parallel fan-out). No secrets
     //    (local docker.sock). Service implements this fast-follow after host.
     z.object({ provider: z.literal("local-docker"), ...DOCKER_FIELDS }),
-    // ── remote-docker: a user-specified remote host's docker. Creds (TLS for tcp://, key for ssh://) are
-    //    env-NAME refs, never bytes. Service implements this fast-follow.
-    z.object({
-        provider: z.literal("remote-docker"),
-        ...DOCKER_FIELDS,
-        /** The remote docker endpoint — a DOCKER_HOST url: `ssh://user@host` or `tcp://host:2376`. A `user@` is OK
-         *  (it's the ssh target, not a secret); an embedded PASSWORD is rejected — credentials go in the env-NAME
-         *  fields below, NEVER in the URL (the secret-as-env-NAME boundary). */
-        dockerHost: z
-            .string()
-            .min(1)
-            .refine((s) => {
-            if (hasNul(s))
-                return false; // a NUL in DOCKER_HOST crashes the adapter at spawn — reject (R20)
-            try {
-                const u = new URL(s);
-                if (u.password)
-                    return false; // a `user@` ssh target is fine; an embedded PASSWORD is not
-                // a secret can also ride in the username (`ssh://sk-live-…@host`) or the query/fragment — scan them
-                // (Round-4). The userinfo password is already rejected above.
-                let user = u.username;
-                try {
-                    user = decodeURIComponent(u.username);
-                }
-                catch {
-                    /* keep raw */
-                }
-                if (user && containsSecretToken(user))
-                    return false;
-                return !urlQueryFragmentHasSecret(u);
-            }
-            catch {
-                // unparseable (e.g. a bare socket path) → reject a `:pw@` userinfo-password pattern AND any
-                // secret-shaped TOKEN anywhere (containsSecretToken tokenizes on URL/query delimiters incl =&, so a
-                // mid-string `/var/run/sk-…` or `socket?token=sk-…` is caught despite the ^-anchored regex). R4/5.
-                if (/:[^/@]+@/.test(s))
-                    return false;
-                if (containsSecretToken(s))
-                    return false;
-                try {
-                    return !containsSecretToken(decodeURIComponent(s)); // also catch percent-encoded secrets
-                }
-                catch {
-                    return true; // malformed %-escape → the raw scan above already passed
-                }
-            }
-        }, "no credentials in dockerHost (password / secret-shaped user/query/fragment) — put them in the env-NAME fields (sshKeyEnv / tls*Env)"),
-        /** env-NAMEs for a tcp+TLS endpoint (NEVER the cert/key bytes). */
-        tlsCertEnv: ENV_NAME.optional(),
-        tlsKeyEnv: ENV_NAME.optional(),
-        tlsCaEnv: ENV_NAME.optional(),
-        /** env-NAME for the SSH private key when dockerHost is `ssh://…` (NEVER the key value). */
-        sshKeyEnv: ENV_NAME.optional(),
-    }),
     // ── e2b: the user's E2B account (service provider "e2b"; REMOTE_EXEC=e2b + E2B_API_KEY).
     z.object({
         provider: z.literal("e2b"),
@@ -163,8 +112,8 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
     // ── ssh: a real host over SSH (service provider "ssh"; REMOTE_EXEC=ssh + SSH_HOST/SSH_USER/SSH_PRIVATE_KEY).
     z.object({
         provider: z.literal("ssh"),
-        // host + username are persisted to config.d/remote-exec.json — scan for a secret-shaped literal, same as the
-        // remote-docker dockerHost scans its embedded ssh user (a secret must go in privateKeyEnv, not the login). R14.
+        // host + username are persisted to config.d/remote-exec.json — scan for a secret-shaped literal (a secret must go
+        // in privateKeyEnv, not the login). R14.
         host: execStr.refine((s) => !containsSecretToken(s), "no secret literal in ssh host — credentials go in privateKeyEnv"),
         port: TCP_PORT.optional(),
         username: execStr.refine((s) => !containsSecretToken(s), "no secret literal in ssh username — credentials go in privateKeyEnv"),

package/dist/secret-refs.d.ts

@@ -22,7 +22,8 @@ export interface EnvRef {
  *  (integrations domain DELETED in 0.6.0 — OA/Gitea coordinates ride worker.env/secretEnv, EXPERT-REDESIGN §9.) */
 export declare function collectEnvRefs(eff: EffectiveConfig): EnvRef[];
 /**
- * Names of workers that reference a given env-NAME — via any of the 4 structured `secretRefs` OR the general
+ * Names of workers that reference a given env-NAME — via any of the structured `secretRefs`, the execution lane's
+ * `runtime.execution.secretRefs` (7.0.0: where E2B_API_KEY / SSH_PRIVATE_KEY / K8S_TOKEN … live now), OR the general
  * `secretEnv` passthrough. Drives batch-rotate (POST /secrets/<name>/rotate): after a credential write, recreate
  * exactly the workers that project it. Reads the raw workers domain (the same shape collectEnvRefs would see).
  */
@@ -30,4 +31,9 @@ export declare function workersReferencingSecret(workers: {
     name: string;
     secretRefs?: Record<string, string | undefined>;
     secretEnv?: Record<string, string>;
+    runtime?: {
+        execution?: {
+            secretRefs?: Record<string, string>;
+        };
+    };
 }[], envName: string): string[];

package/dist/secret-refs.js

@@ -16,7 +16,11 @@ export function collectEnvRefs(eff) {
         add(r.apiKeyEnv, "workers", `worker "${w.name}".secretRefs.apiKeyEnv`);
         add(r.serviceAuthTokenEnv, "workers", `worker "${w.name}".secretRefs.serviceAuthTokenEnv`);
         add(r.gitTokenEnv, "workers", `worker "${w.name}".secretRefs.gitTokenEnv`);
-        add(r.tidbPasswordEnv, "workers", `worker "${w.name}".secretRefs.tidbPasswordEnv`);
+        add(r.dbPasswordEnv, "workers", `worker "${w.name}".secretRefs.dbPasswordEnv`);
+        // 7.0.0: the execution lane's secrets (E2B_API_KEY / SSH_PRIVATE_KEY / K8S_TOKEN …) moved out of the general
+        // `secretEnv` passthrough into `runtime.execution.secretRefs` — still env-NAMEs the host must provide.
+        for (const [key, envName] of Object.entries(w.runtime.execution?.secretRefs ?? {}))
+            add(envName, "workers", `worker "${w.name}".runtime.execution.secretRefs.${key}`);
         // the general secretEnv passthrough also references env-NAMEs (worker-env.ts merges them) — include them
         // so the rotation inventory isn't blind to app-specific tokens like OA_SERVICE_TOKEN→OA_CALLBACK_TOKEN.
         for (const [key, envName] of Object.entries(w.secretEnv ?? {}))
@@ -32,7 +36,8 @@ export function collectEnvRefs(eff) {
     return [...map.entries()].map(([envName, refs]) => ({ envName, refs })).sort((a, b) => a.envName.localeCompare(b.envName));
 }
 /**
- * Names of workers that reference a given env-NAME — via any of the 4 structured `secretRefs` OR the general
+ * Names of workers that reference a given env-NAME — via any of the structured `secretRefs`, the execution lane's
+ * `runtime.execution.secretRefs` (7.0.0: where E2B_API_KEY / SSH_PRIVATE_KEY / K8S_TOKEN … live now), OR the general
  * `secretEnv` passthrough. Drives batch-rotate (POST /secrets/<name>/rotate): after a credential write, recreate
  * exactly the workers that project it. Reads the raw workers domain (the same shape collectEnvRefs would see).
  */
@@ -40,8 +45,9 @@ export function workersReferencingSecret(workers, envName) {
     const out = [];
     for (const w of workers) {
         const inStructured = Object.values(w.secretRefs ?? {}).includes(envName);
+        const inLane = Object.values(w.runtime?.execution?.secretRefs ?? {}).includes(envName);
         const inPassthrough = Object.values(w.secretEnv ?? {}).includes(envName);
-        if (inStructured || inPassthrough)
+        if (inStructured || inLane || inPassthrough)
             out.push(w.name);
     }
     return out;