@sema-agent/server 3.22.0 → 3.23.0

package/dist/bake-runner/main.d.ts

@@ -1,4 +1,4 @@
-import { type ImageApiClient, type ChildSpawner, type HostOps } from "./runner.js";
+import { type ImageApiClient, type ChildSpawner, type HostOps, type BakeRunnerLogger } from "./runner.js";
 interface RunnerEnv {
     imageApiBase: string;
     token: string;
@@ -14,7 +14,7 @@ interface RunnerEnv {
 declare function loadEnv(): RunnerEnv;
 /** The real image-api HTTP client. Authenticates claim/heartbeat with the runner bearer; ingest additionally
  *  carries the per-bake ingest secret header (so image-api can reject a stale/rogue runner — §P2.4e). */
-declare function makeApiClient(env: RunnerEnv): ImageApiClient;
+declare function makeApiClient(env: RunnerEnv, log: BakeRunnerLogger): ImageApiClient;
 /** The real child spawner: `setsid`-style detached process GROUP so a cancel/deadline kill signals the whole tree
  *  (channel-close / a plain kill of the immediate child does NOT stop a detached build — §P2.11). */
 declare function makeSpawner(): ChildSpawner;

package/dist/bake-runner/main.js

@@ -11,6 +11,7 @@ import { spawn, exec as execCb } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import { createLogger } from "../observability/logger.js";
+import { parseNumOrFailNonNegative } from "../config.js";
 import { BakeRunner, } from "./runner.js";
 const exec = promisify(execCb);
 function loadEnv() {
@@ -28,14 +29,22 @@ function loadEnv() {
         recipeDir: process.env.RECIPE_DIR || "/opt/recipes",
         buildShPath: process.env.BUILD_SH_PATH || "e2b-template/dev-sandbox/build.sh",
         dataDir: process.env.BAKE_DATA_DIR || "/data",
-        heartbeatMs: Number(process.env.BAKE_HEARTBEAT_MS || "30000"),
-        idlePollMs: Number(process.env.BAKE_IDLE_POLL_MS || "5000"),
-        minFreeGb: Number(process.env.IMAGE_BAKE_MIN_FREE_GB || "20"),
+        // A2/E5 (gap-sweep 2026-08-01): these were bare `Number(process.env.X || default)` — a unit-suffixed or
+        // typo'd value (`"30s"`) silently became NaN, and NaN survives every downstream `??`/`?? default` guard
+        // (those only catch null/undefined). The fallout is a SILENT-LOOSENING pair: `clock.sleep(NaN)` resolves
+        // ~immediately (`setTimeout(fn, NaN)` behaves like a 0ms timer) turning the lease heartbeat into a tight
+        // POST loop against image-api, and `freeGb < NaN` is always false so the pre-flight disk guard silently
+        // never fires. `parseNumOrFailNonNegative` (config.ts, shared with leader/wire.ts's four resource knobs)
+        // fails loud at bake-runner startup instead — non-numeric OR negative both throw; unset/empty still falls
+        // back to the documented default (zero behavior change on the happy path).
+        heartbeatMs: parseNumOrFailNonNegative("BAKE_HEARTBEAT_MS", process.env.BAKE_HEARTBEAT_MS || "30000"),
+        idlePollMs: parseNumOrFailNonNegative("BAKE_IDLE_POLL_MS", process.env.BAKE_IDLE_POLL_MS || "5000"),
+        minFreeGb: parseNumOrFailNonNegative("IMAGE_BAKE_MIN_FREE_GB", process.env.IMAGE_BAKE_MIN_FREE_GB || "20"),
     };
 }
 /** The real image-api HTTP client. Authenticates claim/heartbeat with the runner bearer; ingest additionally
  *  carries the per-bake ingest secret header (so image-api can reject a stale/rogue runner — §P2.4e). */
-function makeApiClient(env) {
+function makeApiClient(env, log) {
     const auth = { authorization: `Bearer ${env.token}`, "content-type": "application/json" };
     return {
         // Long-poll claim (§P2.12): the bare `POST …/bakes/claim` finds the oldest queued bake AND leases it in one
@@ -46,13 +55,27 @@ function makeApiClient(env) {
                 headers: auth,
                 body: JSON.stringify({ runnerId: env.runnerId }),
             });
-            if (res.status === 204 || res.status === 409)
-                return null; // empty queue, or lost the single-flight CAS
-            if (!res.ok)
+            if (res.status === 204)
+                return null; // empty queue — the routine "nothing to do" case, no log line
+            // C6/C1 (2026-08-01): 401 (bad runner credential) / 409 (lost the single-flight CAS to another runner
+            // replica) / 5xx previously fell into this SAME silent-`null` branch as an empty queue — a misconfigured
+            // BAKE_RUNNER_TOKEN and a healthy idle runner were indistinguishable from the outside (both just idle-poll
+            // forever with zero log lines). `bake_claim_error` (loop()'s catch) only fires on a THROWN error — a non-ok
+            // HTTP response never throws — so this warn is the only trace a non-2xx claim response leaves anywhere.
+            if (!res.ok) {
+                log.warn("bake_claim_rejected", { status: res.status });
                 return null;
+            }
             const c = (await res.json());
-            if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret)
+            if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret) {
+                // A malformed 2xx body is worse than a rejection: image-api's claim call ATOMICALLY leases the bake
+                // server-side before returning it, so a shape we refuse to trust here is a bake already checked OUT
+                // from the queue that we are about to drop on the floor. We still can't safely act on an untrusted
+                // shape (no bakeId ⇒ no way to release/fail it), so this warn is the only surfacing point until
+                // image-api's stale-lease reaper reclaims it (§P2.7) — see runner.ts module doc for the reaper backstop.
+                log.warn("bake_claim_malformed", { status: res.status, bakeId: typeof c.bakeId === "string" ? c.bakeId : undefined });
                 return null;
+            }
             return {
                 bakeId: c.bakeId,
                 argv: c.argv.map(String),
@@ -223,7 +246,7 @@ async function main() {
         minFreeGb: env.minFreeGb,
     }); // NB: the token + per-bake ingest secret are NEVER logged (§P2.4e)
     const runner = new BakeRunner({
-        api: makeApiClient(env),
+        api: makeApiClient(env, log),
         spawner: makeSpawner(),
         host: makeHostOps(env),
         clock: makeClock(),

package/dist/capabilities/center-plugins.js

@@ -180,7 +180,7 @@ export async function applyCenterPlugins(baseline, eff, opts) {
             }
             if (!rootCheck.dir)
                 continue; // 无 skills 目录:合法(commands-only 插件,cli 壳的半场)
-            const loaded = loadSkills(rootCheck.dir);
+            const loaded = loadSkills(rootCheck.dir, { confineTo: liveDir }); // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸) // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸) // 不可信 lane:逐条目约束在 clone root 内(根守卫只守了 skills 根,根下 symlink 可逃逸)
             for (const skill of loaded) {
                 if (taken.has(skill.spec.name)) {
                     // 收紧④:plugin 让位(方向与 center-wins 相反,理由见模块顶注)。

package/dist/capabilities/skills.d.ts

@@ -31,7 +31,18 @@ export interface LoadedSkill {
     /** Scenarios this skill applies to; empty = global (every scenario). */
     scenarios: string[];
 }
-export declare function loadSkills(dir: string): LoadedSkill[];
+/** 加载 lane 的信任级。缺席(受控 lane:烤制进镜像的 skills 目录)= 维持既有语义,symlink 照跟
+ *  ——那个便利是有意的(`foo.md -> 共享文件`)。`confineTo` 在场(**不可信 lane**:第三方 git checkout,
+ *  见 center-plugins 的 plugin 装载)= 每个被读条目 realpath 后必须仍在该根之内,逃逸即抛。
+ *  🔴 为什么信任级必须是**参数**而不是注释里的假设:本函数的头注原写着「skills dir 全受控」,而
+ *  center-plugins 把它原样复用在 attacker-controlled 的 git checkout 上——git 原样保留仓里的 symlink,
+ *  于是 checkout 里某个 skill 条目(`任意 .md -> /宿主/任意文件`)会被读进 spec.files 进入提示词。resolvePluginSkillsRoot
+ *  只 realpath 守了 skills **根**,根下逐条目没守。 */
+export interface LoadSkillsOptions {
+    /** 不可信 lane 的约束根(通常=clone root)。缺席=受控 lane,不做逐条目约束。 */
+    confineTo?: string;
+}
+export declare function loadSkills(dir: string, opts?: LoadSkillsOptions): LoadedSkill[];
 /** Skills applicable to a scenario: those tagged with it, plus untagged (global) ones. */
 export declare function skillsForScenario(loaded: LoadedSkill[], scenario: string): SkillSpec[];
 export declare function parseFrontmatter(raw: string): {

package/dist/capabilities/skills.js

@@ -1,6 +1,20 @@
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-export function loadSkills(dir) {
+import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { join, sep } from "node:path";
+/** `p` 的 realpath 必须落在 `rootReal` 之内(含自身),否则抛。`sep` 边界判定防 `/a/root-evil` 撞
+ *  `/a/root` 前缀。目标不存在 ⇒ realpath 抛 ENOENT,同样是拒绝(悬空链接不该被读)。 */
+function assertConfined(p, rootReal) {
+    let real;
+    try {
+        real = realpathSync(p);
+    }
+    catch (e) {
+        throw new Error(`skill entry ${p} is unreadable (dangling symlink or missing): ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (real !== rootReal && !real.startsWith(rootReal + sep)) {
+        throw new Error(`skill entry ${p} escapes the plugin root (resolves outside ${rootReal}) — untrusted checkouts may not link to host files`);
+    }
+}
+export function loadSkills(dir, opts) {
     let entries;
     try {
         entries = readdirSync(dir, { withFileTypes: true });
@@ -21,17 +35,22 @@ export function loadSkills(dir) {
     // sort 保证加载顺序稳定(冲突报错的"先到者"也因此确定)。dotfile/dot 目录跳过(.DS_Store/.git 类
     // 环境杂物,不是 skill 内容);isFileLike 兼容 symlink(Dirent.isFile() 对 symlink 恒 false,而旧扁平
     // 实现 readFileSync 是跟链接的——不兼容会让 skills 目录下 `foo.md -> 共享文件` 这种软链无声消失)。
+    const confineRoot = opts?.confineTo !== undefined ? realpathSync(opts.confineTo) : undefined;
     const isFileLike = (entry, p) => entry.isFile() || (entry.isSymbolicLink() && statSync(p).isFile());
     const isDirLike = (entry, p) => entry.isDirectory() || (entry.isSymbolicLink() && statSync(p).isDirectory());
     for (const entry of entries.slice().sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
         if (entry.name.startsWith("."))
             continue;
         if (isFileLike(entry, join(dir, entry.name)) && entry.name.endsWith(".md")) {
+            if (confineRoot !== undefined)
+                assertConfined(join(dir, entry.name), confineRoot);
             const raw = readFileSync(join(dir, entry.name), "utf8");
             push(parseSkill(raw, entry.name.replace(/\.md$/, "")), join(dir, entry.name));
         }
         else if (isDirLike(entry, join(dir, entry.name))) {
             const skillDir = join(dir, entry.name);
+            if (confineRoot !== undefined)
+                assertConfined(skillDir, confineRoot);
             let raw;
             try {
                 raw = readFileSync(join(skillDir, "SKILL.md"), "utf8");
@@ -41,8 +60,10 @@ export function loadSkills(dir) {
                 // 整个 skill 无声丢掉 → fail-loud
                 throw new Error(`skill directory ${skillDir} has no SKILL.md`);
             }
+            if (confineRoot !== undefined)
+                assertConfined(join(skillDir, "SKILL.md"), confineRoot);
             const skill = parseSkill(raw, entry.name);
-            const files = collectAttachments(skillDir, "");
+            const files = collectAttachments(skillDir, "", confineRoot);
             if (files.length > 0)
                 skill.spec.files = files;
             push(skill, join(skillDir, "SKILL.md"));
@@ -53,7 +74,7 @@ export function loadSkills(dir) {
 /** 目录形态附件:递归收 SKILL.md 之外的一切文件,path=相对 skill 目录(posix 斜杠),sort 稳定。
  *  dotfile/dot 目录跳过(交叉评审 M3):skill 目录若从别的 checkout 整拷,.git/config、.env 类隐藏物
  *  会连凭据一起进 spec.files 变成提示词可见附件——附件只收显式内容文件。symlink 跟链接(同扁平兼容)。 */
-function collectAttachments(skillDir, rel) {
+function collectAttachments(skillDir, rel, confineRoot) {
     const files = [];
     const here = rel === "" ? skillDir : join(skillDir, rel);
     for (const entry of readdirSync(here, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
@@ -64,9 +85,13 @@ function collectAttachments(skillDir, rel) {
         const dirLike = entry.isDirectory() || (entry.isSymbolicLink() && statSync(abs).isDirectory());
         const fileLike = entry.isFile() || (entry.isSymbolicLink() && statSync(abs).isFile());
         if (dirLike) {
-            files.push(...collectAttachments(skillDir, relPath));
+            if (confineRoot !== undefined)
+                assertConfined(abs, confineRoot);
+            files.push(...collectAttachments(skillDir, relPath, confineRoot));
         }
         else if (fileLike && relPath !== "SKILL.md") {
+            if (confineRoot !== undefined)
+                assertConfined(abs, confineRoot);
             files.push({ path: relPath, content: readFileSync(abs, "utf8") });
         }
     }

package/dist/config.d.ts

@@ -25,6 +25,18 @@ export declare function numEnv(name: string, fallback: string): number;
  * `undefined`/空串 ⇒ 交给调用方的 fallback 语义处理(本函数只判「给了值但不是数」)。
  */
 export declare function parseNumOrFail(name: string, raw: string | undefined): number;
+/**
+ * `parseNumOrFail` layered with a non-negative floor — the SAME judgment `leader/wire.ts`'s (private,
+ * file-local) `parseNumOrFailNonNegative` already applies to its four resource knobs, exported here so a
+ * second call site (bake-runner's heartbeat/idle-poll/disk-guard knobs, gap-sweep 2026-08-01) can reuse the
+ * one shared primitive instead of re-deriving its own "reject a bad number" scheme. A negative value is
+ * JS-truthy, so a bare `|| default` fallback lets it straight through; for a duration knob that means
+ * `clock.sleep(-N)` fires ~immediately (the same tight-loop failure NaN causes), and for a threshold knob
+ * (`freeGb < minFreeGb`) a negative floor makes the comparison vacuously true/false depending on sign —
+ * either way the guard it configures goes silently slack. `undefined`/unset stays NaN (unchanged) so
+ * existing `|| fallback` chains built on `parseNumOrFail` are untouched by this stricter sibling.
+ */
+export declare function parseNumOrFailNonNegative(name: string, raw: string | undefined): number;
 export declare function drainConfigWarnings(): Array<{
     env: string;
     raw: string;

package/dist/config.js

@@ -94,6 +94,23 @@ export function parseNumOrFail(name, raw) {
         throw new Error(`env ${name}="${raw}" must be a number`);
     return n;
 }
+/**
+ * `parseNumOrFail` layered with a non-negative floor — the SAME judgment `leader/wire.ts`'s (private,
+ * file-local) `parseNumOrFailNonNegative` already applies to its four resource knobs, exported here so a
+ * second call site (bake-runner's heartbeat/idle-poll/disk-guard knobs, gap-sweep 2026-08-01) can reuse the
+ * one shared primitive instead of re-deriving its own "reject a bad number" scheme. A negative value is
+ * JS-truthy, so a bare `|| default` fallback lets it straight through; for a duration knob that means
+ * `clock.sleep(-N)` fires ~immediately (the same tight-loop failure NaN causes), and for a threshold knob
+ * (`freeGb < minFreeGb`) a negative floor makes the comparison vacuously true/false depending on sign —
+ * either way the guard it configures goes silently slack. `undefined`/unset stays NaN (unchanged) so
+ * existing `|| fallback` chains built on `parseNumOrFail` are untouched by this stricter sibling.
+ */
+export function parseNumOrFailNonNegative(name, raw) {
+    const n = parseNumOrFail(name, raw);
+    if (n < 0)
+        throw new Error(`env ${name}=${n} must not be negative`);
+    return n;
+}
 /** Numeric env with a [min,max] bound (BL-17): an out-of-range value FAILS at startup instead of being
  *  silently clamped/applied (e.g. a multi-hour MCP_ELICITATION_TTL_MS would silently never expire). */
 function numEnvBounded(name, fallback, min, max) {

package/dist/fleet/fleet-bus.js

@@ -203,9 +203,12 @@ export function fleetRunPublisher(bus, run) {
                 elapsedDonor.add(cid);
             const elapsed = elapsedDonor.has(cid) ? Date.now() - childStartedAt.get(cid) : undefined;
             if (donorName !== undefined || elapsed !== undefined) {
+                // cli [2297]①:donorName 只进 `name` 位。run-leg tick 手上没有独立的类型名([1364]③/core 1.350:
+                // name=display 标签、agentType=类型名),把 display 值同时写进 agentType 会让 fleet 的 TYPE 列显示
+                // description。缺源的键不铸(与「匿名行不铸假名」同一条原则);BCE 行自己的帧带真 agentType 时自然补上。
                 bus.publishTask({
                     id: bceRowId,
-                    ...(donorName !== undefined ? { name: donorName, agentType: donorName } : {}),
+                    ...(donorName !== undefined ? { name: donorName } : {}),
                     ...(elapsed !== undefined ? { elapsedMs: elapsed } : {}),
                 });
             }

package/dist/hooks/hook-llm.js

@@ -160,7 +160,7 @@ export function createHookLlm(deps) {
                 text = j.choices?.[0]?.message?.content ?? undefined;
             }
             metrics.inc("hook_llm_calls_total", { type: "prompt" });
-            return typeof text === "string" ? { ok: true, text } : { ok: false, error: "hook llm returned no content" };
+            return typeof text === "string" ? { ok: true, text } : { ok: false, error: "hook llm returned no content", code: "no_content" };
         }
         catch (e) {
             // 网络层失败原样只有 "TypeError: fetch failed"(不是人话):带上端点与 cause(ECONNREFUSED 等),

package/dist/hooks/hook-runner.d.ts

@@ -91,7 +91,11 @@ export type HookLlmCall = (opts: {
 } | {
     ok: false;
     error: string;
+    code?: HookLlmFailureCode;
 }>;
+/** 失败判别码(B8:判别一律走码,禁按 error 文案分支——v3.1 批2,统检第二波 high)。error 仍是给人看的
+ *  自由文本;code 是给控制流的。缺席=未分类失败(不重试、不特判)。 */
+export type HookLlmFailureCode = "no_content" | "hard_timeout";
 /**
  * 阶段三a:`http` 条目——契约语义 = POST hook 输入 JSON 到 `url`;headers 里的 `$NAME` 仅当 NAME 列在
  * `allowedEnvVars` 才从 worker 进程 env 插值(配置本身绝不携带密钥值,契约同边界)。

package/dist/hooks/hook-runner.js

@@ -383,7 +383,7 @@ async function runLlmHook(entry, payload, ctx, extra) {
     // 顺序是承重的 —— 包装句逐字预设会话在上文,放反了那句话本身就是在骗模型。
     const prompt = extra ? `${extra.transcript}\n\n---\n\n${wrapCondition("Stop", substituted)}` : substituted;
     // 载体外再包一层硬顶:契约说载体自己兜超时,但一个部署组装 bug 不该能挂死工具门(纵深)。
-    const hardTop = new Promise((r) => setTimeout(() => r({ ok: false, error: "__hook_llm_hard_timeout__" }), timeoutMs + 5_000).unref?.());
+    const hardTop = new Promise((r) => setTimeout(() => r({ ok: false, error: "hook llm hard-timeout backstop fired (carrier did not settle within timeoutMs+5s — deployment assembly bug)", code: "hard_timeout" }), timeoutMs + 5_000).unref?.());
     const invoke = () => Promise.race([
         call({
             prompt,
@@ -397,17 +397,17 @@ async function runLlmHook(entry, payload, ctx, extra) {
     // 🔴 **"一个字都没吐出来"重试一次**(仅 CC 评估者路)。这个失败形的后果是**判词被丢弃 ⇒ fail-open**
     // (该拦没拦),而它是**瞬态**的(推理档模型偶尔把额度用在 thinking 上)。
     // ⚠️ 只重试**无内容**,不重试"有内容但读不懂" —— 后者重试一次多半还是读不懂,而且那一格按设计就该放行。
-    if (extra && !res.ok && res.error.includes("returned no content")) {
+    if (extra && !res.ok && res.code === "no_content") { // B8:判别走码不走文案(v3.1 批2)
         ctx.logger.warn("hook_llm_no_content_retry", { event: "Stop" });
         res = await invoke();
         // 重试之后**仍然**没有内容 ⇒ 这一轮的守卫确实没能评估。发观测帧(纯 observe,不改变运行)——
         // 方向仍是 fail-open,但用户/壳侧要能知道「这轮没看住」,否则那个放行与「已达成」无法区分。
-        if (!res.ok && res.error.includes("returned no content")) {
+        if (!res.ok && res.code === "no_content") {
             ctx.onHookNotice?.({ kind: "hook_decision_unavailable", event: "Stop", reason: "no_content", detail: "carrier returned no content (after one retry)" });
         }
     }
     if (!res.ok) {
-        return res.error === "__hook_llm_hard_timeout__"
+        return res.code === "hard_timeout"
             ? { code: null, stdout: "", stderr: "", timedOut: true }
             : { code: null, stdout: "", stderr: "", timedOut: false, spawnError: clip(res.error, 500) };
     }

package/dist/http/routes/runs.js

@@ -1134,7 +1134,12 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         const parkArbiterUnreachable = details?.error === "park_arbiter_unreachable";
         const parkResumeWon = details?.error === "park_resume_won";
         const stillParked = details?.error === "parked_pending_approval" || details?.status === "parked";
-        if (stopVerb && details?.error !== undefined && (details.status === "running" || stillParked || parkResumeWon || parkArbiterUnreachable)) {
+        // v3.1 批2(统检第二波 high):判别方向翻转——旧形是 (status,error) 的**失败白名单**(status==="running"
+        // || 三个具名码),core 新增失败码且行状态不在 {running,parked} 时整个分支被跳过落 200,与上面注释自陈
+        // 的不变量(kill 没落地绝不读成功)正相悖(B5 联合非穷尽的 default-放行形;not_local/park 族/arbiter
+        // 三次历史新增全靠人追认)。新形:stop 动词的 error **在场即失败**(not_found 已在上方早退),具名臂
+        // 保留各自 errorCode,未知码落 stop.not_landed 兜底 409——新失败码默认可见,不默认成功。
+        if (stopVerb && details?.error !== undefined) {
             // 1.250:durable 回落臂(core stopTask agentStore 分支)对他实例 running 行应答 error="not_local"
             // (没有 kill 被尝试)——与「kill 尝试了没落地」(stop.not_landed)是不同的失败形,各给各的
             // errorCode(同 409 家族,additive)。

package/dist/http/server.js

@@ -1671,16 +1671,20 @@ export function createHttpServer(rawDeps) {
                             if (!rs || !taskId)
                                 return;
                             const t = e.type;
+                            // C2/C5(v3.1 批2):写失败留痕——同函数 onTaskNotification 的 park-enqueue 早按 2026-07-11
+                            // 对抗评审补了 warn(false park 指纹),这三处同构 fire-and-forget 此前裸吞:子代 tool 生命周期
+                            // 事件从 durable log 永久消失且零信号。结构上仍不能 await(同步回调),留痕不改调用形。
+                            const warnAppend = (kind) => (err) => deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
                             if (t === "task_progress") {
-                                void append("task_progress", taskProgressEventData(e)).catch(() => undefined);
+                                void append("task_progress", taskProgressEventData(e)).catch(warnAppend(t));
                             }
                             else if (t === "tool_start") {
                                 // C1 (core 1.219): a delegated child's forwarded tool lifecycle — durable via the SAME shared
                                 // whitelist+redact builders as the top stream (parity with the bg leg; deltas not persisted per-chunk).
-                                void append("tool_start", toolStartEventData(e)).catch(() => undefined);
+                                void append("tool_start", toolStartEventData(e)).catch(warnAppend(t));
                             }
                             else if (t === "tool_end") {
-                                void append("tool_end", toolEndEventData(e)).catch(() => undefined);
+                                void append("tool_end", toolEndEventData(e)).catch(warnAppend(t));
                             }
                         },
                         // background-completion observer — flip the child's fleet row +
@@ -2559,7 +2563,7 @@ function cors(res, req, origins, principalHeader) {
     // 后五项都是**真被 handler 读**的自定义头:`idempotency-key`(tasks/runs/images)、
     // `x-detach-on-disconnect`(tasks 断连不中止)、direct-door 决策证明三件套(approvals /decide 的
     // crypto 绑定腿 —— 缺了它,direct-door worker 上的 web 审批面在浏览器里根本用不了)。
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid`);
+    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid, if-none-match`);
     // 🔴 expose-headers 此前**整个缺席** ⇒ fetch 类客户端读不到 `X-Task-Id`(routes/tasks.ts 经 sseHeaders
     // 下发的 durable rewind handle)。tasks.ts 的 G15 meta 帧注释把这归因为「EventSource 与部分代理读不到
     // 响应头」—— 对 EventSource 成立,但对 fetch 客户端真因是这里缺 expose,meta 帧只是绕过。

package/dist/lsp/e2b-bridge.js

@@ -26,7 +26,16 @@ const TOKEN = process.env.LSP_TOKEN || '';
 const MAX = 50 * 1024 * 1024;
 const HEARTBEAT_MS = Number(process.env.LSP_HEARTBEAT_MS || 30000);
 const wss = new WebSocketServer({ host: '0.0.0.0', port: PORT });
+// A zero-listener 'error' on ANY EventEmitter throws and crashes the process (Node default). Without this, a
+// bind failure (e.g. EADDRINUSE — a second bridge start racing the same port) took down the WHOLE bridge
+// process, killing every language's LSP session in the sandbox, not just the one that failed to start (HRD-LSP-4).
+// Exit loud + explicit instead of an uncaught-exception dump so the failure is at least attributable.
+wss.on('error', (err) => { console.error('lsp-bridge wss error', err && err.message); process.exit(1); });
 wss.on('connection', (ws, req) => {
+  // Same zero-listener 'error' hazard as wss above, but per-connection: registered FIRST, before anything else
+  // touches this socket. Close (don't crash) — the heartbeat reaper's own ws.terminate() below is a routine
+  // source of a socket 'error' on an already-half-open connection (HRD-LSP-4).
+  ws.on('error', () => { try { ws.terminate(); } catch {} });
   const q = ((req && req.url) || '').split('?')[1] || '';
   if (TOKEN && new URLSearchParams(q).get('token') !== TOKEN) { ws.close(); return; } // auth (council #4)
   ws.isAlive = true;
@@ -37,7 +46,11 @@ wss.on('connection', (ws, req) => {
   const decode = makeFrameDecoder(MAX);
   child.stdout.on('data', (d) => { for (const f of decode(d)) ws.send(f); });
   ws.on('message', (data) => { const p = Buffer.from(data.toString(), 'utf8'); child.stdin.write('Content-Length: ' + p.length + '\r\n\r\n'); child.stdin.write(p); });
-  ws.on('close', () => child.kill());
+  // pid guard: the child 'error' handler above routes spawn FAILURES (missing binary — pid never assigned)
+  // through ws.close() → this 'close' handler. Killing a child whose pid was never assigned can signal the
+  // CALLER's process group instead of the (nonexistent) child (HRD-LSP-4; same hazard class as bake-runner's
+  // spawner, src/bake-runner/main.ts).
+  ws.on('close', () => { if (child.pid !== undefined) child.kill(); });
   child.on('exit', () => { try { ws.close(); } catch {} });
 });
 // Reap half-open connections: the E2B proxy kills a WS at ~60-75s and the kill can be SILENT on THIS side too —

package/dist/lsp/e2b-manager.d.ts

@@ -8,9 +8,11 @@ export interface E2bLspOptions {
         attempts: number;
         delayMs: number;
     };
-    /** Bridge auth token override. The manager pins ONE token per env+language: on a RE-open (transport heal
-     *  after the E2B proxy idle-killed the WS) the original bridge process is still listening with the FIRST
-     *  token — a fresh random token would be rejected and the reconnect would always fail. */
+    /** Bridge auth token override. The manager pins ONE token per env+PORT — the bridge RESOURCE, not the
+     *  language (`portForLanguage` maps several languages, e.g. typescript/javascript, onto the SAME port/process
+     *  — see `createE2bLspManager`). On a RE-open (transport heal after the E2B proxy idle-killed the WS) the
+     *  original bridge process is still listening with the FIRST token — a fresh random token would be rejected
+     *  and the reconnect would always fail. */
     token?: string;
     /** WS scheme for the bridge URL. E2B's `getHost` returns a public TLS proxy host → `wss` (default);
      *  the k8s adapter returns a cluster-internal `podIP:port` → plain `ws` (no TLS on the pod network;
@@ -19,7 +21,9 @@ export interface E2bLspOptions {
     /** Observability hook (open/heal/degrade events) — prod wires the service logger. */
     log?: (event: string, fields: Record<string, unknown>) => void;
 }
-/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect. */
+/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect.
+ *  Every call starts (or re-starts) the bridge unconditionally — the one production caller is
+ *  `createE2bLspManager`, which de-dupes per env+port before ever reaching here (see its doc). */
 export declare function openE2bLspTransport(language: string, env: LspCapableEnv, opts?: E2bLspOptions): Promise<LspTransport | undefined>;
 /** The single shared `LspServerManager` for the deployment (`RunnerDeps.lspManager`). */
 export declare function createE2bLspManager(opts?: E2bLspOptions): E2bLspManager;

package/dist/lsp/e2b-manager.js

@@ -12,19 +12,28 @@ import { randomUUID } from "node:crypto";
 import { connectWsLspTransport } from "./ws-transport.js";
 import { E2bLspManager } from "./manager.js";
 import { BRIDGE_DIR, BRIDGE_SOURCE, lspInstallCommand, lspStartCommand, portForLanguage, SERVER_CMD } from "./e2b-bridge.js";
-/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect. */
-export async function openE2bLspTransport(language, env, opts) {
-    if (!SERVER_CMD[language])
-        return undefined; // no server for this language → graceful degrade
-    const connect = opts?.connect ?? connectWsLspTransport;
-    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
-    const port = portForLanguage(language);
+/** Write bridge.cjs + (foreground) install the language server, then start the bridge as a TRUE background
+ *  command. Returns whether the bridge is now up-or-starting (`false` only when the foreground install failed).
+ *  A single-shot primitive: it does NOT check whether a bridge is already listening on `port` — a caller that
+ *  can have two languages share one port (`createE2bLspManager`, since `portForLanguage` maps typescript AND
+ *  javascript onto 8123 off the same `SERVER_CMD`) MUST call this at most ONCE per env+port itself. A second
+ *  `node bridge.cjs` on an already-bound port surfaces as an EADDRINUSE `wss` 'error' (e2b-bridge.ts D6
+ *  hardening keeps that from crashing the sandbox, but the second attempt still fails and wastes a sandbox
+ *  round-trip for nothing — HRD-LSP-4). */
+async function startE2bBridge(language, env, port, token) {
     await env.writeFile(`${BRIDGE_DIR}/bridge.cjs`, BRIDGE_SOURCE).catch(() => undefined);
     const installed = await env.exec(lspInstallCommand(language)).catch(() => undefined);
     if (!installed || !installed.ok)
-        return undefined;
-    const token = opts?.token ?? randomUUID(); // per-session bridge auth — the getHost URL is public (council #4)
+        return false;
     await env.startBackground(lspStartCommand(language, port, token)).catch(() => undefined);
+    return true;
+}
+/** Connect (with retry) to an already-started bridge. Each call opens its OWN WS connection — the bridge spawns
+ *  a FRESH child language-server process per connection (e2b-bridge.ts `wss.on('connection', …)`), so two
+ *  languages sharing one bridge port each still get an isolated language-server instance. */
+async function connectE2bLspBridge(env, port, token, opts) {
+    const connect = opts?.connect ?? connectWsLspTransport;
+    const retry = opts?.retry ?? { attempts: 6, delayMs: 1500 };
     const root = env.workspaceHandle().mountPath;
     // the bridge starts as a background command → retry the WS connect (with the auth token) while it comes up
     const scheme = opts?.scheme ?? "wss";
@@ -39,26 +48,49 @@ export async function openE2bLspTransport(language, env, opts) {
     }
     return undefined;
 }
+/** Start (+ install on a non-baked template) the language server + bridge inside THIS env's sandbox, then connect.
+ *  Every call starts (or re-starts) the bridge unconditionally — the one production caller is
+ *  `createE2bLspManager`, which de-dupes per env+port before ever reaching here (see its doc). */
+export async function openE2bLspTransport(language, env, opts) {
+    if (!SERVER_CMD[language])
+        return undefined; // no server for this language → graceful degrade
+    const port = portForLanguage(language);
+    const token = opts?.token ?? randomUUID(); // per-session bridge auth — the getHost URL is public (council #4)
+    const started = await startE2bBridge(language, env, port, token);
+    if (!started)
+        return undefined;
+    return connectE2bLspBridge(env, port, token, opts);
+}
 /** The single shared `LspServerManager` for the deployment (`RunnerDeps.lspManager`). */
 export function createE2bLspManager(opts) {
-    // One bridge token per env+language, pinned across re-opens (heal after an idle-killed WS): the original
-    // bridge keeps listening with the first token, so the reconnect must present the SAME one. WeakMap → a
-    // destroyed task's tokens are collectible with its env.
-    const tokens = new WeakMap();
+    // One bridge PROCESS + token per env+PORT — not per env+language. `portForLanguage` maps typescript and
+    // javascript onto the SAME port (they share `SERVER_CMD`): keying by language minted two auth tokens for the
+    // one listening bridge (HRD-LSP-4) and re-invoked `startBackground` on an already-bound port on every open.
+    // WeakMap → a destroyed task's bridge bookkeeping is collectible with its env.
+    const bridges = new WeakMap();
     return new E2bLspManager({
         log: opts?.log,
-        transportFactory: (language, env) => {
-            let perLang = tokens.get(env);
-            if (!perLang) {
-                perLang = new Map();
-                tokens.set(env, perLang);
+        transportFactory: async (language, env) => {
+            if (!SERVER_CMD[language])
+                return undefined; // no server for this language → graceful degrade (mirrors
+            // openE2bLspTransport's own guard; MUST run before touching `bridges` — `portForLanguage` falls back to
+            // port 8123 for an unmapped language, which would otherwise silently borrow typescript's live bridge)
+            const port = portForLanguage(language);
+            let perPort = bridges.get(env);
+            if (!perPort) {
+                perPort = new Map();
+                bridges.set(env, perPort);
             }
-            let token = perLang.get(language);
-            if (!token) {
-                token = opts?.token ?? randomUUID();
-                perLang.set(language, token);
+            let bridge = perPort.get(port);
+            if (!bridge) {
+                const token = opts?.token ?? randomUUID();
+                bridge = { token, ready: startE2bBridge(language, env, port, token) };
+                perPort.set(port, bridge); // synchronous — no await above (run-to-completion dedupe guard, see E2bBridgeHandle.ready doc)
             }
-            return openE2bLspTransport(language, env, { ...opts, token });
+            const started = await bridge.ready;
+            if (!started)
+                return undefined;
+            return connectE2bLspBridge(env, port, bridge.token, opts);
         },
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "3.22.0",
+  "version": "3.23.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",