@sema-agent/server 7.102.0 → 7.103.1

package/dist/plugins/remote-env-k8s.js

@@ -4,7 +4,7 @@ import https from "node:https";
 import http from "node:http";
 import { StringDecoder } from "node:string_decoder";
 import WebSocket from "ws";
-import { shellQuote, kindFromMode, numEnvOr } from "./remote-shell.js";
+import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode, numEnvOr } from "./remote-shell.js";
 import { presignS3Url } from "./s3-presign.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
@@ -479,6 +479,15 @@ export class RemoteK8sExecutionEnv {
                     return onAbort();
                 opts.signal.addEventListener("abort", onAbort, { once: true });
             }
+            const takeStderr = (bytes) => {
+                if (bytes.length === 0)
+                    return;
+                errBuf.push(bytes);
+                if (detachTee)
+                    feedMemStream(detachTee.err, bytes, K8S_BG_MEM_CAP);
+                if (errDecoder)
+                    opts.onStderr(errDecoder.write(bytes));
+            };
             sock.on("message", (...args) => {
                 const data = args[0];
                 const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
@@ -505,11 +514,7 @@ export class RemoteK8sExecutionEnv {
                         opts.onStdout(outDecoder.write(payload));
                 }
                 else if (channel === 2) {
-                    errBuf.push(payload);
-                    if (detachTee)
-                        feedMemStream(detachTee.err, payload, K8S_BG_MEM_CAP);
-                    if (errDecoder)
-                        opts.onStderr(errDecoder.write(payload));
+                    takeStderr(opts?.stderrFilter ? opts.stderrFilter.filterStderr(payload) : payload);
                 }
                 else if (channel === 3) {
                     statusFrame = payload.toString("utf8");
@@ -545,6 +550,8 @@ export class RemoteK8sExecutionEnv {
                     finish({ ok: false, error: new ExecutionError("spawn_error", parsed.error) });
                     return;
                 }
+                if (opts?.stderrFilter)
+                    takeStderr(opts.stderrFilter.endStderr());
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
                 if (boundOutput) {
@@ -584,31 +591,38 @@ export class RemoteK8sExecutionEnv {
         });
     }
     async exec(command, options) {
+        return this.execCall(createCwdGuardedCall("k8s", command, this.workingDirOf(options?.cwd), options?.env), options);
+    }
+    fsExec(command, abortSignal) {
+        return this.execCall(createCwdGuardedCall("k8s", command, undefined, undefined), { abortSignal });
+    }
+    async execCall(call, options) {
         const c = await this.ensureConnected();
         if (!c.ok)
             return c;
         const detachSignal = options?.detachSignal;
         this.inFlightExecs++;
         try {
-            const composed = this.withCwdEnv(command, options?.cwd, options?.env);
             if (!detachSignal) {
-                return await this.runExec(composed, {
+                return call.settle(await this.runExec(call.command, {
                     signal: options?.abortSignal,
                     timeoutMs: options?.timeout != null ? options.timeout * 1000 : undefined,
                     boundOutput: true,
                     onStdout: options?.onStdout,
                     onStderr: options?.onStderr,
-                });
+                    stderrFilter: call,
+                }));
             }
             const adoptId = randomUUID();
             const dir = `${K8S_BG_DIR_ROOT}/exec-${adoptId}`;
             const tee = { out: seedMemStream(""), err: seedMemStream("") };
-            return await this.runExec(buildDetachCapableExec(dir, composed), {
+            return call.settle(await this.runExec(buildDetachCapableExec(dir, call.command), {
                 signal: options?.abortSignal,
                 timeoutMs: options?.timeout != null ? options.timeout * 1000 : undefined,
                 boundOutput: true,
                 onStdout: options?.onStdout,
                 onStderr: options?.onStderr,
+                stderrFilter: call,
                 detach: {
                     signal: detachSignal,
                     tee,
@@ -624,7 +638,7 @@ export class RemoteK8sExecutionEnv {
                         return adopted?.shellId;
                     },
                 },
-            });
+            }));
         }
         finally {
             this.inFlightExecs--;
@@ -665,7 +679,7 @@ export class RemoteK8sExecutionEnv {
         let bytes = 0;
         const ac = new AbortController();
         const signal = options?.signal ? AbortSignal.any([options.signal, ac.signal]) : ac.signal;
-        const done = this.runExec(this.withCwdEnv(command, options?.cwd, options?.env), {
+        const done = this.runExec(buildCwdEnvCommand(command, this.workingDirOf(options?.cwd), options?.env, "raw").command, {
             signal,
             boundOutput: true,
             onStdout: (d) => {
@@ -752,7 +766,7 @@ export class RemoteK8sExecutionEnv {
                     throw new Error(`pod connect failed: ${conn.error.message}`);
                 const jobId = randomUUID();
                 const dir = `${K8S_BG_DIR_ROOT}/${jobId}`;
-                const inner = self.withCwdEnv(command, options?.cwd, options?.env);
+                const inner = buildCwdEnvCommand(command, self.workingDirOf(options?.cwd), options?.env, "raw").command;
                 const cmdB64 = Buffer.from(inner, "utf8").toString("base64");
                 const runnerB64 = Buffer.from(buildBgRunnerScript(dir), "utf8").toString("base64");
                 const r = await bgExec(buildBgLauncherScript(dir, cmdB64, runnerB64), true);
@@ -868,7 +882,7 @@ export class RemoteK8sExecutionEnv {
         const dir = path.posix.dirname(abs);
         if (!dir || dir === "." || dir === "/")
             return undefined;
-        const mk = await this.exec(`mkdir -p ${shellQuote(dir)}`, { abortSignal });
+        const mk = await this.fsExec(`mkdir -p ${shellQuote(dir)}`, abortSignal);
         if (!mk.ok)
             return { ok: false, error: fileErrorFromExec(mk.error, dir) };
         if (mk.value.exitCode !== 0)
@@ -905,7 +919,7 @@ export class RemoteK8sExecutionEnv {
     posixFsInst;
     get posixFs() {
         return (this.posixFsInst ??= createPosixShellFs({
-            run: (cmd, abortSignal) => this.exec(cmd, { abortSignal }),
+            run: (cmd, abortSignal) => this.fsExec(cmd, abortSignal),
             resolve: (p) => this.resolve(p),
             tempDir: () => this.cwd,
         }));
@@ -946,16 +960,9 @@ export class RemoteK8sExecutionEnv {
             return c;
         return this.runExec(command, { signal: abortSignal, timeoutMs: this.cfg.dataTimeoutMs });
     }
-    withCwdEnv(command, cwd, env) {
-        const parts = [];
+    workingDirOf(cwd) {
         const dir = cwd ?? this.cwd;
-        if (dir)
-            parts.push(`cd ${shellQuote(this.resolve(dir))} &&`);
-        if (env)
-            for (const [k, v] of Object.entries(env))
-                parts.push(`export ${k}=${shellQuote(v)};`);
-        parts.push(command);
-        return parts.join(" ");
+        return dir ? this.resolve(dir) : undefined;
     }
 }
 export function k8sExecutionEnvFactory(config) {

package/dist/plugins/remote-env-ssh.d.ts

@@ -154,6 +154,11 @@ export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
         stderr: string;
         exitCode: number;
     }, ExecutionError>>;
+    /** 文件面探针的 exec(车PL 验修 ③):只用绝对路径,**不进工作目录**、没有 cwd 守卫 —— 工作目录进不去时探针照样答真话(`permission_denied` /
+     *  `not_found` 由命令自己的 stderr 归),core 的 `isDeadCwd` 不会把「进不去」读成「没了」。 */
+    private fsExec;
+    /** buffered exec 的唯一体:`call` 定了整串、stderr 的 started 行剥法与收口(`remote-shell.ts` `createCwdGuardedCall`)。 */
+    private execCall;
     execStream(command: string, options?: ExecStreamOptions): AsyncIterable<OutputChunk>;
     private sftp;
     absolutePath(p: string): Promise<Result<string, FileError>>;
@@ -192,7 +197,9 @@ export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
         suffix?: string;
         abortSignal?: AbortSignal;
     }): Promise<Result<string, FileError>>;
-    private withCwdEnv;
+    /** 本腿只定工作目录(缺省 cwd 规则 + 绝对化);串的形状归 {@link buildCwdEnvCommand} / {@link createCwdGuardedCall}(S-410:cwd 不可用 ⇒ 命令不跑;
+     *  车PL:buffered `exec` 上守卫触发 ⇒ `spawn_error`)。 */
+    private workingDirOf;
     private connErr;
     private fileError;
 }

package/dist/plugins/remote-env-ssh.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { Client } from "ssh2";
 import { createSshHostKeyVerifier } from "../ssh-host-key.js";
-import { shellQuote, kindFromMode } from "./remote-shell.js";
+import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
@@ -234,6 +234,12 @@ export class RemoteSshExecutionEnv {
         return this.destroy();
     }
     async exec(command, options) {
+        return this.execCall(createCwdGuardedCall("ssh", command, this.workingDirOf(options?.cwd), options?.env), options);
+    }
+    fsExec(command, abortSignal) {
+        return this.execCall(createCwdGuardedCall("ssh", command, undefined, undefined), { abortSignal });
+    }
+    async execCall(call, options) {
         const ready = await this.ensureConnected(options?.abortSignal);
         if (!ready.ok)
             return ready;
@@ -269,8 +275,7 @@ export class RemoteSshExecutionEnv {
                     return onAbort();
                 options.abortSignal.addEventListener("abort", onAbort, { once: true });
             }
-            const full = this.withCwdEnv(command, options?.cwd, options?.env);
-            conn.exec(full, (err, stream) => {
+            conn.exec(call.command, (err, stream) => {
                 if (err)
                     return finish({ ok: false, error: new ExecutionError("spawn_error", `ssh exec failed: ${err.message}`, err) });
                 streamRef = stream;
@@ -291,14 +296,22 @@ export class RemoteSshExecutionEnv {
                     if (code == null && !signal) {
                         return finish({ ok: false, error: new ExecutionError("transport_lost", "ssh channel closed without exit status (transport lost / connection dropped)") });
                     }
+                    const tail = call.endStderr();
+                    if (tail.length > 0) {
+                        errBuf.push(tail);
+                        options?.onStderr?.(tail.toString());
+                    }
                     const out = outBuf.result();
                     const err = errBuf.result();
                     const exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 1);
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode }));
+                    finish(call.settle(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode })));
                 })
                     .stderr.on("data", (d) => {
-                    errBuf.push(d);
-                    options?.onStderr?.(d.toString());
+                    const c = call.filterStderr(d);
+                    if (c.length === 0)
+                        return;
+                    errBuf.push(c);
+                    options?.onStderr?.(c.toString());
                 });
             });
         });
@@ -347,7 +360,7 @@ export class RemoteSshExecutionEnv {
             catch {
             }
         };
-        const full = this.withCwdEnv(command, options?.cwd, options?.env);
+        const full = buildCwdEnvCommand(command, this.workingDirOf(options?.cwd), options?.env, "raw").command;
         conn.exec(full, (err, stream) => {
             if (err) {
                 failure = new RemoteExecutionError("unknown", `ssh exec failed: ${err.message}`, err);
@@ -480,7 +493,7 @@ export class RemoteSshExecutionEnv {
         const abs = this.resolve(p);
         const dir = path.posix.dirname(abs);
         if (dir && dir !== "." && dir !== "/") {
-            const mk = await this.exec(`mkdir -p -- ${shellQuote(dir)}`, { abortSignal });
+            const mk = await this.fsExec(`mkdir -p -- ${shellQuote(dir)}`, abortSignal);
             if (!mk.ok)
                 return { ok: false, error: fileErrorFromExec(mk.error, dir) };
             if (mk.value.exitCode !== 0)
@@ -540,7 +553,7 @@ export class RemoteSshExecutionEnv {
     posixFsInst;
     get posixFs() {
         return (this.posixFsInst ??= createPosixShellFs({
-            run: (cmd, abortSignal) => this.exec(cmd, { abortSignal }),
+            run: (cmd, abortSignal) => this.fsExec(cmd, abortSignal),
             resolve: (p) => this.resolve(p),
             tempDir: () => null,
         }));
@@ -574,16 +587,9 @@ export class RemoteSshExecutionEnv {
     async createTempFile(options) {
         return this.posixFs.createTempFile(options);
     }
-    withCwdEnv(command, cwd, env) {
-        const parts = [];
+    workingDirOf(cwd) {
         const dir = cwd ?? (this.cwd !== "." ? this.cwd : undefined);
-        if (dir)
-            parts.push(`cd ${shellQuote(this.resolve(dir))} &&`);
-        if (env)
-            for (const [k, v] of Object.entries(env))
-                parts.push(`export ${k}=${shellQuote(v)};`);
-        parts.push(command);
-        return parts.join(" ");
+        return dir ? this.resolve(dir) : undefined;
     }
     connErr(e) {
         const msg = e.message || String(e);

package/dist/plugins/remote-shell.d.ts

@@ -2,7 +2,7 @@
  * Shared shell/path helpers for the SSH + ADB `RemoteExecutionEnv` adapters. Kept in ONE place so the
  * security-sensitive quoting can't drift between adapters (council design/#4, #5).
  */
-import type { ExecutionError, FileError, FileInfo, RemoteExecutionError, Result, SymlinkChain } from "@sema-agent/core";
+import { ExecutionError, type FileError, type FileInfo, type RemoteExecutionError, type Result, type SymlinkChain } from "@sema-agent/core";
 import type { ChildProcess } from "node:child_process";
 /**
  * D5 pipe-destroy grace (parity with core's vendored `EXEC_FORCE_SETTLE_GRACE_MS`, harness/env/nodejs.js):
@@ -25,6 +25,108 @@ export declare function armPipeDestroyGrace(child: ChildProcess): ReturnType<typ
 /** POSIX single-quote a string for safe interpolation into a remote shell command (the only metacharacter
  *  inside '' is ' itself, closed/escaped/reopened). */
 export declare function shellQuote(s: string): string;
+/** S-410:cwd 守卫在**远端**的退出码 —— 包装层自己失败、命令没跑(POSIX 包装工具 `env(1)` / `nohup(1)` / `timeout(1)` 的惯用码;126 / 127 是 shell
+ *  自己的「不可执行 / 找不到」)。buffered `exec` 经 {@link createCwdGuardedCall} 把它收成 `spawn_error`(车PL);命令自己也可能退 125,判别见那只函数。 */
+export declare const CWD_UNAVAILABLE_EXIT = 125;
+/** S-410:cwd 守卫触发时写进 stderr 的那一行的开头(后接 ` [<nonce>]: <目录> (cd failed; command not run)`),也是 `spawn_error` 消息的主句。 */
+export declare const CWD_UNAVAILABLE_LINE = "sema: working directory unavailable";
+/** 车PL 验修 ②:settled 面上 cd 成功之后、命令之前打到 stderr 的那一行的开头(后接 ` [<同一 nonce>]`)。腿在交出之前把它剥掉。 */
+export declare const CWD_STARTED_LINE = "sema: command started";
+/** 一次调用的 cwd 守卫:被守卫的目录 + 本次调用的两只标记(同一个 nonce)。 */
+export interface CwdGuard {
+    /** 被守卫的目录(腿已绝对化)。 */
+    readonly dir: string;
+    /** `sema: working directory unavailable [<nonce>]` —— 守卫行以它开头。nonce = 每次调用现铸的 8 字节随机数(16 位十六进制)。
+     *  🔴 nonce **对命令不保密**:命令能从 `BASH_EXECUTION_STRING` / `/proc/self/cmdline` 读到整串(验修 codex ②)⇒ 守卫行可以被伪造,
+     *  判据因此不单靠它(见 {@link CwdGuard.started})。 */
+    readonly marker: string;
+    /** settled 面:cd 成功之后、命令之前 `echo` 到 stderr 的那一整行 `sema: command started [<同一 nonce>]`;raw 面缺席(见 {@link CwdGuardFace})。
+     *  它在命令开跑**之前**就进了流,命令收不回它 ⇒「见到这一行 = 命令跑过了」,伪造的守卫行不再被认。 */
+    readonly started: string | undefined;
+}
+/** {@link buildCwdEnvCommand} 的产物(纯数据):交给远端 `sh -c` 的整串 + 本次调用的 cwd 守卫(没给 `dir` ⇒ 缺席)。 */
+export interface CwdEnvCommand {
+    readonly command: string;
+    readonly cwdGuard: CwdGuard | undefined;
+}
+/**
+ * 串是给哪一面用的(闭集,两词):
+ *  · `settled` —— buffered `exec`:结果要经 {@link createCwdGuardedCall} 判「命令跑没跑」,所以守卫之后多打一行 started 标记,腿再把它剥掉;
+ *  · `raw` —— `execStream` 与后台 launch:不判(货币是 `RemoteExecutionError` / 落盘的 job 输出),守卫行 + 125 原样交出,**不打** started 行 ——
+ *    打了就得在流式的三处与后台的落盘文件里各剥一次,而这两面没有要它的判据。
+ */
+export type CwdGuardFace = "settled" | "raw";
+/**
+ * 🔴 S-410(7.103.1)—— 三条远端 shell 腿(ssh / k8s / adb)交给远端 `sh -c` 的那一串**唯一**的组装:进工作目录 →(settled 面)打 started 行 →
+ * 导出任务 env → 跑命令。各腿只决定 `dir`(自己的缺省 cwd 规则 + 路径绝对化),串的形状只在这里。
+ *
+ * 形:`cd '<dir>' || { echo '<marker>: <dir> (cd failed; command not run)' >&2; exit 125; }; echo '<started>' >&2; export K='v'; … <command>`
+ * (raw 面没有 `echo '<started>' >&2;` 那一段)
+ *  · cd 失败(目录不存在 / 无权限 / 不是目录)⇒ 命令**不跑**,整条退 {@link CWD_UNAVAILABLE_EXIT};stderr 先是 shell 自己的 cd 报错,再是守卫行。
+ *    修前形 `cd '<dir>' && export K='v'; <command>`:`&&` 只绑到第一只 `export`,`;` 之后的命令照样在**登录目录**里跑,还少了那只 env ——
+ *    执行面 fail-open([ref])。core 的 Bash 工具每次都带 `env:{PWD}`,所以修前**每一条**模型命令都是这一形;没有 env 时修前形是
+ *    `cd … && <command>`,只短路命令的第一段 —— `a; b`、`a || b`、多行命令的尾部照样在登录目录里跑。本形对两者一律不跑(钉:
+ *    `test/remote-cwd-env-compose.test.ts`「本机 sh 真跑」格的复合命令半)。
+ *  · 为什么是前缀守卫,不是 `cd … && { export …; <command>; }`:命令串原样留在**最后**,与修前同位。包进 `{ …; }` 会让命令里的尾随注释
+ *    (`ls # x` 把 `; }` 注释掉)与 heredoc(终止行后面多出 `; }`)改义或语法错。cd 成功时,命令、env、退出码与修前逐字同义;stderr 在 settled 面
+ *    多出的 started 行由腿剥掉({@link createCwdGuardedCall}),交出去的 stderr 逐字是命令自己的。
+ *  · 两行都用 `echo`,不用 `printf`:`echo` 在每一只 POSIX shell 里都是内建(dash / bash / busybox ash / mksh / toybox sh),早期 Android 的
+ *    toolbox 可能没有 `printf` 可执行件(未实机核)—— 真没有的话,用 `printf` 那种设备上守卫行出不来、腿认不出守卫,命令照样不跑但退回「命令自己退 125」的形。
+ *    `echo` 在 dash 里会解释参数里的反斜杠转义,只动得了守卫行的目录那一段:判别只读行首的 marker(无反斜杠),消息里的目录取 {@link CwdGuard.dir};
+ *    started 行里没有目录、没有反斜杠。
+ *  · export 规则逐字照旧。
+ *    - 值经 {@link shellQuote}(POSIX 单引号,里面只有 `'` 自己要转义)⇒ 命令读到的是原值,不展开、不分词。
+ *    - 键原样拼:键与 `command` 出自同一个调用方(引擎交来的 `ExecOpts.env`),而 `command` 本身就是任意 shell 文本、以同一身份跑 ⇒
+ *      不引用键不多给任何能力。引用了反而改变「非法键名 ⇒ export 报错」的现状。
+ *  · ⚠️ 边界:需要远端是 POSIX sh(`{ …; }` 组命令)。k8s 走 `sh -c`、adb 走设备 `sh`;**ssh 腿走远端账户登录 shell 的 `-c`** —— 登录 shell 是
+ *    csh / tcsh(fish 看版本)的账户不认 `{ …; }`,整条语法错、命令不跑(修前无 env 的 `cd 'X' && cmd` 在 csh 里能跑)。部署前提写在
+ *    `docs/DEPLOY-PREREQS.md`「ssh / k8s / adb 车道:远端工作目录不可用」节。
+ * `dir` 缺席 ⇒ 不进目录、没有守卫、没有 started 行,只有 export + 命令(与修前同)。
+ */
+export declare function buildCwdEnvCommand(command: string, dir: string | undefined, env: Readonly<Record<string, string>> | undefined, face: CwdGuardFace): CwdEnvCommand;
+/** 经 {@link buildCwdEnvCommand} 组串的三条远端 shell 腿(`spawn_error` 消息的腿名,与 host 腿的 `host spawn failed: …` 同一句族)。 */
+export type RemoteShellLeg = "ssh" | "k8s" | "adb";
+/** 远端 stderr 流过的那一半(各腿的传输层按原始字节喂):剥掉本次调用的 started 行(只那一行),其余逐字交出。 */
+export interface CwdStartedStderrFilter {
+    /** 一块原始字节 → 该交给下游(缓冲 / 回调 / tee)的字节。 */
+    filterStderr(chunk: Buffer): Buffer;
+    /** 流结束:交出还压着的字节(started 行之前、还没收到换行的那一截)。 */
+    endStderr(): Buffer;
+}
+/** 远端三腿 buffered `exec` 的一次调用(活对象:stderr 流过它,结果经它收口)。 */
+export interface CwdGuardedCall extends CwdStartedStderrFilter {
+    /** 交给远端 `sh -c` 的整串(settled 面)。 */
+    readonly command: string;
+    /** 收口:退 125 ∧ stderr 有以本次 marker 开头的一行 ∧ **没见到** started 行 ⇒ `spawn_error`;其余原样。 */
+    settle<T extends {
+        readonly stderr: string;
+        readonly exitCode: number;
+    }>(r: Result<T, ExecutionError>): Result<T, ExecutionError>;
+}
+/**
+ * 🔴 车PL(7.103.1 验修轮 A [high] + 验修 codex ②)—— 三条远端 shell 腿 buffered `exec` 的**唯一**协议:组串(settled 面)+ 剥 started 行 + 收口。
+ * 守卫触发 ⇒ 与 host 腿同形的 `ExecutionError("spawn_error", "<腿> spawn failed: sema: working directory unavailable: <目录> — the command did not run
+ * (<cd 自己的话>)")`。
+ *
+ * 为什么是 spawn_error:core 的 ExecutionEnv 契约把「命令没跑(死 cwd 在列)」给了它;core 的 Bash 工具只在 `spawn_error` / `shell_unavailable` 上
+ * 走死 cwd 诊断(`diagnoseDeadCwd`:目录真没了 ⇒ 复位到任务根、答「reset to <root>; re-run」)。S-410 初版把同一形报成 `{ ok:true, exitCode:125 }`,
+ * core 读作命令自己失败 ⇒ cwd 不复位,前缀又挡在模型自救的 `cd` / `mkdir` 前面 ⇒ 本轮后续 Bash 全退 125。host 腿(`remote-env-host.ts` 的
+ * `child.on("error")`)本就报 `spawn_error`,四条腿一条规则。
+ *
+ * 判据(一条规则,缺一不可):`r.ok` ∧ 退出码 = {@link CWD_UNAVAILABLE_EXIT} ∧ stderr 有一行以本次 {@link CwdGuard.marker} 开头 ∧ **流里没出现过**
+ * 本次 {@link CwdGuard.started} 那一整行。started 行在 cd 成功之后、命令之前写进流,命令收不回它 ⇒ 命令读到 nonce 伪造守卫行再退 125,照样按
+ * 「命令跑过了」交出(验修 codex ②:修前这一形被读成「没跑」⇒ 输出丢、调用方可能重试一个非幂等操作)。消息里的目录取 {@link CwdGuard.dir}
+ * (不从 stderr 抠),括号里是守卫行之前 shell 自己的 cd 报错(无则 `cd failed`)。
+ *
+ * started 行的剥法:按原始字节逐行扫,**第一处**与 started 行逐字节相等的整行剥掉(连同换行),其后的字节原样直通;之前的行(ssh 登录 shell 可能
+ * 先说几句)原样交出、只压着还没收到换行的那一截。腿在三处都用它:缓冲的 stderr、流式回调、k8s detach 的 tee ⇒ 交出去的 stderr 逐字是命令自己的。
+ * 没有守卫(没给 `dir`,如文件面探针)⇒ 直通、收口不判。
+ *
+ * 辖域 = buffered `exec`(core Bash 工具、git 探针走它;文件面探针也走同一只 exec 体但**不带 cwd**,见各腿)。流式 `execStream` 与后台 launch 用
+ * `raw` 面:照旧交出 125 + 守卫行 —— 两面的货币是 `RemoteExecutionError`(没有「命令没跑」这个词),消费方(core exec-gate、leader `pullDiff`)
+ * 把任何非 0 退出当失败并带出 stderr,而 core 的后台 Bash 在 launch 前自己先做死 cwd 检查(`fs-bash.js` `run_in_background` 分支)。
+ */
+export declare function createCwdGuardedCall(leg: RemoteShellLeg, command: string, dir: string | undefined, env: Readonly<Record<string, string>> | undefined): CwdGuardedCall;
 /** Derive FileInfo kind from POSIX st_mode bits (raw stat/readdir attrs carry no isDirectory() helper). */
 export declare function kindFromMode(mode?: number): FileInfo["kind"];
 export declare function drainNumEnvWarnings(): Array<{
@@ -43,17 +145,16 @@ export declare const SYMLINK_CHAIN_MAX_HOPS = 64;
  *   `unknown` 而不是 `not_found`),于是调用方拿到的是 `ok:false`(core 读作「这一次没有跳」,永不是拒绝)
  *   而不是一个伪造的空链。
  *
- * 🔴 **整条命令包在一个 `{ …; }` 里**,理由是**调用方会给它加前缀**:四条腿的 `withCwdEnv` 都拼
- *   `cd <dir> && <命令>`(ssh `:760` / k8s `:1418` / adb `:578` / local-docker 同形)。这里连着犯过两次错,
- *   两次都记下来,因为它们是**同一个坑的两面**:
+ * 🔴 **整条命令包在一个 `{ …; }` 里**,让它**只有一个退出状态**,不依赖调用方加的前缀是什么形。今天三条远端 shell 腿的文件面探针
+ *   (本命令经 `PosixShellFs` 发出)**不带 cwd**(车PL 验修 ③:只用绝对路径,不进目录 ⇒ 前面没有 {@link buildCwdEnvCommand} 的守卫前缀);
+ *   local-docker 用 `docker exec -w <dir>`,e2b 走 SDK 的 `cwd`,都不拼前缀。S-410 之前三条远端腿给它拼过 `cd <dir> && <命令>`,在那个形下
+ *   这里连着犯过两次错,记下来是因为它们是**同一个坑的两面**,换任何一种链式前缀都会再来:
  *   · 写成 `command -v … || { …; }`:`||` 与前缀的 `&&` 结成一条链(`cd X && command -v … || { … }`),
  *     **`cd` 失败时跑的是探测的失败臂** —— 报「readlink 不在」而真相是「那个目录没了」,运维去修一个没坏的东西;
  *   · 改成独立语句 `if ! …; fi; c=…; while …`:前缀的 `&&` 只短路**那一条 `if`**,后面的循环照跑 ——
  *     于是「`cd` 失败 ∧ readlink 缺失」这一格里,`|| break` 把工具缺失吞成零跳,脚本 **exit 0 + 空 stdout**,
  *     调用方拿到一条**伪造的空链**。这正是探测本来要挡的那个静默兜底([ref] 轴),换了个入口回来了。
- *   ⇒ 正解是**让整条命令只有一个退出状态**:包进 `{ …; }`,前缀的 `&&` 要么统治全部、要么全部不跑。
- *     `cd` 失败 ⇒ 退出码来自 `cd` 自己、stderr 是它自己的话 ⇒ `ok:false`(core 读作「这一次没有跳」),
- *     诚实且指向真因;`cd` 成功 ⇒ 探测与循环照旧。`{ }` 不是子 shell,里面的 `exit 127` 照样结束整条命令。
+ *   `{ }` 不是子 shell,里面的 `exit 127` 照样结束整条命令。
  *
  * 词法细节(逐条对着 core 的 Node 实现写,两边同形):绝对目标直接接上;相对目标用参数展开
  * `${c%/*}` 取**当前这条链接**所在目录(不调 `dirname` —— toybox 的 `dirname` 不认 `--`,且这里零外部命令
@@ -101,8 +202,7 @@ export type ShellChainRun = (cmd: string) => Promise<Result<{
  *    「叶不是软链」与「叶不存在」**都是 exit 0 + 空 stdout**(脚本里的 `|| break`),所以任何 exit≠0
  *    都**不是**「这个文件不在」,而是解析器自己出了事(工具缺失 / cwd 没了 / 传输坏 / shell 拒)。
  *    把它折成 `not_found` 会让运维去找一条根本没丢的路径。
- *    ⚠️ 例外由 `classifyFsStderr` 自己认:`cd` 失败那一格的 stderr 里真带「No such file」,它按**那句话**
- *    归 `not_found` —— 那时真的有一条路径没了(工作目录),所以那个码是对的。
+ *    三条远端腿的文件面探针不带 cwd(车PL 验修 ③)⇒ 这条命令不会因为某个工作目录不可用而不跑。
  */
 export declare function runSymlinkChain(absPath: string, run: ShellChainRun): Promise<Result<SymlinkChain, FileError>>;
 //# sourceMappingURL=remote-shell.d.ts.map

package/dist/plugins/remote-shell.js

@@ -1,4 +1,6 @@
+import { ExecutionError } from "@sema-agent/core";
 import { classifyFsStderr, fileErrorFromExec } from "./remote-env-file-error.js";
+import { randomBytes } from "node:crypto";
 export const EXEC_FORCE_SETTLE_GRACE_MS = 3000;
 export function armPipeDestroyGrace(child) {
     const t = setTimeout(() => {
@@ -15,6 +17,87 @@ export function armPipeDestroyGrace(child) {
 export function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
 }
+export const CWD_UNAVAILABLE_EXIT = 125;
+export const CWD_UNAVAILABLE_LINE = "sema: working directory unavailable";
+export const CWD_STARTED_LINE = "sema: command started";
+export function buildCwdEnvCommand(command, dir, env, face) {
+    const parts = [];
+    let cwdGuard;
+    if (dir !== undefined && dir !== "") {
+        const nonce = randomBytes(8).toString("hex");
+        cwdGuard = { dir, marker: `${CWD_UNAVAILABLE_LINE} [${nonce}]`, started: startedLineFor(face, nonce) };
+        const line = `${cwdGuard.marker}: ${dir} (cd failed; command not run)`;
+        parts.push(`cd ${shellQuote(dir)} || { echo ${shellQuote(line)} >&2; exit ${CWD_UNAVAILABLE_EXIT}; };`);
+        if (cwdGuard.started !== undefined)
+            parts.push(`echo ${shellQuote(cwdGuard.started)} >&2;`);
+    }
+    if (env)
+        for (const [k, v] of Object.entries(env))
+            parts.push(`export ${k}=${shellQuote(v)};`);
+    parts.push(command);
+    return { command: parts.join(" "), cwdGuard };
+}
+function startedLineFor(face, nonce) {
+    switch (face) {
+        case "settled":
+            return `${CWD_STARTED_LINE} [${nonce}]`;
+        case "raw":
+            return undefined;
+    }
+}
+const STARTED_SCAN_CAP_BYTES = 64 * 1024;
+const EMPTY = Buffer.alloc(0);
+export function createCwdGuardedCall(leg, command, dir, env) {
+    const sent = buildCwdEnvCommand(command, dir, env, "settled");
+    const guard = sent.cwdGuard;
+    const startedBytes = guard?.started === undefined ? undefined : Buffer.from(guard.started, "utf8");
+    let pending = EMPTY;
+    let scanning = startedBytes !== undefined;
+    let sawStarted = false;
+    return {
+        command: sent.command,
+        filterStderr(chunk) {
+            if (!scanning || startedBytes === undefined)
+                return chunk;
+            let rest = pending.length === 0 ? chunk : Buffer.concat([pending, chunk]);
+            const out = [];
+            for (let nl = rest.indexOf(0x0a); nl >= 0; nl = rest.indexOf(0x0a)) {
+                if (rest.subarray(0, nl).equals(startedBytes)) {
+                    sawStarted = true;
+                    scanning = false;
+                    out.push(rest.subarray(nl + 1));
+                    rest = EMPTY;
+                    break;
+                }
+                out.push(rest.subarray(0, nl + 1));
+                rest = rest.subarray(nl + 1);
+            }
+            if (scanning && rest.length > STARTED_SCAN_CAP_BYTES) {
+                scanning = false;
+                out.push(rest);
+                rest = EMPTY;
+            }
+            pending = rest;
+            return out.length === 1 ? out[0] : Buffer.concat(out);
+        },
+        endStderr() {
+            const p = pending;
+            pending = EMPTY;
+            scanning = false;
+            return p;
+        },
+        settle(r) {
+            if (!r.ok || guard === undefined || sawStarted || r.value.exitCode !== CWD_UNAVAILABLE_EXIT)
+                return r;
+            const lines = r.value.stderr.split("\n");
+            const at = lines.findIndex((l) => l.startsWith(guard.marker));
+            if (at < 0)
+                return r;
+            const said = lines.slice(0, at).join(" ").trim().slice(0, 300) || "cd failed";
+            return { ok: false, error: new ExecutionError("spawn_error", `${leg} spawn failed: ${CWD_UNAVAILABLE_LINE}: ${guard.dir} — the command did not run (${said})`) };
+        },
+    };
+}
 export function kindFromMode(mode) {
     const t = (mode ?? 0) & 0o170000;
     if (t === 0o040000)

package/dist/project-memory.js

@@ -3,8 +3,7 @@ import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
 import hostPath, { isAbsolute, join } from "node:path";
 import { announceInstructionSource } from "./instruction-source-notice.js";
-import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
-import { scrubServerSecrets } from "./server-secret-env.js";
+import { gitSubprocessEnv } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
 const INSTRUCTION_FILE_CHAIN = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
 const INSTRUCTION_READ_CAP = 24 * 1024;
@@ -72,11 +71,9 @@ async function readChainMember(root, rel, maxBytes, truncatedFlag) {
 }
 function git(root, args, maxBytes) {
     const safeArgs = ["-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args];
-    const scrubFindings = [];
-    const scrubbedEnv = scrubServerSecrets(process.env, scrubFindings);
-    recordSecretEnvScrub("server.project-memory.git-subprocess", scrubFindings, []);
+    const env = gitSubprocessEnv({ site: "server.project-memory.git-subprocess", isolateConfig: true });
     return new Promise((res) => {
-        execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env: { ...scrubbedEnv, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } }, (err, stdout, stderr) => {
+        execFile("git", safeArgs, { cwd: root, timeout: 5000, maxBuffer: maxBytes, env }, (err, stdout, stderr) => {
             if (!err)
                 return res({ out: stdout.trim() });
             const e = err;

package/dist/run-local.js

@@ -52,6 +52,7 @@ import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
 import { createHostLspManager } from "./host-lsp-manager.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { installOutboundDispatcher } from "./outbound-dispatcher.js";
 export function parseArgs(argv) {
     let objective;
     let root;
@@ -267,6 +268,7 @@ export async function runLocal(argv, deps = {}) {
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     installSecretEnvScrubRecorder({ logger, metrics });
     logConfigDiagnostics(logger);
+    installOutboundDispatcher(logger);
     const configProvider = createConfigProvider({
         provider: config.configProvider ?? "local",
         ...(config.configLocalDir ? { localDir: config.configLocalDir } : { localDir: root }),