@sema-agent/server 7.103.0 → 7.103.1

package/dist/config-center/restart-signal.d.ts

@@ -5,9 +5,14 @@ export type RestartSlice = "skills" | "mcp" | "a2a" | "scenarios" | "degrade-rou
  *  slices cannot see them, because they are configured from env (`ServiceConfig`), not from the center's
  *  EffectiveConfig. Absent/empty = that lane is off ⇒ its slice is inert (null on both sides). */
 export interface RestartSliceCtx {
-    /** `config.degrade.to` when REACTIVE degrade is on (env `MODEL_DEGRADE_TO` + `MODEL_DEGRADE_REACTIVE`);
-     *  undefined = the lane is off ⇒ no degrading brain was composed ⇒ nothing is boot-frozen. */
-    reactiveDegradeTo?: string;
+    /** S-794:反应式降级壳的两侧读数 —— `baked` = createBrain 组壳那一刻焊进去的目标路由指纹,`current` = 同一只
+     *  指纹函数(brain.ts `degradeRouteFingerprint`)对本拍活配置再读一次(读法见 brain.ts `createDegradeRouteWatch`)。
+     *  缺席 = 调用方没有递席(单元调用)⇒ `degrade-route` 片恒不签;车道没开 / 没焊壳在席内表达为两侧同为 null。
+     *  (此前的 `reactiveDegradeTo` 位只剩「阀门开着」一义,已并进本席 —— 一位不留两义。) */
+    degradeRoute?: {
+        readonly baked: unknown;
+        readonly current: unknown;
+    };
     /** #A4(codex 交叉复审 finding 2,验真后采纳):本机 env **显式占住**的 readFace 键
      *  (`applyCenterReadFace` 的返回值,由 boot 存下)。这些键的 center 值在本机**永不 boot-bake**,
      *  所以它们的变化不该产生 restart 理由 —— 否则 center 改一个本机用不上的键,整片 fleet 会为一次
@@ -40,6 +45,38 @@ export interface RestartSliceCtx {
 export type EngineRestartSignal = RestartSignal & {
     reasons: RestartSlice[];
 };
+/** One catalog entry, reduced to the fields whose change is genuinely restart-to-apply. Consumers of a
+ *  boot-frozen catalog entry read almost every field on the FULLY-DERIVED Model (`toModel`) — id → body.model,
+ *  baseUrl → the endpoint, provider → which brain, maxTokens/compat/extraBody/input → the request body,
+ *  apiKeyEnv/sealedApiKey → the credential — so we fingerprint the WHOLE entry minus the three provably HOT
+ *  fields:
+ *    - `cost`'s VALUES — refreshed by `mutateInPlace(pricing, buildPricing(config.models))`, and core prefers
+ *                      `deps.pricing[model.id]` over the (possibly frozen) `Model.cost`, so a pure re-pricing
+ *                      needs neither a swap nor a restart. 🔴 B-089:its PRESENCE is subtracted no longer —
+ *                      a roster row WITHOUT `cost` now mints no `cost` key (unpriced) and therefore no pricing
+ *                      row, and core's fallback is literally `deps.pricing?.[id] ?? modelCostToPricing(model.cost)`
+ *                      (core 7.13.0 run-settle-and-teardown.js and three siblings) — so a FROZEN generation
+ *                      would quietly keep billing at the WITHDRAWN rates. Presence rides the fingerprint in both
+ *                      directions (the rule does not branch on direction); the numbers stay subtracted.
+ *    - `quotaWeight` — refreshed by `mutateInPlace(config.modelQuotaWeights, …)`, read live per burn.
+ *    - `enabled`     — `enabledOnly` already filtered on it, so among the entries that reach here it is
+ *                      `true`-or-absent: two encodings of ONE state. Keeping it would let a center serializer
+ *                      that starts/stops emitting the explicit `true` manufacture a restart out of nothing.
+ *                      Every real enable/disable FLIP changes the filtered SET, so it still signals.
+ *  A DENY-list (not an allow-list) on purpose: a catalog field added later rides the fingerprint automatically,
+ *  so the failure mode of drift is a spurious restart, never a silently missed one.
+ *
+ *  Shared by BOTH frozen-entry consumers — the `modelPlaneChanged` swap gate (over catalog entries) and brain.ts
+ *  `degradeRouteFingerprint` (over the Model the reactive-degrade shell welded, S-794) — so "which fields are hot"
+ *  is answered once. (复审 2026-07-29 留档:the since-retired `models-tiers` slice had
+ *  kept all three, so on a tiers-active deployment a pure re-pricing / weight tweak / serializer writing
+ *  `enabled:true` rolling-restarted the fleet.) For the swap gate a subtracted field means "no swap needed": the
+ *  Runner reads pricing and quota weights live off the maps `mutateInPlace` refreshes. */
+export declare function catalogEntryFingerprint(entry: {
+    readonly cost?: unknown;
+    readonly quotaWeight?: unknown;
+    readonly enabled?: unknown;
+}): unknown;
 /** Restart-to-apply slices that DIFFER between this process's BOOT config and a freshly-pulled one. Empty =
  *  nothing baked-at-boot changed (only hot-apply slices moved, or nothing) → no restart needed. An orchestrator
  *  can auto rolling-restart on a non-empty result WITHOUT a restart loop, because the comparison is always

package/dist/config-center/restart-signal.js

@@ -9,7 +9,7 @@ function enabledOnly(rows) {
         return null;
     return rows.filter((r) => r.enabled !== false);
 }
-function catalogEntryFingerprint(entry) {
+export function catalogEntryFingerprint(entry) {
     const { cost, quotaWeight: _quotaWeight, enabled: _enabled, ...route } = entry;
     return { ...route, costDeclared: cost !== undefined };
 }
@@ -18,11 +18,17 @@ function planeEntriesFingerprint(rows) {
     return enabled ? enabled.map((m) => catalogEntryFingerprint(m)) : null;
 }
 function restartSlicePair(boot, current, slice, ctx) {
-    if (slice === "memory-consolidation") {
-        const seat = ctx?.consolidationSeat;
-        return seat === undefined ? [null, null] : [seat.baked, seat.current];
+    switch (slice) {
+        case "memory-consolidation":
+            return seatPair(ctx?.consolidationSeat);
+        case "degrade-route":
+            return seatPair(ctx?.degradeRoute);
+        default:
+            return [restartSliceValue(boot, slice, ctx), restartSliceValue(current, slice, ctx)];
     }
-    return [restartSliceValue(boot, slice, ctx), restartSliceValue(current, slice, ctx)];
+}
+function seatPair(seat) {
+    return seat === undefined ? [null, null] : [seat.baked, seat.current];
 }
 function restartSliceValue(eff, slice, ctx) {
     if (!eff)
@@ -48,13 +54,6 @@ function restartSliceValue(eff, slice, ctx) {
             const view = Object.entries(d).filter(([k, v]) => !held.has(k) && !CENTER_READ_FACE_LIVE_KEYS.has(k) && v !== undefined);
             return view.length > 0 ? Object.fromEntries(view) : null;
         }
-        case "degrade-route": {
-            const to = ctx?.reactiveDegradeTo;
-            if (to === undefined)
-                return null;
-            const target = (enabledOnly(eff.models?.models) ?? []).find((m) => m.name === to);
-            return target ? catalogEntryFingerprint(target) : null;
-        }
     }
 }
 export function restartReasons(boot, current, ctx) {

package/dist/model-entry-refusal.d.ts

@@ -83,7 +83,8 @@ export interface ModelRefusalVerdict {
  * S-768 —— 判决 → `/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的 wire 形(settings-schema `ModelRefusalsSignal`,纯投影):
  * 名 → 码,**值只码**(拒因事实里的上游 id / provider 词 / 坏字段键 / 出路句都不上 wire —— `entry_invalid` 行是没人验过的行,id / provider
  * 可能就是坏行原样;句子是给本机运维的散文,不是契约)。**名筛在这里、只在这里**:键过 settings-schema `isReportableRefusalName`(唯一判据,
- * import 不复制)—— 秘密形 / 空串 / `__proto__` 这类出不了门的名不进键、不计数;引擎内部的判决不受影响(本机日志的写名行为与基线同)。
+ * import 不复制;6.3.0 起 = 标识符白名单 ∧ 无密钥形 ∧ 无 URL userinfo)—— 秘密形 / 空串 / `__proto__` / 不是标识符的串这类出不了门的名不进键、
+ * 不计数;引擎内部的判决不受影响(本机日志的写名行为与基线同)。
  * 逐条空且无组拒 ⇒ `undefined`(键缺席:「没有」只有一种拼法)。
  */
 export declare function buildModelRefusalsSignal(v: ModelRefusalVerdict | undefined): ModelRefusalsSignal | undefined;

package/dist/observability/secret-env-scrub.d.ts

@@ -49,7 +49,7 @@ interface Sink {
 /**
  * 记一次剥除。**总不抛** —— 观测本身绝不能变成故障(同 `recordFailOpen` / reapers 的判据)。
  * `findings` 为空(这一次没丢任何 key)时什么也不做:那不是事件,是常态。
- * `findings` 只许装**最终没进子进程**的键 —— 点名放回的键不是剥除(不计数、不披露)。
+ * `findings` 只许装**没有按原样交给子进程**的键(剥掉 / 换成 core 占位半条)—— 点名放回的键取回源值,不是剥除(不计数、不披露)。
  * `allowed` = 这一次生效的点名放行名单(S-699),只在有出路的现场(`remedy` 在场)写进披露行;没有放行面的腿传 `[]`。
  */
 export declare function recordSecretEnvScrub(site: SecretEnvScrubSite, findings: readonly ServerSecretEnvFinding[], allowed: readonly string[]): void;

package/dist/observability/secret-env-scrub.js

@@ -27,6 +27,7 @@ export const SECRET_ENV_SCRUB_SITES = {
     },
 };
 const SCRUB_COUNTER = "secret_env_scrubbed_total";
+const SCRUB_COUNTER_HELP = "secret env entries not handed on as written (dropped or replaced in place) to a spawned child process, by site/kind/confidence (core scrubSecretEnv rules + server config-catalog secret names + name-list knobs)";
 const DISCLOSED_CAP = 512;
 const SEP = "=";
 let sink = {};
@@ -90,7 +91,7 @@ export function recordSecretEnvScrub(site, findings, allowed) {
 }
 export function installSecretEnvScrubRecorder(deps) {
     sink = { ...deps };
-    deps.metrics?.counter(SCRUB_COUNTER, "secret env entries dropped before spawning a child process, by site/rule/confidence (core scrubSecretEnv shape rule + server config-catalog secret names)");
+    deps.metrics?.counter(SCRUB_COUNTER, SCRUB_COUNTER_HELP);
     drainToMetrics();
 }
 export function secretEnvScrubDisclosedSize() {
@@ -104,6 +105,6 @@ export function resetSecretEnvScrubRecorderForTest(deps = {}) {
     pushed = new Map();
     disclosed = new Set();
     sink = { ...deps };
-    deps.metrics?.counter(SCRUB_COUNTER, "secret env entries dropped before spawning a child process, by site/rule/confidence (core scrubSecretEnv shape rule + server config-catalog secret names)");
+    deps.metrics?.counter(SCRUB_COUNTER, SCRUB_COUNTER_HELP);
 }
 //# sourceMappingURL=secret-env-scrub.js.map

package/dist/plugins/remote-env-adb.d.ts

@@ -149,6 +149,11 @@ export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
         stderr: string;
         exitCode: number;
     }, ExecutionError>>;
+    /** 文件面探针的 exec(车PL 验修 ③):只用绝对路径,**不进工作目录**、没有 cwd 守卫 —— 工作目录进不去时探针照样答真话(`permission_denied` /
+     *  `not_found` 由命令自己的 stderr 归),core 的 `isDeadCwd` 不会把「进不去」读成「没了」。 */
+    private fsExec;
+    /** buffered exec 的唯一体:`call` 定了整串、stderr 的 started 行剥法与收口(`remote-shell.ts` `createCwdGuardedCall`)。 */
+    private execCall;
     execStream(command: string, options?: ExecStreamOptions): AsyncIterable<OutputChunk>;
     absolutePath(p: string): Promise<Result<string, FileError>>;
     joinPath(parts: string[]): Promise<Result<string, FileError>>;
@@ -230,11 +235,13 @@ export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
      *   远端退出码与分流的那根旗标,即「一条以 `-x` 开头的命令能静默把本修关回去」。真机验证 `--` 之后的
      *   参数原样落到设备 shell(`adb shell -T -- '-x'` ⇒ 设备答 `/system/bin/sh: -c: requires an argument`)。
      *
-     * 命令永远是**最后一个**参数,整条包在一个 argv 元素里(设备侧 `sh -c` 收全串,与 `withCwdEnv` 的
-     * `cd … && …` 前缀语义一致)。
+     * 命令永远是**最后一个**参数,整条包在一个 argv 元素里 —— 设备侧 `sh -c` 收全串,即 {@link buildCwdEnvCommand} /
+     * {@link createCwdGuardedCall} 组出的那一串(带工作目录时含 cwd 守卫前缀:cd 失败 ⇒ 整条不跑)。
      */
     private deviceShellArgs;
-    private withCwdEnv;
+    /** 本腿只定工作目录(缺省 cwd 规则 + 绝对化);串的形状归 {@link buildCwdEnvCommand} / {@link createCwdGuardedCall}(S-410:cwd 不可用 ⇒ 命令不跑;
+     *  车PL:buffered `exec` 上守卫触发 ⇒ `spawn_error`)。 */
+    private workingDirOf;
 }
 /**
  * `ExecutionEnvFactory` for the ADB backend — one fresh (unconnected) env per task against the same device

package/dist/plugins/remote-env-adb.js

@@ -2,7 +2,7 @@ import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";
 import { spawn } from "node:child_process";
-import { shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
+import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, armPipeDestroyGrace } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { classifyFsStderr, fileErrorFromExec } from "./remote-env-file-error.js";
@@ -147,15 +147,21 @@ export class RemoteAdbExecutionEnv {
         return this.destroy();
     }
     async exec(command, options) {
+        return this.execCall(createCwdGuardedCall("adb", command, this.workingDirOf(options?.cwd), options?.env), options);
+    }
+    fsExec(command, abortSignal) {
+        return this.execCall(createCwdGuardedCall("adb", command, undefined, undefined), { abortSignal });
+    }
+    async execCall(call, options) {
         const ready = await this.ensureConnected();
         if (!ready.ok)
             return { ok: false, error: lazyConnectExecError(ready.error) };
-        const wrapped = this.withCwdEnv(command, options?.cwd, options?.env);
-        const r = await this.adb(this.deviceShellArgs(wrapped), {
+        const r = await this.adb(this.deviceShellArgs(call.command), {
             signal: options?.abortSignal,
             timeoutMs: options?.timeout != null ? options.timeout * 1000 : this.cfg.commandTimeoutMs,
             onStdout: options?.onStdout,
             onStderr: options?.onStderr,
+            stderrFilter: call,
         });
         if (!r.ok)
             return { ok: false, error: r.error };
@@ -163,7 +169,7 @@ export class RemoteAdbExecutionEnv {
             this.connected = false;
             return { ok: false, error: new ExecutionError("transport_lost", `adb transport lost mid-command: ${r.value.stderr.trim().slice(0, 200)} — reconnect + retry per idempotency`) };
         }
-        return ok(r.value);
+        return call.settle(ok(r.value));
     }
     async *execStream(command, options) {
         const ready = await this.ensureConnected();
@@ -171,7 +177,7 @@ export class RemoteAdbExecutionEnv {
             throw ready.error;
         if (this.destroyed)
             throw new RemoteExecutionError("connect_failed", "execution env already destroyed");
-        const wrapped = this.withCwdEnv(command, options?.cwd, options?.env);
+        const wrapped = buildCwdEnvCommand(command, this.workingDirOf(options?.cwd), options?.env, "raw").command;
         const child = this.spawnFn(this.cfg.adbPath, this.deviceShellArgs(wrapped), { stdio: ["ignore", "pipe", "pipe"] });
         const queue = [];
         let finished = false;
@@ -327,7 +333,7 @@ export class RemoteAdbExecutionEnv {
         const abs = this.resolve(p);
         const dir = path.posix.dirname(abs);
         if (dir && dir !== "." && dir !== "/") {
-            const mk = await this.exec(`mkdir -p ${shellQuote(dir)}`, { abortSignal });
+            const mk = await this.fsExec(`mkdir -p ${shellQuote(dir)}`, abortSignal);
             if (!mk.ok)
                 return { ok: false, error: fileErrorFromExec(mk.error, dir) };
             if (mk.value.exitCode !== 0)
@@ -374,7 +380,7 @@ export class RemoteAdbExecutionEnv {
     posixFsInst;
     get posixFs() {
         return (this.posixFsInst ??= createPosixShellFs({
-            run: (cmd, abortSignal) => this.exec(cmd, { abortSignal }),
+            run: (cmd, abortSignal) => this.fsExec(cmd, abortSignal),
             resolve: (p) => this.resolve(p),
             tempDir: () => this.cwd,
         }));
@@ -456,14 +462,19 @@ export class RemoteAdbExecutionEnv {
                     outTail.push(d);
                 opts?.onStdout?.(d.toString());
             });
-            child.stderr.on("data", (d) => {
-                errBuf.push(d);
-                opts?.onStderr?.(d.toString());
-            });
+            const takeStderr = (bytes) => {
+                if (bytes.length === 0)
+                    return;
+                errBuf.push(bytes);
+                opts?.onStderr?.(bytes.toString());
+            };
+            child.stderr.on("data", (d) => takeStderr(opts?.stderrFilter ? opts.stderrFilter.filterStderr(d) : d));
             child.on("error", (e) => finish({ ok: false, error: new ExecutionError("spawn_error", `adb spawn failed (is '${this.cfg.adbPath}' installed?): ${e.message}`, e) }));
             child.on("close", (code, signal) => {
                 if (forceSettleTimer)
                     clearTimeout(forceSettleTimer);
+                if (opts?.stderrFilter)
+                    takeStderr(opts.stderrFilter.endStderr());
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
                 const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0);
@@ -481,16 +492,9 @@ export class RemoteAdbExecutionEnv {
     deviceShellArgs(command) {
         return ["-s", this.cfg.serial, "shell", "-T", "--", command];
     }
-    withCwdEnv(command, cwd, env) {
-        const parts = [];
+    workingDirOf(cwd) {
         const dir = cwd ?? this.cwd;
-        if (dir)
-            parts.push(`cd ${shellQuote(this.resolve(dir))} &&`);
-        if (env)
-            for (const [k, v] of Object.entries(env))
-                parts.push(`export ${k}=${shellQuote(v)};`);
-        parts.push(command);
-        return parts.join(" ");
+        return dir ? this.resolve(dir) : undefined;
     }
 }
 export function adbExecutionEnvFactory(config) {

package/dist/plugins/remote-env-k8s.d.ts

@@ -245,6 +245,11 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
             shellId: string;
         };
     }, ExecutionError>>;
+    /** 文件面探针的 exec(车PL 验修 ③):只用绝对路径,**不进工作目录**、没有 cwd 守卫 —— 工作目录进不去时探针照样答真话(`permission_denied` /
+     *  `not_found` 由命令自己的 stderr 归),core 的 `isDeadCwd` 不会把「进不去」读成「没了」。 */
+    private fsExec;
+    /** buffered exec 的唯一体:`call` 定了整串、stderr 的 started 行剥法与收口(`remote-shell.ts` `createCwdGuardedCall`)。 */
+    private execCall;
     /**
      * LSP surface (lsp/manager.ts `isLspCapable` duck-type, [ref] §13.1): cluster-internal address for a
      * port on the sandbox pod. The E2B counterpart returns a public proxy host; a pod has none — the WORKER
@@ -333,7 +338,9 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     }): Promise<Result<string, FileError>>;
     /** exec with the data-transfer bound (large reads/writes legitimately run longer than a control op). */
     private execData;
-    private withCwdEnv;
+    /** 本腿只定工作目录(缺省 cwd 规则 + 绝对化);串的形状归 {@link buildCwdEnvCommand} / {@link createCwdGuardedCall}(S-410:cwd 不可用 ⇒ 命令不跑;
+     *  车PL:buffered `exec` 上守卫触发 ⇒ `spawn_error`)。 */
+    private workingDirOf;
 }
 /**
  * `ExecutionEnvFactory` for the k8s pod-sandbox backend — one fresh (unconnected) env per task; the pod is

package/dist/plugins/remote-env-k8s.js

@@ -4,7 +4,7 @@ import https from "node:https";
 import http from "node:http";
 import { StringDecoder } from "node:string_decoder";
 import WebSocket from "ws";
-import { shellQuote, kindFromMode, numEnvOr } from "./remote-shell.js";
+import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode, numEnvOr } from "./remote-shell.js";
 import { presignS3Url } from "./s3-presign.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
@@ -479,6 +479,15 @@ export class RemoteK8sExecutionEnv {
                     return onAbort();
                 opts.signal.addEventListener("abort", onAbort, { once: true });
             }
+            const takeStderr = (bytes) => {
+                if (bytes.length === 0)
+                    return;
+                errBuf.push(bytes);
+                if (detachTee)
+                    feedMemStream(detachTee.err, bytes, K8S_BG_MEM_CAP);
+                if (errDecoder)
+                    opts.onStderr(errDecoder.write(bytes));
+            };
             sock.on("message", (...args) => {
                 const data = args[0];
                 const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
@@ -505,11 +514,7 @@ export class RemoteK8sExecutionEnv {
                         opts.onStdout(outDecoder.write(payload));
                 }
                 else if (channel === 2) {
-                    errBuf.push(payload);
-                    if (detachTee)
-                        feedMemStream(detachTee.err, payload, K8S_BG_MEM_CAP);
-                    if (errDecoder)
-                        opts.onStderr(errDecoder.write(payload));
+                    takeStderr(opts?.stderrFilter ? opts.stderrFilter.filterStderr(payload) : payload);
                 }
                 else if (channel === 3) {
                     statusFrame = payload.toString("utf8");
@@ -545,6 +550,8 @@ export class RemoteK8sExecutionEnv {
                     finish({ ok: false, error: new ExecutionError("spawn_error", parsed.error) });
                     return;
                 }
+                if (opts?.stderrFilter)
+                    takeStderr(opts.stderrFilter.endStderr());
                 const err = errBuf.result();
                 const stderr = markTruncated(err.text, err.droppedBytes);
                 if (boundOutput) {
@@ -584,31 +591,38 @@ export class RemoteK8sExecutionEnv {
         });
     }
     async exec(command, options) {
+        return this.execCall(createCwdGuardedCall("k8s", command, this.workingDirOf(options?.cwd), options?.env), options);
+    }
+    fsExec(command, abortSignal) {
+        return this.execCall(createCwdGuardedCall("k8s", command, undefined, undefined), { abortSignal });
+    }
+    async execCall(call, options) {
         const c = await this.ensureConnected();
         if (!c.ok)
             return c;
         const detachSignal = options?.detachSignal;
         this.inFlightExecs++;
         try {
-            const composed = this.withCwdEnv(command, options?.cwd, options?.env);
             if (!detachSignal) {
-                return await this.runExec(composed, {
+                return call.settle(await this.runExec(call.command, {
                     signal: options?.abortSignal,
                     timeoutMs: options?.timeout != null ? options.timeout * 1000 : undefined,
                     boundOutput: true,
                     onStdout: options?.onStdout,
                     onStderr: options?.onStderr,
-                });
+                    stderrFilter: call,
+                }));
             }
             const adoptId = randomUUID();
             const dir = `${K8S_BG_DIR_ROOT}/exec-${adoptId}`;
             const tee = { out: seedMemStream(""), err: seedMemStream("") };
-            return await this.runExec(buildDetachCapableExec(dir, composed), {
+            return call.settle(await this.runExec(buildDetachCapableExec(dir, call.command), {
                 signal: options?.abortSignal,
                 timeoutMs: options?.timeout != null ? options.timeout * 1000 : undefined,
                 boundOutput: true,
                 onStdout: options?.onStdout,
                 onStderr: options?.onStderr,
+                stderrFilter: call,
                 detach: {
                     signal: detachSignal,
                     tee,
@@ -624,7 +638,7 @@ export class RemoteK8sExecutionEnv {
                         return adopted?.shellId;
                     },
                 },
-            });
+            }));
         }
         finally {
             this.inFlightExecs--;
@@ -665,7 +679,7 @@ export class RemoteK8sExecutionEnv {
         let bytes = 0;
         const ac = new AbortController();
         const signal = options?.signal ? AbortSignal.any([options.signal, ac.signal]) : ac.signal;
-        const done = this.runExec(this.withCwdEnv(command, options?.cwd, options?.env), {
+        const done = this.runExec(buildCwdEnvCommand(command, this.workingDirOf(options?.cwd), options?.env, "raw").command, {
             signal,
             boundOutput: true,
             onStdout: (d) => {
@@ -752,7 +766,7 @@ export class RemoteK8sExecutionEnv {
                     throw new Error(`pod connect failed: ${conn.error.message}`);
                 const jobId = randomUUID();
                 const dir = `${K8S_BG_DIR_ROOT}/${jobId}`;
-                const inner = self.withCwdEnv(command, options?.cwd, options?.env);
+                const inner = buildCwdEnvCommand(command, self.workingDirOf(options?.cwd), options?.env, "raw").command;
                 const cmdB64 = Buffer.from(inner, "utf8").toString("base64");
                 const runnerB64 = Buffer.from(buildBgRunnerScript(dir), "utf8").toString("base64");
                 const r = await bgExec(buildBgLauncherScript(dir, cmdB64, runnerB64), true);
@@ -868,7 +882,7 @@ export class RemoteK8sExecutionEnv {
         const dir = path.posix.dirname(abs);
         if (!dir || dir === "." || dir === "/")
             return undefined;
-        const mk = await this.exec(`mkdir -p ${shellQuote(dir)}`, { abortSignal });
+        const mk = await this.fsExec(`mkdir -p ${shellQuote(dir)}`, abortSignal);
         if (!mk.ok)
             return { ok: false, error: fileErrorFromExec(mk.error, dir) };
         if (mk.value.exitCode !== 0)
@@ -905,7 +919,7 @@ export class RemoteK8sExecutionEnv {
     posixFsInst;
     get posixFs() {
         return (this.posixFsInst ??= createPosixShellFs({
-            run: (cmd, abortSignal) => this.exec(cmd, { abortSignal }),
+            run: (cmd, abortSignal) => this.fsExec(cmd, abortSignal),
             resolve: (p) => this.resolve(p),
             tempDir: () => this.cwd,
         }));
@@ -946,16 +960,9 @@ export class RemoteK8sExecutionEnv {
             return c;
         return this.runExec(command, { signal: abortSignal, timeoutMs: this.cfg.dataTimeoutMs });
     }
-    withCwdEnv(command, cwd, env) {
-        const parts = [];
+    workingDirOf(cwd) {
         const dir = cwd ?? this.cwd;
-        if (dir)
-            parts.push(`cd ${shellQuote(this.resolve(dir))} &&`);
-        if (env)
-            for (const [k, v] of Object.entries(env))
-                parts.push(`export ${k}=${shellQuote(v)};`);
-        parts.push(command);
-        return parts.join(" ");
+        return dir ? this.resolve(dir) : undefined;
     }
 }
 export function k8sExecutionEnvFactory(config) {

package/dist/plugins/remote-env-ssh.d.ts

@@ -154,6 +154,11 @@ export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
         stderr: string;
         exitCode: number;
     }, ExecutionError>>;
+    /** 文件面探针的 exec(车PL 验修 ③):只用绝对路径,**不进工作目录**、没有 cwd 守卫 —— 工作目录进不去时探针照样答真话(`permission_denied` /
+     *  `not_found` 由命令自己的 stderr 归),core 的 `isDeadCwd` 不会把「进不去」读成「没了」。 */
+    private fsExec;
+    /** buffered exec 的唯一体:`call` 定了整串、stderr 的 started 行剥法与收口(`remote-shell.ts` `createCwdGuardedCall`)。 */
+    private execCall;
     execStream(command: string, options?: ExecStreamOptions): AsyncIterable<OutputChunk>;
     private sftp;
     absolutePath(p: string): Promise<Result<string, FileError>>;
@@ -192,7 +197,9 @@ export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
         suffix?: string;
         abortSignal?: AbortSignal;
     }): Promise<Result<string, FileError>>;
-    private withCwdEnv;
+    /** 本腿只定工作目录(缺省 cwd 规则 + 绝对化);串的形状归 {@link buildCwdEnvCommand} / {@link createCwdGuardedCall}(S-410:cwd 不可用 ⇒ 命令不跑;
+     *  车PL:buffered `exec` 上守卫触发 ⇒ `spawn_error`)。 */
+    private workingDirOf;
     private connErr;
     private fileError;
 }

package/dist/plugins/remote-env-ssh.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { Client } from "ssh2";
 import { createSshHostKeyVerifier } from "../ssh-host-key.js";
-import { shellQuote, kindFromMode } from "./remote-shell.js";
+import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode } from "./remote-shell.js";
 import { signalNumber } from "./host-platform.js";
 import { createPosixShellFs } from "./posix-shell-fs.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
@@ -234,6 +234,12 @@ export class RemoteSshExecutionEnv {
         return this.destroy();
     }
     async exec(command, options) {
+        return this.execCall(createCwdGuardedCall("ssh", command, this.workingDirOf(options?.cwd), options?.env), options);
+    }
+    fsExec(command, abortSignal) {
+        return this.execCall(createCwdGuardedCall("ssh", command, undefined, undefined), { abortSignal });
+    }
+    async execCall(call, options) {
         const ready = await this.ensureConnected(options?.abortSignal);
         if (!ready.ok)
             return ready;
@@ -269,8 +275,7 @@ export class RemoteSshExecutionEnv {
                     return onAbort();
                 options.abortSignal.addEventListener("abort", onAbort, { once: true });
             }
-            const full = this.withCwdEnv(command, options?.cwd, options?.env);
-            conn.exec(full, (err, stream) => {
+            conn.exec(call.command, (err, stream) => {
                 if (err)
                     return finish({ ok: false, error: new ExecutionError("spawn_error", `ssh exec failed: ${err.message}`, err) });
                 streamRef = stream;
@@ -291,14 +296,22 @@ export class RemoteSshExecutionEnv {
                     if (code == null && !signal) {
                         return finish({ ok: false, error: new ExecutionError("transport_lost", "ssh channel closed without exit status (transport lost / connection dropped)") });
                     }
+                    const tail = call.endStderr();
+                    if (tail.length > 0) {
+                        errBuf.push(tail);
+                        options?.onStderr?.(tail.toString());
+                    }
                     const out = outBuf.result();
                     const err = errBuf.result();
                     const exitCode = code ?? (signal ? exitCodeForSignalKill(signal) : 1);
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode }));
+                    finish(call.settle(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr: markTruncated(err.text, err.droppedBytes), exitCode })));
                 })
                     .stderr.on("data", (d) => {
-                    errBuf.push(d);
-                    options?.onStderr?.(d.toString());
+                    const c = call.filterStderr(d);
+                    if (c.length === 0)
+                        return;
+                    errBuf.push(c);
+                    options?.onStderr?.(c.toString());
                 });
             });
         });
@@ -347,7 +360,7 @@ export class RemoteSshExecutionEnv {
             catch {
             }
         };
-        const full = this.withCwdEnv(command, options?.cwd, options?.env);
+        const full = buildCwdEnvCommand(command, this.workingDirOf(options?.cwd), options?.env, "raw").command;
         conn.exec(full, (err, stream) => {
             if (err) {
                 failure = new RemoteExecutionError("unknown", `ssh exec failed: ${err.message}`, err);
@@ -480,7 +493,7 @@ export class RemoteSshExecutionEnv {
         const abs = this.resolve(p);
         const dir = path.posix.dirname(abs);
         if (dir && dir !== "." && dir !== "/") {
-            const mk = await this.exec(`mkdir -p -- ${shellQuote(dir)}`, { abortSignal });
+            const mk = await this.fsExec(`mkdir -p -- ${shellQuote(dir)}`, abortSignal);
             if (!mk.ok)
                 return { ok: false, error: fileErrorFromExec(mk.error, dir) };
             if (mk.value.exitCode !== 0)
@@ -540,7 +553,7 @@ export class RemoteSshExecutionEnv {
     posixFsInst;
     get posixFs() {
         return (this.posixFsInst ??= createPosixShellFs({
-            run: (cmd, abortSignal) => this.exec(cmd, { abortSignal }),
+            run: (cmd, abortSignal) => this.fsExec(cmd, abortSignal),
             resolve: (p) => this.resolve(p),
             tempDir: () => null,
         }));
@@ -574,16 +587,9 @@ export class RemoteSshExecutionEnv {
     async createTempFile(options) {
         return this.posixFs.createTempFile(options);
     }
-    withCwdEnv(command, cwd, env) {
-        const parts = [];
+    workingDirOf(cwd) {
         const dir = cwd ?? (this.cwd !== "." ? this.cwd : undefined);
-        if (dir)
-            parts.push(`cd ${shellQuote(this.resolve(dir))} &&`);
-        if (env)
-            for (const [k, v] of Object.entries(env))
-                parts.push(`export ${k}=${shellQuote(v)};`);
-        parts.push(command);
-        return parts.join(" ");
+        return dir ? this.resolve(dir) : undefined;
     }
     connErr(e) {
         const msg = e.message || String(e);