@sema-agent/server 7.125.1 → 7.126.0

package/dist/config-catalog.js

@@ -2,7 +2,8 @@ import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } fr
 import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
 import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
-import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE } from "./workspace-space.js";
+import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
+import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { THINKING_FORMATS } from "./model-compat.js";
 import { AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, CENTER_BASE_URL_RULE, CONFIG_PROVIDER_WORDS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
 import { webSearchProviderFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
@@ -65,7 +66,7 @@ export const CONFIG_CATALOG = [
     r("APPROVAL_HMAC_KEYS", "approval", "secret", "直连门(D-G)HMAC 完整性密钥集(空=直连门不激活)", { danger: SEC }),
     r("APPROVAL_NEVER_AUTO", "approval", "csv", "永不被 AUTO_BUDGET 自动放行的工具集(不可逆动作恒要人)", { danger: SEC, configKey: "approvalNeverAuto" }),
     r("APPROVAL_REQUIRE", "approval", "csv", "必须人审的工具名单(F4 门;center 腿热:refresh 拍整表换代,无 checkpoint 店的部署发非空名单 ⇒ 审批组整组拒)", { danger: SEC, configKey: "approvalRequire", center: cGov("approvalRequire") }),
-    r("APPROVAL_TERMINAL_BACKSTOP_MS", "approval", "number", "SQL checkpoint 店 pending 行的 crash-safe 绝对 GC 上限(ms;下限 60s,非有限值落默认)", { staticDefault: String(30 * 86_400_000), danger: DATA }),
+    r("APPROVAL_TERMINAL_BACKSTOP_MS", "approval", "number", "checkpoint 店(SQL 与 local 文件孪生同一公式)pending 行的 crash-safe 绝对 GC 上限(ms;下限 60s,非有限值落默认)", { staticDefault: String(30 * 86_400_000), danger: DATA }),
     r("APPROVAL_TIMEOUT_SEC", "approval", "number", "durable HITL 等人上限(秒);0=无限期等,时间型 suspended 回收不跑", { staticDefault: "0", configKey: "approvalTimeoutSec" }),
     r("ASK_QUESTION_ENABLED", "approval", "boolean", "AskUserQuestion 活流 HITL 装配开关", { derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "askQuestionEnabled" }),
     r("ATTACHMENT_MAX_BYTES", "limitsHttp", "number", "附件单文件字节上限(上传整段内存缓冲的 RAM 束)", { staticDefault: String(32 * 1024 * 1024), configKey: "attachmentMaxBytes", center: cLimits("attachmentMaxBytes") }),
@@ -193,6 +194,7 @@ export const CONFIG_CATALOG = [
     r("K8S_MOUNT_PATH", "orchestration", "path", "k8s 工作区挂载路径"),
     r("K8S_NAMESPACE", "orchestration", "string", "沙箱 pod namespace"),
     r("K8S_RUNTIME_CLASS", "orchestration", "string", "沙箱 pod runtimeClass(Kata 等)"),
+    r("K8S_SANDBOX_ENV", "orchestration", "secret", "转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进 pod env —— 不进 spec 的其它位置 / 工作区 / 快照 / center / 事件日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("K8S_SANDBOX_IMAGE", "orchestration", "string", "k8s 车道沙箱镜像(REMOTE_EXEC=k8s 必需件)"),
     r("K8S_TIMEOUT_MS", "orchestration", "number", "k8s 沙箱 pod 寿命(activeDeadlineSeconds,ms;整只 pod 的泄漏护栏,后台任务超时也被它钳;各条命令的超时见工具超时)"),
     r("K8S_TOKEN", "orchestration", "secret", "k8s API token(缺席走 in-cluster SA)", { danger: SEC }),
@@ -454,7 +456,7 @@ export const CONFIG_CATALOG = [
     r("TASK_MAX_OUTPUT_TOKENS_MAX", "limitsHttp", "number", "调用方自报 limits.maxOutputTokens 的运营方封顶(Math.min 钳显式请求值;坏值=封顶不生效+响亮 warn)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_MAX_TURNS_MAX", "limitsHttp", "number", "调用方自报 limits.maxTurns 的运营方封顶(同族三旋钮;只钳显式请求值,不是全队默认限额)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
     r("TASK_TIMEOUT_MAX_SEC", "limitsHttp", "number", "调用方自报 limits.timeoutSec 的运营方封顶(同族三旋钮)", { danger: BILL, derivedDefaultNote: "缺席 ⇒ 不封顶" }),
-    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒);0/缺席=按 tenancy(单用户无墙;多租户 2400s、大任务 3600s);正值**只抬不降**(Math.max 基值);负值拒启", { staticDefault: "0", derivedDefaultNote: "0/缺席 ⇒ 单用户无墙、多租户 2400/3600s;要低于基值的配速请用 body.limits.maxWalltimeMs" }),
+    r("TASK_TIMEOUT_SEC", "limitsHttp", "number", "任务墙钟超时(秒);0/缺席=按 tenancy(单用户无墙;多租户 2400s);正值**只抬不降**(Math.max 基值);负值拒启", { staticDefault: "0", derivedDefaultNote: "0/缺席 ⇒ 单用户无墙、多租户 2400s;要低于基值的配速请用 body.limits.maxWalltimeMs" }),
     r("TASK_WRITE_FACE_ESCALATION", "orchestration", "enum", "任务层「掀开写围栏」声明的运维天花板档位(S-591;只抬天花板,不是部署席)", { enumValues: [...TASK_WRITE_FACE_ESCALATIONS], danger: SEC, derivedDefaultNote: "三态:allow ⇒ 任务层 bypassPermissions 的开放写面成立;refuse ⇒ 无条件拒;**缺席 = 本层不表态** ⇒ 按托管 posture 判(托管拒 / 单用户 turnkey 放行)。判据单点 src/hosted-posture.ts;device 车道不适用(成文裁定:那条穿越结构性不存在)", configKey: "taskWriteFaceEscalation" }),
     r("TOOL_APPROVAL_ENABLED", "approval", "boolean", "活体工具审批 HITL(onAsk 装配;关 ⇒ core resolveAsk 走 headless 缺省)", { danger: SEC, derivedDefaultNote: "posture 三态:显式词恒赢,缺席 = 单用户(REQUIRE_PRINCIPAL≠true)⇒ on / 多租户 ⇒ off", configKey: "toolApprovalEnabled" }),
     r("TOOL_DEFER_LONGTAIL", "orchestration", "boolean", "长尾一方工具 defer 呈现(实验)", { staticDefault: "false", configKey: "toolDeferLongtail" }),
@@ -479,11 +481,16 @@ export const CONFIG_CATALOG = [
     r("WORKFLOW_RUN_STORE", "orchestration", "enum", "后台 workflow run 店后端(auto=有 SQL 用 SQL,否则 File)", { enumValues: ["auto", "file", "memory"], staticDefault: "auto", configKey: "workflowRunStoreBackend" }),
     r("WORKFLOW_SIZE_GUIDELINE", "orchestration", "enum", "Workflow 工具卡的规模建议(advisory;typo 拒启)", { enumValues: ["small", "medium", "large", "unrestricted"], configKey: "workflowSizeGuideline" }),
     r("WORKFLOW_TOTAL_TIMEOUT_MS", "orchestration", "number", "workflow 脚本总时限(ms;0/负不是禁用 —— 无禁用臂)", { staticDefault: "3600000" }),
+    r("WORKSPACE_CACHE", "orchestration", "enum", "k8s 按工作区空间的构建缓存卷:volume = 每个空间(会话住客)一只 PVC(ws-cache-<摘要>,标签 sema.space,StorageClass 用集群缺省),挂到 WORKSPACE_CACHE_MOUNT,并在 pod env 注入工具缓存闭表(GRADLE_USER_HOME / MAVEN_OPTS / npm_config_cache / PIP_CACHE_DIR / UV_CACHE_DIR / GOMODCACHE;Rust 依赖缓存不盖 —— Cargo 没有只放下载缓存的 env;K8S_SANDBOX_ENV 同名显式值胜);卷在快照之外、可丢,pod 删卷留;卷拿不到(建不成 / 快照时限内没绑定)⇒ run 照起、无卷无缓存 env,fail-open 计数 + 一行 workspace_cache_unavailable;off = 不建卷。前提:会话店读得出会话住客(内存会话店 × volume ⇒ 拒启);委派子代不挂卷;词表外拒启", { enumValues: WORKSPACE_CACHE_WORDS, staticDefault: WORKSPACE_CACHE_DEFAULT }),
+    r("WORKSPACE_CACHE_MOUNT", "orchestration", "path", "k8s 构建缓存卷在沙箱 pod 里的挂载点(绝对路径;与工作区挂载 K8S_MOUNT_PATH 相同 / 互相嵌套 ⇒ 拒启;只在 WORKSPACE_CACHE=volume 时读)", { staticDefault: WORKSPACE_CACHE_MOUNT_DEFAULT }),
+    r("WORKSPACE_CACHE_SIZE", "orchestration", "string", "k8s 构建缓存卷的大小(PVC 申请量,k8s quantity 形如 20Gi / 500Mi;形不合拒启;只在 WORKSPACE_CACHE=volume 时读)", { staticDefault: WORKSPACE_CACHE_SIZE_DEFAULT }),
     r("WORKSPACE_FILE_MAX_BYTES", "limitsHttp", "number", "已随 workspace 浏览面退役(S-15):值照常校验/落值,应用于空(重启也不生效)", { envTiming: "inert", configKey: "workspaceFileMaxBytes", center: cLimits("workspaceFileMaxBytes", { timing: "inert" }) }),
-    r("WORKSPACE_PERSIST", "orchestration", "enum", "k8s 工作区跨轮保留(opt-in):space = 每条 run 结束把 /workspace 快照进本会话住客的空间、下一条 run 开始恢复最近一份(开着时有已知残窗:提交标记晚于拆环境上界落地 ⇒ 上一条的改动可能被覆盖,见 USAGE §9.3b);off = 每轮新建(缺省)。设了 space 却没配快照存储(MINIO_* 三键)⇒ 不生效,起服一行 workspace_persist_unavailable 点名缺键;前提:会话店读得出会话住客(local / SQL 会话店),内存会话店设 space(且配了快照存储)⇒ 拒启;词表外拒启", { enumValues: WORKSPACE_PERSIST_WORDS, staticDefault: WORKSPACE_PERSIST_DEFAULT, danger: DATA }),
+    r("WORKSPACE_PERSIST", "orchestration", "enum", "k8s 工作区跨轮保留:space(缺省)= 每条 run 结束把 /workspace 快照进本会话住客的空间、下一条 run 开始恢复最近一份(上一条还在保存 ⇒ 下一条等它存完,最多等一个上传时限,见 USAGE §9.3b);off = 每轮新建。space(含缺省)却没配快照存储(MINIO_* 三键)⇒ 不生效,起服一行 workspace_persist_unavailable 点名缺键;前提:会话店读得出会话住客(local / SQL 会话店),内存会话店 × space(含缺省,且配了快照存储)⇒ 拒启(出路 WORKSPACE_PERSIST=off);词表外拒启", { enumValues: WORKSPACE_PERSIST_WORDS, staticDefault: WORKSPACE_PERSIST_DEFAULT, danger: DATA }),
     r("WORKSPACE_SNAPSHOT_BUCKET", "orchestration", "string", "k8s 工作区快照桶", { derivedDefaultNote: "缺席 ⇒ workspaces" }),
+    r("WORKSPACE_SNAPSHOT_EXCLUDE", "orchestration", "csv", "k8s 工作区快照的排除表(相对工作区根的 tar 排除模式,逗号分隔,如 build,.gradle,node_modules/.cache;每项一个 --exclude=./<项>,run 末快照与停驻挂起同一张表 —— 排除的目录恢复后不在,构建产物本就可再生;项形闭:相对路径段,不含 .. / 前导 / / 空白 / 引号,坏项拒启并点名第几项;不读项目 .gitignore)", { derivedDefaultNote: "缺席 = 不排除(上传命令与旧版逐字同)" }),
     r("WORKSPACE_SNAPSHOT_KEEP", "orchestration", "number", `k8s 工作区每个空间(会话住客)保留的快照份数(整数 [${WORKSPACE_SNAPSHOT_KEEP_RANGE.min}, ${WORKSPACE_SNAPSHOT_KEEP_RANGE.max}];写新快照后删最老的;域外拒启)`, { staticDefault: String(WORKSPACE_SNAPSHOT_KEEP_DEFAULT), danger: DATA }),
     r("WORKSPACE_SNAPSHOT_PREFIX", "orchestration", "string", "k8s 工作区快照 key 前缀"),
+    r("WORKSPACE_SNAPSHOT_TIMEOUT_MS", "orchestration", "number", `k8s 工作区快照的时限(毫秒,整数 [${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.min}, ${WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max}];域外拒启):一个数管四处 —— run 末上传与连沙箱时恢复的墙钟上界、空间结束时回收座一次调用的绝对截止(卷与对象都在内)、下一条 run 等上一条存完的最长等待(提交围栏的存活上界);大文件读写的墙钟也是它。大工作区(构建目录 GB 级)撞上界 ⇒ 调大它或配 WORKSPACE_SNAPSHOT_EXCLUDE`, { staticDefault: String(WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT) }),
     r("WORKSPACE_SNAPSHOT_TTL_SEC", "orchestration", "number", "k8s 工作区快照 presign TTL(秒)"),
     r("WORKTREE_ALLOWED_ROOTS", "orchestration", "csv", "worktree 隔离纵深白名单(缺省 = [repoRoot])", { danger: SEC }),
     r("WORKTREE_BASE_COMMIT", "orchestration", "string", "worktree 基准 ref(缺省 core HEAD)"),

package/dist/config-provider.d.ts

@@ -1,4 +1,4 @@
-import { type DroppedConfigEntry, type UnreadConfigFile } from "./web-admin-client/read-warnings.js";
+import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
@@ -25,6 +25,9 @@ import type { ConfigProviderWord } from "./config-types.js";
  *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 /** `unreadFiles`:`config.d` 里读腿根本不读的文件(不是域 / 不是便携域)—— **不**进候选门(不是读的域判形失败),调用方一份一行
  *  `config_unread_file` 点名、其余照用;缺席 = 没有(本地读腿才会有)。 */
+/** `retiredDomains`(S-1456):带事实的退役域文档(契约包的墓碑)—— 读腿不抛,交成发现,候选判官以成因 `retired_domain` 整拒这份候选(与域判形失败
+ *  同一条回落链、同一行拒判);缺席 = 没有。远端腿:那一键不进 effective、其余域照读;本地腿:契约读腿在读便携域之前就拒,交出的候选只有版本
+ *  (这棵树的内容版本,哈希含退役文件 ⇒ 改 / 删它版本即变),内容是空的 effective(被整拒,不会被应用)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -34,6 +37,7 @@ export type FetchEffectiveResult = {
     }>;
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
+    retiredDomains?: RetiredDomainFinding[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity?: string;
 } | null;

package/dist/config-provider.js

@@ -1,8 +1,8 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
+import { retiredDomainFindingOf, splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { danglingRefs, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
+import { danglingRefs, emptyEffective, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { homedir } from "node:os";
@@ -84,7 +84,21 @@ export class LocalConfigProvider {
                     readWarnings.push(w);
                 },
             });
-        const { effective: eff, domainErrors } = await store.getEffective({ tolerant: true });
+        let read;
+        let retired;
+        try {
+            read = await store.getEffective({ tolerant: true });
+        }
+        catch (e) {
+            retired = retiredDomainFindingOf(e);
+            if (retired === undefined)
+                throw e;
+            const version = await store.getVersion().catch(() => {
+                throw e;
+            });
+            read = { effective: { ...emptyEffective(), version }, domainErrors: [] };
+        }
+        const { effective: eff, domainErrors } = read;
         const tag = String(eff.version);
         if (etag !== undefined && etag === tag)
             return null;
@@ -97,7 +111,7 @@ export class LocalConfigProvider {
         }
         for (const [domain, rows] of byReferrer)
             refErrors.push({ domain, error: rows.join("; ") });
-        const folded = splitFoldedReadWarnings(readWarnings);
+        const folded = splitFoldedReadWarnings(readWarnings, "local");
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
@@ -108,6 +122,7 @@ export class LocalConfigProvider {
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
             ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
             ...(folded.unreadFiles.length > 0 ? { unreadFiles: folded.unreadFiles } : {}),
+            ...(retired !== undefined ? { retiredDomains: [retired] } : {}),
         };
     }
     async fetchSkillContent(contentHash) {
@@ -172,6 +187,9 @@ export function mapToServiceEffective(eff, version) {
                     ...(s.contentOrigin !== undefined ? { contentOrigin: s.contentOrigin } : {}),
                     ...readMcpSourceLabel(s.name, s.source),
                     ...(s.toolFaces !== undefined ? { toolFaces: s.toolFaces } : {}),
+                    ...(s.toolAxes !== undefined ? { toolAxes: s.toolAxes } : {}),
+                    ...(s.authForm !== undefined ? { authForm: s.authForm } : {}),
+                    ...(s.entryKind !== undefined ? { entryKind: s.entryKind } : {}),
                 };
                 if (s.transport.kind === "stdio") {
                     return {
@@ -191,6 +209,7 @@ export function mapToServiceEffective(eff, version) {
                         url: s.transport.url,
                         ...(s.transport.headerRefs !== undefined ? { headerRefs: s.transport.headerRefs } : {}),
                         ...(s.transport.principalHeader !== undefined ? { principalHeader: s.transport.principalHeader } : {}),
+                        ...(s.transport.assertionHeader !== undefined ? { assertionHeader: s.transport.assertionHeader } : {}),
                     },
                 };
             }),

package/dist/config-types.d.ts

@@ -604,7 +604,8 @@ export interface ServiceConfigFlat {
         defaultScopes?: string[];
     }>;
     /** Role → model map (1.24): `subagent`/`summarize` → the cheap model when `MODEL_CHEAP_ID` is set
-     *  (council lenses + compaction get cheap), `default`/`team`/`synthesize` stay on the main model. */
+     *  (delegated children + compaction get cheap), `default` stays on the main model. Keys are the engine's role
+     *  words (core `MODEL_ROLES`, six since 7.49.0). */
     roles: ModelRoles;
     /** [ref] / [ref] —— **「`@` 能点名哪些模型」**(settings-schema 11 `models.atMention` 的服务端消费面;三态闭集
      *  `{mode:"all"}` / `{mode:"none"}` / `{mode:"only", models}`,形与缺省读法的属主是契约,本仓读法 = `model-select.ts`
@@ -898,6 +899,9 @@ export interface ServiceConfigFlat {
         /** Resource-profile knobs: sandbox pod limits (adapter defaults: 2Gi / 1 cpu). */
         memory?: string;
         cpu?: string;
+        /** `K8S_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同名同形、同一只解析器、同一只谓词 `allowlistedEnv`,
+         *  空串值照带)。只进 pod 容器 env;装配点与包源派生 env 合并一处,显式名单胜。键缺席 = 旋钮未设 / 空串(零转发)。 */
+        sandboxEnv?: Record<string, string>;
         s3Snapshot?: {
             endpoint: string;
             bucket: string;
@@ -913,6 +917,15 @@ export interface ServiceConfigFlat {
          *  unavailable). */
         workspacePersist?: import("./workspace-space.js").WorkspacePersist;
         workspaceSnapshotKeep?: number;
+        /** `WORKSPACE_SNAPSHOT_TIMEOUT_MS` — the lane's one data bound (`workspace-space.ts`); the loader always mints it, the boot
+         *  assembly hands it to the adapter as `dataTimeoutMs`, the capability fact reports it (`workspaceSync.timeoutMs`). */
+        workspaceSnapshotTimeoutMs?: number;
+        /** The build-cache volume per workspace space (`WORKSPACE_CACHE=volume`, `_SIZE`, `_MOUNT`; `workspace-cache.ts`); present iff
+         *  `volume`. Effective policy = the capability fact `workspaceCache`. */
+        workspaceCache?: import("./workspace-cache.js").WorkspaceCacheCapability;
+        /** `WORKSPACE_SNAPSHOT_EXCLUDE` — the snapshot's tar exclusion table (closed item form, `workspace-space.ts`); present iff
+         *  non-empty. Handed to the adapter's one tar upload (both snapshot lanes); never on the wire. */
+        workspaceSnapshotExclude?: readonly string[];
     } | {
         provider: "ssh";
         host: string;

package/dist/config.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
@@ -26,7 +26,8 @@ import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf }
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
-import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE } from "./workspace-space.js";
+import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
+import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap } from "./workspace-cache.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
@@ -1855,7 +1856,9 @@ function parseOrchestrationDomain(ctx) {
                         ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("K8S_TIMEOUT_MS")),
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
                         ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
+                        ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("K8S_SANDBOX_ENV", singleUserTurnkey)),
                         ...k8sWorkspaceStore(),
+                        ...((c) => (c !== undefined ? { workspaceCache: c } : {}))(k8sWorkspaceCache()),
                     }
                     :
                         process.env.REMOTE_EXEC === "ssh" && process.env.SSH_HOST && process.env.SSH_USER && process.env.SSH_PRIVATE_KEY
@@ -2387,6 +2390,11 @@ function k8sWorkspaceStore() {
     const workspaceSnapshotKeep = numEnvBounded("WORKSPACE_SNAPSHOT_KEEP", String(WORKSPACE_SNAPSHOT_KEEP_DEFAULT), WORKSPACE_SNAPSHOT_KEEP_RANGE.min, WORKSPACE_SNAPSHOT_KEEP_RANGE.max);
     if (!Number.isInteger(workspaceSnapshotKeep))
         throw new Error(`env WORKSPACE_SNAPSHOT_KEEP=${workspaceSnapshotKeep} must be an integer (a count of snapshots kept per space key)`);
+    const workspaceSnapshotTimeoutMs = numEnvBounded("WORKSPACE_SNAPSHOT_TIMEOUT_MS", String(WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT), WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.min, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max);
+    if (!Number.isInteger(workspaceSnapshotTimeoutMs))
+        throw new Error(`env WORKSPACE_SNAPSHOT_TIMEOUT_MS=${workspaceSnapshotTimeoutMs} must be an integer (milliseconds)`);
+    const exclude = parseWorkspaceSnapshotExclude(process.env.WORKSPACE_SNAPSHOT_EXCLUDE);
+    const knobs = { workspacePersist, workspaceSnapshotKeep, workspaceSnapshotTimeoutMs, ...(exclude.length > 0 ? { workspaceSnapshotExclude: exclude } : {}) };
     const endpoint = process.env.MINIO_ENDPOINT;
     const accessKey = process.env.MINIO_ACCESS_KEY;
     const secretKey = process.env.MINIO_SECRET_KEY;
@@ -2396,14 +2404,13 @@ function k8sWorkspaceStore() {
             CONFIG_NOTICES.push({
                 level: "warn",
                 event: "workspace_persist_unavailable",
-                fields: { missing: missing.join(","), effect: "k8s workspace starts empty every run (no snapshot store); set the missing keys, or drop WORKSPACE_PERSIST=space (the default is off) to silence this line" },
+                fields: { missing: missing.join(","), effect: "k8s workspace starts empty every run (no snapshot store); set the missing keys, or set WORKSPACE_PERSIST=off to silence this line" },
             });
         }
-        return { workspacePersist, workspaceSnapshotKeep };
+        return knobs;
     }
     return {
-        workspacePersist,
-        workspaceSnapshotKeep,
+        ...knobs,
         s3Snapshot: {
             endpoint,
             bucket: process.env.WORKSPACE_SNAPSHOT_BUCKET ?? "workspaces",
@@ -2415,6 +2422,32 @@ function k8sWorkspaceStore() {
         },
     };
 }
+function k8sWorkspaceCache() {
+    const word = enumEnv("WORKSPACE_CACHE", WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_WORDS);
+    switch (word) {
+        case "off":
+            return undefined;
+        case "volume":
+            break;
+        default: {
+            const unreachable = word;
+            throw new Error(`unhandled WORKSPACE_CACHE word: ${String(unreachable)}`);
+        }
+    }
+    const size = process.env.WORKSPACE_CACHE_SIZE || WORKSPACE_CACHE_SIZE_DEFAULT;
+    if (!isK8sQuantity(size))
+        throw new Error(`env WORKSPACE_CACHE_SIZE=${JSON.stringify(size)} is not a k8s quantity (a positive number with an optional unit, e.g. 20Gi / 500Mi)`);
+    const raw = process.env.WORKSPACE_CACHE_MOUNT || WORKSPACE_CACHE_MOUNT_DEFAULT;
+    if (!raw.startsWith("/"))
+        throw new Error(`env WORKSPACE_CACHE_MOUNT=${JSON.stringify(raw)} is not an absolute path (the cache volume's mount inside the sandbox pod)`);
+    const mount = posixPath.normalize(raw).replace(/(.)\/+$/, "$1");
+    const workspace = posixPath.normalize(process.env.K8S_MOUNT_PATH || K8S_WORKSPACE_MOUNT_DEFAULT).replace(/(.)\/+$/, "$1");
+    if (mount === "/" || mountsOverlap(mount, workspace)) {
+        throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} overlaps the workspace mount ${workspace} (K8S_MOUNT_PATH) — the cache volume must sit OUTSIDE the workspace ` +
+            "(the workspace is snapshotted between runs, the cache is not); pick a separate absolute path such as /cache");
+    }
+    return { mount, size };
+}
 export function loadConfig() {
     EXEC_LANE_NOTICE = undefined;
     rejectRetiredEnvs();

package/dist/deployment-governance.d.ts

@@ -1,4 +1,4 @@
-import { FileError, StubExecutionEnv, type ExecutionEnv, type Result, type ToolPolicy } from "@sema-agent/core";
+import { FileError, StubExecutionEnv, type ExecutionEnv, type PathFamily, type Result, type ToolPolicy } from "@sema-agent/core";
 import { type DeploymentListExemption } from "./approval.js";
 import type { ServiceConfig } from "./config.js";
 import type { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -15,8 +15,9 @@ export interface DeploymentGovernanceConfigView {
     readonly agentConfigDir?: ServiceConfig["agentConfigDir"];
     /**
      * 本部署的**本地店根**(`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent`)—— 在本口只喂
-     * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的 `dataRoot`(那是引擎记忆根,见
-     * {@link DeploymentGovernanceRoots});下面这段历史注保留,记的是 S-125 件⑦ 把两根混作一根的由来。
+     * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的数据根(那是引擎记忆根);core 7.49.0 [ref] 起守卫集
+     * 根本不收数据根 —— 豁免根只从 `RunnerDeps.memoryEngineDir` 一处来(`boot/runner-deps.ts` 共享基座,每只 boot Runner 同一个值)。
+     * 下面这段历史注保留,记的是 S-125 件⑦ 把两根混作一根的由来。
      *
      * S-125 件⑦(core 7.4.0 [ref] HRD-PRM-10)—— 当时把本键原样交给 `createSensitivePathPolicy` 的 `dataRoot`。
      *
@@ -28,21 +29,10 @@ export interface DeploymentGovernanceConfigView {
      * ⇒ 本键 = 「这道门与 transcript 门说的是同一个目录」的单一属主,值与 `ServiceConfig.localDataRoot`
      * **同一个**解析结果(不在本口重算,重算就是第二个写者)。
      *
-     * 缺席(窄接口的老调用方 / 测试夹具)⇒ **不铸 `dataRoot` 键**,core 走它自己的缺省 —— 与本口既有的
-     * `rootPath` 条件展开同姿势:缺席是「本调用方没有这项知识」,不是「数据根是 undefined」。
+     * 缺席(窄接口的老调用方 / 测试夹具)⇒ 不铸誊本门(缺席是「本调用方没有这项知识」,不是「店根是 undefined」)。
      */
     readonly localDataRoot?: ServiceConfig["localDataRoot"];
 }
-/**
- * S-133 —— 守卫集 `dataRoot` 的**显式供给**(与 `DeploymentGovernanceConfigView.localDataRoot` 是两件事):
- * `engineDataRoot` = 引擎写记忆的根 = boot 已铸的 `memoryEngine.root`(boot/stores.ts 是唯一写者;推导函数
- * `memoryEngineRootFor` 只在那里与 `memoryEngineBackendFor` 里调)。**调用腿读那只活对象,不重推导**——重推导
- * 就是第二个写者(7.59.0 重扫 codex 轮抓到 HTTP 腿的 fallback 与 stores 不同源,正是这一形)。参数非可选:
- * 一条腿忘了 = 编译红。`undefined` = 引擎未接(或窄接口的测试夹具),那时不铸 `dataRoot` 键,core 走自己的缺省。
- */
-export interface DeploymentGovernanceRoots {
-    readonly engineDataRoot: string | undefined;
-}
 /** 审批基线读的配置切面(同上,窄接口)。 */
 export interface ApprovalBaselineConfigView {
     readonly approvalRequire: ServiceConfig["approvalRequire"];
@@ -175,18 +165,26 @@ export declare function createDurableQuestionGate(live: LiveQuestionFace | undef
  *  · 词法层(`RelativeTargetLexicalEnv`)判 **缺戳相对形**(自身拼写里的守卫段,fail-closed);
  *  两层射程互补、无重叠、无缝隙;各自射程外**显式 allow**(= 让位给另一层),canon 失败留给真的判不了的形
  *  (UNC/NUL/越根)—— 那正是 7.17.1 要 deny 的。提取写目标用 core 自家 `protectivePathTargetOf` + `pathTargetValue`
- *  (与 core 守卫策略同一只提取器,零复刻);「算不算绝对」用 core `isAbsoluteForFamily(undefined, …)`(沙箱 lane
- *  无 root/cwd 声明 ⇒ 家族 undefined ⇒ 只认 `/`-rooted,与引擎同一律)。
+ *  (与 core 守卫策略同一只提取器,零复刻);「算不算绝对」用 core `isAbsoluteForFamily(SANDBOX_TREE_FAMILY, …)` —— 两层读
+ *  **同一只**谓词(词法层的 `absolutePath` 拒的正是这一形),射程因此按构造互补。
+ */
+/**
+ * 沙箱 lane 的树是 **POSIX** 树(core 7.49.0 [ref] 起 `isAbsoluteForFamily` 的族参数必写:树的族,或无树时的 `"own"`)。
+ * 沙箱的文件系统是远端容器 / 机器的 POSIX 文件系统,词法层也按 POSIX 归一(`posix.normalize`)—— 所以这里写树的族,而不是 `"own"`:
+ * `"own"` 会把 `C:\x` / UNC 拼法读成绝对形送进真身层,而在 POSIX 树上它们是**相对文件名**(写进 cwd 的一个叫 `C:\x` 的文件)。
+ * 7.48.0 的 `undefined` 只认 `/`-rooted,与本常量逐字同判(读数不变)。
  */
+export declare const SANDBOX_TREE_FAMILY: PathFamily;
 type WriteTargetForm = "unstamped-relative" | "absolute-or-stamped";
 /**
  * 只在 `form` 那一类写目标上说话,其余显式 allow(让位);非写调用与提不出目标的调用原样交给 policy(它自己判 allow)。
  *
  * 🔴 **S-877(core 7.35.0 #1200):本包装不是 `wrapToolPolicy`,它自报成员**。core 的 wrap 契约是「包装至少拒内层所拒」,
  * 而本包装**放行**内层会拒的另一形写目标 ⇒ 按契约它是一只自己的策略,内层的成员不能照搬(core wire 单点名这一只):
- *  · `writeTargetGuard`(守卫集策略自带,shell 写站问「这个绝对目标守不守」)—— 只在本层的形**覆盖守卫的入参形**时带上
- *    ({@link WRITE_TARGET_GUARD_DOMAIN}):真身层带;词法层不带(它的 env 对绝对形报错 ⇒ core 的「判不了就守」会把每一次
- *    shell 写都判成受守,正与两层射程互补的原设计相反)。这不是给某一形开的特例,是同一条「成员描述它守得住的那部分」的读法;
+ *  · `writeGuardRows`(core 7.49.0 [ref] 起;7.48.0 叫 `writeTargetGuard`,旧成员 core **不按名拒** ⇒ 不改就是壳写站静默丢部署守卫行)
+ *    —— 守卫集策略自带,壳写站按它交出的行判绝对目标;只在本层的形**覆盖行的判定形**时带上({@link WRITE_GUARD_ROWS_DOMAIN}):
+ *    真身层带;词法层不带(它的行与真身层是同一张模式表,带上只是同一组行判两遍)。这不是给某一形开的特例,是同一条
+ *    「成员描述它守得住的那部分」的读法;
  *  · `projection` / `pathRules` / `nameSets` —— 守卫集策略不带,本包装也不报(报了就是替它声称一张它没有的拒表)。
  * 修前(core 7.33.x)这里是一只 `{ check }` 字面量,7.34.0 起那只字面量把真身层的守卫剥掉了 —— 沙箱 lane 的 shell 写站
  * 因此看不见部署守卫集(`cp x .env` 在 acceptEdits 下被引擎 place 并答掉)。
@@ -253,7 +251,7 @@ export declare function buildOnlySensitiveBaselineWarning(config: Pick<Deploymen
  * 本口不知道出身这件事,也不再有自己的折叠点。叶的顺序 = 修前折叠的顺序(真身层 → 词法层 → 誊本门),deny 优先 / 首问 / 成员合并
  * 的读法因此不变。
  */
-export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication, roots: DeploymentGovernanceRoots): DeploymentGovernanceInputs;
+export declare function createDeploymentGovernanceInputs(config: DeploymentGovernanceConfigView, pathAdjudication: PathAdjudication): DeploymentGovernanceInputs;
 /**
  * 运维 allow 表 `APPROVAL_GRANT` 的**起服通告**载荷(纯数据 ⇒ `build*`;HTTP 腿与 run-local 腿各在装配时说一次,用 info 级)。规则不是秘密
  * (它们是工具名 / 命令规则),所以原样列出;空表 ⇒ `undefined`(不打)。运维只读面上同一个事实另有一处:`GET /v1/diagnostics/wiring` 的

package/dist/deployment-governance.js

@@ -16,6 +16,7 @@ export function createDurableQuestionGate(live) {
         },
     };
 }
+export const SANDBOX_TREE_FAMILY = "posix";
 function writeTargetFormOf(req) {
     if (!isProtectedWrite(req))
         return undefined;
@@ -23,11 +24,11 @@ function writeTargetFormOf(req) {
     const target = pt === undefined ? undefined : pathTargetValue(req.args, pt);
     if (typeof target !== "string" || target.length === 0)
         return undefined;
-    if (req.cwd !== undefined || target.includes("\u0000") || isAbsoluteForFamily(undefined, target))
+    if (req.cwd !== undefined || target.includes("\u0000") || isAbsoluteForFamily(SANDBOX_TREE_FAMILY, target))
         return "absolute-or-stamped";
     return "unstamped-relative";
 }
-const WRITE_TARGET_GUARD_DOMAIN = "absolute-or-stamped";
+const WRITE_GUARD_ROWS_DOMAIN = "absolute-or-stamped";
 export function scopedToWriteTargetForm(policy, form) {
     return {
         async check(req, signal) {
@@ -36,12 +37,12 @@ export function scopedToWriteTargetForm(policy, form) {
                 return { action: "allow" };
             return policy.check(req, signal);
         },
-        ...(form === WRITE_TARGET_GUARD_DOMAIN && policy.writeTargetGuard !== undefined ? { writeTargetGuard: policy.writeTargetGuard } : {}),
+        ...(form === WRITE_GUARD_ROWS_DOMAIN && policy.writeGuardRows !== undefined ? { writeGuardRows: policy.writeGuardRows } : {}),
     };
 }
 export class RelativeTargetLexicalEnv extends StubExecutionEnv {
     absolutePath(path) {
-        if (path.length === 0 || path.startsWith("/") || path.includes("\u0000")) {
+        if (path.length === 0 || isAbsoluteForFamily(SANDBOX_TREE_FAMILY, path) || path.includes("\u0000")) {
             return Promise.resolve(err(new FileError("not_supported", "this guard layer only adjudicates RELATIVE write targets (absolute forms are adjudicated against the real sandbox filesystem)", path)));
         }
         return Promise.resolve(ok(posix.normalize(`/${path}`)));
@@ -83,16 +84,14 @@ export function buildOnlySensitiveBaselineWarning(config, seat) {
         },
     };
 }
-export function createDeploymentGovernanceInputs(config, pathAdjudication, roots) {
+export function createDeploymentGovernanceInputs(config, pathAdjudication) {
     const sensitivePathLayers = config.sensitiveWritePatterns.length > 0
         ? (() => {
-            const dataRootOpt = roots.engineDataRoot !== undefined ? { dataRoot: roots.engineDataRoot } : {};
             const configRootOpt = config.agentConfigDir !== undefined ? { agentConfigDir: config.agentConfigDir } : {};
             const realTarget = createSensitivePathPolicy({
                 env: pathAdjudication.env,
                 patterns: config.sensitiveWritePatterns,
                 ...(pathAdjudication.cwd !== undefined ? { rootPath: pathAdjudication.cwd } : {}),
-                ...dataRootOpt,
                 ...configRootOpt,
             });
             const transcriptGuard = config.localDataRoot !== undefined ? [createTranscriptIntegrityPolicy({ sessionsDirs: [join(config.localDataRoot, "sessions")] })] : [];
@@ -100,7 +99,7 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
                 return [realTarget, ...transcriptGuard];
             return [
                 scopedToWriteTargetForm(realTarget, "absolute-or-stamped"),
-                scopedToWriteTargetForm(createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...dataRootOpt, ...configRootOpt }), "unstamped-relative"),
+                scopedToWriteTargetForm(createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...configRootOpt }), "unstamped-relative"),
                 ...transcriptGuard,
             ];
         })()

package/dist/env-name-allowlist-knobs.d.ts

@@ -6,10 +6,10 @@
  *  · `example` 进拒句;
  *  · `multiTenant` = `REQUIRE_PRINCIPAL=true` 下名单作不作数 —— **只有服务进程读的旋钮有这一列**(姿态是服务进程的概念):
  *    - `LSP_ENV_ALLOW` ⇒ ignored:host 腿语言服务器在多租户姿态下本来就不起,名单无处作数,设了要说出来(S-699)。
- *    - 两只沙箱名单 ⇒ honored:S-713 照录修前语义(任何姿态下都转发),S-715 主会话裁定维持 —— 沙箱 env 是部署方为隔离沙箱显式配的
- *      带外凭据(e2b / docker 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
+ *    - 三只沙箱名单(e2b / local-docker / k8s 各一只) ⇒ honored:S-713 照录修前语义(任何姿态下都转发),S-715 主会话裁定维持 —— 沙箱 env 是部署方为隔离沙箱显式配的
+ *      带外凭据(e2b / docker / k8s 车道本来就是多租户 fleet 的主形),与 LSP 那条「本机子进程」的形不同;多租户下起服说一句。
  *  · `BAKE_ENV_ALLOW`(S-684 残余,7.103.0)由 **bake-runner 进程**读(构建宿主守护进程:没有主体、没有租户 ⇒ 没有姿态列,
- *    不进 {@link describeAllowlistPostures} 的姿态句)。它与三只服务侧旋钮同一只解析器、同一只「点名放行」谓词、同一条「原文按凭据类」律。
+ *    不进 {@link describeAllowlistPostures} 的姿态句)。它与服务侧四只旋钮同一只解析器、同一只「点名放行」谓词、同一条「原文按凭据类」律。
  * 表是 `Record<旋钮, …>`:闭集加一只旋钮而不补行 = 编译红;行形随读它的进程定(服务进程 ⇒ 必须写姿态列)。
  *
  * 🔴 **姿态列只在这里写一次**([ref];7.101.0 合并复审 O9):凡要对人说「多租户下哪只旋钮忽略、哪只照转发」的句子,一律取
@@ -18,7 +18,7 @@
  * 当场撒谎。为什么是纯叶:`config-catalog.ts` 被 `config.ts` 值引,表留在 `config.ts` 会成装载环。
  */
 /** 服务进程(`config.ts` `loadConfig`)读的名单型旋钮 —— 有多租户姿态。 */
-export type ServerEnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV";
+export type ServerEnvNameAllowlistKnob = "LSP_ENV_ALLOW" | "E2B_SANDBOX_ENV" | "DOCKER_SANDBOX_ENV" | "K8S_SANDBOX_ENV";
 /** bake-runner 进程(`bake-runner/main.ts` `loadEnv`)读的名单型旋钮 —— 构建宿主守护进程没有主体 / 租户,没有姿态。 */
 export type RunnerEnvNameAllowlistKnob = "BAKE_ENV_ALLOW";
 export type EnvNameAllowlistKnob = ServerEnvNameAllowlistKnob | RunnerEnvNameAllowlistKnob;
@@ -41,7 +41,7 @@ export type EnvNameAllowlistKnobTable = {
     readonly [K in EnvNameAllowlistKnob]: K extends ServerEnvNameAllowlistKnob ? ServerEnvNameAllowlistKnobRow : RunnerEnvNameAllowlistKnobRow;
 };
 export declare const ENV_NAME_ALLOWLIST_KNOBS: EnvNameAllowlistKnobTable;
-/** 名单型旋钮的全部名字(四只;表键派生)—— 两处用:解析器的「点名名单型旋钮 = 形错」、剥除的「名单原文按凭据类」臂。 */
+/** 名单型旋钮的全部名字(五只;表键派生)—— 两处用:解析器的「点名名单型旋钮 = 形错」、剥除的「名单原文按凭据类」臂。 */
 export declare const ENV_NAME_ALLOWLIST_KNOB_NAMES: ReadonlySet<string>;
 /**
  * 多租户姿态句 —— **由表派生**,不许在别处手写。形:`under REQUIRE_PRINCIPAL=true: <旋钮> is ignored; <旋钮> / <旋钮> are forwarded as configured`

package/dist/env-name-allowlist-knobs.js

@@ -5,6 +5,7 @@ export const ENV_NAME_ALLOWLIST_KNOBS = {
     },
     E2B_SANDBOX_ENV: { example: "E2B_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
     DOCKER_SANDBOX_ENV: { example: "DOCKER_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
+    K8S_SANDBOX_ENV: { example: "K8S_SANDBOX_ENV=GIT_TOKEN,NPM_TOKEN", multiTenant: { kind: "honored" } },
     BAKE_ENV_ALLOW: { example: "BAKE_ENV_ALLOW=REGISTRY_PASSWORD,NPM_TOKEN" },
 };
 export const ENV_NAME_ALLOWLIST_KNOB_NAMES = new Set(Object.keys(ENV_NAME_ALLOWLIST_KNOBS));

package/dist/execution-lane-caps.js

@@ -56,7 +56,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: NO,
+                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "k8s":
@@ -128,7 +128,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
-                canonicalPathAuthority: NO,
+                canonicalPathAuthority: YES,
                 tenantSeparation: executionLaneRow(lane).tenantSeparation,
             };
         case "device":