@sema-agent/server 7.125.1 → 7.127.0

package/dist/plugins/pg-session-storage.js

@@ -12,7 +12,7 @@ import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING
 import { isPgUniqueViolation } from "./sql-errors.js";
 import { BASELINE_IO_DEADLINE_MS, decodeInstructionSource, encodeInstructionSource } from "../instruction-source-notice.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
-import { SESSION_META_INCARNATION_COLUMN, carriedIncarnation, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
+import { SESSION_META_INCARNATION_COLUMN, carriedIncarnation, incarnationFromCell, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { ensureIndexes } from "./ensure-index.js";
 const isDupKey = isPgUniqueViolation;
 function baselineQuery(text, values) {
@@ -99,7 +99,7 @@ export class PgSessionStorage extends BaseSessionStorage {
         }
     }
     static async wake(pool, sessionId) {
-        const metaRes = await pool.query(`SELECT created_at, leaf_id, leaf_seq, ${PLACEMENT_SELECT_COLUMNS} FROM session_meta WHERE session_id = $1`, [sessionId]);
+        const metaRes = await pool.query(`SELECT created_at, leaf_id, leaf_seq, incarnation, ${PLACEMENT_SELECT_COLUMNS} FROM session_meta WHERE session_id = $1`, [sessionId]);
         const meta = metaRes.rows[0];
         if (!meta)
             return null;
@@ -107,7 +107,7 @@ export class PgSessionStorage extends BaseSessionStorage {
         const eventRes = await pool.query(`SELECT seq, ${jsonColumnText("pg", "payload")} FROM session_event WHERE session_id = $1 AND seq >= $2 ORDER BY seq ASC`, [sessionId, floorSeq]);
         const entries = eventRes.rows.map((r) => decodeSessionEventPayload(r.payload, sessionId, r.seq));
         const placement = placementFromRow(meta);
-        const metadata = { id: sessionId, createdAt: toIso(meta.created_at), ...(placement !== undefined ? { placement } : {}) };
+        const metadata = { id: sessionId, createdAt: toIso(meta.created_at), incarnation: incarnationFromCell(sessionId, meta.incarnation), ...(placement !== undefined ? { placement } : {}) };
         return new PgSessionStorage(pool, sessionId, metadata, entries, meta.leaf_id ?? null, floorEntryId, floorSeq);
     }
     static async computeFloor(pool, sessionId) {
@@ -259,6 +259,9 @@ export class PgSessionStore {
             return undefined;
         return sessionFaceFromRow(sessionId, res.rows[0].owner ?? null, res.rows[0].incarnation);
     }
+    async incarnationOf(sessionId) {
+        return (await this.sessionFaceOf(sessionId))?.incarnation;
+    }
     async touch(sessionId) {
         await this.pool.query("UPDATE session_meta SET updated_at = $1 WHERE session_id = $2", [
             new Date(),
@@ -661,13 +664,14 @@ class PgStagingHandle {
             const now = new Date();
             await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES ($1,$2,$3,$4,$5,$6,$7) " +
                 "ON CONFLICT (session_id) DO UPDATE SET owner = EXCLUDED.owner, updated_at = EXCLUDED.updated_at, leaf_id = EXCLUDED.leaf_id, leaf_seq = EXCLUDED.leaf_seq", [this.realSessionId, owner, now, now, leafId, srcIds.length, mintSessionIncarnation()]);
-            const afterMeta = await conn.query("SELECT placement_kind FROM session_meta WHERE session_id = $1", [this.realSessionId]);
+            const afterMeta = await conn.query("SELECT placement_kind, owner, incarnation FROM session_meta WHERE session_id = $1", [this.realSessionId]);
             if (afterMeta.rows[0]?.placement_kind != null) {
                 await conn.query("ROLLBACK");
                 throw new SessionError("placement_refused", `session ${this.realSessionId} belongs to the ${afterMeta.rows[0].placement_kind} placement partition — a session-sync staged commit cannot overwrite a delegation transcript`);
             }
+            const face = sessionFaceFromRow(this.realSessionId, afterMeta.rows[0]?.owner ?? null, afterMeta.rows[0]?.incarnation);
             await conn.query("COMMIT");
-            return { relation: rel.relation };
+            return { relation: rel.relation, face };
         }
         catch (err) {
             try {

package/dist/plugins/remote-env-adb.d.ts

@@ -88,6 +88,9 @@ export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
     private connectPromise?;
     /** core `ExecutionEnv.homeDir`([ref]):本沙箱/目标机上执行用户的 home。见配置同名字段。 */
     readonly homeDir?: string | undefined;
+    /** core 7.49.0 #1554:shell 子进程真拿到的 `CDPATH` 条目 —— 本车道的命令跑在 Android 设备的 shell 里(设备自己的 env),本类不读那份 env ⇒ `"unknown"`(core 契约:说不出就说 unknown,
+     *  不许报一张没读过的空表;删除守卫因此对裸 `cd <相对名>` 之后的删除问人,而不是按「没有 CDPATH」放行)。 */
+    readonly cdPath: "unknown";
     private readonly cfg;
     private readonly spawnFn;
     private readonly injectedConnectOnce?;

package/dist/plugins/remote-env-adb.js

@@ -30,6 +30,7 @@ export class RemoteAdbExecutionEnv {
     destroyed = false;
     connectPromise;
     homeDir;
+    cdPath = "unknown";
     cfg;
     spawnFn;
     injectedConnectOnce;

package/dist/plugins/remote-env-device.d.ts

@@ -88,6 +88,9 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
     private readonly cfg;
     /** core `ExecutionEnv.homeDir`([ref]):设备上执行用户的 home。见 `DeviceEnvConfig.homeDir`。 */
     readonly homeDir?: string | undefined;
+    /** core 7.49.0 #1554:shell 子进程真拿到的 `CDPATH` 条目 —— 本车道的命令跑在设备上(设备自己的 env),本类不读那份 env ⇒ `"unknown"`(core 契约:说不出就说 unknown,
+     *  不许报一张没读过的空表;删除守卫因此对裸 `cd <相对名>` 之后的删除问人,而不是按「没有 CDPATH」放行)。 */
+    readonly cdPath: "unknown";
     /**
      * 🔴 `suspendable: false` 在 core 契约里**同时断言**「工作区在目标上外部持久」(remote-env.ts 的
      * load-bearing 不变量)—— 设备工作区 = 员工机磁盘,真持久 ✅,park-only 降级腿因此合法可用。

package/dist/plugins/remote-env-device.js

@@ -120,6 +120,7 @@ function assertPosixDevicePlatform(os, deviceId) {
 export class RemoteDeviceExecutionEnv {
     cfg;
     homeDir;
+    cdPath = "unknown";
     capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     externalContentTarget = true;
     hostLocalPaths = false;

package/dist/plugins/remote-env-e2b.d.ts

@@ -100,6 +100,9 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
     cwd: string;
     /** core `ExecutionEnv.homeDir`([ref]):本沙箱/目标机上执行用户的 home。见配置同名字段。 */
     readonly homeDir?: string | undefined;
+    /** core 7.49.0 #1554:shell 子进程真拿到的 `CDPATH` 条目 —— 本车道的命令跑在 e2b 沙箱里(模板镜像的 env),本类不读那份 env ⇒ `"unknown"`(core 契约:说不出就说 unknown,
+     *  不许报一张没读过的空表;删除守卫因此对裸 `cd <相对名>` 之后的删除问人,而不是按「没有 CDPATH」放行)。 */
+    readonly cdPath: "unknown";
     private readonly cfg;
     private readonly sandboxApi;
     private sbx?;
@@ -129,6 +132,7 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     workspaceHandle(): WorkspaceHandle;
     /**

package/dist/plugins/remote-env-e2b.js

@@ -19,6 +19,7 @@ const ok = (value) => ({ ok: true, value });
 export class RemoteContainerExecutionEnv {
     cwd;
     homeDir;
+    cdPath = "unknown";
     cfg;
     sandboxApi;
     sbx;
@@ -42,7 +43,7 @@ export class RemoteContainerExecutionEnv {
         this.homeDir = config.homeDir;
         this.sandboxApi = deps.sandboxApi ?? Sandbox;
     }
-    capabilities = { isolation: true, suspendable: true };
+    capabilities = { isolation: true, suspendable: true, canonicalPathAuthoritative: true };
     workspaceHandle() {
         if (!this.handle) {
             throw new RemoteExecutionError("connect_failed", "workspaceHandle() called before connect()");

package/dist/plugins/remote-env-host.d.ts

@@ -1,4 +1,4 @@
-import { FileError, ExecutionError, RemoteExecutionError, SchedulerError, type SchedulerCapability, type ScheduledIntent, type SchedulerContext, type ScheduledTaskId, type ScheduledTaskSummary, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, BackgroundShellError, type BackgroundShellCapability, type BackgroundShellId, type BackgroundHardKillOutcome, type BackgroundPoll, type BackgroundSpawnOptions } from "@sema-agent/core";
+import { FileError, ExecutionError, RemoteExecutionError, SchedulerError, type SchedulerCapability, type ScheduledIntent, type SchedulerContext, type ScheduledTaskId, type ScheduledTaskSummary, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type BoundFileObject, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, BackgroundShellError, type BackgroundShellCapability, type BackgroundShellId, type BackgroundHardKillOutcome, type BackgroundPoll, type BackgroundSpawnOptions } from "@sema-agent/core";
 /** Options accepted by `ExecutionEnv.exec` (core does not re-export the type; derive it from the seam). */
 type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
 /** SIGTERM → grace → SIGKILL (no host isolation). 🔴 宽限的**唯一属主**:本 driver 的 `kill` 梯子用它排升级定时器;会话级收敛
@@ -94,6 +94,12 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
     cwd: string;
     /** core `ExecutionEnv.homeDir`([ref]):本沙箱/目标机上执行用户的 home。见配置同名字段。 */
     readonly homeDir?: string | undefined;
+    /**
+     * core 7.49.0 #1554:shell 子进程**真拿到的** `CDPATH` 条目(`[]` = 没有)—— 删除守卫按它解裸 `cd <dir>`。本车道的命令就是本机子进程,
+     * env 是本类自己组合的(继承姿态 + `cfg.env`),所以说得出:读同一只组合({@link childEnv},不披露),切法与 core `NodeExecutionEnv` 同
+     * (缺席 / 空串 ⇒ `[]`,否则按 `:` 切)。逐命令的 `options.env` 由引擎自己交,它知道。
+     */
+    get cdPath(): readonly string[];
     private readonly workspaceDir;
     private readonly cfg;
     /** Workspace created on disk (lazily, on first use). */
@@ -284,6 +290,16 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
         maxLines?: number;
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
+    /** core `NodeExecutionEnv` 的绑定读器 —— 首次 {@link openBound} 时建(构造无副作用,只记 cwd)。 */
+    private boundReader;
+    /**
+     * core 7.50.0 `FileSystem.openBound`:开着并**持有**一只对象(叶链接不跟,开后身份对拍),调用方判的与读的是同一只对象 ——
+     * LSP 会话的读口与路径附件只经它读,不实现 ⇒ 两者在本车道一律拒。
+     * 🔴 **不重写**:委托 core `NodeExecutionEnv.openBound`(O_NOFOLLOW 开句柄 + fstat / 路径身份对拍的唯一属主;本车道的命令就跑在
+     * 这台机器、这个用户下,与它判的是同一个文件系统)。本适配器只给它两道与其余读口同一的入口纪律:销毁后拒(`fsReady`)与
+     * 工作区相对解析(`resolve`)。持有的对象由调用方关;本适配器的 destroy 不追它(只读句柄,活到被关)。
+     */
+    openBound(p: string, abortSignal?: AbortSignal): Promise<Result<BoundFileObject, FileError>>;
     readBinaryFile(p: string, abortSignal?: AbortSignal): Promise<Result<Uint8Array, FileError>>;
     /** S-539:整只方法体(**含** `fsReady` 那道门)走 `withInflightFs` —— 登记必须与调用方同一同步段,
      *  否则 destroy 的快照可能刚好在 `await this.fsReady(...)` 的让出点上取完。见那处头注。 */
@@ -406,7 +422,13 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      *  source of the shape rule) minus the config catalog's `secret`-typed names (`scrubServerSecrets`, 7.99.0 F7). `"all"` = full inherit (opt-out); a `string[]` = strict allowlist. Legacy `inheritProcessEnv`
      *  maps `true`→`"all"` / `false`→`[]`. */
     private inheritMode;
+    /** 每次 spawn 交给子进程的 env(组合 + 剥除披露)。 */
     private mergeEnv;
+    /**
+     * 子进程 env 的**唯一组合**。`disclose` = 这一次是不是真要交给子进程(是 ⇒ scrub 腿经 `hostSubprocessEnv` 记剥除;否 ⇒ 只读组合,
+     * 不计数 —— {@link cdPath} 这类「子进程会拿到什么」的读者走这一臂,一次没发生的 spawn 不进剥除账)。
+     */
+    private childEnv;
     private fileError;
 }
 /**

package/dist/plugins/remote-env-host.js

@@ -9,8 +9,8 @@ import { armPipeDestroyGrace, numEnvOr, SYMLINK_CHAIN_MAX_HOPS } from "./remote-
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
 import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeSoft, hardKillGroupNow, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
-import { FileError, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
-import { allowlistedEnv, hostSubprocessEnv } from "../server-secret-env.js";
+import { FileError, NodeExecutionEnv, ExecutionError, RemoteExecutionError, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
+import { allowlistedEnv, composeHostSubprocessEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { trackEphemeralHostWorkspace, untrackEphemeralHostWorkspace } from "./host-workspace-registry.js";
 const PROVIDER = "host";
 const DEFAULT_COMMAND_TIMEOUT_MS = 30 * 60_000;
@@ -57,6 +57,10 @@ export class RemoteHostExecutionEnv {
     }
     cwd;
     homeDir;
+    get cdPath() {
+        const value = this.childEnv(undefined, false).CDPATH;
+        return value === undefined || value === "" ? [] : value.split(":");
+    }
     workspaceDir;
     cfg;
     prepared = false;
@@ -954,6 +958,14 @@ export class RemoteHostExecutionEnv {
             lines = lines.slice(0, options.maxLines);
         return ok(lines);
     }
+    boundReader;
+    async openBound(p, abortSignal) {
+        const ready = await this.fsReady(p);
+        if (!ready.ok)
+            return ready;
+        this.boundReader ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
+        return this.boundReader.openBound(this.resolve(p), abortSignal);
+    }
     async readBinaryFile(p, abortSignal) {
         const ready = await this.fsReady(p);
         if (!ready.ok)
@@ -1308,6 +1320,9 @@ export class RemoteHostExecutionEnv {
         return "scrub";
     }
     mergeEnv(perCommand) {
+        return this.childEnv(perCommand, true);
+    }
+    childEnv(perCommand, disclose) {
         const mode = this.inheritMode();
         let base;
         if (mode === "all")
@@ -1315,6 +1330,9 @@ export class RemoteHostExecutionEnv {
         else if (Array.isArray(mode)) {
             base = allowlistedEnv(mode, process.env);
         }
+        else if (!disclose) {
+            base = composeHostSubprocessEnv([]);
+        }
         else {
             base = hostSubprocessEnv({ site: "server.remote-env-host.inherit-scrub", allow: [] });
         }