@sema-agent/server 7.125.1 → 7.127.0

package/dist/runs.js

@@ -64,13 +64,6 @@ export function markChildrenStoppedByUserOnAbort(signal, taskId, principal) {
     }
     signal.addEventListener("abort", mark, { once: true });
 }
-export function isSessionConflictResult(result) {
-    if (result.terminal.kind !== "failed")
-        return false;
-    if (result.terminal.code)
-        return result.terminal.code === "conflict";
-    return /stale write|concurrent write|conflict/i.test(result.terminal.message ?? "");
-}
 const PREPARE_REFUSAL_HTTP_STATUS = {
     "resume.session_not_found": 404,
     "rewind_snapshot.unresolvable": 422,
@@ -83,6 +76,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.skill_listing_budget_invalid": 400,
     "config.user_invoked_skill_unknown": 400,
     "config.image_invalid": 400,
+    "config.tool_face_control": 400,
     "config.memory_capture_unsupported": 409,
 };
 export function resumeAtHttpStatus(result) {
@@ -169,12 +163,7 @@ export async function graftParkToolCallId(result, cs) {
     const id = await parkToolCallId(result, cs);
     return id === undefined ? result : { ...result, toolCallId: id };
 }
-export function evictIfConflict(runner, sessionId, result) {
-    if (sessionId && isSessionConflictResult(result)) {
-        runner.sessions.evict?.(sessionId);
-    }
-}
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger, acceptance) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -337,7 +326,6 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             if (verify !== undefined) {
                 const result = await runWithVerification(runner, { ...spec, taskId, signal: cancelCtrl.signal }, verify, { ...fwdInternals, ...statusSeat });
                 await flush();
-                evictIfConflict(runner, spec.sessionId, result);
                 await flushPromptManifest();
                 const safe = await withModelUsage(sealResultForExit(result));
                 await append("done", { result: safe });
@@ -345,13 +333,13 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 const plane = outwardPlane(safe.terminal);
                 await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
                 await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
+                acceptance?.settle(safe);
                 recordDone(safe, plane.status);
                 return;
             }
             if (cascade !== undefined) {
                 const result = await runCascade(runner, { ...spec, taskId, signal: cancelCtrl.signal }, cascade, { ...fwdInternals, ...statusSeat });
                 await flush();
-                evictIfConflict(runner, spec.sessionId, result);
                 await flushPromptManifest();
                 const safe = await withModelUsage(sealResultForExit(result));
                 await append("done", { result: safe });
@@ -359,6 +347,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 const plane = outwardPlane(safe.terminal);
                 await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
                 await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
+                acceptance?.settle(safe);
                 recordDone(safe, plane.status);
                 return;
             }
@@ -372,6 +361,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 }
                 fleetPublisher?.onEvent(ev);
                 await userInputLedger?.observeLegEvent(stream, ev);
+                acceptance?.observe(ev);
                 await flushPromptManifest();
                 switch (ev.type) {
                     case "text_delta":
@@ -405,7 +395,6 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         await parkNeedsReview(ev.result);
                         continue;
                     }
-                    evictIfConflict(runner, spec.sessionId, ev.result);
                     {
                         const settled = causeAtDone !== undefined ? cancelledResult(causeAtDone, ev.result) : ev.result;
                         settledAsCancel = failureCodeOf(settled.terminal) === CANCELLED_CODE;
@@ -490,6 +479,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
                 await releaseKeyIfZeroWorkRefusal(runStore, taskId, reached.result);
+                acceptance?.settle(reached.result);
             }
             else if (reached?.kind === "suspended") {
                 await runStore.setSuspended(taskId, reached.result);

package/dist/sandbox-egress-policy.d.ts

@@ -0,0 +1,61 @@
+/** `K8S_SANDBOX_IPV6` 闭集:`enabled` = pod 保留平台给的 IPv6(pod spec 与未引入本旋钮时逐字同形);`disabled` = pod 级 sysctl 关掉 IPv6。 */
+export declare const SANDBOX_IPV6_WORDS: readonly ["enabled", "disabled"];
+export type SandboxIpv6 = (typeof SANDBOX_IPV6_WORDS)[number];
+/** 旋钮缺席时的姿态(缺省不动 pod:关 v6 要每个节点的 kubelet 放行这两只 sysctl,没放行的集群 pod 起不来)。 */
+export declare const SANDBOX_IPV6_DEFAULT: SandboxIpv6;
+/** 一只 pod 级 sysctl(k8s `PodSecurityContext.sysctls[]` 的形)。 */
+export interface PodSysctl {
+    readonly name: string;
+    readonly value: string;
+}
+/**
+ * 沙箱 pod 的 sysctl 只有这一个属主:`disabled` ⇒ `all`(已有接口)与 `default`(之后建的接口)都关 IPv6;`enabled` ⇒ 不铸。
+ * 两只都不在 k8s 的 safe sysctl 表里 ⇒ 每个节点 kubelet 要 `--allowed-unsafe-sysctls` 点名它们,否则 pod 起不来(车道连沙箱失败,响亮)。
+ */
+export declare function sandboxPodSysctls(ipv6: SandboxIpv6): readonly PodSysctl[] | undefined;
+/** 自检读的两张表(车道侧各一只 GET)。 */
+export type EgressPolicyRead = "nodes" | "networkpolicies";
+/** 节点地址里自检判的两类(`Hostname` / `InternalDNS` / `ExternalDNS` 不是地址)。 */
+type NodeAddressType = "InternalIP" | "ExternalIP";
+export type SandboxEgressGap = {
+    readonly kind: "node_address_open";
+    readonly node: string;
+    readonly addressType: NodeAddressType;
+    readonly address: string;
+    readonly policy: string;
+    readonly ports: string;
+} | {
+    readonly kind: "policy_absent";
+} | {
+    readonly kind: "ipv6_enabled";
+} | {
+    readonly kind: "unreadable";
+    readonly what: EgressPolicyRead;
+    readonly detail: string;
+};
+/** 一只 GET 的读数:答了 2xx ⇒ 体;否则一句为什么读不到(HTTP 码 / 错误句)。 */
+export type ApiRead = {
+    readonly ok: true;
+    readonly json: unknown;
+} | {
+    readonly ok: false;
+    readonly detail: string;
+};
+export interface EgressPolicyInputs {
+    readonly nodes: ApiRead;
+    readonly policies: ApiRead;
+    /** 沙箱 pod 的标签(车道建 pod 时铸的那一份)。 */
+    readonly podLabels: Readonly<Record<string, string>>;
+    readonly ipv6: SandboxIpv6;
+}
+/**
+ * 读数 → 缺口(纯函数、全函数:不抛;顺序:读不到的表 → 策略缺席 → 逐节点逐地址 → IPv6)。一张表读不到,只跳过要它的那一判;另一张照判。
+ */
+export declare function sandboxEgressGaps(inputs: EgressPolicyInputs): SandboxEgressGap[];
+/** 读数的说法:每个缺口一行 warn `sandbox_egress_policy_gap` + 一次 `recordFailOpen`(P-DEBT);零缺口一行 info `sandbox_egress_policy_checked`。 */
+export declare function sayEgressPolicyReading(gaps: readonly SandboxEgressGap[], logger: {
+    info(msg: string, fields?: Record<string, unknown>): void;
+    warn(msg: string, fields?: Record<string, unknown>): void;
+} | undefined, namespace: string): void;
+export {};
+//# sourceMappingURL=sandbox-egress-policy.d.ts.map

package/dist/sandbox-egress-policy.js

@@ -0,0 +1,235 @@
+import { BlockList, isIP } from "node:net";
+import { recordFailOpen } from "./observability/fail-open.js";
+export const SANDBOX_IPV6_WORDS = ["enabled", "disabled"];
+export const SANDBOX_IPV6_DEFAULT = "enabled";
+export function sandboxPodSysctls(ipv6) {
+    switch (ipv6) {
+        case "enabled":
+            return undefined;
+        case "disabled":
+            return [
+                { name: "net.ipv6.conf.all.disable_ipv6", value: "1" },
+                { name: "net.ipv6.conf.default.disable_ipv6", value: "1" },
+            ];
+    }
+}
+class Unjudgeable extends Error {
+}
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function recordAt(v, where) {
+    if (!isRecord(v))
+        throw new Unjudgeable(`${where} is not an object`);
+    return v;
+}
+function optRecordAt(v, where) {
+    return v === undefined || v === null ? undefined : recordAt(v, where);
+}
+function arrayAt(v, where) {
+    if (!Array.isArray(v))
+        throw new Unjudgeable(`${where} is not a list`);
+    return v;
+}
+function optArrayAt(v, where) {
+    return v === undefined || v === null ? undefined : arrayAt(v, where);
+}
+function stringAt(v, where) {
+    if (typeof v !== "string")
+        throw new Unjudgeable(`${where} is not a string`);
+    return v;
+}
+function listItems(json, what) {
+    const items = isRecord(json) ? json.items : undefined;
+    if (!Array.isArray(items))
+        throw new Unjudgeable(`${what} answer carries no items list`);
+    return items;
+}
+const SELECTOR_OPERATORS = ["In", "NotIn", "Exists", "DoesNotExist"];
+function readSelector(v, where) {
+    const sel = optRecordAt(v, where) ?? {};
+    const labels = optRecordAt(sel.matchLabels, `${where}.matchLabels`) ?? {};
+    const matchLabels = {};
+    for (const [k, val] of Object.entries(labels))
+        matchLabels[k] = stringAt(val, `${where}.matchLabels.${k}`);
+    const matchExpressions = (optArrayAt(sel.matchExpressions, `${where}.matchExpressions`) ?? []).map((e, i) => {
+        const x = recordAt(e, `${where}.matchExpressions[${i}]`);
+        const operator = stringAt(x.operator, `${where}.matchExpressions[${i}].operator`);
+        if (!SELECTOR_OPERATORS.includes(operator))
+            throw new Unjudgeable(`${where} operator ${JSON.stringify(operator)} is not one of ${SELECTOR_OPERATORS.join(" / ")}`);
+        return { key: stringAt(x.key, `${where}.matchExpressions[${i}].key`), operator, values: (optArrayAt(x.values, `${where}.matchExpressions[${i}].values`) ?? []).map((y, j) => stringAt(y, `${where}.matchExpressions[${i}].values[${j}]`)) };
+    });
+    return { matchLabels, matchExpressions };
+}
+function selects(sel, labels) {
+    for (const [k, v] of Object.entries(sel.matchLabels))
+        if (labels[k] !== v)
+            return false;
+    for (const e of sel.matchExpressions) {
+        const has = Object.prototype.hasOwnProperty.call(labels, e.key);
+        switch (e.operator) {
+            case "In":
+                if (!has || !e.values.includes(labels[e.key]))
+                    return false;
+                break;
+            case "NotIn":
+                if (has && e.values.includes(labels[e.key]))
+                    return false;
+                break;
+            case "Exists":
+                if (!has)
+                    return false;
+                break;
+            case "DoesNotExist":
+                if (has)
+                    return false;
+                break;
+            default:
+                throw new Unjudgeable(`podSelector operator ${JSON.stringify(e.operator)} is not one of ${SELECTOR_OPERATORS.join(" / ")}`);
+        }
+    }
+    return true;
+}
+function readCidr(v, where) {
+    const cidr = stringAt(v, where);
+    parseCidr(cidr);
+    return cidr;
+}
+function readRule(v, where) {
+    const r = recordAt(v, where);
+    const to = optArrayAt(r.to, `${where}.to`);
+    const blocks = [];
+    for (const [i, peer] of (to ?? []).entries()) {
+        const ip = optRecordAt(recordAt(peer, `${where}.to[${i}]`).ipBlock, `${where}.to[${i}].ipBlock`);
+        if (ip === undefined)
+            continue;
+        blocks.push({ cidr: readCidr(ip.cidr, `${where}.to[${i}].ipBlock.cidr`), except: (optArrayAt(ip.except, `${where}.to[${i}].ipBlock.except`) ?? []).map((x, j) => readCidr(x, `${where}.to[${i}].ipBlock.except[${j}]`)) });
+    }
+    const ports = optArrayAt(r.ports, `${where}.ports`);
+    const portText = ports === undefined || ports.length === 0
+        ? "all"
+        : ports
+            .map((p, i) => {
+            const x = recordAt(p, `${where}.ports[${i}]`);
+            return `${typeof x.protocol === "string" ? x.protocol : "TCP"}/${typeof x.port === "number" || typeof x.port === "string" ? x.port : "*"}${typeof x.endPort === "number" ? `-${x.endPort}` : ""}`;
+        })
+            .join(",");
+    return { to: to === undefined || to.length === 0 ? undefined : blocks, ports: portText };
+}
+function isolatesEgress(spec, where) {
+    const types = optArrayAt(spec.policyTypes, `${where}.policyTypes`);
+    return types !== undefined ? types.map((t, i) => stringAt(t, `${where}.policyTypes[${i}]`)).includes("Egress") : spec.egress !== undefined && spec.egress !== null;
+}
+function egressPolicies(json, podLabels) {
+    const out = [];
+    for (const [i, item] of listItems(json, "networkpolicies").entries()) {
+        const p = recordAt(item, `networkpolicies[${i}]`);
+        const name = stringAt(recordAt(p.metadata, `networkpolicies[${i}].metadata`).name, `networkpolicies[${i}].metadata.name`);
+        const spec = recordAt(p.spec, `networkpolicy ${name} spec`);
+        if (!isolatesEgress(spec, `networkpolicy ${name}`) || !selects(readSelector(spec.podSelector, `networkpolicy ${name} podSelector`), podLabels))
+            continue;
+        out.push({ name, rules: (optArrayAt(spec.egress, `networkpolicy ${name} egress`) ?? []).map((r, j) => readRule(r, `networkpolicy ${name} egress[${j}]`)) });
+    }
+    return out;
+}
+function nodeAddresses(json) {
+    const out = [];
+    for (const [i, item] of listItems(json, "nodes").entries()) {
+        const n = recordAt(item, `nodes[${i}]`);
+        const node = stringAt(recordAt(n.metadata, `nodes[${i}].metadata`).name, `nodes[${i}].metadata.name`);
+        const addresses = arrayAt(recordAt(n.status, `node ${node} status`).addresses, `node ${node} status.addresses`);
+        let seen = 0;
+        for (const [j, a] of addresses.entries()) {
+            const x = recordAt(a, `node ${node} status.addresses[${j}]`);
+            const type = stringAt(x.type, `node ${node} status.addresses[${j}].type`);
+            if (type !== "InternalIP" && type !== "ExternalIP")
+                continue;
+            const address = stringAt(x.address, `node ${node} status.addresses[${j}].address`);
+            if (isIP(address) === 0)
+                throw new Unjudgeable(`node ${node} ${type} ${JSON.stringify(address)} is not an IP address`);
+            out.push({ node, addressType: type, address });
+            seen++;
+        }
+        if (seen === 0)
+            throw new Unjudgeable(`node ${node} reports no InternalIP / ExternalIP`);
+    }
+    return out;
+}
+function parseCidr(cidr) {
+    const slash = cidr.indexOf("/");
+    const net = slash < 0 ? cidr : cidr.slice(0, slash);
+    const fam = isIP(net);
+    const max = fam === 6 ? 128 : 32;
+    const prefix = slash < 0 ? max : Number(cidr.slice(slash + 1));
+    if (fam === 0 || !/^\d+$/.test(slash < 0 ? String(max) : cidr.slice(slash + 1)) || prefix > max)
+        throw new Unjudgeable(`ipBlock cidr ${JSON.stringify(cidr)} does not parse`);
+    return { net, prefix, family: fam === 6 ? "ipv6" : "ipv4" };
+}
+function inCidr(address, cidr) {
+    const c = parseCidr(cidr);
+    if ((isIP(address) === 6 ? "ipv6" : "ipv4") !== c.family)
+        return false;
+    const list = new BlockList();
+    list.addSubnet(c.net, c.prefix, c.family);
+    return list.check(address, c.family);
+}
+function ruleAllows(rule, address) {
+    if (rule.to === undefined)
+        return true;
+    return rule.to.some((b) => inCidr(address, b.cidr) && !b.except.some((x) => inCidr(address, x)));
+}
+function readTable(read, what, parse, gaps) {
+    if (!read.ok) {
+        gaps.push({ kind: "unreadable", what, detail: read.detail });
+        return undefined;
+    }
+    try {
+        return parse(read.json);
+    }
+    catch (e) {
+        gaps.push({ kind: "unreadable", what, detail: e instanceof Unjudgeable ? e.message : `answer not understood: ${e instanceof Error ? e.message : String(e)}` });
+        return undefined;
+    }
+}
+export function sandboxEgressGaps(inputs) {
+    const gaps = [];
+    const policies = readTable(inputs.policies, "networkpolicies", (json) => egressPolicies(json, inputs.podLabels), gaps);
+    const addresses = readTable(inputs.nodes, "nodes", nodeAddresses, gaps);
+    if (policies !== undefined && policies.length === 0)
+        gaps.push({ kind: "policy_absent" });
+    if (policies !== undefined && policies.length > 0 && addresses !== undefined) {
+        for (const a of addresses) {
+            for (const p of policies) {
+                const rule = p.rules.find((r) => ruleAllows(r, a.address));
+                if (rule !== undefined) {
+                    gaps.push({ kind: "node_address_open", node: a.node, addressType: a.addressType, address: a.address, policy: p.name, ports: rule.ports });
+                    break;
+                }
+            }
+        }
+    }
+    if (inputs.ipv6 === "enabled")
+        gaps.push({ kind: "ipv6_enabled" });
+    return gaps;
+}
+function effectOf(gap) {
+    switch (gap.kind) {
+        case "node_address_open":
+            return "sandbox pods can reach this node address through the egress policy — add it to sandbox.networkPolicy.nodeCidrs (kube-up lists every node's addresses) or narrow the allowing rule";
+        case "policy_absent":
+            return "no NetworkPolicy selects the sandbox pods for egress — the policy layer does not restrict sandbox egress (chart sandbox.networkPolicy.enabled, or the CNI's own policy)";
+        case "ipv6_enabled":
+            return "sandbox pods keep IPv6 — an enforcement layer that filters only IPv4 leaves the pods' IPv6 (link-local included) unfiltered; K8S_SANDBOX_IPV6=disabled turns it off in the pod (needs the two sysctls allowed by every node's kubelet)";
+        case "unreadable":
+            return `the ${gap.what} could not be read — this part of the egress check did not run (the server's k8s account needs ${gap.what === "nodes" ? "get/list on nodes (cluster scope)" : "get/list on networkpolicies in the sandbox namespace"})`;
+    }
+}
+export function sayEgressPolicyReading(gaps, logger, namespace) {
+    if (gaps.length === 0) {
+        logger?.info("sandbox_egress_policy_checked", { namespace, gaps: 0 });
+        return;
+    }
+    for (const gap of gaps) {
+        recordFailOpen("server.sandbox-egress.policy-gap", `kind=${gap.kind}${gap.kind === "unreadable" ? ` what=${gap.what}` : ""}`);
+        logger?.warn("sandbox_egress_policy_gap", { namespace, ...gap, effect: effectOf(gap) });
+    }
+}
+//# sourceMappingURL=sandbox-egress-policy.js.map

package/dist/security.d.ts

@@ -195,6 +195,13 @@ export type OwnerAwareSessionStore = SessionStore & {
 /** True iff `s` matches the canonical uuidv7 shape core mints (see {@link UUIDV7_RE}). */
 export declare function isUuidV7(s: string): boolean;
 export declare function isUuidShape(s: string): boolean;
+/** The submit door's refusal of a caller-supplied session id that is not a canonical uuid, or `undefined` when the value
+ *  is absent / not a string (the authorizer only ever reads a string `sessionId`; a non-string never enters the session
+ *  slot) / a canonical uuid. The sentence opens with the store verbs' sentence (`invalid session id (must be a canonical
+ *  uuid)`, same `request.id_invalid` code) and then names the remedy — a self-chosen name is not a session id; the caller
+ *  keeps its own name → uuid mapping. HTTP admission answers it as `400 request.id_invalid`; `run-local --session` prints
+ *  it as a usage error: ONE judge, ONE sentence, no second door-specific rule. */
+export declare function sessionIdShapeIssue(sessionId: unknown): string | undefined;
 /** An HTTP error the server maps to a status code (instead of a generic 500). `code` (optional) is a stable
  *  machine-readable identifier the HTTP layer echoes as `{code}` beside the human `{error}` message — the
  *  "typed rejection" posture (structured code on the wire, prose stays with the shell/web).

package/dist/security.js

@@ -25,6 +25,11 @@ const UUID_ANY_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}
 export function isUuidShape(s) {
     return UUID_ANY_RE.test(s);
 }
+export function sessionIdShapeIssue(sessionId) {
+    if (typeof sessionId !== "string" || isUuidShape(sessionId))
+        return undefined;
+    return "invalid session id (must be a canonical uuid); a self-chosen session name is not accepted — use a uuid (any version) and keep your own name-to-uuid mapping";
+}
 export class HttpError extends Error {
     status;
     code;

package/dist/server-secret-env.d.ts

@@ -19,7 +19,7 @@
  * {@link scrubServerSecrets} = core `scrubSecretEnv`(按形)∘ 本仓按名两臂:
  *  · 目录臂 —— 配置目录(`config-catalog.ts`)里 `type:"secret"` 的每一行,从目录机器派生,不手抄第二份名单;
  *  · 名单型旋钮臂 —— `ENV_NAME_ALLOWLIST_KNOBS` 的每一只(`env-name-allowlist-knobs.ts`,表键派生):名单**原文**可能夹着一枚被错展开进来
- *    的令牌,按凭据类对待。服务侧三只(`LSP_ENV_ALLOW` S-699 / `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` S-713)同时是目录 secret 行,
+ *    的令牌,按凭据类对待。服务侧四只(`LSP_ENV_ALLOW` S-699 / `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` S-713 / `K8S_SANDBOX_ENV`)同时是目录 secret 行,
  *    目录臂先认;本臂接住的是**不在服务目录里**的那一只 —— bake-runner 的 `BAKE_ENV_ALLOW`(它不是服务进程的配置)。
  * core 形状规则的缺口由 core 源头修 —— 7.30.1 #1072 补 `KEYS|TOKENS|PASSWORDS`(S-616),7.33.7 #1180 按名认 OTLP 头变量一族(7.103.2 车PM 提货;目录臂照旧点名
  * `OTEL_EXPORTER_OTLP_HEADERS` = 双保险,互证钉在 `test/secret-env-scrub-disclosure.test.ts`),目录臂独担的只剩名单型旋钮(值是变量名单,core 本来就不该认它们)。
@@ -32,10 +32,10 @@
  * ## 点名放行(S-699 / S-713,一只谓词各处用)
  * {@link allowlistedEnv} 是本仓「一张名单点到哪些 env 键,就把它们从源 env **原样**交给子进程」的唯一实现。调用:
  * host shell 的 `inheritEnv:[names]`(`plugins/remote-env-host.ts`,hermetic 形)、{@link hostSubprocessEnv}(剥后放回形:本地语言服务器的
- * `LSP_ENV_ALLOW`、bake-runner 的 `BAKE_ENV_ALLOW`)、沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`(`config.ts`,S-713 起)。
+ * `LSP_ENV_ALLOW`、bake-runner 的 `BAKE_ENV_ALLOW`)、沙箱带外 env 的 `E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` / `K8S_SANDBOX_ENV`(`config.ts`,S-713 起)。
  * 名单型旋钮的**名单**另由 `config.ts` 的同一只解析器 `parseEnvNameAllowlist` 判形(形错拒启 / 源里没有的名按序号 warn),本函数只管取值。
  * 「点名」在各处同义:点到的键原样带值(空串值照带),密钥形也照过(点名 = 部署方显式承担);源里没有的名不产生条目。
- * 沙箱两腿不继承本进程环境:进沙箱的本进程值只有点到的键(与 host shell 的 hermetic 形同一侧)。
+ * 沙箱三腿不继承本进程环境:进沙箱的本进程值只有点到的键(与 host shell 的 hermetic 形同一侧)。
  * host shell 与「剥后放回」形**只在没点到的键上**不同,这是有意保留的差别:host shell 的 `string[]` 形是 hermetic 白名单(与 core
  * `NodeExecutionEnv` 同名选项同义,没点到的一律不继承);语言服务器 / bake-runner 在 {@link scrubServerSecrets} 的结果之上放回点名键
  * (没点到的照缺省剥,`PATH` / `HOME` 这类非密钥键照常在 —— hermetic 形会让子进程当场找不到自己的工具链)。
@@ -70,7 +70,7 @@ export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
  * 各腿不直接调它 —— 经 {@link hostSubprocessEnv}(剥 + 放回 + 留痕一只口)。
  *
  * **只为宿主子进程组合**。本包跑在别的平台上的子进程(ssh / k8s / adb / e2b / docker 车道)的 env 不经本函数:那些车道不继承本进程 env,只交
- * 调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV`,经 {@link allowlistedEnv})。(core 7.33.6 #1159 的平台尾参随
+ * 调用方显式给的 env 与部署方点名的键(`E2B_SANDBOX_ENV` / `DOCKER_SANDBOX_ENV` / `K8S_SANDBOX_ENV`,经 {@link allowlistedEnv})。(core 7.33.6 #1159 的平台尾参随
  * core 7.35.0 #1201 删除 —— git 的 env 配置族成了豁免族,不再有「按子进程平台读记录」这件事,S-877。)
  */
 export declare function scrubServerSecrets(env: NodeJS.ProcessEnv, findings: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
@@ -100,6 +100,12 @@ export declare function hostSubprocessEnv(o: {
     site: SecretEnvScrubSite;
     allow: readonly string[];
 }, sourceEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * {@link hostSubprocessEnv} 的**组合本体**(不披露、不计数)—— 同一只组合,两个入口:真要交给子进程的现场经 `hostSubprocessEnv`(组合 + 披露);
+ * 只想知道「子进程**会**拿到什么」的读者(core 7.49.0 #1554:host 车道的 `ExecutionEnv.cdPath` 要报子进程真拿到的 `CDPATH`)读这一只 ——
+ * 既不另写一份组合(第二份会漂),也不把一次没发生的 spawn 记进剥除计数。
+ */
+export declare function composeHostSubprocessEnv(allow: readonly string[], sourceEnv?: NodeJS.ProcessEnv, findings?: ServerSecretEnvFinding[]): NodeJS.ProcessEnv;
 /** git 子进程腿的现场(闭集里名字带 `.git-` 的那几只 —— 编译期筛;它们都没有点名放行面)。 */
 export type GitSubprocessSite = Extract<SecretEnvScrubSite, `${string}.git-${string}`>;
 /**

package/dist/server-secret-env.js

@@ -24,10 +24,13 @@ export function scrubServerSecrets(env, findings) {
 }
 export function hostSubprocessEnv(o, sourceEnv = process.env) {
     const scrubFindings = [];
-    const composed = { ...scrubServerSecrets(sourceEnv, scrubFindings), ...allowlistedEnv(o.allow, sourceEnv) };
+    const composed = composeHostSubprocessEnv(o.allow, sourceEnv, scrubFindings);
     recordSecretEnvScrub(o.site, scrubFindings.filter((f) => composed[f.key] !== sourceEnv[f.key]), o.allow);
     return composed;
 }
+export function composeHostSubprocessEnv(allow, sourceEnv = process.env, findings = []) {
+    return { ...scrubServerSecrets(sourceEnv, findings), ...allowlistedEnv(allow, sourceEnv) };
+}
 export function gitSubprocessEnv(o) {
     return {
         ...hostSubprocessEnv({ site: o.site, allow: [] }),

package/dist/session-error-wire.d.ts

@@ -29,8 +29,8 @@
  *    列表里的缺席),码位各不相同,不由本表统一。
  *  · `invalid_entry` / `invalid_fork_target` / `placement_refused` —— 留白:本仓今天没有一条 wire 口把它们作为自己的
  *    应答(它们在 core 的追加 / 分叉 / 放置面上抛,落进各站点既有的处置或通用 500)。给它们起名是另一件事、另一张票。
- *  · `storage` / `conflict` / `unknown` —— 留白:`conflict` 由提交腿的 CAS 冲突臂按结果处置(`runs.ts`
- *    `isSessionConflictResult`),`storage` / `unknown` 是故障类,通用 500 就是它们今天的应答。
+ *  · `storage` / `conflict` / `unknown` —— 留白:`conflict` 是 run 的写撞上真并发写,落成那条 run 的 `failed` 终局
+ *    (`terminal.code: "conflict"`),提交腿不另作处置;`storage` / `unknown` 是故障类,通用 500 就是它们今天的应答。
  *
  * core 给闭集加一个词 ⇒ 下面的 `switch` 编译红,由人裁定它在两面上的答复,而不是让它静默落进某个恰好存在的臂
  * ([ref] 词表纪律;同形先例 `session-policy-wire.ts` 的 `sessionPolicyErrorHttp`)。

package/dist/session-incarnation.d.ts

@@ -1,3 +1,33 @@
+/**
+ * S-790 / S-506([ref] §2)—— **会话化身**:一个会话 id 是座位,化身是这一位住客。
+ *
+ * 会话 id 由调用方自选,删掉之后同一个 id 可以被别人(或同一个人)重新登记(`boot/session-faces.ts` 的级联删除注自认)。
+ * 本仓大量持久状态只按会话 id 分区,于是「上一位住客留下的东西」会在下一位名下继续起作用。化身令牌给「是不是同一位住客」
+ * 一个可比的答案 —— 今天只能比属主,同一个人删了重建就比不出来。
+ *
+ * ## 规则(全仓唯一处写)
+ *  · **铸点只在新建行**:会话店的 `register` / 无 id 创建 / fork / session-sync 的导入新行。已存在的行一个字节都不动
+ *    (与 `owner` 同一条 first-write 律);session-sync 的整段换装(replace / staged commit)换的是**同一位住客**的日志,
+ *    化身沿用。删除随行消失,同 id 重新登记铸新的。
+ *  · **值是不透明随机串**(`randomUUID()`,v4:没有时间戳、没有机器信息 —— 刻意不用 uuidv7,那一形带铸造时刻)。只拿来比较。
+ *  · **一格、一个解码**:住客令牌是会话**行**上的一格 —— SQL `session_meta.incarnation`(两方言)、local 后端的会话元数据边档那一格
+ *    (`plugins/local-session-store.ts` 的 `session-incarnations.json`)。每只店对它只有**一次读**(`sessionFaceOf`),行上的值只经
+ *    {@link incarnationFromCell} 解码;别的读法都从这一次读派生(下一节),没有第二份。
+ *  · **读口唯一**:会话店的 `sessionFaceOf(sessionId) → { owner, incarnation } | undefined`,一次读同时给两样
+ *    (两次独立读在删除 / 重登记的缝里能拼出混世代组合,与 `getHead` 同一条理由)。`undefined` = 没有这只会话。
+ *  · **读到空化身 ⇒ 响亮拒**({@link SessionIncarnationMissingError}):一次性迁移(`plugins/one-time-migrations.ts` 登记表 M5)
+ *    之后,空值只可能来自没铸化身的写腿或人为改库 —— 把它当「通配」就是让任何人都能和这一行比成同一位住客。
+ *  · **不上 wire、不进模型上下文、不进日志正文**:日志里要点名时只打 {@link incarnationLogPrefix}(前 8 位)。
+ *
+ * ## 谁读它(全部派生自那一格)
+ *  · `/decide` 的 parked 赎回腿(`parked-decide.ts`):claim 前读一次、claim 后再读一次,会话不在或化身变了 ⇒ 回滚 claim、
+ *    答既有的 `409 decide.not_parked`;赎回面(`parked-revive-surface.ts`)只在属主相等**且**两次读是同一位住客时交继承座。
+ *  · core 的记忆引擎:Runner 读**它取到的那只会话**的 `getMetadata().incarnation`(SQL 两店的 wake 带出这一列;local 店交出的会话
+ *    在元数据上答边档那一格),不再有宿主座。
+ *  · 按 id 读的消费方(没取会话的那一侧 —— k8s 工作区空间的分区,`boot/execution-env.ts`):core 的 `SessionStore.incarnationOf`,
+ *    三只店都实装为 `sessionFaceOf` 的化身那一半;缓存包装层原样转发。「店有没有这只读」只判一处:{@link incarnationReadOf}。
+ */
+import type { SessionStore } from "@sema-agent/core";
 /** 会话元数据的一次读:属主 + 化身(同一行、同一次读)。 */
 export interface SessionFace {
     /** `null` = 登记为无主的会话。 */
@@ -31,10 +61,24 @@ export declare class SessionIncarnationMissingError extends Error {
     constructor(sessionId: string);
 }
 /**
- * 店把一行原始列读成 {@link SessionFace} 的唯一口(三只店共用 —— 空值判据只写这一处)。
- * `incarnation` 不是非空字符串 ⇒ {@link SessionIncarnationMissingError}。
+ * 行上化身那一格的**唯一解码**(三只店的 `sessionFaceOf` 与 SQL 两店 wake 带出的会话元数据都经它 —— 空值判据只写这一处)。
+ * 不是非空字符串 ⇒ {@link SessionIncarnationMissingError}。
  */
+export declare function incarnationFromCell(sessionId: string, cell: unknown): string;
+/** 店把一行原始列读成 {@link SessionFace} 的唯一口(三只店共用;化身那一格经 {@link incarnationFromCell})。 */
 export declare function sessionFaceFromRow(sessionId: string, owner: string | null, incarnation: unknown): SessionFace;
+/** 按 id 读住客(core `SessionStore.incarnationOf` 的形):`undefined` = 没有这只会话;读抛 = 读故障,不是答案。 */
+export type IncarnationRead = (sessionId: string) => Promise<string | undefined>;
+/**
+ * 「这只会话店能不能按 id 答住客」—— 全仓**只判这一处**:起服门(`assertWorkspaceSpaceReadable`)与 k8s 工作区空间的每 run 读
+ * (`createK8sRunEnvFactory`)读的是同一只返回值(装配第 5 段判一次)。缺席 = 店没有实装 `incarnationOf`。
+ */
+export declare function incarnationReadOf(store: Pick<SessionStore, "incarnationOf"> | undefined): IncarnationRead | undefined;
+/**
+ * 「这只会话店能不能按 id 答住客脸(属主 + 化身一次读)」—— 与 {@link incarnationReadOf} 同一处判法、同一个「能不能」:
+ * 空间缓存卷的回收用它一次拿两位(属主要与这次删除验过的那位相符,化身是空间键)。店没有这只读口 ⇒ `undefined`(回收不做,不响)。
+ */
+export declare function sessionFaceReadOf(store: object | undefined): SessionFaceReader | undefined;
 /**
  * session-sync **整段换装**(replace)时化身的去留 —— 三只店共用的一句判据:换装删掉再插回的是**同一位住客**的那一行
  * (删除带属主门),所以行在、属主相同、化身非空 ⇒ 沿用;行不在(这是一次新建)或还是空的存量形 ⇒ 铸一只新的。

package/dist/session-incarnation.js

@@ -24,10 +24,21 @@ export class SessionIncarnationMissingError extends Error {
         this.name = "SessionIncarnationMissingError";
     }
 }
-export function sessionFaceFromRow(sessionId, owner, incarnation) {
-    if (typeof incarnation !== "string" || incarnation === "")
+export function incarnationFromCell(sessionId, cell) {
+    if (typeof cell !== "string" || cell === "")
         throw new SessionIncarnationMissingError(sessionId);
-    return { owner, incarnation };
+    return cell;
+}
+export function sessionFaceFromRow(sessionId, owner, incarnation) {
+    return { owner, incarnation: incarnationFromCell(sessionId, incarnation) };
+}
+export function incarnationReadOf(store) {
+    const read = store?.incarnationOf;
+    return typeof read === "function" ? read.bind(store) : undefined;
+}
+export function sessionFaceReadOf(store) {
+    const read = store?.sessionFaceOf;
+    return typeof read === "function" ? read.bind(store) : undefined;
 }
 export function carriedIncarnation(prior, owner) {
     if (prior !== undefined && (prior.owner ?? null) === owner && typeof prior.incarnation === "string" && prior.incarnation !== "") {

package/dist/session-sync-kernel.d.ts

@@ -5,11 +5,12 @@
  * importSession/planSync) so the three DB session adapters (local/pg/tidb) and security.ts can depend on these
  * symbols WITHOUT touching the orchestration module — session-sync.ts value-imports StoreBackend and type-imports
  * security's OwnerAwareSessionStore, so importing it from security.ts formed the repo's only true type cycle
- * (security ↔ session-sync; lens2 §B/§E). This file imports NOTHING from the repo (core types only) — a leaf,
- * same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
+ * (security ↔ session-sync; lens2 §B/§E). This file imports nothing from the repo but TYPES from leaves (core types, and
+ * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
  * keep working unchanged.
  */
 import type { SessionTreeEntry } from "@sema-agent/core";
+import type { SessionFace } from "./session-incarnation.js";
 /**
  * P1d-β (PUSH streaming, sema-internal server/docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
  * handle. The whole-bundle `importSession` (session-sync.ts) buffers every entry in one JSON body (server memory ∝ session size);
@@ -39,11 +40,17 @@ export interface StagingHandle {
     appendBatch(entries: SessionTreeEntry[]): Promise<void>;
     /** ATOMICALLY swap the staged rows into the real session id (ONE txn): in-txn re-classify (TOCTOU close) → purge dst
      *  → row-key rename staging→real → session_meta LAST (the commit point). `owner` is re-stamped (§9). Throws
-     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation. */
+     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation **and the settled session
+     *  face** — the occupant (owner + incarnation) the commit left in the real session id, read INSIDE the same txn (the local
+     *  store: the same hold of the session's write lock), never re-read afterwards. The post-commit replays conditioned on the
+     *  occupant (the session row's two bits) write on exactly this face — a session deleted and re-created after the commit,
+     *  even by the same owner, is a different occupant and is not written. A row without an incarnation is refused at that read
+     *  (`sessionFaceFromRow`, the same law as every face read). */
     commit(owner: string | null, opts?: {
         resolution?: "overwrite-dst";
     }): Promise<{
         relation: SyncRelation["relation"];
+        face: SessionFace;
     }>;
     /** Drop the staging rows (Phase B aborted before commit) — DELETE the staging-id session_event rows. Idempotent. */
     abort(): Promise<void>;

package/dist/session-titler.d.ts

@@ -1,8 +1,10 @@
 /**
  * Auto-generated session titles.
  *
- * SHAPE: fire-and-forget at a task submit whose session has NO title (the objective is known then — no need to wait
- * for the run to finish, and the web Recents gets the title sooner). Fills a NULL title only (`setTitleIfNull`,
+ * SHAPE: fire-and-forget once the ENGINE ACCEPTS a submitted run whose session has NO title — the one caller is the
+ * submission's acceptance seat (`run-acceptance.ts`: the objective entered the conversation, or a result-only verify /
+ * cascade leg came back having done work). A run the engine refuses before acceptance never reaches the titler (no
+ * model call for a refused input). No need to wait for the run to finish, and the web Recents gets the title sooner. Fills a NULL title only (`setTitleIfNull`,
  * store-side `WHERE title IS NULL`) — the user writes the SAME column unconditionally (`PATCH /v1/sessions/:id` →
  * `patchSessionMeta`): a user-set title is never overwritten (the probe below reads "titled" and skips the model
  * call), and a title the user cleared (`title: null` ⇒ NULL) is filled again at the next submit (law: `session-row.ts`).
@@ -25,7 +27,7 @@ export interface SessionTitlerDeps {
     setTitleIfNull(sessionId: string, title: string): Promise<boolean>;
     /** Cheap pre-LLM probe: "titled" = skip (a restart/evicted-seen/another replica
      *  already paid — don't re-spend an LLM call); "untitled" = generate; "none" = the session_meta row hasn't
-     *  been REGISTERED yet (createRun fires before the Runner's session acquire) — retry after a grace window,
+     *  been REGISTERED (or was deleted meanwhile) — retry after a grace window,
      *  and if still absent, release the seen slot so the NEXT submit retries (never a permanently-untitled
      *  session via a swallowed early UPDATE-0). Local lane has no row-existence dimension → never "none". */
     probeTitle(sessionId: string): Promise<"none" | "untitled" | "titled">;