@sema-agent/server 7.126.0 → 7.127.1

package/dist/boot/execution-env.js

@@ -10,7 +10,7 @@ import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { createSpaceReclaimer, k8sExecutionEnvFactory } from "../plugins/remote-env-k8s.js";
+import { checkSandboxEgressPolicy, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory } from "../plugins/remote-env-k8s.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
 import { createSpaceCommitFence } from "../workspace-space-commit.js";
 import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-docker.js";
@@ -24,8 +24,9 @@ import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-sourc
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
+import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { isSandboxPathAdjudicationLane, sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneIsolated } from "../execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneHomeDir, executionLaneOf, isSingleMachineDefaultLane, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -224,6 +225,7 @@ export function createExecutionEnv(ctx) {
             dataTimeoutMs: workspaceSnapshotTimeoutOf(config.remoteExec),
             ...(config.remoteExec.memory ? { memory: config.remoteExec.memory } : {}),
             ...(config.remoteExec.cpu ? { cpu: config.remoteExec.cpu } : {}),
+            ...(config.remoteExec.sandboxIpv6 !== undefined ? { ipv6: config.remoteExec.sandboxIpv6 } : {}),
             ...(config.remoteExec.s3Snapshot ? { s3Snapshot: { ...config.remoteExec.s3Snapshot, ...((f) => (f.available ? { space: { persist: f.policy.persist, keep: f.policy.keep } } : {}))(facts.workspaceSpace(config)) } } : {}),
             ...((f) => (f.available ? { cache: f.cache } : {}))(facts.workspaceCache(config)),
             ...(config.remoteExec.workspaceSnapshotExclude ? { snapshotExclude: config.remoteExec.workspaceSnapshotExclude } : {}),
@@ -233,6 +235,9 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = createK8sRunEnvFactory(k8sCfg, { imageOf: (sid) => perTaskImage.get(sid), incarnationOf: ctx.incarnationOf, spaceCommits: ctx.spaceCommits ?? (() => undefined) });
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
+        void checkSandboxEgressPolicy(k8sCfg)
+            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT))
+            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
     else if (config.remoteExec?.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
@@ -402,7 +407,15 @@ export function createExecutionEnv(ctx) {
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
     const lspProvider = config.remoteExec?.provider;
-    const lspManager = (lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled
+    const lspLane = executionLaneOf(lspProvider);
+    const lspLaneBindsReads = lspLane !== undefined && laneBindsReads(lspLane);
+    if ((lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && !lspLaneBindsReads) {
+        logger.warn("lsp_not_mounted", {
+            provider: lspProvider,
+            reason: "LSP_ENABLED is set, but this lane's execution environment cannot bind a read to the file that was checked (openBound), so every language-server file sync would be refused; the LSP tool is not mounted on this lane in this version",
+        });
+    }
+    const lspManager = (lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && lspLaneBindsReads
         ? createE2bLspManager({
             log: (event, fields) => logger.info(event, fields),
             scheme: lspProvider === "k8s" ? "ws" : "wss",
@@ -410,7 +423,7 @@ export function createExecutionEnv(ctx) {
             metrics,
         })
         :
-            lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true
+            lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true && lspLaneBindsReads
                 ? createHostLspManager(config, (event, fields) => logger.info(event, fields))
                 : undefined;
     if (lspManager)

package/dist/boot/leader.d.ts

@@ -12,6 +12,7 @@ import type { buildPricing } from "../budget.js";
 import { createLeaderEndpoint } from "../leader/endpoint.js";
 import type { Logger } from "../observability/logger.js";
 import type { CheckpointStoreFull, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { createSessionStore } from "../plugins/session-store.js";
 import type { RunnerDeps } from "@sema-agent/core";
 export interface LeaderCtx {
     config: ServiceConfig;
@@ -20,7 +21,7 @@ export interface LeaderCtx {
     pricing: ReturnType<typeof buildPricing>;
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     toolResultStore: ToolResultStoreFull | undefined;
-    sessionStore: ReturnType<StoreBackend["session"]>;
+    sessionStore: ReturnType<typeof createSessionStore>;
     checkpointStore: CheckpointStoreFull | undefined;
     /** [ref] 件B/C/D([ref],codex R2-F1):部署治理三座席 —— leader 车道的每一只 Runner 都要带上它,
      *  否则开了 leader 端点的部署就有一条在部署治理**之外**的执行面(合规否决/锁都够不着)。 */

package/dist/boot/memory-consolidation.d.ts

@@ -1,6 +1,11 @@
 import type { RestartSliceCtx } from "../web-admin-client/restart-signal.js";
 import type { MemoryConsolidationDriverConfig, ServiceConfig } from "../config-types.js";
-import { type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type RunMemoryConsolidationOptions, type SessionCaptureRecordStore } from "@sema-agent/core";
+import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type SessionCaptureRecordStore } from "@sema-agent/core";
+/**
+ * 座解析的 options 形 = core 解析器交回的那只(core 7.50.0 起它**不含** `writeJudge`:判官不是模型席的一部分,由调用方在动词上带)。
+ * 取解析器的返回型而不是自己写 `Omit<…>`:形的属主是 core 的解析器,本仓不持第二份。
+ */
+type ConsolidationSeatOptions = ReturnType<typeof resolveMemoryConsolidationDriver>;
 /** D3 投影的座标签闭集。`role:<name>` 里的 name 只可能是 core 的 role 链两跳之一。 */
 export type ConsolidationSeatLabel = "explicit" | "role:consolidate" | "role:summarize";
 /** {@link buildConsolidationValveAudit} 的告警名闭集(事件名进日志 ⇒ 运维可按名过滤/告警)。 */
@@ -48,8 +53,8 @@ export type ConsolidationSeatBilling = {
 };
 /** 座解析的产物:core 的 options 原样 + 给投影用的两位自证。 */
 export interface ConsolidationDriverSeat {
-    /** `runMemoryConsolidationDriver` 的第三参,core 的 `resolveMemoryConsolidationDriver` 原样产出。 */
-    readonly options: RunMemoryConsolidationOptions;
+    /** `runMemoryConsolidationDriver` 第三参的**模型席那一半**,core 的 `resolveMemoryConsolidationDriver` 原样产出(写判官另由操作面的座给)。 */
+    readonly options: ConsolidationSeatOptions;
     /** D3 的 `seat` 位。 */
     readonly seat: ConsolidationSeatLabel;
     /** 真正会被记进 run 行与 mint 归档的模型 id(= `options.model`,单独拎出来是投影面的便利)。 */
@@ -390,6 +395,27 @@ export declare function assertAutoConsolidationWirable(input: {
     /** 铸好的 `RunnerDeps` 上**真的**有整理席吗(`deps.memoryConsolidation !== undefined`)。 */
     memoryConsolidationWired: boolean;
 }): void;
+/**
+ * 运维阀门腿的写判官座(core 7.50.0 起驱动动词必带)。
+ *
+ * ## 判官只有一只,这条腿拿不到它
+ *
+ * 「这条路径能不能写」在引擎里只有**一只**判官(合成写判官:技能拒行 / 收窄折叠 / 调用方与继承策略 / 人的持久规则车道 /
+ * 组织车道,一条走法一个优先序);引擎的自动整理腿把**腿自己的**那只交给驱动。本腿(运维手动阀门)没有腿:没有名册上的
+ * `Write` 脸、没有引擎盖的豁免根与工作目录、没有持久规则车道 —— 而引擎包今天不导出那只判官的构造器。在本仓手搭一只
+ * 「对部署策略问一次合成 `Write`」的判官 = 把引擎判官的层走法、脸、豁免根、已中止信号的约定与判词读法**再写一份**
+ * (第二个读者,与引擎那只迟早分歧,而且分歧是静默的)。所以本腿不造第二只。
+ *
+ * ## 于是它是一只**响亮的放行座**,登记为保护型欠账
+ *
+ * 答 `no_objection` —— 与 v7.49.x 本腿的行为逐字同(那时驱动根本不问),不回退任何现网能力;每被问一次记一次
+ * `server.memory-consolidation.operator-valve-unjudged`(P-DEBT:计数 + 探针行 + 一次性告警),债在遥测里显形。
+ * 自动整理腿不受影响:它走引擎腿自己的判官,人的持久规则与部署策略照判。
+ * 退役条件:引擎导出宿主可用的写判官构造器(收部署策略 + 一只规则店主体)那一版,本函数换成它、本 tag 删。
+ * scope 与人:本仓的文件后端不按请求主体铸 scope(单用户形是部署声明的全局层 `MEMORY_SCOPE` 与按任务根派生的项目层),
+ * 所以从 scope 读不出「这是谁的库」;匿名 run 读不读本地属主那只规则桶另候裁定 —— 两件都不在本座里猜。
+ */
+export declare function createOperatorValveWriteJudge(): ConsolidationWriteJudge;
 /** 两个 admin 口消费的窄能力面(`ServiceDeps.memoryConsolidation` 的实参来源)。 */
 export interface MemoryConsolidationFaces {
     /** D3 的座位自证(投影用;boot 期解析一次,restart-to-apply)。 */
@@ -446,5 +472,13 @@ export declare function createMemoryConsolidationFaces(store: {
      *  机器钉 capture-optout-lane ②)。S-215 起 local 车道在引擎接线时也供(core 文件三腿,同一只控制面);
      *  缺席 ⇒ 记忆面暗(引擎未接线),与 Runner 同本。 */
     captureRecordStore?: SessionCaptureRecordStore;
+    /** core 7.50.0:整理跑的**写判官座**(必填 —— 缺席不是「没有规则」,core 也拒)。操作面不判任何东西,只把它原样递给驱动动词:
+     *  早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
+    writeJudge: ConsolidationWriteJudge;
+    /** 引擎通告的**运维行**座(与 Runner 的 `onNotice` 同一只转发器)。缺席 ⇒ 通告只在回执上。判官拒的两种时机都经它走一次:
+     *  应用时拒 = 引擎在驱动里铸的 `memory.consolidation_incomplete`;早问拒 = 驱动抛出的拒绝经引擎导出的构造器转成的
+     *  `memory.consolidation_refused`(本仓不读通告名、不自铸通告形)。 */
+    onNotice?: (notice: EngineNotice) => void;
 }): MemoryConsolidationFaces;
+export {};
 //# sourceMappingURL=memory-consolidation.d.ts.map

package/dist/boot/memory-consolidation.js

@@ -1,8 +1,9 @@
 import { redactSecrets } from "../trace/redact.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 import { memoryMountRootOf } from "../memory-scope.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
 import { backendOwnsControlPlane } from "../memory-operator-faces.js";
-import { expandTiers, MemoryEngine, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError, expandTiers, MemoryEngine, memoryConsolidationRefusedNotice, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -316,6 +317,12 @@ export function assertAutoConsolidationWirable(input) {
         `unset, or set MEMORY_AUTO_CONSOLIDATION=off (unsetting it is NOT the same: the engine's named default is ON as of ` +
         `core 7.21.1).`);
 }
+export function createOperatorValveWriteJudge() {
+    return () => {
+        recordFailOpen("server.memory-consolidation.operator-valve-unjudged");
+        return { verdict: "no_objection" };
+    };
+}
 export function createMemoryConsolidationFaces(store, input) {
     const engine = new MemoryEngine({
         backend: store.backend,
@@ -331,7 +338,16 @@ export function createMemoryConsolidationFaces(store, input) {
         model: input.seat.model,
         scopes: input.scopes,
         run: (scope) => flight(scope, async () => {
-            const receipt = await runMemoryConsolidationDriver(engine, scope, input.seat.options);
+            const receipt = await runMemoryConsolidationDriver(engine, scope, {
+                ...input.seat.options,
+                writeJudge: input.writeJudge,
+                ...(input.onNotice !== undefined ? { onNotice: input.onNotice } : {}),
+            }).catch((err) => {
+                if (input.onNotice !== undefined && err instanceof ConsolidationRefusedError && err.code === CONSOLIDATION_WRITE_REFUSED_CODE) {
+                    input.onNotice(memoryConsolidationRefusedNotice({ code: err.code, scope, reason: err.message, ...(err.occurrenceId !== undefined ? { occurrenceId: err.occurrenceId } : {}) }));
+                }
+                throw err;
+            });
             if (receipt.stopDetail !== undefined) {
                 input.onStopDetail?.(buildStopDetailAudit({ scope, runId: receipt.runId, outcome: receipt.outcome, stopDetail: receipt.stopDetail }));
             }

package/dist/boot/runner-deps.d.ts

@@ -23,6 +23,7 @@ import { type WorkflowCompletionInbox } from "../orchestration/workflow-completi
 import { type EngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
 import type { ServiceWorkflowJournalStore, SessionCaptureRecordSource, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { createSessionStore } from "../plugins/session-store.js";
 import type { QuestionCoordinator } from "../question.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { MemoryBackend } from "@sema-agent/core";
@@ -102,7 +103,7 @@ export interface RunnerDepsCtx {
     elicitation: ElicitationCoordinator | undefined;
     question: QuestionCoordinator | undefined;
     toolApproval: ToolApprovalCoordinator | undefined;
-    sessionStore: ReturnType<StoreBackend["session"]>;
+    sessionStore: ReturnType<typeof createSessionStore>;
     /**
      * B-060(test [ref] 核心发现①)—— **一条部署腿上的每一只 Runner 看同一只检查点店**。
      *

package/dist/boot/session-faces.d.ts

@@ -17,6 +17,7 @@ import type { Metrics } from "../observability/metrics.js";
 import type { WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
 import { PlanCacheProbe } from "../plan-cache-probe.js";
 import type { CheckpointStoreFull, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { createSessionStore } from "../plugins/session-store.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { OwnerAwareSessionStore } from "../security.js";
@@ -33,7 +34,7 @@ export interface SessionFacesCtx {
     metrics: Metrics;
     localRoot: string;
     backend: StoreBackend | undefined;
-    sessionStore: ReturnType<StoreBackend["session"]>;
+    sessionStore: ReturnType<typeof createSessionStore>;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
     toolResultStore: ToolResultStoreFull | undefined;

package/dist/boot/stage-06-runners.js

@@ -9,13 +9,14 @@ import { hasServiceAuth } from "../http/server.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
-import { buildConsolidationValveAudit, createMemoryConsolidationFaces, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
+import { buildConsolidationValveAudit, createMemoryConsolidationFaces, createOperatorValveWriteJudge, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
 import { createParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
-import { createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
+import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
+import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
 import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-authorizer.js";
@@ -75,6 +76,8 @@ export function runStage06(ctx) {
             onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
             ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
+            writeJudge: createOperatorValveWriteJudge(),
+            onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
         })
         : undefined;
     for (const w of buildConsolidationValveAudit({

package/dist/config-catalog.js

@@ -2,6 +2,7 @@ import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } fr
 import { GLOBAL_SCOPE } from "@sema-agent/settings-schema/api/scopes";
 import { WEB_ADMIN_ENV, DOMAIN_SCHEMAS, buildRetiredEnvWire } from "@sema-agent/settings-schema";
 import { CENTER_CREDENTIAL_RENEW_LEAD_DEFAULT_MS, CENTER_CREDENTIAL_RENEW_LEAD_MAX_MS, CENTER_CREDENTIAL_RENEW_LEAD_MIN_MS } from "./center-credential-renewer.js";
+import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS } from "./workspace-cache.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "./workspace-space.js";
 import { THINKING_FORMATS } from "./model-compat.js";
@@ -196,6 +197,7 @@ export const CONFIG_CATALOG = [
     r("K8S_RUNTIME_CLASS", "orchestration", "string", "沙箱 pod runtimeClass(Kata 等)"),
     r("K8S_SANDBOX_ENV", "orchestration", "secret", "转发进 k8s 沙箱 pod 容器 env 的本进程 env 点名表(NAME,NAME;点到的键从 worker env 原样取,值只进 pod env —— 不进 spec 的其它位置 / 工作区 / 快照 / center / 事件日志;与 LSP_ENV_ALLOW / E2B_SANDBOX_ENV / DOCKER_SANDBOX_ENV 同一只解析器与「点名放行」谓词:形错 / 点名名单型旋钮拒启且不回显值;本进程环境里没有的名按序号 warn、不转发;与包源派生 env 撞名时显式名单胜;只在本车道被选中时求值;原文按凭据类对待:只回在场位、不进任何子进程)", { danger: SEC }),
     r("K8S_SANDBOX_IMAGE", "orchestration", "string", "k8s 车道沙箱镜像(REMOTE_EXEC=k8s 必需件)"),
+    r("K8S_SANDBOX_IPV6", "orchestration", "enum", "k8s 沙箱 pod 的 IPv6:disabled = pod 级 sysctl 关 IPv6(net.ipv6.conf.all / default.disable_ipv6=1;两只都不在 k8s 的 safe sysctl 表里 ⇒ 每个节点 kubelet 要 --allowed-unsafe-sysctls 点名,否则 pod 起不来;沙箱 ns 不能 enforce PodSecurity baseline / restricted);enabled = 不动 pod(pod 保留平台给的 IPv6,只执行 IPv4 的出网策略管不到它,起服自检每次一行 sandbox_egress_policy_gap{kind: ipv6_enabled});词表外拒启", { enumValues: SANDBOX_IPV6_WORDS, staticDefault: SANDBOX_IPV6_DEFAULT, danger: SEC }),
     r("K8S_TIMEOUT_MS", "orchestration", "number", "k8s 沙箱 pod 寿命(activeDeadlineSeconds,ms;整只 pod 的泄漏护栏,后台任务超时也被它钳;各条命令的超时见工具超时)"),
     r("K8S_TOKEN", "orchestration", "secret", "k8s API token(缺席走 in-cluster SA)", { danger: SEC }),
     r("KUBERNETES_SERVICE_HOST", "orchestration", "string", "平台注入的 in-cluster k8s API host(K8S_API_URL 缺席时用)"),
@@ -218,7 +220,7 @@ export const CONFIG_CATALOG = [
     r("LOCAL_DATA_ROOT", "store", "path", "file 店数据根的最高优先覆写(设了则与配置根分家,boot 出声)", { danger: DATA }),
     r("LOCKED_CONFIG_KEYS", "auth", "csv", "管理员锁定层声明(词表=core 闭集注册表,未知键拒启)", { danger: SEC, configKey: "lockedConfigKeys" }),
     r("LOG_LEVEL", "observability", "string", "日志档位", { staticDefault: "info", configKey: "logLevel" }),
-    r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in(需烤好的 LSP 模板;host 腿另有 LSP_HOST_ENABLED)", { staticDefault: "false", configKey: "lspEnabled" }),
+    r("LSP_ENABLED", "orchestration", "boolean", "LSP 沙箱腿 opt-in —— 本版 e2b / k8s 执行环境不实现绑定读,开了也不挂(起服一行 lsp_not_mounted);host 腿另有 LSP_HOST_ENABLED", { staticDefault: "false", configKey: "lspEnabled" }),
     r("LSP_ENV_ALLOW", "orchestration", "secret", `host 腿语言服务器子进程 env 的点名放行名单(点到的键从服务 env 原样放回、部署方显式承担;没点到的照剥;与 host shell inheritEnv:[names] 同一只谓词;形错 / 点名任一只名单型旋钮(含自己)拒启且不回显值;本进程环境里没有的名按序号 warn、不放行、不回显;多租户姿态(忽略时起服 warn 一次):${describeAllowlistPostures()};原文按凭据类对待:只回在场位、不进任何子进程,生效名单见起服披露行 allowed)`, { danger: SEC, derivedDefaultNote: "缺席 / 空串 ⇒ 空名单 = 全剥(7.100.0 行为)" }),
     r("LSP_HOST_ENABLED", "orchestration", "boolean", "LSP host 腿开关(本机 language server,优雅降级)", { staticDefault: "true", configKey: "lspHostEnabled" }),
     r("MANUAL_MODE_SHELL_GATE", "approval", "enum", "手动模式 shell 门收紧腿(off=no-op 非放松 —— 本键只有收紧半场;拼错拒启;S-877 起 classify 退役 = 拒启指路)", { danger: SEC, enumValues: ["always", "off"], echoWords: ["always"], resolve: (c) => c.manualModeShellGate ?? null, derivedDefaultNote: "off/未设 ⇒ 本键不贡献任何东西(归一成键缺席)⇒ 回显 null;真姿态只有 always 一个(core 7.34.0 起形状档在每一种模式下都装,classify 不再是运维选的档)" }),

package/dist/config-types.d.ts

@@ -631,7 +631,8 @@ export interface ServiceConfigFlat {
      * engine DB_BACKEND picks), a historical label kept to avoid churning every comparison site.
      */
     sessionBackend: "memory" | "tidb" | "auto";
-    /** Warm-cache idle TTL (seconds) for woken TiDB sessions; 0 disables. Requires session affinity. */
+    /** Warm-cache idle TTL (seconds) for woken durable sessions; 0 disables. Correct under any routing: a hit is served only
+     *  while the store's head still names the cached leaf (`plugins/caching-session-store.ts`). */
     sessionCacheTtlSec: number;
     /** B1 /health 活体 store 探测:后台缓存探针间隔 ms(STORE_PROBE_INTERVAL_MS;0=显式关,负/非数 boot
      *  响亮拒)。只对 SQL 后端接线;探针原语=backend.dbNowMs()(S10 时钟探针的真 DB 往返,零新 SQL 面)。 */
@@ -899,6 +900,9 @@ export interface ServiceConfigFlat {
         /** Resource-profile knobs: sandbox pod limits (adapter defaults: 2Gi / 1 cpu). */
         memory?: string;
         cpu?: string;
+        /** `K8S_SANDBOX_IPV6`(闭集与缺省的属主 `sandbox-egress-policy.ts`):`disabled` ⇒ 沙箱 pod 级 sysctl 关 IPv6;`enabled` ⇒ pod spec 不带 sysctl。
+         *  loader 恒铸;可选只为手搓配置。 */
+        sandboxIpv6?: import("./sandbox-egress-policy.js").SandboxIpv6;
         /** `K8S_SANDBOX_ENV=NAME,NAME` 点到、且本进程环境里真有的键 ⇒ 原值(与 e2b 的 `sandboxEnv` 同名同形、同一只解析器、同一只谓词 `allowlistedEnv`,
          *  空串值照带)。只进 pod 容器 env;装配点与包源派生 env 合并一处,显式名单胜。键缺席 = 旋钮未设 / 空串(零转发)。 */
         sandboxEnv?: Record<string, string>;

package/dist/config.js

@@ -27,6 +27,7 @@ import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdent
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
+import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
 import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap } from "./workspace-cache.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
@@ -1856,6 +1857,7 @@ function parseOrchestrationDomain(ctx) {
                         ...((n) => (n !== undefined ? { timeoutMs: n } : {}))(optNumEnvStrict("K8S_TIMEOUT_MS")),
                         ...(process.env.K8S_MEMORY ? { memory: process.env.K8S_MEMORY } : {}),
                         ...(process.env.K8S_CPU ? { cpu: process.env.K8S_CPU } : {}),
+                        sandboxIpv6: enumEnv("K8S_SANDBOX_IPV6", SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS),
                         ...((names) => (names !== undefined ? { sandboxEnv: allowlistedEnv(names, process.env) } : {}))(parseEnvNameAllowlist("K8S_SANDBOX_ENV", singleUserTurnkey)),
                         ...k8sWorkspaceStore(),
                         ...((c) => (c !== undefined ? { workspaceCache: c } : {}))(k8sWorkspaceCache()),

package/dist/execution-lane-caps.d.ts

@@ -190,6 +190,18 @@ export declare function executionLaneOf(provider: string | undefined): Execution
  *  ③ `approval.ts` 的 `buildNoResponderBootWarns` —— 写门的 ask 只在「有手写本机盘」时才会发生。
  */
 export declare function handsOnWorkerFilePlane(lane: ExecutionLane): boolean;
+/**
+ * core 7.50.0 —— 「这条车道的执行环境能不能把一次读**绑到判过的那只对象**上」(`FileSystem.openBound`:开着并持有,叶链接不跟,
+ * 开后身份对拍)。LSP 会话的读口与路径附件只经它读;环境不实现 ⇒ 那两个读口在这条车道上一律拒。
+ *
+ * **一条律**:LSP 只在本谓词为真的车道挂(`boot/execution-env.ts` 的 LSP 管理器两臂都合取它;表的 `lsp` 位与之同向,
+ * 对拍钉 `test/host-env-open-bound.test.ts`:本谓词 ⟺ 适配器类原型上有 `openBound`)。
+ *  · `host` —— `RemoteHostExecutionEnv.openBound` 委托 core `NodeExecutionEnv` 的实现(唯一属主),真;
+ *  · `in-process` —— 没有手(core 落桩环境),无物可绑;
+ *  · 其余车道(沙箱 / 远端 shell / 设备)—— 读走 exec / sftp / 设备协议,本版不实现绑定读,假。实现之日翻这一格,LSP 沙箱桥随之回来。
+ * 穷举 switch、无 default 臂:车道加词而此处不表态 = 编译红。
+ */
+export declare function laneBindsReads(lane: ExecutionLane): boolean;
 /**
  * S-281 —— 「这条车道的手在不在 OS 级隔离边界里」。**全仓唯一**的布尔判别式(读表 `isolation` 位,见该位头注的读者清单)。
  * 穷举 switch、无 default 臂:`isolation` 的型只有两档,加档 = 编译红。

package/dist/execution-lane-caps.js

@@ -46,7 +46,7 @@ export function executionLaneCaps(lane) {
                 callerCwd: NO,
                 backgroundShell: YES,
                 scheduler: NO,
-                lsp: YES,
+                lsp: NO,
                 sandboxSendUserFile: YES,
                 isolation: YES,
                 suspendable: YES,
@@ -64,7 +64,7 @@ export function executionLaneCaps(lane) {
                 callerCwd: NO,
                 backgroundShell: YES,
                 scheduler: NO,
-                lsp: YES,
+                lsp: NO,
                 sandboxSendUserFile: YES,
                 isolation: YES,
                 suspendable: YES,
@@ -202,6 +202,20 @@ export function handsOnWorkerFilePlane(lane) {
     const caps = executionLaneCaps(lane);
     return caps.hostFilePlane === "supported" && caps.coreRemoteExecutionEnv === "supported";
 }
+export function laneBindsReads(lane) {
+    switch (lane) {
+        case "host":
+            return true;
+        case "in-process":
+        case "e2b":
+        case "k8s":
+        case "ssh":
+        case "adb":
+        case "device":
+        case "local-docker":
+            return false;
+    }
+}
 export function laneIsolated(lane) {
     const isolation = executionLaneCaps(lane).isolation;
     switch (isolation) {

package/dist/fleet/subagent-tail-bus.js

@@ -1,5 +1,6 @@
 import { redactSecrets } from "../trace/redact.js";
-import { taskProgressEventData, toolStartEventData, toolEndEventData, textEndEventData } from "../trace/project.js";
+import { taskProgressEventData, taskStartedEventData, toolStartEventData, toolEndEventData, textEndEventData } from "../trace/project.js";
+import { liveMediaBytesOf, liveToolEndForBacklog } from "../trace/tool-output-media.js";
 import { createReasoningSegments } from "../trace/model-segment.js";
 const TAIL_QUEUE_CAP = 512;
 export function projectTailFrame(e) {
@@ -7,6 +8,9 @@ export function projectTailFrame(e) {
     if (t === "task_progress") {
         return { type: "task_progress", ...taskProgressEventData(e) };
     }
+    if (t === "task_started") {
+        return { type: "task_started", ...taskStartedEventData(e) };
+    }
     if (t === "tool_start") {
         const tsv = e;
         return { type: "tool_start", ...toolStartEventData(tsv) };
@@ -80,10 +84,14 @@ export class SubagentTailBus {
             if (sub.closed)
                 continue;
             if (sub.queue.length >= TAIL_QUEUE_CAP) {
-                sub.queue.shift();
+                const oldest = sub.queue.shift();
+                if (oldest !== undefined)
+                    sub.mediaBytes -= liveMediaBytesOf(oldest);
                 sub.dropped++;
             }
-            sub.queue.push(frame);
+            const queued = frame.type === "tool_end" ? liveToolEndForBacklog(frame, sub.mediaBytes) : frame;
+            sub.mediaBytes += liveMediaBytesOf(queued);
+            sub.queue.push(queued);
             sub.wake?.();
         }
     }
@@ -91,7 +99,7 @@ export class SubagentTailBus {
         return (this.subs.get(bgAgentId)?.size ?? 0) > 0;
     }
     subscribe(bgAgentId) {
-        const sub = { queue: [], dropped: 0, closed: false };
+        const sub = { queue: [], dropped: 0, mediaBytes: 0, closed: false };
         let set = this.subs.get(bgAgentId);
         if (!set) {
             set = new Set();
@@ -121,8 +129,10 @@ export class SubagentTailBus {
                         return { value: { type: "lagged", dropped }, done: false };
                     }
                     const head = sub.queue.shift();
-                    if (head !== undefined)
+                    if (head !== undefined) {
+                        sub.mediaBytes -= liveMediaBytesOf(head);
                         return { value: head, done: false };
+                    }
                     if (sub.closed)
                         return { value: undefined, done: true };
                     await new Promise((resolve) => {

package/dist/http/admission.js

@@ -14,6 +14,7 @@ import { MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
 import { resolveDevicePlacementIntent } from "./device-placement.js";
+import { createRunAcceptance } from "../run-acceptance.js";
 import { sendError, httpErrorCode } from "./send.js";
 import { ABSOLUTE_HOST_PATH_MAX, isAbsoluteHostPath, WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 const APPROVAL_REACH_WORDS = APPROVAL_REACH.map((word) => JSON.stringify(word)).join(" / ");
@@ -62,6 +63,7 @@ function refuseUnavailableModel(res, config, field, ref) {
     sendError(res, 400, "request.model_unavailable", message);
     return true;
 }
+const modelIdOf = (model) => (typeof model === "string" ? model : model?.id);
 export function createAdmission(ctx) {
     const { deps, readJson, runnerFor } = ctx;
     async function prepareSpec(req, res, bodyIn, onTypedFailure, legFacts) {
@@ -640,7 +642,9 @@ export function createAdmission(ctx) {
                 store: deps.deviceStore,
                 enrollment: deps.deviceEnrollment,
             });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            const model = modelIdOf(spec.model);
+            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), objective: spec.objective, ...(model !== undefined ? { model } : {}) });
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, acceptance, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/durable-run-leg.js

@@ -20,8 +20,6 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         clearTurnActivity(taskId);
     if (created.ok)
         recordResourceWindow(taskId, args.prepared.spec.resourceSuspend);
-    if (created.ok)
-        deps.sessionTitler?.maybeTitle(sessionId, args.prepared.spec.objective, typeof args.prepared.spec.model === "string" ? args.prepared.spec.model : args.prepared.spec.model?.id);
     if (created.existing)
         return { existing: created.existing };
     if (!created.ok) {
@@ -65,7 +63,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger);
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger, args.prepared.acceptance);
     return { status: 202, body: { taskId, sessionId, status: "running" } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/resume-legs.js

@@ -6,7 +6,7 @@ const sessionFaceUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no sessionFaceOf read (every built-in store has one) — refusing rather than resuming unverified`);
 };
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
-import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../run-cancel-context.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
@@ -22,10 +22,10 @@ import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
-import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
+import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
 import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
 import { errorText } from "../observability/err-text.js";
@@ -48,6 +48,7 @@ import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
 import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
+import { createRunAcceptance } from "../run-acceptance.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
     return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
@@ -769,10 +770,16 @@ export function createResumeLegs(ctx) {
                             if (!rs || !taskId)
                                 return;
                             const t = e.type;
-                            const warnAppend = (kind) => (err) => deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
+                            const warnAppend = (kind) => (err) => {
+                                createForwardAppendFailedNote(kind)(err);
+                                deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
+                            };
                             if (t === "task_progress") {
                                 void append("task_progress", taskProgressEventData(e)).catch(warnAppend(t));
                             }
+                            else if (t === "task_started") {
+                                void append("task_started", taskStartedEventData(e)).catch(warnAppend(t));
+                            }
                             else if (t === "tool_start") {
                                 void append("tool_start", toolStartEventData(e)).catch(warnAppend(t));
                             }
@@ -901,6 +908,9 @@ export function createResumeLegs(ctx) {
                             case "message_committed":
                                 await anchor.onMessageCommitted(ev.role, ev.entryId);
                                 break;
+                            case "task_started":
+                                await append("task_started", taskStartedEventData(ev));
+                                break;
                             case "task_progress":
                                 await append("task_progress", taskProgressEventData(ev));
                                 break;
@@ -1085,7 +1095,6 @@ export function createResumeLegs(ctx) {
                 clearInterval(resumeHeartbeat);
             resumeLegLive = false;
         }
-        evictIfConflict(deps.runner, sessionId, result);
         const checkpointReopened = reopenConfirmedPark;
         const sealed = sealResultForExit(result);
         const resumePlane = outwardPlane(sealed.terminal);
@@ -1214,7 +1223,7 @@ export function createResumeLegs(ctx) {
         const { spec, engineNotices } = resolved;
         const hostSpec = { ...spec, objective, sessionId };
         const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), ...(engineNotices.length > 0 ? { engineNotices } : {}) },
             fleetScope: resumeFleetScope(req, auth),
             elicitOwner: principal ?? null,
             source: "workflow_parked_decide",

package/dist/http/route-ctx.d.ts

@@ -140,6 +140,12 @@ export interface PreparedTaskSubmission {
      * 成功点**必须**把它交给 `commitPlacement`(唯一写入属主;类级机器门钉住每个调用点都接了)。
      */
     bindingIntent?: import("./device-placement.js").DevicePlacementIntent;
+    /**
+     * 这次提交的**受理座**(`run-acceptance.ts`):标题器只在引擎受理之后起。提交门(`prepareSpec`)随 spec 一起铸;
+     * 三条提交腿只喂它(持流的形逐帧 `observe`,终局落行之后 `settle` 一次),不再各自判「什么时候起标题」。
+     * 不经提交门的内部车道(`/decide` 的宿主新 turn)铸一只不带标题器的座:不起标题。
+     */
+    acceptance: import("../run-acceptance.js").RunAcceptance;
 }
 /**
  * 一条会话的**续跑重建输入**(`checkpoint_ctx` 的行体)—— 提交腿写一次,续跑腿读它重建 spec。
@@ -384,7 +390,7 @@ export interface RouteLegs {
         liveStream?: boolean;
     }): Promise<PreparedTaskSubmission | null>;
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
-    finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
+    finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
      *  `hostDecision` = **这次结算的事实**(谁结束了这次等待 + 通道自报的归属),必填:本腿有两个调用方
      *  (HTTP `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把