@sema-agent/server 7.135.0 → 7.137.0

package/dist/plugins/k8s-exec-protocol.js

@@ -1,35 +1,125 @@
-export function applyPodSpecPatch(pod, patch) {
-    assertHardeningOnly(patch.podSecurityContext, "podSecurityContext");
-    if (patch.podSecurityContext !== undefined && "sysctls" in patch.podSecurityContext) {
-        throw new Error("podSpecPatch.podSecurityContext rejected — `sysctls` is not a patch key (the pod's sysctls are minted only by the lane's IPv6 posture, K8S_SANDBOX_IPV6)");
+import { BROKER_VOLUME_NAME } from "../broker/constants.js";
+export const SANDBOX_POD_LABELS = { app: "sema-sandbox", "managed-by": "sema-server" };
+export const SANDBOX_RUN_LABEL = "sema.io/run";
+export const SANDBOX_RUN_END_HOLD_ANNOTATION = "sema.io/run-end-hold-ms";
+export const SANDBOX_SECRET_SEAT_VERBS = { env: ["create"], lease: ["create", "patch"] };
+const IDENTITY_LABEL_KEYS = new Set([...Object.keys(SANDBOX_POD_LABELS), SANDBOX_RUN_LABEL]);
+const LABEL_VALUE = /^(?:[A-Za-z0-9](?:[-A-Za-z0-9_.]{0,61}[A-Za-z0-9])?)?$/;
+export function isLabelValue(v) {
+    return LABEL_VALUE.test(v);
+}
+export const ADAPTER_VOLUME_NAMES = { cache: "ws-cache", brokerLease: BROKER_VOLUME_NAME };
+const RESERVED_VOLUME_NAMES = new Set(Object.values(ADAPTER_VOLUME_NAMES));
+const agentContainerOf = (pod) => pod.spec.containers?.[0];
+const POD_SPEC_PATCH_FIELDS = {
+    volumes: {
+        judge: (volumes) => {
+            assertVolumesPodLocal(volumes, "volumes");
+            for (const v of volumes)
+                assertPatchVolumeName(v?.name, "volumes");
+        },
+        apply: (pod, volumes) => {
+            if (volumes.length > 0)
+                pod.spec.volumes = [...(pod.spec.volumes ?? []), ...volumes];
+        },
+        withBroker: "allowed",
+    },
+    volumeMounts: {
+        judge: (mounts) => {
+            for (const m of mounts)
+                assertPatchVolumeName(m?.name, "volumeMounts");
+        },
+        apply: (pod, mounts) => {
+            const container = agentContainerOf(pod);
+            if (container && mounts.length > 0)
+                container.volumeMounts = [...(container.volumeMounts ?? []), ...mounts];
+        },
+        withBroker: "allowed",
+    },
+    podSecurityContext: {
+        judge: (sc) => {
+            assertHardeningOnly(sc, "podSecurityContext");
+            if ("sysctls" in sc) {
+                throw new Error("podSpecPatch.podSecurityContext rejected — `sysctls` is not a patch key (the pod's sysctls are minted only by the lane's IPv6 posture, K8S_SANDBOX_IPV6)");
+            }
+        },
+        apply: (pod, sc) => {
+            pod.spec.securityContext = { ...(pod.spec.securityContext ?? {}), ...sc };
+        },
+        withBroker: {
+            refused: "podSpecPatch.podSecurityContext is not allowed on a pod that carries the member-credential broker — every pod-level key would reach the broker container too; put the hardening into containerSecurityContext (it lands on the agent container only)",
+        },
+    },
+    containerSecurityContext: {
+        judge: (sc) => assertHardeningOnly(sc, "containerSecurityContext"),
+        apply: (pod, sc) => {
+            const container = agentContainerOf(pod);
+            if (container)
+                container.securityContext = { ...(container.securityContext ?? {}), ...sc };
+        },
+        withBroker: "allowed",
+    },
+    labels: {
+        judge: () => { },
+        apply: (pod, labels) => {
+            const merged = { ...pod.metadata.labels };
+            for (const [k, v] of Object.entries(labels))
+                if (!IDENTITY_LABEL_KEYS.has(k))
+                    merged[k] = v;
+            pod.metadata.labels = merged;
+        },
+        withBroker: "allowed",
+    },
+};
+const PATCH_FIELD_ORDER = Object.keys(POD_SPEC_PATCH_FIELDS);
+export function applyPodSpecPatch(pod, patch, presence = { broker: false }) {
+    const present = judgePodSpecPatch(patch, presence);
+    for (const k of present)
+        applyField(k, pod, patch);
+}
+export function podSpecPatchBrokerRefusal(patch) {
+    if (patch === undefined)
+        return undefined;
+    try {
+        judgePodSpecPatch(patch, { broker: true });
+        return undefined;
+    }
+    catch (e) {
+        return e instanceof Error ? e.message : String(e);
     }
-    assertHardeningOnly(patch.containerSecurityContext, "containerSecurityContext");
-    if (patch.labels) {
-        const identity = {};
-        for (const k of ["app", "managed-by"]) {
-            const v = pod.metadata.labels?.[k];
-            if (v !== undefined)
-                identity[k] = v;
+}
+function judgePodSpecPatch(patch, presence) {
+    for (const key of Object.keys(patch)) {
+        if (!Object.hasOwn(POD_SPEC_PATCH_FIELDS, key)) {
+            throw new Error(`podSpecPatch rejected — ${JSON.stringify(key)} is not a patch field (the patch fields are ${PATCH_FIELD_ORDER.join(" / ")}; any other key is refused, never ignored)`);
         }
-        pod.metadata.labels = { ...pod.metadata.labels, ...patch.labels, ...identity };
     }
-    const spec = pod.spec;
-    assertVolumesPodLocal(patch.volumes, "volumes");
-    if (patch.volumes?.length)
-        spec.volumes = [...(spec.volumes ?? []), ...patch.volumes];
-    if (patch.podSecurityContext)
-        spec.securityContext = { ...(spec.securityContext ?? {}), ...patch.podSecurityContext };
-    const container = spec.containers?.[0];
-    if (container) {
-        if (patch.volumeMounts?.length)
-            container.volumeMounts = [...(container.volumeMounts ?? []), ...patch.volumeMounts];
-        if (patch.containerSecurityContext)
-            container.securityContext = { ...(container.securityContext ?? {}), ...patch.containerSecurityContext };
+    const present = PATCH_FIELD_ORDER.filter((k) => patch[k] !== undefined);
+    if (presence.broker) {
+        for (const k of present) {
+            const column = POD_SPEC_PATCH_FIELDS[k].withBroker;
+            if (column !== "allowed")
+                throw new Error(column.refused);
+        }
+    }
+    for (const k of present)
+        judgeField(k, patch);
+    return present;
+}
+function judgeField(key, patch) {
+    POD_SPEC_PATCH_FIELDS[key].judge(patch[key]);
+}
+function applyField(key, pod, patch) {
+    POD_SPEC_PATCH_FIELDS[key].apply(pod, patch[key]);
+}
+function assertPatchVolumeName(name, where) {
+    if (typeof name !== "string" || name === "")
+        throw new Error(`podSpecPatch.${where} rejected — every entry needs a non-empty string \`name\``);
+    if (RESERVED_VOLUME_NAMES.has(name)) {
+        throw new Error(`podSpecPatch.${where} rejected — volume name ${JSON.stringify(name)} is reserved (the adapter mints it on the pod itself: ${[...RESERVED_VOLUME_NAMES].join(" / ")}); name the patch volume something else`);
     }
 }
 function assertHardeningOnly(sc, where) {
-    if (!sc)
-        return;
     const bad = (msg) => {
         throw new Error(`podSpecPatch.${where} rejected — it may only HARDEN, never weaken isolation: ${msg}`);
     };
@@ -53,8 +143,6 @@ function assertHardeningOnly(sc, where) {
         bad('seccompProfile.type:"Unconfined" (disables syscall filtering)');
 }
 function assertVolumesPodLocal(volumes, where) {
-    if (!volumes?.length)
-        return;
     const POD_LOCAL = new Set(["emptyDir", "configMap", "secret", "projected", "downwardAPI", "ephemeral"]);
     for (const v of volumes) {
         const vol = v;

package/dist/plugins/k8s-pod-delete-failure.d.ts

@@ -0,0 +1,25 @@
+/** A pod DELETE the API answered with something other than "deleted" (2xx) or "not there" (404): a Role without `delete`, a 5xx — the pod is still in the namespace. */
+export declare class PodDeleteRefused extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+/** 删失败的原因码(闭集两形):API 回了 2xx / 404 以外的答复 ⇒ `http_<状态>`;请求本身抛(传输失败 / 超时)⇒ `request_failed`。 */
+export declare function podDeleteCauseOf(error: unknown): string;
+/** 一次删失败的读数(座自己填 `why` 与 `effect`)。 */
+export interface PodDeleteFailure {
+    readonly namespace: string;
+    readonly pod: string;
+    /** 这只 pod 为什么要删(每个座一个闭集词)。 */
+    readonly why: string;
+    /** 被抛出的那一只(只读它的类型取原因码,其文字不上任何一行)。 */
+    readonly error: unknown;
+    /** 留下什么(运维行的后果句,英文,不带值)。 */
+    readonly effect: string;
+    /** 运维行座:可缺 / 可没有 `error` 档(计数不依赖座)。 */
+    readonly logger?: {
+        error?(event: string, fields?: Record<string, unknown>): void;
+    };
+}
+/** 上报一次删 pod 失败(计数 + 一行 error)。不抛。 */
+export declare function reportPodDeleteFailed(f: PodDeleteFailure): void;
+//# sourceMappingURL=k8s-pod-delete-failure.d.ts.map

package/dist/plugins/k8s-pod-delete-failure.js

@@ -0,0 +1,17 @@
+import { recordFailOpen } from "../observability/fail-open.js";
+export class PodDeleteRefused extends Error {
+    status;
+    constructor(status) {
+        super(`pod delete answered HTTP ${status}`);
+        this.status = status;
+    }
+}
+export function podDeleteCauseOf(error) {
+    return error instanceof PodDeleteRefused ? `http_${error.status}` : "request_failed";
+}
+export function reportPodDeleteFailed(f) {
+    const cause = podDeleteCauseOf(f.error);
+    recordFailOpen("server.sandbox-pod.delete-failed", `namespace=${f.namespace} pod=${f.pod} why=${f.why} cause=${cause}`);
+    f.logger?.error?.("sandbox_pod_delete_failed", { pod: f.pod, namespace: f.namespace, why: f.why, cause, effect: f.effect });
+}
+//# sourceMappingURL=k8s-pod-delete-failure.js.map

package/dist/plugins/k8s-pod-reaper.d.ts

@@ -0,0 +1,112 @@
+/**
+ * k8s 沙箱 Pod 的 reaper —— server 建出来、却没被自己的 run 收尾删掉的 Pod 由它删(该 Pod 的 Secret 以 `ownerReferences` 属于它,随它由集群 GC)。
+ *
+ * 为什么要它:`activeDeadlineSeconds` 只让容器到点终止、Pod 进 `Failed`,**不删 Pod 对象**;run 收尾的 `destroy()` 是删 Pod 的正常路,
+ * 而 server 进程崩溃 / 收尾里删失败(`destroy` 的删是吞错的)时 Pod 对象(连同它的 Secret)就一直留着。
+ *
+ * 法(只删两形;判决链的缺省臂是「不动作」,删必须被显式选中 —— 销毁不可逆,拿不准恒不删,与 E2B 孤儿回收同一方向纪律):
+ *  ② `status.phase ∈ {Succeeded, Failed}` —— 容器已全部结束,删它不掐断任何东西;不看 run、不看标签;
+ *  ① 带 run 标签(`sema.io/run`,只有顶层 run 的 Pod 带)、run 行在 server 店里**已是终态**,且自 run 行**转终态的时刻**(行上的 `updatedAt` ——
+ *     三只 run 店的终态写当拍盖它)起超过**这只 Pod 自带的**上界:`max(租约上限 + 宽限 = 6 min, 工作区快照时限 + 引擎拆环境放行 15 s)`
+ *     ({@link sandboxRunEndHoldMs};租约上限 = 凭据代理的租约律那一只 `LEASE_TTL_MAX_MS`,本模块不另立)。
+ *     第二项是 run 收尾的 `destroy()` 在终态之后还可能在 Pod 上存快照的最长时间(引擎的拆环境腿 15 s 放行、run 随即落终态,快照按数据时限接着跑)——
+ *     那个数据时限是**建这只 Pod 的副本**的配置,所以上界**随 Pod 走、写一次读一次**:适配器建 Pod 时按自己的快照时限算一次、写进注解
+ *     `sema.io/run-end-hold-ms`(`k8s-exec-protocol.ts` `SANDBOX_RUN_END_HOLD_ANNOTATION`),回收器只读 Pod 自带的这一格,**从不**读回收器所在副本的配置
+ *     (列举是整个命名空间的 Pod:滚动改 `WORKSPACE_SNAPSHOT_TIMEOUT_MS` 时,一个时限短的副本不得替时限长的副本判它的 Pod)。
+ *     带 run 标签的 Pod 上注解缺席(不是本服务写的:标签与注解由建 Pod 的适配器在同一个条件下一起写)、不是十进制整数、不在 [租约上限 + 宽限, 快照时限上限 + 引擎拆环境放行] 里
+ *     ⇒ 不按 ① 删(`hold_unreadable`;这只 Pod 由自己的 `activeDeadlineSeconds` 到点后命中 ② 收)。7.136.x 及以前建的 Pod 没有 run 标签(标签与注解都是本版起写)⇒ 落在下面
+ *     「不带 run 标签」一类(`no_run_label`),同样只按 ② 收。持久化开 / 关两种部署同一条律。
+ *     **活 run 的 Pod 不由本模块判**:run 行非终态(活 / 停驻)、查不到、读抛、词表外 ⇒ 不删 —— 它由自己的截止(`activeDeadlineSeconds` 到点
+ *     ⇒ 之后命中 ②)与取消 / 收尾路径收;本模块从不按 Pod 存在时长判活。
+ * 不带 run 标签的 Pod(委派子代 / 服务自己的 run / 没有 run id)只按 ② 删:会话级后台子代刻意活过父 run 的回合,「会话里没有非终态 run」
+ * 推不出「这只 Pod 没人用」。
+ *
+ * 没有 run 店(无存储后端的部署)⇒ ② 照删;带 run 标签的 Pod 跳过 `run_store_absent`(查不了 run ⇒ 不删)。
+ * 每轮一行结构化日志 `sandbox_pod_reap_round`(扫了几只、按闭集原因分的删 / 跳过计数),每删一只一行 `sandbox_pod_reaped`;**列举失败**这一轮一只都删不了 ——
+ * F 类兜底口 `server.sandbox-pod-reaper.list-failed` 计一次 + 一行 warn `sandbox_pod_reap_list_failed`(下一轮一个周期后照常再列);**某一只删失败**不挡其余 ——
+ * 与连接清理同一只上报口 `reportPodDeleteFailed`(F 类计数 `server.sandbox-pod.delete-failed` + 一行 error `sandbox_pod_delete_failed`,`why=reaper_<删它的理由>`,下一轮再判再删)。
+ * 每副本起服后第一个维护 tick 跑一次、此后每 {@link SANDBOX_POD_REAP_PERIOD_MS} 一次(`boot/reapers.ts`);多副本同时删同一只 ⇒ 404 计 `gone`。
+ */
+import type { Logger } from "../observability/logger.js";
+import type { Metrics } from "../observability/metrics.js";
+/** ① 的宽限(在租约上限之外再等的一段)。常量。 */
+export declare const SANDBOX_POD_REAP_GRACE_MS = 60000;
+/**
+ * 引擎在 run 收尾时给「拆执行环境」那条腿的放行时限:超过它 run 照样落终态,`destroy()` 脱离着继续跑。值 = core 的 `TEARDOWN_LEG_MAX_MS`
+ * (`dist/core/runner/teardown-bounded.js`)—— core 不从包根导出它(包的 exports 只有 `.` / `./bench` / `./fixtures`),本仓只能照抄这一个数;
+ * 收口 = 向 core 要一个包根读口后改读、删本常量。
+ */
+export declare const ENGINE_TEARDOWN_RELEASE_MS = 15000;
+/** ① 的上界:`max(租约上限 + 宽限, 快照时限 + 引擎拆环境放行)`。唯一的调用方 = 适配器建 Pod 的那一拍(快照时限 = 建它的副本的 `dataTimeoutMs`),结果写进 Pod 的注解。 */
+export declare function sandboxRunEndHoldMs(snapshotTimeoutMs: number): number;
+/** 一个副本两轮回收之间的间隔。常量。 */
+export declare const SANDBOX_POD_REAP_PERIOD_MS: number;
+/** 列举出来的一只沙箱 Pod(只带判官要读的几样;时刻是毫秒)。 */
+export interface SandboxPodListing {
+    readonly name: string;
+    /** 标签 `sema.io/run`:顶层 run 的 id;缺席 = 这只 Pod 不点名 run。 */
+    readonly runId?: string;
+    /** 注解 `sema.io/run-end-hold-ms` 的原串(建它的副本写的 ① 上界);缺席 = Pod 上没有这一格(或不是串)。判官自己读它({@link judgeSandboxPod})。 */
+    readonly runEndHold?: string;
+    readonly phase?: string;
+    /** `metadata.deletionTimestamp` 在场:已在删除中。 */
+    readonly terminating: boolean;
+}
+/** reaper 对沙箱命名空间的窄面(真实装配 = `remote-env-k8s.ts` 的 `createSandboxPodApi`;测试注入假面)。 */
+export interface SandboxPodApi {
+    readonly namespace: string;
+    /** 按身份标签列本命名空间的沙箱 Pod。失败抛。 */
+    list(): Promise<SandboxPodListing[]>;
+    /** 删一只;404 ⇒ `gone`。其余失败抛。 */
+    delete(name: string): Promise<"deleted" | "gone">;
+}
+/** 一行 run 在判官眼里的两位。状态词按**串**读:滚动升级里新副本写下的词本进程可能不认(`runStatusClassOf` 答 `undefined` ⇒ 不删)。
+ *  `updatedAt` = 行最后一次被写的时刻(ISO);终态行上它就是转终态那一拍(之后改它的写只会让 reaper 等得更久)。 */
+export interface SandboxPodRunRow {
+    readonly status: string;
+    readonly updatedAt: string;
+}
+/** run 店的窄读口(三只 run 店共有的 `getRun`)。 */
+export interface SandboxPodRunReader {
+    getRun(taskId: string): Promise<SandboxPodRunRow | null | undefined>;
+}
+/** 一只 Pod 的 run 读数(闭集):读到行 / 店答没有这一行 / 读抛 / 本部署没有 run 店可问。 */
+export type SandboxPodRunReading = {
+    readonly found: SandboxPodRunRow;
+} | {
+    readonly absent: true;
+} | {
+    readonly failed: true;
+} | {
+    readonly storeAbsent: true;
+};
+export type SandboxPodDeleteReason = "containers_ended" | "run_ended_past_hold";
+export type SandboxPodSkipReason = "terminating" | "no_run_label" | "run_store_absent" | "run_unread" | "run_read_failed" | "run_status_unknown" | "run_live" | "run_end_unreadable" | "hold_unreadable" | "within_run_end_hold";
+export type SandboxPodVerdict = {
+    readonly delete: SandboxPodDeleteReason;
+} | {
+    readonly skip: SandboxPodSkipReason;
+};
+/** 一只 Pod 删不删(纯判官;法见文件头)。`now` 毫秒;① 的上界只读 Pod 自带的注解(`pod.runEndHold`),没有第二个来源。 */
+export declare function judgeSandboxPod(pod: SandboxPodListing, run: SandboxPodRunReading, now: number): SandboxPodVerdict;
+/** 一轮的读数(轮次行与计数的来源)。`deleted` / `skipped` 只列出现过的原因。 */
+export interface SandboxPodReapRound {
+    readonly listed: boolean;
+    readonly scanned: number;
+    readonly deleted: Partial<Record<SandboxPodDeleteReason, number>>;
+    readonly skipped: Partial<Record<SandboxPodSkipReason, number>>;
+    /** 判了删、删时已不在(404)。 */
+    readonly gone: number;
+    readonly deleteFailed: number;
+}
+export interface SandboxPodReaper {
+    /** 一轮:列举 → 逐只判 → 删被判删的。不抛(列举失败 ⇒ `listed: false` + F 计数 + 一行 warn)。`runs` 缺席 = 本部署没有 run 店(② 照删)。 */
+    reapOnce(runs: SandboxPodRunReader | undefined): Promise<SandboxPodReapRound>;
+}
+export declare function createSandboxPodReaper(deps: {
+    readonly api: SandboxPodApi;
+    readonly logger?: Pick<Logger, "info" | "warn" | "error">;
+    readonly metrics?: Pick<Metrics, "inc">;
+    readonly now?: () => number;
+}): SandboxPodReaper;
+//# sourceMappingURL=k8s-pod-reaper.d.ts.map

package/dist/plugins/k8s-pod-reaper.js

@@ -0,0 +1,122 @@
+import { recordFailOpen } from "../observability/fail-open.js";
+import { reportPodDeleteFailed } from "./k8s-pod-delete-failure.js";
+import { runStatusClassOf } from "./store-contracts.js";
+import { LEASE_TTL_MAX_MS } from "../broker/lease-file.js";
+import { WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "../workspace-space.js";
+export const SANDBOX_POD_REAP_GRACE_MS = 60_000;
+export const ENGINE_TEARDOWN_RELEASE_MS = 15_000;
+export function sandboxRunEndHoldMs(snapshotTimeoutMs) {
+    return Math.max(LEASE_TTL_MAX_MS + SANDBOX_POD_REAP_GRACE_MS, snapshotTimeoutMs + ENGINE_TEARDOWN_RELEASE_MS);
+}
+const RUN_END_HOLD_READABLE = { min: LEASE_TTL_MAX_MS + SANDBOX_POD_REAP_GRACE_MS, max: WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max + ENGINE_TEARDOWN_RELEASE_MS };
+function runEndHoldOf(raw) {
+    if (raw === undefined || !/^[0-9]{1,16}$/.test(raw))
+        return undefined;
+    const ms = Number(raw);
+    return Number.isSafeInteger(ms) && ms >= RUN_END_HOLD_READABLE.min && ms <= RUN_END_HOLD_READABLE.max ? ms : undefined;
+}
+export const SANDBOX_POD_REAP_PERIOD_MS = 5 * 60_000;
+const CLASS_VERDICT = {
+    live: "live",
+    parked: "live",
+    succeeded: "terminal",
+    unsuccessful: "terminal",
+};
+export function judgeSandboxPod(pod, run, now) {
+    if (pod.terminating)
+        return { skip: "terminating" };
+    if (pod.phase === "Succeeded" || pod.phase === "Failed")
+        return { delete: "containers_ended" };
+    if (pod.runId === undefined)
+        return { skip: "no_run_label" };
+    if ("storeAbsent" in run)
+        return { skip: "run_store_absent" };
+    if ("failed" in run)
+        return { skip: "run_read_failed" };
+    if ("absent" in run)
+        return { skip: "run_unread" };
+    const cls = runStatusClassOf(run.found.status);
+    if (cls === undefined)
+        return { skip: "run_status_unknown" };
+    if (CLASS_VERDICT[cls] === "live")
+        return { skip: "run_live" };
+    const endedAt = Date.parse(run.found.updatedAt);
+    if (!Number.isFinite(endedAt))
+        return { skip: "run_end_unreadable" };
+    const hold = runEndHoldOf(pod.runEndHold);
+    if (hold === undefined)
+        return { skip: "hold_unreadable" };
+    if (now - endedAt <= hold)
+        return { skip: "within_run_end_hold" };
+    return { delete: "run_ended_past_hold" };
+}
+export function createSandboxPodReaper(deps) {
+    const now = deps.now ?? Date.now;
+    return {
+        async reapOnce(runs) {
+            const deleted = {};
+            const skipped = {};
+            let gone = 0;
+            let deleteFailed = 0;
+            let pods;
+            try {
+                pods = await deps.api.list();
+            }
+            catch (e) {
+                const error = e instanceof Error ? e.message : String(e);
+                recordFailOpen("server.sandbox-pod-reaper.list-failed", `namespace=${deps.api.namespace} ${error}`);
+                deps.logger?.warn("sandbox_pod_reap_list_failed", {
+                    namespace: deps.api.namespace,
+                    error,
+                    effect: "sandbox pods were not deleted this round — ended pods and pods of ended runs (with their Secrets) stay until a later round lists them (one period later)",
+                });
+                return { listed: false, scanned: 0, deleted, skipped, gone, deleteFailed };
+            }
+            const reads = new Map();
+            const readRun = (runId) => {
+                if (runs === undefined)
+                    return Promise.resolve({ storeAbsent: true });
+                let r = reads.get(runId);
+                if (r === undefined) {
+                    r = runs.getRun(runId).then((row) => (row === undefined || row === null ? { absent: true } : { found: row }), () => ({ failed: true }));
+                    reads.set(runId, r);
+                }
+                return r;
+            };
+            const at = now();
+            for (const pod of pods) {
+                const reading = pod.runId === undefined ? { absent: true } : await readRun(pod.runId);
+                const verdict = judgeSandboxPod(pod, reading, at);
+                if ("skip" in verdict) {
+                    skipped[verdict.skip] = (skipped[verdict.skip] ?? 0) + 1;
+                    continue;
+                }
+                try {
+                    const outcome = await deps.api.delete(pod.name);
+                    if (outcome === "gone") {
+                        gone++;
+                        continue;
+                    }
+                    deleted[verdict.delete] = (deleted[verdict.delete] ?? 0) + 1;
+                    deps.metrics?.inc("sandbox_pods_reaped_total", { reason: verdict.delete });
+                    deps.logger?.info("sandbox_pod_reaped", { namespace: deps.api.namespace, pod: pod.name, reason: verdict.delete, ...(pod.runId !== undefined ? { run: pod.runId } : {}) });
+                }
+                catch (e) {
+                    deleteFailed++;
+                    reportPodDeleteFailed({
+                        namespace: deps.api.namespace,
+                        pod: pod.name,
+                        why: `reaper_${verdict.delete}`,
+                        error: e,
+                        effect: "the pod, and the Secret it owns, stay in the sandbox namespace; the reaper tries this pod again next round (one period later), until then it holds static data only",
+                        logger: deps.logger,
+                    });
+                }
+            }
+            const round = { listed: true, scanned: pods.length, deleted, skipped, gone, deleteFailed };
+            deps.logger?.info("sandbox_pod_reap_round", { namespace: deps.api.namespace, ...round });
+            return round;
+        },
+    };
+}
+//# sourceMappingURL=k8s-pod-reaper.js.map

package/dist/plugins/local-checkpoint-store.d.ts

@@ -1,5 +1,5 @@
 import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ExecutionOutcomeRecordWord, type GateOutcome, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
-import { type CheckpointAskCandidate, type CtxRowsRewriteM28, type DecidedApprovalRecord, type PendingCheckpoint, type PendingRowBinding } from "./checkpoint-store-sql.js";
+import { type CheckpointAskCandidate, type CtxRowRewrite, type CtxRowsRewrite, type DecidedApprovalRecord, type PendingCheckpoint, type PendingRowBinding } from "./checkpoint-store-sql.js";
 import type { SealedCheckpointCtx } from "../http/checkpoint-ctx.js";
 export interface LocalCheckpointStoreOptions {
     /** taskId join for the pending card (the local FileRunStore's `getActiveTaskId`). Absent ⇒ `taskId: null`. */
@@ -213,15 +213,12 @@ export declare class LocalCheckpointStore {
      */
     getCtx<T extends object = object>(sessionId: string): Promise<T | null>;
     /**
-     * 🔴 **一次性迁移 M28 的店腿**(local 孪生;窗与删法见 `plugins/one-time-migrations.ts` 登记表 M28,判词与 SQL 孪生 `rewriteCtxRowsM28` 逐条同):
+     * 🔴 **一次性迁移的 ctx 行改写店腿**(local 孪生;`checkpoint-store-sql.ts` `CheckpointCtxRowsRewriter`,判词与 SQL 孪生 `rewriteCtxRows` 逐条同):
      * 逐档读(信封经读腿**同一只**判形 —— 读不出 ⇒ 计数、跳过、**不删**),`rewrite` 交回新体 ⇒ 信封原样(`sessionId` / `updatedAt` 不动:收割按 `updatedAt` 判)
      * 只换 `ctx`,经写腿同一只形闸、同一只原子写落回原档。封签绑的是信封里的 `sessionId`(与 `getCtx` 认行的那一格同一个)。
      * 数据根独占 + 起服在任何读写者之前跑 ⇒ 本车道没有并发写者,不需要 CAS;没有一行装不下这回事(`tooLarge` 恒 0)。
      */
-    rewriteCtxRowsM28(rewrite: (sessionId: string, ctx: object) => {
-        readonly ctx: SealedCheckpointCtx;
-        readonly values: number;
-    } | undefined): Promise<CtxRowsRewriteM28>;
+    rewriteCtxRows(rewrite: CtxRowRewrite): Promise<CtxRowsRewrite>;
     /** GC ctx files whose lifecycle is over — same three guards as the SQL twins (stale ∧ no pending ∧ no active run). */
     reapCtx(cutoff: number): Promise<number>;
     /**

package/dist/plugins/local-checkpoint-store.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { denySweepOwns, parkedApprovalCard } from "../approval-content-kind.js";
-import { parkRowFacts } from "../approval-card.js";
+import { parkRowFacts, skillCardFacts } from "../approval-card.js";
 import { durableRowIdentity } from "../checkpoint-identity.js";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
@@ -155,7 +155,7 @@ export class LocalCheckpointStore {
             for (const summary of await this.inner.listByScope(s)) {
                 const cp = await this.inner.get(summary.token);
                 if (cp && cp.status === "pending")
-                    out.push({ token: summary.token, cp });
+                    out.push({ token: summary.token, cp, summary });
             }
         }
         return out;
@@ -165,7 +165,7 @@ export class LocalCheckpointStore {
     }
     async listPending(scope) {
         const rows = [];
-        for (const { token, cp } of await this.pendings(scope)) {
+        for (const { token, cp, summary } of await this.pendings(scope)) {
             const pa = cp.pendingAction;
             const gate = cp.gate;
             const gateKind = queueRowGateKind(gate?.kind);
@@ -193,6 +193,7 @@ export class LocalCheckpointStore {
                 ...(pa?.hasBidiControls === true ? { hasBidiControls: true } : {}),
                 ...((card) => (card !== undefined ? { approvalCard: card } : {}))(parkedApprovalCard(cp.gate)),
                 ...parkRowFacts(cp.pendingAction),
+                ...skillCardFacts(summary),
             });
         }
         return rows.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
@@ -326,7 +327,7 @@ export class LocalCheckpointStore {
         const rec = refusingCtx(sessionId, () => decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${ctxFileOf(sessionId)} for session ${JSON.stringify(sessionId)}`));
         return rec.sessionId === sessionId ? rec.ctx : null;
     }
-    async rewriteCtxRowsM28(rewrite) {
+    async rewriteCtxRows(rewrite) {
         const out = { scanned: 0, rewritten: 0, valuesRewritten: 0, unreadable: 0, tooLarge: 0 };
         for (const f of readdirSync(this.ctxDir)) {
             if (!f.endsWith(".json"))
@@ -334,7 +335,7 @@ export class LocalCheckpointStore {
             const p = join(this.ctxDir, f);
             let rec;
             try {
-                rec = decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${f} (M28 scan)`);
+                rec = decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${f} (ctx row rewrite scan)`);
             }
             catch {
                 out.unreadable += 1;
@@ -345,7 +346,7 @@ export class LocalCheckpointStore {
             if (next === undefined)
                 continue;
             const text = JSON.stringify({ sessionId: rec.sessionId, updatedAt: rec.updatedAt, ctx: next.ctx });
-            assertJsonColumnWritable(text, createCtxRecordReader(), `checkpoint ctx for session ${JSON.stringify(rec.sessionId)} (local M28 write)`);
+            assertJsonColumnWritable(text, createCtxRecordReader(), `checkpoint ctx for session ${JSON.stringify(rec.sessionId)} (local ctx row rewrite)`);
             atomicWriteFile(this.tmpDir, p, text);
             out.rewritten += 1;
             out.valuesRewritten += next.values;

package/dist/plugins/memory-run-store.js

@@ -43,6 +43,7 @@ export class MemoryRunStore {
             errorCode: r.errorCode,
             jobId: r.jobId,
             source: r.source,
+            identity: r.identity,
             instanceId: r.instanceId,
             cancelRequested: r.cancelRequested,
             objectivePreview: r.objectivePreview,
@@ -75,6 +76,7 @@ export class MemoryRunStore {
             objectivePreview: meta.objectivePreview ?? null,
             idemKey,
             idemBodyFingerprint: meta.idem?.bodyFingerprint ?? null,
+            identity: meta.identity ?? null,
             createdAt: now,
             updatedAt: now,
             cancelRequested: false,