@sema-agent/server 7.136.0 → 7.137.0

package/dist/approval-gate-currency.d.ts

@@ -8,10 +8,26 @@
  *
  * ## 判官
  * 问题:**这把 gate token 是不是该会话当前待决的审批门?**(应答口的答法:`resumeCheckpoint` 的 stale 臂 —— 回显的 token ≠ 该会话当前待决的审批门 ⇒ `409 approval_stale`。)
+ *  · {@link sightsCurrentGate} —— 「决断方回显的**门身份**(token / `checkpointId`)是不是当前门的同一面」的**唯一**比较(`approval_stale` 律,两道决断门一条,见下一节);
+ *    本仓每一处拿**决断方 / 读口给的那把**门身份比「是不是当前门」都经它(`/decide` 的 token 回显、计划审阅的身份回显、下面的 {@link readGateCurrency});
+ *    服务端对**自己选出的那张卡**的复核不是回显比较,不经它(`drivePlanReview` 的卡令牌复核答认领输家 `409 conflict.not_resumable`、唤醒腿的赢家比较);
+ *    射程:本判官问的是「**哪扇门**」;`/decide` 的 [ref] 第二源问的是「**哪只调用**」(回显的 `boundCallId` vs 载入行的 `toolCallId`)—— 两问不同,所以是两条比较,
+ *    不是「不能并」:它们共用同一个 409 答复,缺值规则各按各的问题定(说不出门身份 ⇒ 判「不是」;行上没有 `toolCallId` ⇒ 那一问不判,交引擎的绑定等值校验 fail-closed 兜)。
+ *    过期决断的 409 一族(门身份 / 调用绑定两问怎么排成一族、老行那一形答哪个码)是 7.138.0 的设计票(DEBTS-server,主会话开票);
  *  · {@link currentApprovalGateToken} —— 该会话当前待决的审批门(审批门型优先,没有再退到任一待决行);应答口读它,读口读它,别处不再内联第二份;
  *  · {@link readGateCurrency} —— 一把 token 对着它的读数:`current`(带那一行)/ `absent`(店里没有这一行)/ `settled`(行在,但不再是当前待决门:已结算、已过期、被取代);
  *  · {@link createParkedGateRead} —— 协调器读口的门读席:把读数译成读口要的四种读法({@link ParkedGateReading}),`state` 闭集不加字。
  *
+ * ## `approval_stale` 律(两道决断门一条;[ref] 把计划审阅收进来)
+ * 一句话:**决断体带了「决断方看到的那道门」,而它不是该会话此刻在这道门上待决的那道门 ⇒ `409 approval_stale`,不落决断,拒体带当前门的回显坐标;不带 ⇒ 照旧受理。**
+ * 门的身份有两个面,**同一次铸**在同一行上(core 的每个停驻铸点把 `token` 与 `checkpointId` 一起铸;重开翻的是同一行、两面都不变)⇒ 在带身份的行上两面一一对应:
+ *  · 能力面 `checkpointToken` —— 秘密,永不外发;`/decide` 的老回显键(直连门上拒收);
+ *  · 身份面 `checkpointId` —— 非秘密(park 结果的 `terminal.checkpointId`、运维队列 / 收件行上的那一个);计划审阅能回显的只有它。
+ *    读法只有 `checkpoint-identity.ts` 的信任边界那一只:core 5.42.0 之前铸的老行没有它、没过边界的值不算它 ⇒ 这样的门**说不出**自己的身份面。
+ * 判官 {@link sightsCurrentGate} 只做一件事:回显的那一面 = 当前门的同一面。当前门没有那一面(老行 / 不可信值 / 调用方没读行)⇒ 不是(fail-closed:拒,不放)。
+ * 「当前门」由每道门按**自己的门型**选(`/decide` = {@link currentApprovalGateToken};计划审阅 = 它的选卡读),判官门型无关。
+ * 不把能力面先解成身份面再比:两面在同一行上同生同灭,比能力面就是比这一行;先解一次只会在快路上多一次店读,并在老行上(两边都读不出身份面)把两道不同的门判成同一道。
+ *
  * ## 一个读数只取自一个时刻([ref])
  * 门身份就是 token:引擎重开一张门(`reopen`:续跑腿在被批准的动作开跑之前失败)翻的是**同一行**(resolved → pending,token 不变)。所以「这张卡此刻在哪」可以在两次店读之间
  * 来回变(待决 → 被决 → 被重开);判官的分类只用**同一时刻成立**的读数:
@@ -33,8 +49,10 @@
  *    表明说 `decided` ⇒ 往下读;明说 `void` ⇒ `void`(没有人决过它,答案无处兑现 —— 已过期〔取消 / 收割〕、仍待决却不是当前门〔被取代,应答口答 stale〕、
  *    结算种类是引擎窗到期 / 宿主 SLA 扫 / 无人可答的失败族);**表外 ⇒ `unknown`**(读不懂的词撑不起「有人决过」,也撑不起「没有人决过它」);
  *  ② 结算赢家的门记录 `resolvedOutcome.gateOutcome` 先过 core 唯一的门记录筛 `screenGateOutcome`(**档案读法**:读回的耐久行,闭集 = 今日成员 ∪ 已退役词;
- *    坏形记缺陷、绝不抛;本仓 `trace/project.ts` 投影同一种记录也只经这一只筛),有缺陷 ⇒ `unknown`,过了筛才读它的成员;
- *  ③ 分类之前记录要**读得全**:有结算记录、时刻(引擎写进赢家的 `settlement.when`)是有限数、赢家绑的是这一行的调用且判词是 allow / deny(与
+ *    坏形记缺陷、绝不抛;本仓 `trace/project.ts` 投影同一种记录也只经这一只筛),有缺陷 ⇒ `unknown`,过了筛才读它的成员。core 7.56.0 [ref] 起筛自己判
+ *    I10(`settlement.when` 是有限数)与 I11(调用方把赢家的 `decision` 一并交给筛:它是赢家拿得出的词,方向与记录的结算种类 / 处置同向)—— 本判官在同一次筛调用里
+ *    交 `winnerDecision`,时刻与方向的手判随之退役;
+ *  ③ 分类之前记录要**读得全**:有结算记录、赢家绑的是这一行的调用且判词是 allow / deny(与
  *    `findDecidedApprovalsForBinding` 同一只 {@link approvalDecisionOfWinner})—— 缺一个都是 `unknown`(**不编一个首决**;读口答 404,应答口对已结算的门答 409 `approval_stale`,两口不同判;
  *    `void` 也要读得全:绑在别的调用上的结算说的不是这张卡);读全了再按**结算种类**表分类:人 / 策略的四个种类 ⇒ `decided`(理由取自赢家的 `reason`),其余十个 ⇒ `void`
  *    (按种类不按当事方:跨版本稳定的是种类词,变过义的是当事方词 —— 此前版本的策略拒记 `policy_refused` + `who.party:"none"`,此后记 `"policy"`,按当事方查会把那一代合法历史记录读成 `void`);
@@ -42,14 +60,38 @@
  * `unknown` 的这一类(`decision_unreadable`)带上读不出的那几处(缺陷句,非空):读口答 404 `tool_approval.not_pending`,并记一行 error(首句 + 计数)。
  * 行没了 ⇒ `unknown`(`row_absent`;应答口 PARKED 臂的 404 `not_found.approval` 同判)。
  *
- * ## 盲区(core 的筛不判的两处,如实写下:一处本判官手判有限数,一处本判官也不核)
- *  · 结算时刻 `settlement.when`:筛不判,本判官手判「有限数」;而本仓另一个读同一种记录的读者(trace 投影)把 `when` 原样放上 wire —— 同一个坏时刻,两个读者两种答法;
- *  · 方向与配对:赢家的方向(`resolvedOutcome.decision`)与记录自己的种类 / 处置说的方向是否一致,以及种类 × 当事方的配对 —— 筛不判,本判官也不核:读口以赢家的方向为准、读的是种类。
- * 只有坏行 / 手改行才走得到这两处。候引擎的筛把时刻、方向与种类 × 当事方配对一并判了,两个读者同时退掉各自的手判(配对今天没有手判可退 —— 它无人判)。
+ * ## 盲区(core 的筛仍不判的一处,如实写下)
+ *  · 种类 × 当事方的配对(结算种类与 `settlement.who` 的当事方是否相配)—— 筛不判(core KL-1265-b),本判官也不核:读的是种类。只有坏行 / 手改行才走得到。
+ *  (时刻与方向两处自 core 7.56.0 [ref] 起由筛判:I10 / I11。trace 投影读同一种记录、经同一只筛,零改即得 I10 —— 坏时刻在两个读者那里是同一个答法。)
  */
 import { type Checkpoint, type CheckpointToken, type SettlementKind } from "@sema-agent/core";
 import { type PendingRowBinding } from "./plugins/checkpoint-store-sql.js";
 import { type ParkedGateRead } from "./tool-approval.js";
+/**
+ * 决断方回显的「我看到的那道门」—— 门的两个身份面之一(两面的来历与读法见模块头注「`approval_stale` 律」)。
+ * `face` 就是回显它的那个体键名:`/decide` 的 `checkpointToken`,计划审阅的 `checkpointId`。
+ */
+export type GateSighting = {
+    readonly face: "checkpointToken" | "checkpointId";
+    readonly value: string;
+};
+/**
+ * 当前门的身份面。能力面恒在;身份面在场 ⇔ 行上的 `checkpointId` 过了信任边界 —— 老行 / 没过边界 / 调用方没读行时缺席,
+ * 缺席读作「说不出它的身份面」(判官据此对身份面回显答「不是」),**不**读作「没有门」。
+ */
+export interface CurrentGateFaces {
+    readonly checkpointToken: string;
+    readonly checkpointId?: string;
+}
+/** 一道已载入的当前门 → 它的两个身份面(身份面只经 {@link trustedCheckpointId};它含 token 的形在这里就被当成缺席,永不上比较、永不上 wire)。 */
+export declare function currentGateFacesOf(token: string, row: {
+    readonly checkpointId?: unknown;
+}): CurrentGateFaces;
+/**
+ * `approval_stale` 律的**唯一**判官:回显的那一面是不是当前门的同一面(律全文见模块头注)。没有当前门(`null` / `undefined`)⇒ 不是;
+ * 当前门说不出回显的那一面 ⇒ 不是(fail-closed)。调用点:`/decide` 的 token 回显、计划审阅的身份回显、本模块的 {@link readGateCurrency}。
+ */
+export declare function sightsCurrentGate(sighting: GateSighting, current: CurrentGateFaces | null | undefined): boolean;
 /** 判官要的两个店口(三后端同形;窄接口让测试与装配都不必拿整只店)。 */
 export interface GateCurrencyStore {
     get(token: CheckpointToken): Promise<Checkpoint | null>;

package/dist/approval-gate-currency.js

@@ -1,13 +1,21 @@
-import { REOPEN_REASONS, screenGateOutcome } from "@sema-agent/core";
+import { REOPEN_REASONS, checkpointRevOf, screenGateOutcome } from "@sema-agent/core";
 import { approvalDecisionOfWinner } from "./plugins/checkpoint-store-sql.js";
 import {} from "./tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "./approval-content-kind.js";
+import { trustedCheckpointId } from "./checkpoint-identity.js";
+export function currentGateFacesOf(token, row) {
+    const checkpointId = trustedCheckpointId(row.checkpointId, token);
+    return checkpointId === undefined ? { checkpointToken: token } : { checkpointToken: token, checkpointId };
+}
+export function sightsCurrentGate(sighting, current) {
+    if (current === null || current === undefined)
+        return false;
+    const face = current[sighting.face];
+    return face !== undefined && face === sighting.value;
+}
 export async function currentApprovalGateToken(cs, sessionId) {
     return (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
 }
-function revisionOf(cp) {
-    return cp.rev ?? 0;
-}
 const GATE_READ_ROUNDS = 3;
 export async function readGateCurrency(cs, gateToken) {
     const token = gateToken;
@@ -17,10 +25,11 @@ export async function readGateCurrency(cs, gateToken) {
             return { kind: "absent" };
         if (row.status !== "pending")
             return { kind: "settled", checkpoint: row };
-        const isCurrent = (await currentApprovalGateToken(cs, row.sessionId)) === gateToken;
+        const currentToken = await currentApprovalGateToken(cs, row.sessionId);
+        const isCurrent = sightsCurrentGate({ face: "checkpointToken", value: gateToken }, currentToken ? { checkpointToken: currentToken } : null);
         const again = await cs.get(token);
         if (again !== null && again.status === "pending") {
-            if (revisionOf(again) === revisionOf(row))
+            if (checkpointRevOf(again) === checkpointRevOf(row))
                 return isCurrent ? { kind: "current", checkpoint: again } : { kind: "settled", checkpoint: again };
             if (round === GATE_READ_ROUNDS)
                 throw new Error(`the checkpoint row moved between reads in ${GATE_READ_ROUNDS} rounds in a row (decided and reopened each time): there is no single-instant reading of its gate`);
@@ -68,14 +77,12 @@ function decisionReading(checkpoint, gateBoundCallId) {
 function readWinner(checkpoint, gateBoundCallId) {
     const winner = checkpoint.resolvedOutcome;
     const recorded = winner?.gateOutcome;
-    const [defect, ...more] = screenGateOutcome(recorded, { reading: "archive" });
+    const [defect, ...more] = screenGateOutcome(recorded, { reading: "archive", ...(winner !== undefined ? { winnerDecision: winner.decision } : {}) });
     if (defect !== undefined)
         return unreadable([defect, ...more]);
     const settlement = recorded?.settlement;
     if (settlement === undefined)
         return unreadable(["the gate record carries no settlement: no decider and no time"]);
-    if (!Number.isFinite(settlement.when))
-        return unreadable(["settlement.when is not a finite epoch-ms time"]);
     const boundCallId = gateBoundCallId ?? (checkpoint.pendingAction.kind === "tool_approval" ? checkpoint.pendingAction.toolCallId : "");
     const direction = approvalDecisionOfWinner(winner, boundCallId);
     if (direction === null)

package/dist/approval-hmac.d.ts

@@ -20,6 +20,8 @@ import type { ApprovalHmacKey } from "./auth-keys.js";
  * `reason`,以及 [ref] 起的 `permissionModeAfter`)。⇒ 「同一张卡上把 approve 的档偷偷调宽」这件事,
  * 结构上只有 HMAC 这一把拦得住;往 `cnf.bnd` 里加位既不解决它,还会把一份合法 JWT 绑死在一个它签发时
  * 根本不知道的值上。**本次([ref] F1)只动 HMAC 这一把,`approvalBnd` 一个字节不动。**
+ * [ref] 同一判断:`plan_review` 的门身份 `checkpointId` 进 HMAC 的扩展对象,不进 `cnf.bnd` —— 计划审阅的 `cnf.bnd` 绑的是会话(它的第二位是一次性 nonce),
+ * 签发 JWT 的一方不知道此刻是哪道计划门;知道的是作决断的那一方,而 HMAC 正是它签的。
  *
  * ── 🔴 字节构造规则(权威定义;跨仓签名器照此实现,docs/ASSISTANT-WIRE-CONTRACT.md §6.2 同源)──────────
  * 被 HMAC 的是下面这个字符串的 **UTF-8 字节**:
@@ -81,7 +83,7 @@ export declare function questionAnswerFromProjection(p: QuestionAnswerProjection
  * 下面那两条编译期门当场红。**不许有第三种在场判**:恒 `!== undefined`(不是真值判、也不是 `?? null`
  * 折叠)—— `null` 与缺席在扩展位上是两个不同的被签值(「签名方明说这次不动」≠「签名方不知道有这个键」)。
  */
-export declare const APPROVAL_ENVELOPE_EXT_KEYS: readonly ["answer", "permissionModeAfter"];
+export declare const APPROVAL_ENVELOPE_EXT_KEYS: readonly ["answer", "checkpointId", "permissionModeAfter"];
 export type ApprovalEnvelopeExtKey = (typeof APPROVAL_ENVELOPE_EXT_KEYS)[number];
 /** The canonical envelope both {@link approvalHmacMessage} (the signer's/verifier's shared byte-rule) and
  *  {@link verifyApprovalHmac} take — ONE named type so the two signatures cannot silently drift into two
@@ -105,6 +107,16 @@ export interface ApprovalEnvelope {
      * 值是 {@link projectQuestionAnswer} 的产物,不是请求体上那个对象(理由见该函数)。
      */
     answer?: QuestionAnswerProjection;
+    /**
+     * 🔴 **[ref](7.137.0)—— `plan_review` 决断方看到的那道门(`checkpointId`)进签名载荷。**
+     *
+     * 计划审阅的证明只绑会话(`cnf.bnd` = 会话 + 一次性 nonce + 内容哈希),不绑门 ⇒ 决断体上的门身份是这次决断**落在哪道门**的唯一陈述
+     * (不是当前门 ⇒ `409 approval_stale`)。不签它,能改写线上字节的一方就能把它摘掉(陈旧保护整个不在)或换掉;拒收它则把这项保护在直连门部署上整个关掉。
+     * 判据扩成一句:**凡决定这次决断落在哪道门、续跑能做什么 / 落什么账的决裁字段都在签名信封里**。
+     * 与 `permissionModeAfter` 同形:在场才进扩展对象,缺席 ⇒ 字节与不认识它的签名器逐字相同(既有签名器零改动);带了不签 ⇒ `401 approval_mac_invalid`。
+     * `/decide` 不送它(那道门的门身份是 `boundCallId` / `boundInputHash`,已在前五位)。
+     */
+    checkpointId?: string;
     /**
      * 🔴 **[ref] 合并复审 F1 [high]**(7.86.0 立,[ref] 把它从裸尾位挪进扩展对象)—— `plan_review` 的
      * `permissionModeAfter` 选的是**批准之后这条 run 有没有手**(`acceptEdits` = 工作目录内的写不再逐次

package/dist/approval-hmac.js

@@ -5,7 +5,7 @@ export function projectQuestionAnswer(a) {
 export function questionAnswerFromProjection(p) {
     return { answers: p.map(([header, selected, note]) => ({ header, selected: [...selected], ...(note === null ? {} : { note }) })) };
 }
-export const APPROVAL_ENVELOPE_EXT_KEYS = ["answer", "permissionModeAfter"];
+export const APPROVAL_ENVELOPE_EXT_KEYS = ["answer", "checkpointId", "permissionModeAfter"];
 const APPROVAL_ENVELOPE_HEAD_KEYS = ["sessionId", "boundCallId", "boundInputHash", "decision", "reason"];
 export function approvalHmacMessage(env) {
     const head = [env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null];

package/dist/approval.js

@@ -1,4 +1,4 @@
-import { createApprovalPolicy, isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "@sema-agent/core";
+import { createApprovalPolicy, isCoveringRuleName, ruleNameCovers } from "@sema-agent/core";
 import { operatorAlwaysHumanAsk, operatorAsk, requestAlwaysHumanAsk } from "./operator-ask.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
@@ -116,10 +116,10 @@ export function createDeploymentListExemption(store, sessionId, logger, leg) {
 }
 function createNameSetMatcher(names) {
     const exact = new Set(names);
-    const covering = names.filter((name) => isNamespacedCoveringRuleName(name, NAME_TABLE_BEHAVIOR));
+    const covering = names.filter((name) => isCoveringRuleName(name, NAME_TABLE_BEHAVIOR));
     if (covering.length === 0)
         return (toolName) => exact.has(toolName);
-    return (toolName) => exact.has(toolName) || covering.some((rule) => namespacedRuleNameCovers(rule, toolName));
+    return (toolName) => exact.has(toolName) || covering.some((rule) => ruleNameCovers(rule, toolName));
 }
 export const AUTO_APPROVE_BUDGET_APPROVER = "auto_approve_budget";
 function budgetSeatAnswer(req, requireHit, signal) {

package/dist/auth-bridge.js

@@ -2,6 +2,7 @@ import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
+import { centerJwksFetch } from "./web-admin-client/center-request.js";
 export function authBridgeIssuerOf(config) {
     if (config.authBridgeIssuer !== undefined)
         return { issuer: config.authBridgeIssuer, source: "explicit" };
@@ -49,7 +50,6 @@ export function createWebAdminJwtVerifier(opts) {
     const refreshMin = opts.jwksRefreshMinIntervalSec ?? DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC;
     const offlineGraceSec = opts.offlineGraceSec ?? DEFAULT_OFFLINE_GRACE_SEC;
     const jwksTtlSec = opts.jwksTtlSec ?? DEFAULT_JWKS_TTL_SEC;
-    const doFetch = opts.fetchImpl ?? fetch;
     const now = opts.nowMs ?? Date.now;
     const keys = new Map();
     let lastFetchAttemptMs;
@@ -66,7 +66,7 @@ export function createWebAdminJwtVerifier(opts) {
         inflight = (async () => {
             lastFetchAttemptMs = now();
             try {
-                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS) });
+                const res = await centerJwksFetch(jwksUrl, { timeoutMs: JWKS_FETCH_TIMEOUT_MS, fetchImpl: opts.fetchImpl });
                 if (!res.ok)
                     throw new Error(`jwks HTTP ${res.status}`);
                 const cl = Number(res.headers.get("content-length"));

package/dist/boot/execution-env.d.ts

@@ -7,7 +7,9 @@ import { PerTaskImageRegistry } from "../per-task-image.js";
 import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
-import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps } from "../plugins/remote-env-k8s.js";
+import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
+import { type SandboxGitPlane, type SandboxGitRunRows } from "../sandbox-git-plane.js";
+import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { type SpaceCommitRows } from "../workspace-space-commit.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
@@ -76,6 +78,10 @@ export declare function createSessionScopedRegistries(maxEntries?: number): Sess
  */
 export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     imageOf(sessionId: string): string | undefined;
+    /** The member git-credential broker seat for the pod's run (`runId` = the one reading of the run that owns the pod, the same value its
+     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `sandboxBrokerSeatOf` over the boot's plane reading and the run row's identity);
+     *  absent seat / `undefined` answer ⇒ the pod carries no broker. */
+    brokerSeatOf?(runId: string | undefined): Promise<K8sEnvConfig["sandboxBroker"]>;
     /** The session store's by-id head read (`SessionStore.headOf`, picked once by `headReadOf`); the occupant is its live-occupant projection
      *  (`sessionFaceOfHead`). Absent ⇔ the store has none, which `assertWorkspaceSpaceReadable` refuses together with `space` (embeddings that
      *  wire another lane pass none). */
@@ -84,6 +90,17 @@ export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
      *  or without a store backend — the latter `assertWorkspaceSpaceReadable` refuses together with `space`. */
     spaceCommits(): SpaceCommitRows | undefined;
 }, deps?: K8sEnvDeps): ReturnType<typeof k8sExecutionEnvFactory>;
+/**
+ * k8s 车道沙箱秘密座的**起服前提**(装配后的真门,第 5 段 await)。法只有一条:**秘密座非空(`K8S_SANDBOX_ENV` 点到了本进程环境里有的键)⇒
+ * 问一次 SelfSubjectAccessReview(env 座那一行动词 {@link SANDBOX_SECRET_SEAT_VERBS}`.env`,沙箱命名空间)** —— 只问这一座自己发的调用,
+ * 不问租约座的 `patch`(那一座由凭据平面的判官在它的前提都成立时另问,见 `readSandboxGitPlane`):
+ *  · 答了「不许」(任一动词)⇒ 拒启,一行拒句点名缺的动词、命名空间、Role 规则原文与出路(`[sandbox-secret-rbac]`)—— 不等第一个 run 才失败;
+ *  · 问不到(请求失败 / 审查本身被拒 / 答复没有 `status.allowed`)⇒ 照常起服:F 类兜底口 `server.sandbox-secret.seat-unverified` 计数 + 一行
+ *    `sandbox_secret_seat_unverified`。放行的最坏后果:RBAC 真缺时第一个要建 Secret 的 run 连接即拒(`auth_failed`,pod 被删)—— 秘密值仍然
+ *    只经 Secret,不回落明文;
+ *  · 秘密座空 ⇒ 一个请求都不发(没有 Secret 要建)。
+ */
+export declare function ensureSandboxSecretSeat(k8sCfg: K8sEnvConfig, logger: Pick<Logger, "warn">, deps?: K8sEnvDeps, read?: () => Promise<SandboxSecretSeat>): Promise<void>;
 /**
  * k8s 工作区空间的**起服前提**(装配后的真门;同段先例 = `assertDeviceLaneWired`)。法只有一条:
  * **生效策略 `space`(事实 `workspaceSpace`)∧ {@link createK8sRunEnvFactory} 的两只座缺一 ⇒ 拒启。**
@@ -119,6 +136,9 @@ export interface ExecutionEnvCtx {
     spaceCommits?: () => SpaceCommitRows | undefined;
     /** k8s 工作区空间的住客读:会话店的按 id 读(`headReadOf(sessionStore)`,第 5 段判一次、与起服门同一只)。不传 ⇒ 同上,不开、响亮。 */
     headOf?: HeadRead;
+    /** run 店的按 id 读(成员凭据代理座读 run 行上受理时记下的身份元组 `RunRecord.identity`)。取值闭包:run 店第 7 段才绑(`late-binds.ts`),
+     *  平面开着时每个 run 的 pod 建起前求值一次。不传 / 答 `undefined`(没有存储后端)⇒ 读不到身份 ⇒ 不挂代理。 */
+    runRows?: () => SandboxGitRunRows | undefined;
 }
 export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perTaskImage: PerTaskImageRegistry;
@@ -134,5 +154,8 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: SpaceReclaimer | undefined;
+    sandboxSecretSeatGate: (() => Promise<void>) | undefined;
+    sandboxPodReaper: SandboxPodReaper | undefined;
+    readSandboxGitPlane: () => Promise<SandboxGitPlane>;
 };
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/boot/execution-env.js

@@ -11,7 +11,11 @@ import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { boundedStoreCall, checkSandboxEgressPolicy, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
+import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
+import { judgeSandboxGitPlane, runIdentitySourceOf, sandboxBrokerSeatOf, sandboxGitPlaneAsksSecretSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
+import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
 import { createSpaceCommitFence } from "../workspace-space-commit.js";
 import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-docker.js";
@@ -58,7 +62,12 @@ function forwardedSandboxEnvKeys(remoteExec) {
     }
 }
 function buildSandboxLaneEnv(config, explicit) {
-    const merged = { ...derivePkgSourceEnv(config.sandboxPkgSource, config.sandboxPkgSourceCustom), ...(explicit ?? {}) };
+    const secretEnv = { ...(explicit ?? {}) };
+    const env = Object.fromEntries(Object.entries(derivePkgSourceEnv(config.sandboxPkgSource, config.sandboxPkgSourceCustom)).filter(([name]) => !Object.hasOwn(secretEnv, name)));
+    return { ...(Object.keys(env).length > 0 ? { env } : {}), ...(Object.keys(secretEnv).length > 0 ? { secretEnv } : {}) };
+}
+function sandboxLaneEnvMerged(lane) {
+    const merged = { ...(lane.env ?? {}), ...(lane.secretEnv ?? {}) };
     return Object.keys(merged).length > 0 ? merged : undefined;
 }
 const MAX_CWD_SESSIONS = 4096;
@@ -118,6 +127,8 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
         const child = ctx.placementRootSessionId !== ctx.sessionId;
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
         const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId, rpcTimeoutMsOf(k8sCfg));
+        const runId = !child && ctx.taskId !== undefined ? ctx.taskId : undefined;
+        const sandboxBroker = await seats.brokerSeatOf?.(runId);
         const { cache, ...deploymentCfg } = k8sCfg;
         return k8sExecutionEnvFactory({
             ...deploymentCfg,
@@ -125,6 +136,8 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
             ...(s3Snapshot !== undefined ? { s3Snapshot } : {}),
             image: seats.imageOf(ctx.sessionId) ?? k8sCfg.image,
             ...(spaceOccupant !== undefined ? { spaceOccupant } : {}),
+            ...(runId !== undefined ? { runId } : {}),
+            ...(sandboxBroker !== undefined ? { sandboxBroker } : {}),
             onWorkspaceSnapshot,
         }, deps)(ctx);
     };
@@ -156,6 +169,34 @@ function spaceOff(store) {
     const { space: _off, ...parkOnly } = store;
     return parkOnly;
 }
+export async function ensureSandboxSecretSeat(k8sCfg, logger, deps, read = () => readSandboxSecretSeat(k8sCfg, "env", deps)) {
+    const names = Object.keys(k8sCfg.podSecretEnv ?? {});
+    if (names.length === 0)
+        return;
+    const namespace = k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT;
+    const seat = await read();
+    switch (seat.state) {
+        case "granted":
+            return;
+        case "denied":
+            throw new Error(`K8S_SANDBOX_ENV forwards ${names.length} variable(s) into the k8s sandbox, but this service account may not ${seat.verbs.join(", ")} secrets ` +
+                `in namespace ${namespace} [sandbox-secret-rbac]: the forwarded values reach a sandbox pod only through that pod's own Secret (the pod spec carries ` +
+                `references, never the values). Add to the sandbox Role in ${namespace}: \`- apiGroups: [""] resources: [secrets] verbs: [${SANDBOX_SECRET_SEAT_VERBS.env.join(", ")}]\` ` +
+                "(or unset K8S_SANDBOX_ENV), and restart");
+        case "unverified":
+            recordFailOpen("server.sandbox-secret.seat-unverified", `namespace=${namespace} ${seat.detail}`);
+            logger.warn("sandbox_secret_seat_unverified", {
+                namespace,
+                detail: seat.detail,
+                effect: `the boot could not confirm the sandbox Secret RBAC (secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")}) — the service starts; if the Role lacks them, the first run that forwards K8S_SANDBOX_ENV is refused at connect (auth_failed) and its pod deleted — the values never go into the pod spec`,
+            });
+            return;
+        default: {
+            const unreachable = seat;
+            throw new Error(`unhandled sandbox secret seat reading: ${String(unreachable.state)}`);
+        }
+    }
+}
 export function assertWorkspaceSpaceReadable(space, seats, cache, sessionStoreLabel) {
     if (space.available && persistNeedsOccupant(space.policy.persist)) {
         const missing = seats.headOf === undefined ? `the session store (${sessionStoreLabel}) has no by-id occupant read (headOf)`
@@ -207,6 +248,10 @@ export function createExecutionEnv(ctx) {
     const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
     let executionEnvFactory;
     let spaceReclaimer;
+    let sandboxSecretSeatGate;
+    let sandboxPodReaper;
+    const planeCell = {};
+    let readSandboxGitPlane = async () => (planeCell.current = judgeSandboxGitPlane(sandboxGitPlanePremisesOf(config, {})));
     let worktreeReap;
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
@@ -217,7 +262,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.livenessMs != null ? { livenessMs: config.remoteExec.livenessMs } : {}),
             ...(config.remoteExec.allowInternetAccess != null ? { allowInternetAccess: config.remoteExec.allowInternetAccess } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
-            ...((env) => (env !== undefined ? { sandboxEnv: env } : {}))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
+            ...((env) => (env !== undefined ? { sandboxEnv: env } : {}))(sandboxLaneEnvMerged(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv))),
             logger,
             metrics,
         });
@@ -243,11 +288,29 @@ export function createExecutionEnv(ctx) {
             ...((f) => (f.available ? { cache: f.cache } : {}))(facts.workspaceCache(config)),
             ...(config.remoteExec.workspaceSnapshotExclude ? { snapshotExclude: config.remoteExec.workspaceSnapshotExclude } : {}),
             logger,
-            ...((env) => (env !== undefined ? { podEnv: env } : {}))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
+            ...((lane) => ({ ...(lane.env !== undefined ? { podEnv: lane.env } : {}), ...(lane.secretEnv !== undefined ? { podSecretEnv: lane.secretEnv } : {}) }))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
         };
-        executionEnvFactory = createK8sRunEnvFactory(k8sCfg, { imageOf: (sid) => perTaskImage.get(sid), headOf: ctx.headOf, spaceCommits: ctx.spaceCommits ?? (() => undefined) });
+        const brokerImage = config.remoteExec.brokerImage;
+        executionEnvFactory = createK8sRunEnvFactory(k8sCfg, {
+            imageOf: (sid) => perTaskImage.get(sid),
+            headOf: ctx.headOf,
+            spaceCommits: ctx.spaceCommits ?? (() => undefined),
+            brokerSeatOf: async (runId) => {
+                const plane = planeCell.current;
+                if (plane === undefined || plane.state !== "on")
+                    return undefined;
+                return sandboxBrokerSeatOf(plane, brokerImage, await runIdentitySourceOf(runId, ctx.runRows?.(), logger));
+            },
+        });
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
+        sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
+        readSandboxGitPlane = async () => {
+            const premises = sandboxGitPlanePremisesOf(config, { ...((r) => (r !== undefined ? { patchRefusal: r } : {}))(podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch)) });
+            const secretSeat = sandboxGitPlaneAsksSecretSeat(premises) ? await readSandboxSecretSeat(k8sCfg, "lease") : undefined;
+            return (planeCell.current = judgeSandboxGitPlane({ ...premises, secretSeat }));
+        };
+        sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT))
             .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
@@ -446,7 +509,7 @@ export function createExecutionEnv(ctx) {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, readSandboxGitPlane,
     };
 }
 //# sourceMappingURL=execution-env.js.map

package/dist/boot/reapers.d.ts

@@ -25,6 +25,7 @@ import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { ApprovalNonceStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { type AuditRotationPort } from "../approval-ask-retention.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
@@ -113,6 +114,8 @@ export interface ReapersCtx {
     approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
+    /** k8s 车道的沙箱 Pod reaper(`plugins/k8s-pod-reaper.ts`;第 5 段与 run 工厂同一份 k8s 配置铸)。缺席 = 非 k8s 车道 ⇒ 本腿零调用。 */
+    sandboxPodReaper?: SandboxPodReaper;
 }
 /** core 5.48 `reapDurableAgents` 的 `deps.sessions` 面(结构形,只列本仓要填的三格)。 */
 export interface ReapSessionsFacade {

package/dist/boot/reapers.js

@@ -4,6 +4,7 @@ import { CostQuota } from "../observability/cost-quota.js";
 import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
+import { SANDBOX_POD_REAP_PERIOD_MS } from "../plugins/k8s-pod-reaper.js";
 import { APPROVAL_ASK_RETENTION_PASS_MS, runApprovalAskRetentionPass } from "../approval-ask-retention.js";
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
@@ -57,7 +58,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, sandboxPodReaper, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -73,6 +74,8 @@ export function startReapers(ctx) {
         : undefined;
     let e2bOrphanLastRunMs = Date.now() - E2B_ORPHAN_GRACE_MS;
     let e2bOrphanInFlight = false;
+    let sandboxPodReapLastRunMs = Date.now() - SANDBOX_POD_REAP_PERIOD_MS;
+    let sandboxPodReapInFlight = false;
     let wfRunReapInFlight = false;
     let attachmentSweepInFlight = false;
     let bgAgentReapInFlight = false;
@@ -80,6 +83,7 @@ export function startReapers(ctx) {
     const probeClockSkewGuard = createThrottledReaperCatch("probe_clock_skew", logger);
     const runsReapStaleGuard = createThrottledReaperCatch("runs_reap_stale", logger);
     const e2bOrphanGuard = createThrottledReaperCatch("e2b_orphan_reclaim", logger);
+    const sandboxPodReapGuard = createThrottledReaperCatch("sandbox_pod_reap", logger);
     const checkpointsReapExpiredGuard = createThrottledReaperCatch("checkpoints_reap_expired", logger);
     const approvalNonceReapExpiredGuard = createThrottledReaperCatch("approval_nonce_reap_expired", logger);
     const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
@@ -366,6 +370,16 @@ export function startReapers(ctx) {
                 e2bOrphanInFlight = false;
             }));
         }
+        if (sandboxPodReaper && Date.now() - sandboxPodReapLastRunMs >= SANDBOX_POD_REAP_PERIOD_MS && !sandboxPodReapInFlight) {
+            sandboxPodReapInFlight = true;
+            sandboxPodReapLastRunMs = Date.now();
+            leg(sandboxPodReaper
+                .reapOnce(runStore)
+                .then(() => sandboxPodReapGuard.onSuccess(), sandboxPodReapGuard.onError)
+                .finally(() => {
+                sandboxPodReapInFlight = false;
+            }));
+        }
     }, config.reapIntervalSec * 1000);
     reaper.unref?.();
     return reaper;

package/dist/boot/resolve-spec.d.ts

@@ -2,6 +2,7 @@ import { type MemoryBackend } from "@sema-agent/core";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
+import { type LoadedSkill } from "../capabilities/skills.js";
 import type { ServiceConfig } from "../config.js";
 import { type LiveQuestionFace } from "../deployment-governance.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
@@ -83,6 +84,9 @@ export interface ResolveSpecCtx {
     /** [ref] 件C:本部署已校验的锁集(boot/governance-seams.ts 的产物,与 `RunnerDeps.lockedConfig`
      *  同源一次解析)。空集 = 无锁 = 现行为。本域只用它做**同步拒面**(§4.3),不做第二次裁决。 */
     lockedKeys: ReadonlySet<import("@sema-agent/core").LockedKey>;
+    /** 本部署**装载簿**(stage-07 的出厂技能 + 配置源覆盖之后的终表,场景工厂读的同一份)。本装配器只拿它答「场景交来的这只技能来自哪里」
+     *  (run 名册 `wiring_manifest.skills[].source`,`buildRunSkills`);名字在装载簿里唯一(装载器同名即抛、配置源按名覆盖)。 */
+    loadedSkills: readonly LoadedSkill[];
 }
 export declare function createResolveSpec(ctx: ResolveSpecCtx): ServiceDeps["resolveSpec"];
 export {};